CaptureFilterValidator Class Reference

FilterValidator for libpcap/BPF capture filters. More...

#include <capture_filter_validator.h>

Inheritance diagram for CaptureFilterValidator:

Public Member Functions
	CaptureFilterValidator (QObject *parent=nullptr)
QValidator::State	validate (QString &input, int &pos) const override
	Validates input and updates the stashed Detail.
Detail	lastDetail () const override
	Returns the Detail produced by the most recent validate() call.
Public Member Functions inherited from FilterValidator
	FilterValidator (QObject *parent=nullptr)
QString	lastError () const
	Short error message from the last validation (Detail::errMsg).
QString	lastErrorFull (const QString &filter) const
	Full, location-annotated error message for filter.
QString	deprecatedToken () const
	The deprecated token from the last validation, or empty.

Additional Inherited Members
Static Public Member Functions inherited from FilterValidator
static QString	createSyntaxErrorMessageFull (const QString &filter, const QString &err_msg, qsizetype loc_start, size_t loc_length)
	Builds a full, location-annotated error string.

Detailed Description

FilterValidator for libpcap/BPF capture filters.

validate() compiles the expression with pcap_compile() against the DLTs of the currently selected capture interfaces (and verifies extcap interfaces via extcap_verify_capture_filter()), mirroring the old CaptureFilterSyntaxWorker.

The check is synchronous: it runs on the host widget's debounce and returns immediately, giving instant in-place feedback. (The old code ran it on a background thread because pcap_compile() may call gethostbyname() and block on DNS for filters that name hosts; the synchronous form can briefly lag on such input. The Busy state is reserved in FilterEdit for re-introducing an async path if that ever proves necessary.)

Cases the BPF backend cannot definitively check — DLT_USER interfaces, BPF extensions that need a live handle, unknown extcap status — are reported as Acceptable with a non-empty Detail::deprecatedToken so the host maps them to the (amber) Deprecated state, matching historical behaviour.

Member Function Documentation

lastDetail()

Detail CaptureFilterValidator::lastDetail ( ) const

inlineoverridevirtual

Returns the Detail produced by the most recent validate() call.

Implements FilterValidator.

validate()

QValidator::State CaptureFilterValidator::validate ( QString & input, int & pos ) const

overridevirtual

Validates input and updates the stashed Detail.

Parameters

input	The text to validate; may be normalised in place.
pos	In/out cursor position.

Returns

Invalid, Intermediate, or Acceptable.

Implements FilterValidator.

---

The documentation for this class was generated from the following files:

• /builds/wireshark/wireshark/ui/qt/models/capture_filter_validator.h
• /builds/wireshark/wireshark/ui/qt/models/capture_filter_validator.cpp