Wireshark  4.3.0
The Wireshark network protocol analyzer
dfilter.h
Go to the documentation of this file.
1 
10 #ifndef DFILTER_H
11 #define DFILTER_H
12 
13 #include <wireshark.h>
14 
15 #include "dfilter-loc.h"
16 #include <epan/proto.h>
17 
18 /* Passed back to user */
19 typedef struct epan_dfilter dfilter_t;
20 
21 #ifdef __cplusplus
22 extern "C" {
23 #endif /* __cplusplus */
24 
25 struct epan_dissect;
26 
27 #define DF_ERROR_GENERIC -1
28 #define DF_ERROR_UNEXPECTED_END -2
29 
30 typedef struct {
31  int code;
32  char *msg;
33  df_loc_t loc;
34 } df_error_t;
35 
36 df_error_t *
37 df_error_new(int code, char *msg, df_loc_t *loc);
38 
39 df_error_t *
40 df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
41 G_GNUC_PRINTF(3, 4);
42 
43 #define df_error_new_msg(msg) \
44  df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
45 
46 df_error_t *
47 df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
48 
49 WS_DLL_PUBLIC
50 void
51 df_error_free(df_error_t **ep);
52 
53 /* Module-level initialization */
54 void
55 dfilter_init(void);
56 
57 /* Module-level cleanup */
58 void
59 dfilter_cleanup(void);
60 
61 /* Perform macro expansion. */
62 WS_DLL_PUBLIC
63 char *
64 dfilter_expand(const char *expr, df_error_t **err_ret);
65 
66 /* Save textual representation of syntax tree (for debugging purposes). */
67 #define DF_SAVE_TREE (1U << 0)
68 /* Perform macro substitution on filter text. */
69 #define DF_EXPAND_MACROS (1U << 1)
70 /* Do an optimization pass on the compiled filter. */
71 #define DF_OPTIMIZE (1U << 2)
72 /* Enable debug trace for flex. */
73 #define DF_DEBUG_FLEX (1U << 3)
74 /* Enable debug trace for lemon. */
75 #define DF_DEBUG_LEMON (1U << 4)
76 
77 /* Compiles a string to a dfilter_t.
78  * On success, sets the dfilter* pointed to by dfp
79  * to either a NULL pointer (if the filter is a null
80  * filter, as generated by an all-blank string) or to
81  * a pointer to the newly-allocated dfilter_t
82  * structure.
83  *
84  * On failure, *err_msg is set to point to the error
85  * message. This error message is allocated with
86  * g_malloc(), and must be freed with g_free().
87  * The dfilter* will be set to NULL after a failure.
88  *
89  * Returns true on success, false on failure.
90  */
91 WS_DLL_PUBLIC
92 bool
93 dfilter_compile_full(const char *text, dfilter_t **dfp,
94  df_error_t **errpp, unsigned flags,
95  const char *caller);
96 
97 #define dfilter_compile(text, dfp, errp) \
98  dfilter_compile_full(text, dfp, errp, \
99  DF_EXPAND_MACROS|DF_OPTIMIZE, \
100  __func__)
101 
102 /* Frees all memory used by dfilter, and frees
103  * the dfilter itself. */
104 WS_DLL_PUBLIC
105 void
106 dfilter_free(dfilter_t *df);
107 
108 /* Apply compiled dfilter */
109 WS_DLL_PUBLIC
110 bool
111 dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
112 
113 /* Apply compiled dfilter */
114 bool
115 dfilter_apply(dfilter_t *df, proto_tree *tree);
116 
117 /* Prime a proto_tree using the fields/protocols used in a dfilter. */
118 void
119 dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
120 
121 /* Refresh references in a compiled display filter. */
122 WS_DLL_PUBLIC
123 void
124 dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
125 
126 /* Refresh references in a compiled display filter. */
127 WS_DLL_PUBLIC
128 void
129 dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
130 
131 /* Check if dfilter has interesting fields */
132 bool
133 dfilter_has_interesting_fields(const dfilter_t *df);
134 
135 /* Check if dfilter is interested in a given field
136  *
137  * @param df The dfilter
138  * @param hfid The header field info ID to check
139  * @return true if the field is interesting to the dfilter
140  */
141 bool
142 dfilter_interested_in_field(const dfilter_t *df, int hfid);
143 
144 /* Check if dfilter is interested in a given protocol
145  *
146  * @param df The dfilter
147  * @param proto_id The protocol ID to check
148  * @return true if the dfilter is interested in a field whose
149  * parent is proto_id
150  */
151 bool
152 dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
153 
154 WS_DLL_PUBLIC
155 bool
156 dfilter_requires_columns(const dfilter_t *df);
157 
158 WS_DLL_PUBLIC
159 GPtrArray *
160 dfilter_deprecated_tokens(dfilter_t *df);
161 
162 WS_DLL_PUBLIC
163 GSList *
164 dfilter_get_warnings(dfilter_t *df);
165 
166 #define DF_DUMP_REFERENCES (1U << 0)
167 #define DF_DUMP_SHOW_FTYPE (1U << 1)
168 
169 /* Print bytecode of dfilter to fp */
170 WS_DLL_PUBLIC
171 void
172 dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
173 
174 /* Text after macro expansion. */
175 WS_DLL_PUBLIC
176 const char *
177 dfilter_text(dfilter_t *df);
178 
179 /* Text representation of syntax tree (if it was saved, NULL oterwise). */
180 WS_DLL_PUBLIC
181 const char *
182 dfilter_syntax_tree(dfilter_t *df);
183 
184 /* Print bytecode of dfilter to log */
185 WS_DLL_PUBLIC
186 void
187 dfilter_log_full(const char *domain, enum ws_log_level level,
188  const char *file, long line, const char *func,
189  dfilter_t *dfcode, const char *msg);
190 
191 #ifdef WS_DEBUG
192 #define dfilter_log(dfcode, msg) \
193  dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY, \
194  __FILE__, __LINE__, __func__, \
195  dfcode, msg)
196 #else
197 #define dfilter_log(dfcode, msg) (void)0
198 #endif
199 
200 #define DFILTER_DEBUG_HERE(dfcode) \
201  dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO, \
202  __FILE__, __LINE__, __func__, \
203  dfcode, #dfcode);
204 
205 #ifdef __cplusplus
206 }
207 #endif /* __cplusplus */
208 
209 #endif /* DFILTER_H */
Definition: dfilter-loc.h:16
Definition: proto.h:897
Definition: dfilter.h:30
Definition: dfilter-int.h:35
Definition: epan_dissect.h:28