dfilter.h

Go to the documentation of this file.

 
#ifndef DFILTER_H
#define DFILTER_H
 
#include <wireshark.h>
 
#include "dfilter-loc.h"
#include <epan/proto.h>
 
/* Passed back to user */
typedef struct epan_dfilter dfilter_t;
 
#ifdef __cplusplus
extern "C" {
#endif /* __cplusplus */
 
struct epan_dissect;
 
#define DF_ERROR_GENERIC        -1
#define DF_ERROR_UNEXPECTED_END     -2
 
typedef struct {
    int      code; 
    char*    msg;  
    df_loc_t loc;  
} df_error_t;
 
df_error_t *
df_error_new(int code, char *msg, df_loc_t *loc);
 
df_error_t *
df_error_new_printf(int code, df_loc_t *loc, const char *fmt, ...)
G_GNUC_PRINTF(3, 4);
 
#define df_error_new_msg(msg) \
    df_error_new_printf(DF_ERROR_GENERIC, NULL, "%s", msg)
 
df_error_t *
df_error_new_vprintf(int code, df_loc_t *loc, const char *fmt, va_list ap);
 
WS_DLL_PUBLIC
void
df_error_free(df_error_t **ep);
 
/* Module-level initialization */
 
void
dfilter_init(const char* app_env_var_prefix);
 
/* Module-level cleanup */
void
 dfilter_cleanup(void);
 
/* Perform macro expansion. */
WS_DLL_PUBLIC
char *
dfilter_expand(const char *expr, df_error_t **err_ret);
 
/* Save textual representation of syntax tree (for debugging purposes). */
#define DF_SAVE_TREE        (1U << 0)
/* Perform macro substitution on filter text. */
#define DF_EXPAND_MACROS    (1U << 1)
/* Do an optimization pass on the compiled filter. */
#define DF_OPTIMIZE     (1U << 2)
/* Enable debug trace for flex. */
#define DF_DEBUG_FLEX       (1U << 3)
/* Enable debug trace for lemon. */
#define DF_DEBUG_LEMON      (1U << 4)
/* If the root of the syntax tree is a field, load and return the field values.
 * By default the field is only checked for existence. */
#define DF_RETURN_VALUES        (1U << 5)
 
WS_DLL_PUBLIC
bool
dfilter_compile_full(const char *text, dfilter_t **dfp,
            df_error_t **errpp, unsigned flags,
            const char *caller);
 
#define dfilter_compile(text, dfp, errp) \
    dfilter_compile_full(text, dfp, errp, \
                DF_EXPAND_MACROS|DF_OPTIMIZE, \
                __func__)
 
struct stnode;
 
WS_DLL_PUBLIC
struct stnode *dfilter_get_syntax_tree(const char *text);
 
WS_DLL_PUBLIC
void
dfilter_free(dfilter_t *df);
 
WS_DLL_PUBLIC
bool
dfilter_apply_edt(dfilter_t *df, struct epan_dissect *edt);
 
bool
dfilter_apply(dfilter_t *df, proto_tree *tree);
 
bool
dfilter_apply_full(dfilter_t *df, proto_tree *tree, GPtrArray **fvals);
 
void
dfilter_prime_proto_tree(const dfilter_t *df, proto_tree *tree);
 
void
dfilter_prime_proto_tree_print(const dfilter_t *df, proto_tree *tree);
 
WS_DLL_PUBLIC
void
dfilter_load_field_references(const dfilter_t *df, proto_tree *tree);
 
WS_DLL_PUBLIC
void
dfilter_load_field_references_edt(const dfilter_t *df, struct epan_dissect *edt);
 
bool
dfilter_has_interesting_fields(const dfilter_t *df);
 
bool
dfilter_interested_in_field(const dfilter_t *df, int hfid);
 
bool
dfilter_interested_in_proto(const dfilter_t *df, int proto_id);
 
WS_DLL_PUBLIC
bool
dfilter_requires_columns(const dfilter_t *df);
 
WS_DLL_PUBLIC
GPtrArray *
dfilter_deprecated_tokens(dfilter_t *df);
 
WS_DLL_PUBLIC
GSList *
dfilter_get_warnings(dfilter_t *df);
 
#define DF_DUMP_REFERENCES  (1U << 0)
#define DF_DUMP_SHOW_FTYPE  (1U << 1)
 
/* Print bytecode of dfilter to fp */
WS_DLL_PUBLIC
void
dfilter_dump(FILE *fp, dfilter_t *df, uint16_t flags);
 
/* Text after macro expansion. */
WS_DLL_PUBLIC
const char *
dfilter_text(dfilter_t *df);
 
WS_DLL_PUBLIC
const char *
dfilter_syntax_tree(dfilter_t *df);
 
WS_DLL_PUBLIC
ftenum_t
dfilter_get_return_type(dfilter_t *df);
 
/* Print bytecode of dfilter to log */
WS_DLL_PUBLIC
void
dfilter_log_full(const char *domain, enum ws_log_level level,
            const char *file, long line, const char *func,
            dfilter_t *dfcode, const char *msg);
 
#ifdef WS_DEBUG
#define dfilter_log(dfcode, msg) \
    dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_NOISY,   \
                __FILE__, __LINE__, __func__,   \
                dfcode, msg)
#else
#define dfilter_log(dfcode, msg) (void)0
#endif
 
#define DFILTER_DEBUG_HERE(dfcode) \
    dfilter_log_full(LOG_DOMAIN_DFILTER, LOG_LEVEL_ECHO,    \
                __FILE__, __LINE__, __func__,   \
                dfcode, #dfcode);
 
#ifdef __cplusplus
}
#endif /* __cplusplus */
 
#endif /* DFILTER_H */