| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Public Member Functions | List of all members
CaptureFilterValidator Class Reference

FilterValidator for libpcap/BPF capture filters. More...

`#include <capture_filter_validator.h>`

Inheritance diagram for CaptureFilterValidator:

## Public Member Functions
| CaptureFilterValidator (QObject *parent=nullptr)
QValidator::State | validate (QString &input, int &pos) const override
| Validates `input` and updates the stashed Detail.
Detail | lastDetail () const override
| Returns the Detail produced by the most recent validate() call.
Public Member Functions inherited from FilterValidator
| FilterValidator (QObject *parent=nullptr)
QString | lastError () const
| Short error message from the last validation (Detail::errMsg).
QString | lastErrorFull (const QString &filter) const
| Full, location-annotated error message for `filter`.
QString | deprecatedToken () const
| The deprecated token from the last validation, or empty.

## Additional Inherited Members
Static Public Member Functions inherited from FilterValidator
static QString | createSyntaxErrorMessageFull (const QString &filter, const QString &err_msg, qsizetype loc_start, size_t loc_length)
| Builds a full, location-annotated error string.

## Detailed Description

FilterValidator for libpcap/BPF capture filters.

validate() compiles the expression with pcap_compile() against the DLTs of the currently selected capture interfaces (and verifies extcap interfaces via extcap_verify_capture_filter()), mirroring the old CaptureFilterSyntaxWorker.

The check is synchronous: it runs on the host widget's debounce and returns immediately, giving instant in-place feedback. (The old code ran it on a background thread because pcap_compile() may call gethostbyname() and block on DNS for filters that name hosts; the synchronous form can briefly lag on such input. The Busy state is reserved in FilterEdit for re-introducing an async path if that ever proves necessary.)

Cases the BPF backend cannot definitively check — DLT_USER interfaces, BPF extensions that need a live handle, unknown extcap status — are reported as Acceptable with a non-empty Detail::deprecatedToken so the host maps them to the (amber) Deprecated state, matching historical behaviour.

## Member Function Documentation

## ◆ lastDetail()

Detail CaptureFilterValidator::lastDetail | ( |  | ) | const
| inline override virtual

Returns the Detail produced by the most recent validate() call.

Implements FilterValidator.

## ◆ validate()

QValidator::State CaptureFilterValidator::validate | ( | QString & | input,
|  | int & | pos ) const
| override virtual

Validates `input` and updates the stashed Detail.

Parameters

  input | The text to validate; may be normalised in place.
  pos | In/out cursor position.

Returns
  Invalid, Intermediate, or Acceptable.

Implements FilterValidator.

The documentation for this class was generated from the following files:

- /builds/wireshark/wireshark/ui/qt/models/capture_filter_validator.h
- /builds/wireshark/wireshark/ui/qt/models/capture_filter_validator.cpp