Wireshark  4.3.0
The Wireshark network protocol analyzer
dfilter.h
Go to the documentation of this file.
1 
10 #ifndef DFILTER_H
11 #define DFILTER_H
12 
13 #include <wireshark.h>
14 
15 #include "dfilter-loc.h"
16 #include <epan/proto.h>
17 
18 /* Passed back to user */
19 typedef struct epan_dfilter dfilter_t;
20 
21 #ifdef __cplusplus
22 extern "C" {
23 #endif /* __cplusplus */
24 
25 struct epan_dissect;
26 
27 #define DF_ERROR_GENERIC -1
28 #define DF_ERROR_UNEXPECTED_END -2
29 
30 typedef struct {
31  int code;
32  char *msg;
33  df_loc_t loc;
34 } df_error_t;
35 
36 df_error_t *
37 df_error_new(int code, char *msg, df_loc_t *loc);
38 
39 df_error_t *
40 df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
41 G_GNUC_PRINTF(3, 4);
42 
43 #define df_error_new_msg(msg) \
44  df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
45 
46 df_error_t *
47 df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
48 
49 WS_DLL_PUBLIC
50 void
51 df_error_free(df_error_t **ep);
52 
53 /* Module-level initialization */
54 void
55 dfilter_init(void);
56 
57 /* Module-level cleanup */
58 void
59 dfilter_cleanup(void);
60 
61 /* Perform macro expansion. */
62 WS_DLL_PUBLIC
63 char *
64 dfilter_expand(const char *expr, df_error_t **err_ret);
65 
66 /* Save textual representation of syntax tree (for debugging purposes). */
67 #define DF_SAVE_TREE (1U << 0)
68 /* Perform macro substitution on filter text. */
69 #define DF_EXPAND_MACROS (1U << 1)
70 /* Do an optimization pass on the compiled filter. */
71 #define DF_OPTIMIZE (1U << 2)
72 /* Enable debug trace for flex. */
73 #define DF_DEBUG_FLEX (1U << 3)
74 /* Enable debug trace for lemon. */
75 #define DF_DEBUG_LEMON (1U << 4)
76 /* If the root of the syntax tree is a field, load and return the field values.
77  * By default the field is only checked for existence. */
78 #define DF_RETURN_VALUES (1U << 5)
79 
80 /* Compiles a string to a dfilter_t.
81  * On success, sets the dfilter* pointed to by dfp
82  * to either a NULL pointer (if the filter is a null
83  * filter, as generated by an all-blank string) or to
84  * a pointer to the newly-allocated dfilter_t
85  * structure.
86  *
87  * On failure, *err_msg is set to point to the error
88  * message. This error message is allocated with
89  * g_malloc(), and must be freed with g_free().
90  * The dfilter* will be set to NULL after a failure.
91  *
92  * Returns true on success, false on failure.
93  */
94 WS_DLL_PUBLIC
95 bool
96 dfilter_compile_full(const char *text, dfilter_t **dfp,
97  df_error_t **errpp, unsigned flags,
98  const char *caller);
99 
100 #define dfilter_compile(text, dfp, errp) \
101  dfilter_compile_full(text, dfp, errp, \
102  DF_EXPAND_MACROS|DF_OPTIMIZE, \
103  __func__)
104 
105 /* Frees all memory used by dfilter, and frees
106  * the dfilter itself. */
107 WS_DLL_PUBLIC
108 void
109 dfilter_free(dfilter_t *df);
110 
111 /* Apply compiled dfilter */
112 WS_DLL_PUBLIC
113 bool
114 dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
115 
116 /* Apply compiled dfilter */
117 bool
118 dfilter_apply(dfilter_t *df, proto_tree *tree);
119 
120 /* Apply compiled dfilter and return final set of fvalues (if they
121  * exist) in addition to true/false determination. */
122 bool
123 dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals);
124 
125 /* Prime a proto_tree using the fields/protocols used in a dfilter. */
126 void
127 dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
128 
129 /* Refresh references in a compiled display filter. */
130 WS_DLL_PUBLIC
131 void
132 dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
133 
134 /* Refresh references in a compiled display filter. */
135 WS_DLL_PUBLIC
136 void
137 dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
138 
139 /* Check if dfilter has interesting fields */
140 bool
141 dfilter_has_interesting_fields(const dfilter_t *df);
142 
143 /* Check if dfilter is interested in a given field
144  *
145  * @param df The dfilter
146  * @param hfid The header field info ID to check
147  * @return true if the field is interesting to the dfilter
148  */
149 bool
150 dfilter_interested_in_field(const dfilter_t *df, int hfid);
151 
152 /* Check if dfilter is interested in a given protocol
153  *
154  * @param df The dfilter
155  * @param proto_id The protocol ID to check
156  * @return true if the dfilter is interested in a field whose
157  * parent is proto_id
158  */
159 bool
160 dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
161 
162 WS_DLL_PUBLIC
163 bool
164 dfilter_requires_columns(const dfilter_t *df);
165 
166 WS_DLL_PUBLIC
167 GPtrArray *
168 dfilter_deprecated_tokens(dfilter_t *df);
169 
170 WS_DLL_PUBLIC
171 GSList *
172 dfilter_get_warnings(dfilter_t *df);
173 
174 #define DF_DUMP_REFERENCES (1U << 0)
175 #define DF_DUMP_SHOW_FTYPE (1U << 1)
176 
177 /* Print bytecode of dfilter to fp */
178 WS_DLL_PUBLIC
179 void
180 dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
181 
182 /* Text after macro expansion. */
183 WS_DLL_PUBLIC
184 const char *
185 dfilter_text(dfilter_t *df);
186 
187 /* Text representation of syntax tree (if it was saved, NULL oterwise). */
188 WS_DLL_PUBLIC
189 const char *
190 dfilter_syntax_tree(dfilter_t *df);
191 
192 /* Print bytecode of dfilter to log */
193 WS_DLL_PUBLIC
194 void
195 dfilter_log_full(const char *domain, enum ws_log_level level,
196  const char *file, long line, const char *func,
197  dfilter_t *dfcode, const char *msg);
198 
199 #ifdef WS_DEBUG
200 #define dfilter_log(dfcode, msg) \
201  dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY, \
202  __FILE__, __LINE__, __func__, \
203  dfcode, msg)
204 #else
205 #define dfilter_log(dfcode, msg) (void)0
206 #endif
207 
208 #define DFILTER_DEBUG_HERE(dfcode) \
209  dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO, \
210  __FILE__, __LINE__, __func__, \
211  dfcode, #dfcode);
212 
213 #ifdef __cplusplus
214 }
215 #endif /* __cplusplus */
216 
217 #endif /* DFILTER_H */
Definition: dfilter-loc.h:16
Definition: proto.h:898
Definition: dfilter.h:30
Definition: dfilter-int.h:35
Definition: epan_dissect.h:28