| Wireshark 4.7.0 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
dfilter.h
Go to the documentation of this file.
1
10#ifndef DFILTER_H
11#define DFILTER_H
12
13#include <wireshark.h>
14
15#include "dfilter-loc.h"
16#include <epan/proto.h>
17
18/* Passed back to user */
19 typedef struct epan_dfilter dfilter_t;
20
21#ifdef __cplusplus
22 extern "C" {
23#endif /* __cplusplus */
24
25 struct epan_dissect;
26
27#define DF_ERROR_GENERIC -1
28#define DF_ERROR_UNEXPECTED_END -2
29
30 typedef struct {
31 int code;
32 char *msg;
33 df_loc_t loc;
34} df_error_t;
35
44 df_error_t *
45 df_error_new(int code, char *msg, df_loc_t *loc);
46
55 df_error_t *
56 df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
57G_GNUC_PRINTF(3, 4);
58
59#define df_error_new_msg(msg) \
60 df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
61
71 df_error_t *
72 df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
73
81WS_DLL_PUBLIC
82 void
83 df_error_free(df_error_t **ep);
84
85/* Module-level initialization */
86
95 void
96 dfilter_init(const char* app_env_var_prefix);
97
98/* Module-level cleanup */
105 void
106 dfilter_cleanup(void);
107
108/* Perform macro expansion. */
118WS_DLL_PUBLIC
119 char *
120dfilter_expand(const char *expr, df_error_t **err_ret);
121
122/* Save textual representation of syntax tree (for debugging purposes). */
123#define DF_SAVE_TREE (1U << 0)
124/* Perform macro substitution on filter text. */
125#define DF_EXPAND_MACROS (1U << 1)
126/* Do an optimization pass on the compiled filter. */
127#define DF_OPTIMIZE (1U << 2)
128/* Enable debug trace for flex. */
129#define DF_DEBUG_FLEX (1U << 3)
130/* Enable debug trace for lemon. */
131#define DF_DEBUG_LEMON (1U << 4)
132/* If the root of the syntax tree is a field, load and return the field values.
133 * By default the field is only checked for existence. */
134#define DF_RETURN_VALUES (1U << 5)
135
152WS_DLL_PUBLIC
153 bool
154 dfilter_compile_full(const char *text, dfilter_t **dfp,
155 df_error_t **errpp, unsigned flags,
156 const char *caller);
157
158#define dfilter_compile(text, dfp, errp) \
159 dfilter_compile_full(text, dfp, errp, \
160 DF_EXPAND_MACROS|DF_OPTIMIZE, \
161 __func__)
162
163 struct stnode;
164
170WS_DLL_PUBLIC
171 struct stnode *dfilter_get_syntax_tree(const char *text);
172
181WS_DLL_PUBLIC
182 void
183 dfilter_free(dfilter_t *df);
184
192WS_DLL_PUBLIC
193 bool
194 dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
195
202 bool
203 dfilter_apply(dfilter_t *df, proto_tree *tree);
204
215 bool
216 dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals);
217
224 void
225 dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
226
233 void
234 dfilter_prime_proto_tree_print(const dfilter_t *df, proto_tree *tree);
235
242WS_DLL_PUBLIC
243 void
244 dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
245
252WS_DLL_PUBLIC
253 void
254 dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
255
262 bool
263 dfilter_has_interesting_fields(const dfilter_t *df);
264
272 bool
273 dfilter_interested_in_field(const dfilter_t *df, int hfid);
274
283 bool
284 dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
285
292WS_DLL_PUBLIC
293 bool
294 dfilter_requires_columns(const dfilter_t *df);
295
302WS_DLL_PUBLIC
303GPtrArray *
304 dfilter_deprecated_tokens(dfilter_t *df);
305
312WS_DLL_PUBLIC
313GSList *
314 dfilter_get_warnings(dfilter_t *df);
315
316#define DF_DUMP_REFERENCES (1U << 0)
317#define DF_DUMP_SHOW_FTYPE (1U << 1)
318
319/* Print bytecode of dfilter to fp */
327WS_DLL_PUBLIC
328 void
329 dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
330
331/* Text after macro expansion. */
338WS_DLL_PUBLIC
339 const char *
340 dfilter_text(dfilter_t *df);
341
350WS_DLL_PUBLIC
351 const char *
352 dfilter_syntax_tree(dfilter_t *df);
353
360WS_DLL_PUBLIC
361ftenum_t
362 dfilter_get_return_type(dfilter_t *df);
363
364/* Print bytecode of dfilter to log */
378WS_DLL_PUBLIC
379 void
380 dfilter_log_full(const char *domain, enum ws_log_level level,
381 const char *file, long line, const char *func,
382 dfilter_t *dfcode, const char *msg);
383
384#ifdef WS_DEBUG
385#define dfilter_log(dfcode, msg) \
386 dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY, \
387 __FILE__, __LINE__, __func__, \
388 dfcode, msg)
389#else
390#define dfilter_log(dfcode, msg) (void)0
391#endif
392
393#define DFILTER_DEBUG_HERE(dfcode) \
394 dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO, \
395 __FILE__, __LINE__, __func__, \
396 dfcode, #dfcode);
397
398#ifdef __cplusplus
399}
400#endif /* __cplusplus */
401
402#endif /* DFILTER_H */
dfilter-loc.h
dfilter_has_interesting_fields
bool dfilter_has_interesting_fields(const dfilter_t *df)
Check if a display filter has any interesting fields.
Definition dfilter.c:729
df_error_new_printf
df_error_t * df_error_new_printf(int code, df_loc_t *loc, const char *fmt,...)
Create a new error with formatted message.
Definition dfilter.c:963
dfilter_requires_columns
WS_DLL_PUBLIC bool dfilter_requires_columns(const dfilter_t *df)
Check if a display filter requires specific columns.
Definition dfilter.c:772
dfilter_deprecated_tokens
WS_DLL_PUBLIC GPtrArray * dfilter_deprecated_tokens(dfilter_t *df)
Get deprecated tokens from a dfilter.
Definition dfilter.c:789
dfilter_interested_in_proto
bool dfilter_interested_in_proto(const dfilter_t *df, int proto_id)
Check if dfilter is interested in a given protocol.
Definition dfilter.c:748
dfilter_init
void dfilter_init(const char *app_env_var_prefix)
Initialize the display filter module.
Definition dfilter.c:105
dfilter_apply
bool dfilter_apply(dfilter_t *df, proto_tree *tree)
Apply a compiled dfilter to a protocol tree.
Definition dfilter.c:693
dfilter_apply_full
bool dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals)
Apply a dfilter to a proto_tree and populate fvals.
Definition dfilter.c:705
dfilter_free
WS_DLL_PUBLIC void dfilter_free(dfilter_t *df)
Free a compiled dfilter.
Definition dfilter.c:171
dfilter_load_field_references_edt
WS_DLL_PUBLIC void dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt)
Load field references for a display filter into an epan_dissect_t structure.
Definition dfilter.c:901
dfilter_text
WS_DLL_PUBLIC const char * dfilter_text(dfilter_t *df)
Get the text representation of a syntax tree.
Definition dfilter.c:809
df_error_new_vprintf
df_error_t * df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap)
Create a new error with formatted message and location information.
Definition dfilter.c:946
dfilter_prime_proto_tree_print
void dfilter_prime_proto_tree_print(const dfilter_t *df, proto_tree *tree)
Prime a proto_tree using the fields/protocols used in a dfilter, marked for print.
Definition dfilter.c:721
dfilter_load_field_references
WS_DLL_PUBLIC void dfilter_load_field_references(const dfilter_t *df, proto_tree *tree)
Refresh references in a compiled display filter.
Definition dfilter.c:894
dfilter_get_warnings
WS_DLL_PUBLIC GSList * dfilter_get_warnings(dfilter_t *df)
Get warnings associated with a display filter.
Definition dfilter.c:797
dfilter_cleanup
void dfilter_cleanup(void)
Perform module-level cleanup for the dfilter subsystem.
Definition dfilter.c:125
dfilter_apply_edt
WS_DLL_PUBLIC bool dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt)
Apply a compiled display filter to an epan_dissect structure.
Definition dfilter.c:699
df_error_free
WS_DLL_PUBLIC void df_error_free(df_error_t **ep)
Frees a df_error_t structure.
Definition dfilter.c:973
df_error_new
df_error_t * df_error_new(int code, char *msg, df_loc_t *loc)
Create a new error object with a specific code and message.
Definition dfilter.c:929
dfilter_get_syntax_tree
WS_DLL_PUBLIC struct stnode * dfilter_get_syntax_tree(const char *text)
Build a syntax tree for a filter.
Definition dfilter.c:654
dfilter_syntax_tree
WS_DLL_PUBLIC const char * dfilter_syntax_tree(dfilter_t *df)
Get the syntax tree of a dfilter.
Definition dfilter.c:815
dfilter_interested_in_field
bool dfilter_interested_in_field(const dfilter_t *df, int hfid)
Check if dfilter is interested in a given field.
Definition dfilter.c:735
dfilter_prime_proto_tree
void dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree)
Prime a proto_tree using the fields/protocols used in a dfilter.
Definition dfilter.c:711
dfilter_log_full
WS_DLL_PUBLIC void dfilter_log_full(const char *domain, enum ws_log_level level, const char *file, long line, const char *func, dfilter_t *dfcode, const char *msg)
Log a display filter with full details.
Definition dfilter.c:827
dfilter_dump
WS_DLL_PUBLIC void dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags)
Dump a dfilter to a file.
Definition dfilter.c:803
dfilter_compile_full
WS_DLL_PUBLIC bool dfilter_compile_full(const char *text, dfilter_t **dfp, df_error_t **errpp, unsigned flags, const char *caller)
Compiles a string to a dfilter_t.
Definition dfilter.c:605
dfilter_get_return_type
WS_DLL_PUBLIC ftenum_t dfilter_get_return_type(dfilter_t *df)
Get the return type of a display filter.
Definition dfilter.c:821
proto.h
_dfilter_loc
Definition dfilter-loc.h:16
_proto_node
Definition proto.h:905
df_error_t
Definition dfilter.h:30
epan_dfilter
Definition dfilter-int.h:35
epan_dissect
Definition epan_dissect.h:28
stnode
Definition syntax-tree.h:78