in pcap-cli/pkg/pcap/pcap.go [183:215]
func providePcapFilter(
ctx context.Context,
filter *string,
providers []PcapFilterProvider,
) *string {
select {
case <-ctx.Done():
return filter
default:
}
pcapFilter := ""
// if `filter` is available, then providers are not used to build the BPF filter.
if filter != nil && *filter != "" && !strings.EqualFold(*filter, "DISABLED") {
// `filter` is extremely unsafe as it is a free form expression:
// [ToDo] – validate `filter` to enforce correctness of expressions.
pcapFilter = stringFormatter.Format("({0})", *filter)
} else if len(providers) > 0 {
for _, provider := range providers {
if provider != nil {
if f := provider.Apply(ctx,
&pcapFilter, PCAP_FILTER_MODE_AND); f != nil {
pcapFilter = *f
}
}
}
} else {
pcapFilter = string(PcapDefaultFilter)
}
return &pcapFilter
}