Wireshark  4.3.0
The Wireshark network protocol analyzer
dfilter.h
Go to the documentation of this file.
1 
10 #ifndef DFILTER_H
11 #define DFILTER_H
12 
13 #include <wireshark.h>
14 
15 #include "dfilter-loc.h"
16 #include <epan/proto.h>
17 
18 /* Passed back to user */
19 typedef struct epan_dfilter dfilter_t;
20 
21 #ifdef __cplusplus
22 extern "C" {
23 #endif /* __cplusplus */
24 
25 struct epan_dissect;
26 
27 #define DF_ERROR_GENERIC -1
28 #define DF_ERROR_UNEXPECTED_END -2
29 
30 typedef struct {
31  int code;
32  char *msg;
33  df_loc_t loc;
34 } df_error_t;
35 
36 df_error_t *
37 df_error_new(int code, char *msg, df_loc_t *loc);
38 
39 df_error_t *
40 df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
41 G_GNUC_PRINTF(3, 4);
42 
43 #define df_error_new_msg(msg) \
44  df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
45 
46 df_error_t *
47 df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
48 
49 WS_DLL_PUBLIC
50 void
51 df_error_free(df_error_t **ep);
52 
53 /* Module-level initialization */
54 void
55 dfilter_init(void);
56 
57 /* Module-level cleanup */
58 void
59 dfilter_cleanup(void);
60 
61 /* Perform macro expansion. */
62 WS_DLL_PUBLIC
63 char *
64 dfilter_expand(const char *expr, df_error_t **err_ret);
65 
66 /* Save textual representation of syntax tree (for debugging purposes). */
67 #define DF_SAVE_TREE (1U << 0)
68 /* Perform macro substitution on filter text. */
69 #define DF_EXPAND_MACROS (1U << 1)
70 /* Do an optimization pass on the compiled filter. */
71 #define DF_OPTIMIZE (1U << 2)
72 /* Enable debug trace for flex. */
73 #define DF_DEBUG_FLEX (1U << 3)
74 /* Enable debug trace for lemon. */
75 #define DF_DEBUG_LEMON (1U << 4)
76 /* If the root of the syntax tree is a field, load and return the field values.
77  * By default the field is only checked for existence. */
78 #define DF_RETURN_VALUES (1U << 5)
79 
80 /* Compiles a string to a dfilter_t.
81  * On success, sets the dfilter* pointed to by dfp
82  * to either a NULL pointer (if the filter is a null
83  * filter, as generated by an all-blank string) or to
84  * a pointer to the newly-allocated dfilter_t
85  * structure.
86  *
87  * On failure, *err_msg is set to point to the error
88  * message. This error message is allocated with
89  * g_malloc(), and must be freed with g_free().
90  * The dfilter* will be set to NULL after a failure.
91  *
92  * Returns true on success, false on failure.
93  */
94 WS_DLL_PUBLIC
95 bool
96 dfilter_compile_full(const char *text, dfilter_t **dfp,
97  df_error_t **errpp, unsigned flags,
98  const char *caller);
99 
100 #define dfilter_compile(text, dfp, errp) \
101  dfilter_compile_full(text, dfp, errp, \
102  DF_EXPAND_MACROS|DF_OPTIMIZE, \
103  __func__)
104 
105 struct stnode;
106 
111 WS_DLL_PUBLIC
112 struct stnode *dfilter_get_syntax_tree(const char *text);
113 
114 /* Frees all memory used by dfilter, and frees
115  * the dfilter itself. */
116 WS_DLL_PUBLIC
117 void
118 dfilter_free(dfilter_t *df);
119 
120 /* Apply compiled dfilter */
121 WS_DLL_PUBLIC
122 bool
123 dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
124 
125 /* Apply compiled dfilter */
126 bool
127 dfilter_apply(dfilter_t *df, proto_tree *tree);
128 
129 /* Apply compiled dfilter and return final set of fvalues (if they
130  * exist) in addition to true/false determination. */
131 bool
132 dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals);
133 
134 /* Prime a proto_tree using the fields/protocols used in a dfilter. */
135 void
136 dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
137 
138 /* Refresh references in a compiled display filter. */
139 WS_DLL_PUBLIC
140 void
141 dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
142 
143 /* Refresh references in a compiled display filter. */
144 WS_DLL_PUBLIC
145 void
146 dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
147 
148 /* Check if dfilter has interesting fields */
149 bool
150 dfilter_has_interesting_fields(const dfilter_t *df);
151 
152 /* Check if dfilter is interested in a given field
153  *
154  * @param df The dfilter
155  * @param hfid The header field info ID to check
156  * @return true if the field is interesting to the dfilter
157  */
158 bool
159 dfilter_interested_in_field(const dfilter_t *df, int hfid);
160 
161 /* Check if dfilter is interested in a given protocol
162  *
163  * @param df The dfilter
164  * @param proto_id The protocol ID to check
165  * @return true if the dfilter is interested in a field whose
166  * parent is proto_id
167  */
168 bool
169 dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
170 
171 WS_DLL_PUBLIC
172 bool
173 dfilter_requires_columns(const dfilter_t *df);
174 
175 WS_DLL_PUBLIC
176 GPtrArray *
177 dfilter_deprecated_tokens(dfilter_t *df);
178 
179 WS_DLL_PUBLIC
180 GSList *
181 dfilter_get_warnings(dfilter_t *df);
182 
183 #define DF_DUMP_REFERENCES (1U << 0)
184 #define DF_DUMP_SHOW_FTYPE (1U << 1)
185 
186 /* Print bytecode of dfilter to fp */
187 WS_DLL_PUBLIC
188 void
189 dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
190 
191 /* Text after macro expansion. */
192 WS_DLL_PUBLIC
193 const char *
194 dfilter_text(dfilter_t *df);
195 
196 /* Text representation of syntax tree (if it was saved, NULL oterwise). */
197 WS_DLL_PUBLIC
198 const char *
199 dfilter_syntax_tree(dfilter_t *df);
200 
201 /* Print bytecode of dfilter to log */
202 WS_DLL_PUBLIC
203 void
204 dfilter_log_full(const char *domain, enum ws_log_level level,
205  const char *file, long line, const char *func,
206  dfilter_t *dfcode, const char *msg);
207 
208 #ifdef WS_DEBUG
209 #define dfilter_log(dfcode, msg) \
210  dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY, \
211  __FILE__, __LINE__, __func__, \
212  dfcode, msg)
213 #else
214 #define dfilter_log(dfcode, msg) (void)0
215 #endif
216 
217 #define DFILTER_DEBUG_HERE(dfcode) \
218  dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO, \
219  __FILE__, __LINE__, __func__, \
220  dfcode, #dfcode);
221 
222 #ifdef __cplusplus
223 }
224 #endif /* __cplusplus */
225 
226 #endif /* DFILTER_H */
WS_DLL_PUBLIC struct stnode * dfilter_get_syntax_tree(const char *text)
Definition: dfilter.c:649
Definition: dfilter-loc.h:16
Definition: proto.h:904
Definition: dfilter.h:30
Definition: dfilter-int.h:35
Definition: epan_dissect.h:28
Definition: syntax-tree.h:79