Skip to content

Conversation

@dieter-exc
Copy link
Contributor

Add systemd Journal Export Block.

  • I had to add a "maximum size" to the stream-based decoding routines, as the total block length is needed to deduce the size of the Journal Entry field, but was unavailable there. Note that this is the first time we need the total block length during parsing. Previously, tricks with seen list of earlier parsed header fields was all we needed.
  • Note that the Journal Entry field is of type bytes, see https://github.com/pcapng/pcapng and https://www.freedesktop.org/wiki/Software/systemd/export/
  • Note that the function decode_block in pcapng/structs.py is never used, so I removed it.

@dieter-exc
Copy link
Contributor Author

dieter-exc commented Oct 29, 2020

I realize that using https://docs.python.org/3/library/io.html#io.RawIOBase.readall might be possible to eliminate the use of the "max_size" parameter in this particular case (as each block gets a separate stream).

However, taking that direction also has its shortcoming of not allowing a possible later generalization to a global per-file stream (which is probably more efficient than the current behavior). What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant