| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
dfilter.h
Go to the documentation of this file.
1
9
10#ifndef DFILTER_H
11#define DFILTER_H
12
13#include <wireshark.h>
14
15#include "dfilter-loc.h"
16#include <epan/proto.h>
17
18/* Passed back to user */
19 typedef struct epan_dfilter dfilter_t;
20
21#ifdef __cplusplus
22 extern "C" {
23#endif /* __cplusplus */
24
25 struct epan_dissect;
26
27#define DF_ERROR_GENERIC -1
28#define DF_ERROR_UNEXPECTED_END -2
29
33 typedef struct {
34 int code;
35 char* msg;
36 df_loc_t loc;
37} df_error_t;
38
47 df_error_t *
48 df_error_new(int code, char *msg, df_loc_t *loc);
49
58 df_error_t *
59 df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
60G_GNUC_PRINTF(3, 4);
61
62#define df_error_new_msg(msg) \
63 df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
64
74 df_error_t *
75 df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
76
84WS_DLL_PUBLIC
85 void
86 df_error_free(df_error_t **ep);
87
88/* Module-level initialization */
89
98 void
99 dfilter_init(const char* app_env_var_prefix);
100
101/* Module-level cleanup */
108 void
109 dfilter_cleanup(void);
110
111/* Perform macro expansion. */
121WS_DLL_PUBLIC
122 char *
123 dfilter_expand(const char *expr, df_error_t **err_ret);
124
125/* Save textual representation of syntax tree (for debugging purposes). */
126#define DF_SAVE_TREE (1U << 0)
127/* Perform macro substitution on filter text. */
128#define DF_EXPAND_MACROS (1U << 1)
129/* Do an optimization pass on the compiled filter. */
130#define DF_OPTIMIZE (1U << 2)
131/* Enable debug trace for flex. */
132#define DF_DEBUG_FLEX (1U << 3)
133/* Enable debug trace for lemon. */
134#define DF_DEBUG_LEMON (1U << 4)
135/* If the root of the syntax tree is a field, load and return the field values.
136 * By default the field is only checked for existence. */
137#define DF_RETURN_VALUES (1U << 5)
138
155WS_DLL_PUBLIC
156 bool
157 dfilter_compile_full(const char *text, dfilter_t **dfp,
158 df_error_t **errpp, unsigned flags,
159 const char *caller);
160
161#define dfilter_compile(text, dfp, errp) \
162 dfilter_compile_full(text, dfp, errp, \
163 DF_EXPAND_MACROS|DF_OPTIMIZE, \
164 __func__)
165
166 struct stnode;
167
173WS_DLL_PUBLIC
174 struct stnode *dfilter_get_syntax_tree(const char *text);
175
184WS_DLL_PUBLIC
185 void
186 dfilter_free(dfilter_t *df);
187
195WS_DLL_PUBLIC
196 bool
197 dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
198
205 bool
206 dfilter_apply(dfilter_t *df, proto_tree *tree);
207
218 bool
219 dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals);
220
227 void
228 dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
229
236 void
237 dfilter_prime_proto_tree_print(const dfilter_t *df, proto_tree *tree);
238
245WS_DLL_PUBLIC
246 void
247 dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
248
255WS_DLL_PUBLIC
256 void
257 dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
258
265 bool
266 dfilter_has_interesting_fields(const dfilter_t *df);
267
275 bool
276 dfilter_interested_in_field(const dfilter_t *df, int hfid);
277
286 bool
287 dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
288
295WS_DLL_PUBLIC
296 bool
297 dfilter_requires_columns(const dfilter_t *df);
298
305WS_DLL_PUBLIC
306GPtrArray *
307 dfilter_deprecated_tokens(dfilter_t *df);
308
315WS_DLL_PUBLIC
316GSList *
317 dfilter_get_warnings(dfilter_t *df);
318
319#define DF_DUMP_REFERENCES (1U << 0)
320#define DF_DUMP_SHOW_FTYPE (1U << 1)
321
322/* Print bytecode of dfilter to fp */
330WS_DLL_PUBLIC
331 void
332 dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
333
334/* Text after macro expansion. */
341WS_DLL_PUBLIC
342 const char *
343 dfilter_text(dfilter_t *df);
344
353WS_DLL_PUBLIC
354 const char *
355 dfilter_syntax_tree(dfilter_t *df);
356
363WS_DLL_PUBLIC
364 ftenum_t
365 dfilter_get_return_type(dfilter_t *df);
366
367/* Print bytecode of dfilter to log */
381WS_DLL_PUBLIC
382 void
383 dfilter_log_full(const char *domain, enum ws_log_level level,
384 const char *file, long line, const char *func,
385 dfilter_t *dfcode, const char *msg);
386
387#ifdef WS_DEBUG
388#define dfilter_log(dfcode, msg) \
389 dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY, \
390 __FILE__, __LINE__, __func__, \
391 dfcode, msg)
392#else
393#define dfilter_log(dfcode, msg) (void)0
394#endif
395
396#define DFILTER_DEBUG_HERE(dfcode) \
397 dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO, \
398 __FILE__, __LINE__, __func__, \
399 dfcode, #dfcode);
400
401#ifdef __cplusplus
402}
403#endif /* __cplusplus */
404
405#endif /* DFILTER_H */
dfilter-loc.h
df_loc_t
struct _dfilter_loc df_loc_t
Represents a location (column start and length) within a display filter string.
dfilter_has_interesting_fields
bool dfilter_has_interesting_fields(const dfilter_t *df)
Check if a display filter has any interesting fields.
Definition dfilter.c:729
df_error_new_printf
df_error_t * df_error_new_printf(int code, df_loc_t *loc, const char *fmt,...)
Create a new error with formatted message.
Definition dfilter.c:963
dfilter_requires_columns
WS_DLL_PUBLIC bool dfilter_requires_columns(const dfilter_t *df)
Check if a display filter requires specific columns.
Definition dfilter.c:772
dfilter_deprecated_tokens
WS_DLL_PUBLIC GPtrArray * dfilter_deprecated_tokens(dfilter_t *df)
Get deprecated tokens from a dfilter.
Definition dfilter.c:789
dfilter_interested_in_proto
bool dfilter_interested_in_proto(const dfilter_t *df, int proto_id)
Check if dfilter is interested in a given protocol.
Definition dfilter.c:748
dfilter_init
void dfilter_init(const char *app_env_var_prefix)
Initialize the display filter module.
Definition dfilter.c:105
dfilter_expand
WS_DLL_PUBLIC char * dfilter_expand(const char *expr, df_error_t **err_ret)
Expand a display filter expression.
Definition dfilter.c:392
dfilter_apply
bool dfilter_apply(dfilter_t *df, proto_tree *tree)
Apply a compiled dfilter to a protocol tree.
Definition dfilter.c:693
dfilter_apply_full
bool dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals)
Apply a dfilter to a proto_tree and populate fvals.
Definition dfilter.c:705
dfilter_free
WS_DLL_PUBLIC void dfilter_free(dfilter_t *df)
Free a compiled dfilter.
Definition dfilter.c:171
dfilter_load_field_references_edt
WS_DLL_PUBLIC void dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt)
Load field references for a display filter into an epan_dissect_t structure.
Definition dfilter.c:901
dfilter_text
WS_DLL_PUBLIC const char * dfilter_text(dfilter_t *df)
Get the text representation of a syntax tree.
Definition dfilter.c:809
df_error_new_vprintf
df_error_t * df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap)
Create a new error with formatted message and location information.
Definition dfilter.c:946
dfilter_prime_proto_tree_print
void dfilter_prime_proto_tree_print(const dfilter_t *df, proto_tree *tree)
Prime a proto_tree using the fields/protocols used in a dfilter, marked for print.
Definition dfilter.c:721
dfilter_load_field_references
WS_DLL_PUBLIC void dfilter_load_field_references(const dfilter_t *df, proto_tree *tree)
Refresh references in a compiled display filter.
Definition dfilter.c:894
dfilter_get_warnings
WS_DLL_PUBLIC GSList * dfilter_get_warnings(dfilter_t *df)
Get warnings associated with a display filter.
Definition dfilter.c:797
dfilter_cleanup
void dfilter_cleanup(void)
Perform module-level cleanup for the dfilter subsystem.
Definition dfilter.c:125
dfilter_apply_edt
WS_DLL_PUBLIC bool dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt)
Apply a compiled display filter to an epan_dissect structure.
Definition dfilter.c:699
df_error_free
WS_DLL_PUBLIC void df_error_free(df_error_t **ep)
Frees a df_error_t structure.
Definition dfilter.c:973
df_error_new
df_error_t * df_error_new(int code, char *msg, df_loc_t *loc)
Create a new error object with a specific code and message.
Definition dfilter.c:929
dfilter_get_syntax_tree
WS_DLL_PUBLIC struct stnode * dfilter_get_syntax_tree(const char *text)
Build a syntax tree for a filter.
Definition dfilter.c:654
dfilter_syntax_tree
WS_DLL_PUBLIC const char * dfilter_syntax_tree(dfilter_t *df)
Get the syntax tree of a dfilter.
Definition dfilter.c:815
dfilter_interested_in_field
bool dfilter_interested_in_field(const dfilter_t *df, int hfid)
Check if dfilter is interested in a given field.
Definition dfilter.c:735
dfilter_prime_proto_tree
void dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree)
Prime a proto_tree using the fields/protocols used in a dfilter.
Definition dfilter.c:711
dfilter_log_full
WS_DLL_PUBLIC void dfilter_log_full(const char *domain, enum ws_log_level level, const char *file, long line, const char *func, dfilter_t *dfcode, const char *msg)
Log a display filter with full details.
Definition dfilter.c:827
dfilter_dump
WS_DLL_PUBLIC void dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags)
Dump a dfilter to a file.
Definition dfilter.c:803
dfilter_compile_full
WS_DLL_PUBLIC bool dfilter_compile_full(const char *text, dfilter_t **dfp, df_error_t **errpp, unsigned flags, const char *caller)
Compiles a string to a dfilter_t.
Definition dfilter.c:605
dfilter_get_return_type
WS_DLL_PUBLIC ftenum_t dfilter_get_return_type(dfilter_t *df)
Get the return type of a display filter.
Definition dfilter.c:821
ftenum_t
enum ftenum ftenum_t
Convenience typedef for ftenum.
Definition ftypes.h:190
proto.h
df_error_t
Represents a display filter error, including an error code, message, and source location.
Definition dfilter.h:33
df_error_t::msg
char * msg
Definition dfilter.h:35
df_error_t::code
int code
Definition dfilter.h:34
df_error_t::loc
df_loc_t loc
Definition dfilter.h:36
epan_dfilter
The compiled display filter object passed back to the user.
Definition dfilter-int.h:46
epan_dissect
Holds all state for the dissection of a single byte array, including session, buffer,...
Definition epan_dissect.h:28
stnode
A single node instance in the display filter syntax tree.
Definition syntax-tree.h:115