Wireshark 4.5.0
The Wireshark network protocol analyzer
Loading...
Searching...
No Matches
dfilter.h
Go to the documentation of this file.
1
10#ifndef DFILTER_H
11#define DFILTER_H
12
13#include <wireshark.h>
14
15#include "dfilter-loc.h"
16#include <epan/proto.h>
17
18/* Passed back to user */
19typedef struct epan_dfilter dfilter_t;
20
21#ifdef __cplusplus
22extern "C" {
23#endif /* __cplusplus */
24
25struct epan_dissect;
26
27#define DF_ERROR_GENERIC -1
28#define DF_ERROR_UNEXPECTED_END -2
29
30typedef struct {
31 int code;
32 char *msg;
33 df_loc_t loc;
35
37df_error_new(int code, char *msg, df_loc_t *loc);
38
40df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
41G_GNUC_PRINTF(3, 4);
42
43#define df_error_new_msg(msg) \
44 df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
45
47df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
48
49WS_DLL_PUBLIC
50void
51df_error_free(df_error_t **ep);
52
53/* Module-level initialization */
54void
55dfilter_init(void);
56
57/* Module-level cleanup */
58void
59dfilter_cleanup(void);
60
61/* Perform macro expansion. */
62WS_DLL_PUBLIC
63char *
64dfilter_expand(const char *expr, df_error_t **err_ret);
65
66/* Save textual representation of syntax tree (for debugging purposes). */
67#define DF_SAVE_TREE (1U << 0)
68/* Perform macro substitution on filter text. */
69#define DF_EXPAND_MACROS (1U << 1)
70/* Do an optimization pass on the compiled filter. */
71#define DF_OPTIMIZE (1U << 2)
72/* Enable debug trace for flex. */
73#define DF_DEBUG_FLEX (1U << 3)
74/* Enable debug trace for lemon. */
75#define DF_DEBUG_LEMON (1U << 4)
76/* If the root of the syntax tree is a field, load and return the field values.
77 * By default the field is only checked for existence. */
78#define DF_RETURN_VALUES (1U << 5)
79
80/* Compiles a string to a dfilter_t.
81 * On success, sets the dfilter* pointed to by dfp
82 * to either a NULL pointer (if the filter is a null
83 * filter, as generated by an all-blank string) or to
84 * a pointer to the newly-allocated dfilter_t
85 * structure.
86 *
87 * On failure, *err_msg is set to point to the error
88 * message. This error message is allocated with
89 * g_malloc(), and must be freed with g_free().
90 * The dfilter* will be set to NULL after a failure.
91 *
92 * Returns true on success, false on failure.
93 */
94WS_DLL_PUBLIC
95bool
96dfilter_compile_full(const char *text, dfilter_t **dfp,
97 df_error_t **errpp, unsigned flags,
98 const char *caller);
99
100#define dfilter_compile(text, dfp, errp) \
101 dfilter_compile_full(text, dfp, errp, \
102 DF_EXPAND_MACROS|DF_OPTIMIZE, \
103 __func__)
104
105struct stnode;
106
111WS_DLL_PUBLIC
112struct stnode *dfilter_get_syntax_tree(const char *text);
113
114/* Frees all memory used by dfilter, and frees
115 * the dfilter itself. */
116WS_DLL_PUBLIC
117void
118dfilter_free(dfilter_t *df);
119
120/* Apply compiled dfilter */
121WS_DLL_PUBLIC
122bool
123dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
124
125/* Apply compiled dfilter */
126bool
127dfilter_apply(dfilter_t *df, proto_tree *tree);
128
129/* Apply compiled dfilter and return final set of fvalues (if they
130 * exist) in addition to true/false determination. */
131bool
132dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals);
133
134/* Prime a proto_tree using the fields/protocols used in a dfilter. */
135void
136dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
137
138/* Prime a proto_tree using the fields/protocols used in a dfilter, marked for print. */
139void
140dfilter_prime_proto_tree_print(const dfilter_t *df, proto_tree *tree);
141
142/* Refresh references in a compiled display filter. */
143WS_DLL_PUBLIC
144void
145dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
146
147/* Refresh references in a compiled display filter. */
148WS_DLL_PUBLIC
149void
150dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
151
152/* Check if dfilter has interesting fields */
153bool
154dfilter_has_interesting_fields(const dfilter_t *df);
155
156/* Check if dfilter is interested in a given field
157 *
158 * @param df The dfilter
159 * @param hfid The header field info ID to check
160 * @return true if the field is interesting to the dfilter
161 */
162bool
163dfilter_interested_in_field(const dfilter_t *df, int hfid);
164
165/* Check if dfilter is interested in a given protocol
166 *
167 * @param df The dfilter
168 * @param proto_id The protocol ID to check
169 * @return true if the dfilter is interested in a field whose
170 * parent is proto_id
171 */
172bool
173dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
174
175WS_DLL_PUBLIC
176bool
177dfilter_requires_columns(const dfilter_t *df);
178
179WS_DLL_PUBLIC
180GPtrArray *
181dfilter_deprecated_tokens(dfilter_t *df);
182
183WS_DLL_PUBLIC
184GSList *
185dfilter_get_warnings(dfilter_t *df);
186
187#define DF_DUMP_REFERENCES (1U << 0)
188#define DF_DUMP_SHOW_FTYPE (1U << 1)
189
190/* Print bytecode of dfilter to fp */
191WS_DLL_PUBLIC
192void
193dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
194
195/* Text after macro expansion. */
196WS_DLL_PUBLIC
197const char *
198dfilter_text(dfilter_t *df);
199
200/* Text representation of syntax tree (if it was saved, NULL otherwise). */
201WS_DLL_PUBLIC
202const char *
203dfilter_syntax_tree(dfilter_t *df);
204
205/* Print bytecode of dfilter to log */
206WS_DLL_PUBLIC
207void
208dfilter_log_full(const char *domain, enum ws_log_level level,
209 const char *file, long line, const char *func,
210 dfilter_t *dfcode, const char *msg);
211
212#ifdef WS_DEBUG
213#define dfilter_log(dfcode, msg) \
214 dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY, \
215 __FILE__, __LINE__, __func__, \
216 dfcode, msg)
217#else
218#define dfilter_log(dfcode, msg) (void)0
219#endif
220
221#define DFILTER_DEBUG_HERE(dfcode) \
222 dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO, \
223 __FILE__, __LINE__, __func__, \
224 dfcode, #dfcode);
225
226#ifdef __cplusplus
227}
228#endif /* __cplusplus */
229
230#endif /* DFILTER_H */
WS_DLL_PUBLIC struct stnode * dfilter_get_syntax_tree(const char *text)
Definition dfilter.c:649
Definition dfilter-loc.h:16
Definition proto.h:901
Definition dfilter.h:30
Definition dfilter-int.h:35
Definition epan_dissect.h:28
Definition syntax-tree.h:78