osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity
wireshark/epan/dfilter/sttype-test.c

406 lines
6.6 KiB
C
Raw Normal View History

Grumble, grumble. I forgot to add the license comment at the top of these files. svn path=/trunk/; revision=2968
2001-02-01 20:31:21 +00:00
/*
name change svn path=/trunk/; revision=18197
2006-05-21 05:12:17 +00:00
* Wireshark - Network traffic analyzer
Changed email address for Gerald from zing.org to wireshark.org in a lot of files, which I suppose is correct. svn path=/trunk/; revision=24034
2008-01-08 22:54:51 +00:00
* By Gerald Combs <gerald@wireshark.org>
Grumble, grumble. I forgot to add the license comment at the top of these files. svn path=/trunk/; revision=2968
2001-02-01 20:31:21 +00:00
* Copyright 2001 Gerald Combs
*
Removed trailing whitespaces from .h and .c files using the winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6116
2002-08-28 20:41:00 +00:00
*
epan: use SPDX indentifiers. Skipping dissectors dir for now. Change-Id: I717b66bfbc7cc81b83f8c2cbc011fcad643796aa Reviewed-on: https://code.wireshark.org/review/25694 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-08 16:59:17 +00:00
* SPDX-License-Identifier: GPL-2.0-or-later
Grumble, grumble. I forgot to add the license comment at the top of these files. svn path=/trunk/; revision=2968
2001-02-01 20:31:21 +00:00
*/
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
#include "syntax-tree.h"
#include "sttype-test.h"
typedef struct {
guint32 magic;
test_op_t op;
stnode_t *val1;
stnode_t *val2;
} test_t;
#define TEST_MAGIC 0xab9009ba
static gpointer
test_new(gpointer junk)
{
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
test_t *test;
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
Remove some lingering uses of g_assert() Also replace some incorrect uses of g_assert_true(). g_assert_true -> g_assert -> ws_assert
2021-12-16 10:19:45 +00:00
ws_assert(junk == NULL);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
test = g_new(test_t, 1);
test->magic = TEST_MAGIC;
test->op = TEST_OP_UNINITIALIZED;
test->val1 = NULL;
test->val2 = NULL;
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
return test;
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
}
Support multiple relation test without logic and (python-like) Like: a == b == c or a < b <= c <= d < e Real life example: 6660 <= tcp.port <= 6669 Just syntactic sugar, this is *NOT* optimized. svn path=/trunk/; revision=43353
2012-06-19 12:12:41 +00:00
static gpointer
test_dup(gconstpointer data)
{
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
const test_t *org = data;
test_t *test;
Support multiple relation test without logic and (python-like) Like: a == b == c or a < b <= c <= d < e Real life example: 6660 <= tcp.port <= 6669 Just syntactic sugar, this is *NOT* optimized. svn path=/trunk/; revision=43353
2012-06-19 12:12:41 +00:00
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
test = test_new(NULL);
Support multiple relation test without logic and (python-like) Like: a == b == c or a < b <= c <= d < e Real life example: 6660 <= tcp.port <= 6669 Just syntactic sugar, this is *NOT* optimized. svn path=/trunk/; revision=43353
2012-06-19 12:12:41 +00:00
test->op = org->op;
test->val1 = stnode_dup(org->val1);
test->val2 = stnode_dup(org->val1);
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
return test;
Support multiple relation test without logic and (python-like) Like: a == b == c or a < b <= c <= d < e Real life example: 6660 <= tcp.port <= 6669 Just syntactic sugar, this is *NOT* optimized. svn path=/trunk/; revision=43353
2012-06-19 12:12:41 +00:00
}
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
static void
test_free(gpointer value)
{
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
test_t *test = value;
dfilter: Fix ws_assert_magic() macro We need to use WS_DISABLE_DEBUG, not WS_DEBUG. Fixes 0e50979b3f45250ee1dacd5c826a281ad9a9c460. Rename some lingering assert_magic() references.
2021-10-06 11:21:59 +00:00
ws_assert_magic(test, TEST_MAGIC);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
if (test->val1)
stnode_free(test->val1);
if (test->val2)
stnode_free(test->val2);
g_free(test);
}
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
static const char *
test_todisplay(test_op_t op)
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
{
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
const char *s = "<notset>";
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
switch(op) {
case TEST_OP_EXISTS:
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
s = "<exists>";
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
break;
case TEST_OP_NOT:
s = "!";
break;
case TEST_OP_AND:
s = "&&";
break;
case TEST_OP_OR:
s = "||";
break;
dfilter: Add an "all equal" operator To complete the set of equality operators add an "all equal" operator that matches a frame if all fields match the condition. The symbol chosen for "all_eq" is "===".
2021-12-13 01:06:01 +00:00
case TEST_OP_ALL_EQ:
s = "===";
break;
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
case TEST_OP_ANY_EQ:
s = "==";
break;
case TEST_OP_ALL_NE:
s = "!=";
break;
case TEST_OP_ANY_NE:
s = "~=";
break;
case TEST_OP_GT:
s = ">";
break;
case TEST_OP_GE:
s = ">=";
break;
case TEST_OP_LT:
s = "<";
break;
case TEST_OP_LE:
s = "<=";
break;
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
case OP_BITWISE_AND:
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
s = "&";
break;
dfilter: Add binary arithmetic (add/subtract) Add support for display filter binary addition and subtraction. The grammar is intentionally kept simple for now. The use case is to add a constant to a protocol field, or (maybe) add two fields in an expression. We use signed arithmetic with unsigned numbers, checking for overflow and casting where necessary to do the conversion. We could legitimately opt to use traditional modular arithmetic instead (like C) and if it turns out that that is more useful for some reason we may want to in the future. Fixes #15504.
2022-02-27 14:47:31 +00:00
case OP_ADD:
s = "+";
break;
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
case OP_UNARY_MINUS:
dfilter: Add binary arithmetic (add/subtract) Add support for display filter binary addition and subtraction. The grammar is intentionally kept simple for now. The use case is to add a constant to a protocol field, or (maybe) add two fields in an expression. We use signed arithmetic with unsigned numbers, checking for overflow and casting where necessary to do the conversion. We could legitimately opt to use traditional modular arithmetic instead (like C) and if it turns out that that is more useful for some reason we may want to in the future. Fixes #15504.
2022-02-27 14:47:31 +00:00
case OP_SUBTRACT:
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
s = "-";
break;
dfilter: Add remaining arithmetic integer ops
2022-03-31 13:50:20 +00:00
case OP_MULTIPLY:
s = "*";
break;
case OP_DIVIDE:
s = "/";
break;
case OP_MODULO:
s = "%";
break;
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
case TEST_OP_NOTZERO:
s = "<notzero>";
break;
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
case TEST_OP_CONTAINS:
s = "contains";
break;
case TEST_OP_MATCHES:
s = "matches";
break;
case TEST_OP_IN:
s = "in";
break;
case TEST_OP_UNINITIALIZED:
s = "<uninitialized>";
break;
}
return s;
}
dfilter: Pass a test_op_t in check_relation()
2021-10-21 08:03:51 +00:00
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
static const char *
test_todebug(test_op_t op)
{
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
const char *s = "<notset>";
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
switch(op) {
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
case TEST_OP_EXISTS:
dfilter: Fixup syntax tree node display
2021-09-30 16:05:02 +00:00
s = "TEST_EXISTS";
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
break;
case TEST_OP_NOT:
s = "TEST_NOT";
break;
case TEST_OP_AND:
s = "TEST_AND";
break;
case TEST_OP_OR:
s = "TEST_OR";
break;
dfilter: Add an "all equal" operator To complete the set of equality operators add an "all equal" operator that matches a frame if all fields match the condition. The symbol chosen for "all_eq" is "===".
2021-12-13 01:06:01 +00:00
case TEST_OP_ALL_EQ:
s = "TEST_ALL_EQ";
break;
dfilter: Fix "!=" relation to be free of contradictions Wireshark defines the relation of equality A == B as A any_eq B <=> An == Bn for at least one An, Bn. More accurately I think this is (formally) an equivalence relation, not true equality. Whichever definition for "==" we choose we must keep the definition of "!=" as !(A == B), otherwise it will lead to logical contradictions like (A == B) AND (A != B) being true. Fix the '!=' relation to match the definition of equality: A != B <=> !(A == B) <=> A all_ne B <=> An != Bn, for every n. This has been the recomended way to write "not equal" for a long time in the documentation, even to the point where != was deprecated, but it just wasn't implemented consistently in the language, which has understandably been a persistent source of confusion. Even a field that is normally well-behaved with "!=" like "ip.src" or "ip.dst" will produce unexpected results with encapsulations like IP-over-IP. The opcode ALL_NE could have been implemented in the compiler instead using NOT and ANY_EQ but I chose to implement it in bytecode. It just seemed more elegant and efficient but the difference was not very significant. Keep around "~=" for any_ne relation, in case someone depends on that, and because we don't have an operator for true equality: A strict_equal B <=> A all_eq B <=> !(A any_ne B). If there is only one value then any_ne and all_ne are the same comparison operation. Implementing this change did not require fixing any tests so it is unlikely the relation "~=" (any_ne) will be very useful. Note that the behaviour of the '<' (less than) comparison relation is a separate, more subtle issue. In the general case the definition of '<' that is used is only a partial order.
2021-10-18 20:07:06 +00:00
case TEST_OP_ANY_EQ:
s = "TEST_ANY_EQ";
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
break;
dfilter: Fix "!=" relation to be free of contradictions Wireshark defines the relation of equality A == B as A any_eq B <=> An == Bn for at least one An, Bn. More accurately I think this is (formally) an equivalence relation, not true equality. Whichever definition for "==" we choose we must keep the definition of "!=" as !(A == B), otherwise it will lead to logical contradictions like (A == B) AND (A != B) being true. Fix the '!=' relation to match the definition of equality: A != B <=> !(A == B) <=> A all_ne B <=> An != Bn, for every n. This has been the recomended way to write "not equal" for a long time in the documentation, even to the point where != was deprecated, but it just wasn't implemented consistently in the language, which has understandably been a persistent source of confusion. Even a field that is normally well-behaved with "!=" like "ip.src" or "ip.dst" will produce unexpected results with encapsulations like IP-over-IP. The opcode ALL_NE could have been implemented in the compiler instead using NOT and ANY_EQ but I chose to implement it in bytecode. It just seemed more elegant and efficient but the difference was not very significant. Keep around "~=" for any_ne relation, in case someone depends on that, and because we don't have an operator for true equality: A strict_equal B <=> A all_eq B <=> !(A any_ne B). If there is only one value then any_ne and all_ne are the same comparison operation. Implementing this change did not require fixing any tests so it is unlikely the relation "~=" (any_ne) will be very useful. Note that the behaviour of the '<' (less than) comparison relation is a separate, more subtle issue. In the general case the definition of '<' that is used is only a partial order.
2021-10-18 20:07:06 +00:00
case TEST_OP_ALL_NE:
s = "TEST_ALL_NE";
break;
case TEST_OP_ANY_NE:
s = "TEST_ANY_NE";
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
break;
case TEST_OP_GT:
s = "TEST_GT";
break;
case TEST_OP_GE:
s = "TEST_GE";
break;
case TEST_OP_LT:
s = "TEST_LT";
break;
case TEST_OP_LE:
s = "TEST_LE";
break;
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
case OP_BITWISE_AND:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_BITWISE_AND";
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
break;
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
case OP_UNARY_MINUS:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_UNARY_MINUS";
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
break;
dfilter: Add binary arithmetic (add/subtract) Add support for display filter binary addition and subtraction. The grammar is intentionally kept simple for now. The use case is to add a constant to a protocol field, or (maybe) add two fields in an expression. We use signed arithmetic with unsigned numbers, checking for overflow and casting where necessary to do the conversion. We could legitimately opt to use traditional modular arithmetic instead (like C) and if it turns out that that is more useful for some reason we may want to in the future. Fixes #15504.
2022-02-27 14:47:31 +00:00
case OP_ADD:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_ADD";
dfilter: Add binary arithmetic (add/subtract) Add support for display filter binary addition and subtraction. The grammar is intentionally kept simple for now. The use case is to add a constant to a protocol field, or (maybe) add two fields in an expression. We use signed arithmetic with unsigned numbers, checking for overflow and casting where necessary to do the conversion. We could legitimately opt to use traditional modular arithmetic instead (like C) and if it turns out that that is more useful for some reason we may want to in the future. Fixes #15504.
2022-02-27 14:47:31 +00:00
break;
case OP_SUBTRACT:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_SUBTRACT";
dfilter: Add binary arithmetic (add/subtract) Add support for display filter binary addition and subtraction. The grammar is intentionally kept simple for now. The use case is to add a constant to a protocol field, or (maybe) add two fields in an expression. We use signed arithmetic with unsigned numbers, checking for overflow and casting where necessary to do the conversion. We could legitimately opt to use traditional modular arithmetic instead (like C) and if it turns out that that is more useful for some reason we may want to in the future. Fixes #15504.
2022-02-27 14:47:31 +00:00
break;
dfilter: Add remaining arithmetic integer ops
2022-03-31 13:50:20 +00:00
case OP_MULTIPLY:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_MULTIPLY";
dfilter: Add remaining arithmetic integer ops
2022-03-31 13:50:20 +00:00
break;
case OP_DIVIDE:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_DIVIDE";
dfilter: Add remaining arithmetic integer ops
2022-03-31 13:50:20 +00:00
break;
case OP_MODULO:
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
s = "OP_MODULO";
dfilter: Add remaining arithmetic integer ops
2022-03-31 13:50:20 +00:00
break;
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
case TEST_OP_NOTZERO:
s = "TEST_NOTZERO";
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
break;
case TEST_OP_CONTAINS:
s = "TEST_CONTAINS";
break;
case TEST_OP_MATCHES:
s = "TEST_MATCHES";
break;
case TEST_OP_IN:
s = "TEST_IN";
break;
case TEST_OP_UNINITIALIZED:
s = "<uninitialized>";
break;
}
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
return s;
}
static char *
test_tostr(const void *value, gboolean pretty)
{
const test_t *test = value;
ws_assert_magic(test, TEST_MAGIC);
const char *s;
if (pretty)
s = test_todisplay(test->op);
else
s = test_todebug(test->op);
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
return g_strdup(s);
}
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
static int
num_operands(test_op_t op)
{
switch(op) {
case TEST_OP_UNINITIALIZED:
Fix Coverity CID 432, "Missing Break". svn path=/trunk/; revision=39564
2011-10-25 14:19:34 +00:00
break;
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
case TEST_OP_EXISTS:
case TEST_OP_NOT:
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
case TEST_OP_NOTZERO:
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
case OP_UNARY_MINUS:
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
return 1;
case TEST_OP_AND:
case TEST_OP_OR:
dfilter: Add an "all equal" operator To complete the set of equality operators add an "all equal" operator that matches a frame if all fields match the condition. The symbol chosen for "all_eq" is "===".
2021-12-13 01:06:01 +00:00
case TEST_OP_ALL_EQ:
dfilter: Fix "!=" relation to be free of contradictions Wireshark defines the relation of equality A == B as A any_eq B <=> An == Bn for at least one An, Bn. More accurately I think this is (formally) an equivalence relation, not true equality. Whichever definition for "==" we choose we must keep the definition of "!=" as !(A == B), otherwise it will lead to logical contradictions like (A == B) AND (A != B) being true. Fix the '!=' relation to match the definition of equality: A != B <=> !(A == B) <=> A all_ne B <=> An != Bn, for every n. This has been the recomended way to write "not equal" for a long time in the documentation, even to the point where != was deprecated, but it just wasn't implemented consistently in the language, which has understandably been a persistent source of confusion. Even a field that is normally well-behaved with "!=" like "ip.src" or "ip.dst" will produce unexpected results with encapsulations like IP-over-IP. The opcode ALL_NE could have been implemented in the compiler instead using NOT and ANY_EQ but I chose to implement it in bytecode. It just seemed more elegant and efficient but the difference was not very significant. Keep around "~=" for any_ne relation, in case someone depends on that, and because we don't have an operator for true equality: A strict_equal B <=> A all_eq B <=> !(A any_ne B). If there is only one value then any_ne and all_ne are the same comparison operation. Implementing this change did not require fixing any tests so it is unlikely the relation "~=" (any_ne) will be very useful. Note that the behaviour of the '<' (less than) comparison relation is a separate, more subtle issue. In the general case the definition of '<' that is used is only a partial order.
2021-10-18 20:07:06 +00:00
case TEST_OP_ANY_EQ:
case TEST_OP_ALL_NE:
case TEST_OP_ANY_NE:
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
case TEST_OP_GT:
case TEST_OP_GE:
case TEST_OP_LT:
case TEST_OP_LE:
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
case OP_BITWISE_AND:
dfilter: Add binary arithmetic (add/subtract) Add support for display filter binary addition and subtraction. The grammar is intentionally kept simple for now. The use case is to add a constant to a protocol field, or (maybe) add two fields in an expression. We use signed arithmetic with unsigned numbers, checking for overflow and casting where necessary to do the conversion. We could legitimately opt to use traditional modular arithmetic instead (like C) and if it turns out that that is more useful for some reason we may want to in the future. Fixes #15504.
2022-02-27 14:47:31 +00:00
case OP_ADD:
case OP_SUBTRACT:
dfilter: Add remaining arithmetic integer ops
2022-03-31 13:50:20 +00:00
case OP_MULTIPLY:
case OP_DIVIDE:
case OP_MODULO:
Add a "contains" operator for byte-strings, strings, and tvbuffs (protocols). The search uses a naive approach; more work is required to add a Boyer-Moore Search algorithm. svn path=/trunk/; revision=8280
2003-08-27 15:23:11 +00:00
case TEST_OP_CONTAINS:
From Olivier Biot New "matches" operater in display filter language. Uses PCRE. If a "matches" operator is found in a dfilter while libpcre has not been used to build the binary, then an exception is thrown after using dfilter_fail() to set an apporporiate error message. svn path=/trunk/; revision=9182
2003-12-06 16:35:20 +00:00
case TEST_OP_MATCHES:
dfilter: Add membership operator Added a new relational test: 'x in {a b c}'. The only LHS entity supported at this time is a field. The generated DFVM operations are equivalent to an OR'ed series of =='s, but with the redundant existence tests removed. Change-Id: Iddc89b81cf7ad6319aef1a2a94f93314cb721a8a Reviewed-on: https://code.wireshark.org/review/10246 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-08-19 03:03:41 +00:00
case TEST_OP_IN:
From Olivier Biot New "matches" operater in display filter language. Uses PCRE. If a "matches" operator is found in a dfilter while libpcre has not been used to build the binary, then an exception is thrown after using dfilter_fail() to set an apporporiate error message. svn path=/trunk/; revision=9182
2003-12-06 16:35:20 +00:00
return 2;
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
}
Remove some lingering uses of g_assert() Also replace some incorrect uses of g_assert_true(). g_assert_true -> g_assert -> ws_assert
2021-12-16 10:19:45 +00:00
ws_assert_not_reached();
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
return -1;
}
void
sttype_test_set1(stnode_t *node, test_op_t op, stnode_t *val1)
{
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
test_t *test = stnode_data(node);
dfilter: Fix ws_assert_magic() macro We need to use WS_DISABLE_DEBUG, not WS_DEBUG. Fixes 0e50979b3f45250ee1dacd5c826a281ad9a9c460. Rename some lingering assert_magic() references.
2021-10-06 11:21:59 +00:00
ws_assert_magic(test, TEST_MAGIC);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
Remove some lingering uses of g_assert() Also replace some incorrect uses of g_assert_true(). g_assert_true -> g_assert -> ws_assert
2021-12-16 10:19:45 +00:00
ws_assert(num_operands(op) == 1);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
test->op = op;
test->val1 = val1;
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
test->val2 = NULL;
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
}
void
sttype_test_set2(stnode_t *node, test_op_t op, stnode_t *val1, stnode_t *val2)
{
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
test_t *test = stnode_data(node);
dfilter: Fix ws_assert_magic() macro We need to use WS_DISABLE_DEBUG, not WS_DEBUG. Fixes 0e50979b3f45250ee1dacd5c826a281ad9a9c460. Rename some lingering assert_magic() references.
2021-10-06 11:21:59 +00:00
ws_assert_magic(test, TEST_MAGIC);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
Remove some lingering uses of g_assert() Also replace some incorrect uses of g_assert_true(). g_assert_true -> g_assert -> ws_assert
2021-12-16 10:19:45 +00:00
ws_assert(num_operands(op) == 2);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
test->op = op;
test->val1 = val1;
test->val2 = val2;
}
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
void
sttype_test_set1_args(stnode_t *node, stnode_t *val1)
{
test_t *test;
test = (test_t*)stnode_data(node);
ws_assert_magic(test, TEST_MAGIC);
Remove some lingering uses of g_assert() Also replace some incorrect uses of g_assert_true(). g_assert_true -> g_assert -> ws_assert
2021-12-16 10:19:45 +00:00
ws_assert(num_operands(test->op) == 1);
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
test->val1 = val1;
dfilter: Print syntax tree using dftest + format enhancements Add argument to dfilter_compile_real() to save syntax tree text representation. Use it with dftest to print syntax tree. Misc debug output format improvements.
2022-04-04 22:42:52 +00:00
test->val2 = NULL;
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
}
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
void
sttype_test_set2_args(stnode_t *node, stnode_t *val1, stnode_t *val2)
{
test_t *test;
Fix warnings svn path=/trunk/; revision=43046
2012-06-03 20:59:41 +00:00
test = (test_t*)stnode_data(node);
dfilter: Fix ws_assert_magic() macro We need to use WS_DISABLE_DEBUG, not WS_DEBUG. Fixes 0e50979b3f45250ee1dacd5c826a281ad9a9c460. Rename some lingering assert_magic() references.
2021-10-06 11:21:59 +00:00
ws_assert_magic(test, TEST_MAGIC);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
Remove some lingering uses of g_assert() Also replace some incorrect uses of g_assert_true(). g_assert_true -> g_assert -> ws_assert
2021-12-16 10:19:45 +00:00
ws_assert(num_operands(test->op) == 2);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
test->val1 = val1;
test->val2 = val2;
}
dfilter: Save lexical token value to syntax tree Use that for error messages, including any using test operators. This allows to always use the same name as the user. It avoids cases where the user write "a && b" and the message is "a and b" is syntactically invalid. It should also allow us to be more consistent with the use of double quotes.
2021-11-28 01:10:11 +00:00
void
sttype_test_set_op(stnode_t *node, test_op_t op)
{
test_t *test = stnode_data(node);
ws_assert_magic(test, TEST_MAGIC);
ws_assert(test->op == TEST_OP_UNINITIALIZED);
test->op = op;
}
dfilter: Pass a test_op_t in check_relation()
2021-10-21 08:03:51 +00:00
test_op_t
sttype_test_get_op(stnode_t *node)
{
ws_assert_magic(node, TEST_MAGIC);
return ((test_t *)node)->op;
}
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
void
sttype_test_get(stnode_t *node, test_op_t *p_op, stnode_t **p_val1, stnode_t **p_val2)
{
Remove some unnecessary casts. Casts are best avoided unless they are truly required. Fix some constness mismatches this revealed.
2021-10-26 12:53:06 +00:00
test_t *test = stnode_data(node);
dfilter: Fix ws_assert_magic() macro We need to use WS_DISABLE_DEBUG, not WS_DEBUG. Fixes 0e50979b3f45250ee1dacd5c826a281ad9a9c460. Rename some lingering assert_magic() references.
2021-10-06 11:21:59 +00:00
ws_assert_magic(test, TEST_MAGIC);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
Support multiple relation test without logic and (python-like) Like: a == b == c or a < b <= c <= d < e Real life example: 6660 <= tcp.port <= 6669 Just syntactic sugar, this is *NOT* optimized. svn path=/trunk/; revision=43353
2012-06-19 12:12:41 +00:00
if (p_op)
*p_op = test->op;
if (p_val1)
*p_val1 = test->val1;
if (p_val2)
*p_val2 = test->val2;
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
}
void
sttype_register_test(void)
{
static sttype_t test_type = {
STTYPE_TEST,
"TEST",
test_new,
test_free,
dfilter: Display syntax tree for debugging Use wslog to output debug information. Being able to control it at runtime is a big advantage. We extend the syntax tree nodes with a method to return a canonical string representation. Add a routine to walk the tree and return an textual representation for debugging purposes.
2021-09-26 15:28:39 +00:00
test_dup,
test_tostr
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
};
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
/* XXX Bitwise ops are not "tests". */
static sttype_t bitwise_type = {
STTYPE_BITWISE,
"BITWISE",
test_new,
test_free,
test_dup,
test_tostr
};
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
static sttype_t arithmetic_type = {
STTYPE_ARITHMETIC,
"ARITHMETIC",
test_new,
test_free,
test_dup,
test_tostr
};
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
sttype_register(&test_type);
dfilter: Add bitwise masking of bits Add support for masking of bits. Before the bitwise operator could only test bits, it did not support clearing bits. This allows testing if any combination of bits are set/unset more naturally with a single test. Previously this was only possible by combining several bitwise predicates. Bitwise is implemented as a test node, even though it is not. Maybe the test node should be renamed to something else. Fixes #17246.
2022-02-25 19:37:53 +00:00
sttype_register(&bitwise_type);
dfilter: Add support for unary arithmetic This change implements a unary minus operator. Filter: tcp.window_size_scalefactor == -tcp.dstport Instructions: 00000 READ_TREE tcp.window_size_scalefactor -> reg#0 00001 IF_FALSE_GOTO 6 00002 READ_TREE tcp.dstport -> reg#1 00003 IF_FALSE_GOTO 6 00004 MK_MINUS -reg#1 -> reg#2 00005 ANY_EQ reg#0 == reg#2 00006 RETURN It is supported for integer types, floats and relative time values. The unsigned integer types are promoted to a 32 bit signed integer. Unary plus is implemented as a no-op. The plus sign is simply ignored. Constant arithmetic expressions are computed during compilation. Overflow with constants is a compile time error. Overflow with variables is a run time error and silently ignored. Only a debug message will be printed to the console. Related to #15504.
2022-02-27 09:56:41 +00:00
sttype_register(&arithmetic_type);
Create a more modular type system for the FT_* types. Put them into epan/ftypes. Re-write display filter routines using Lemon parser instead of yacc. Besides using a different tool, the new grammar is much simpler, while the display filter engine itself is more powerful and more easily extended. Add dftest executable, to test display filter "bytecode" generation. Add option to "configure" to build dftest or randpkt, both of which are not built by default. Implement Ed Warnicke's ideas about dranges in the new display filter and ftype code. Remove type FT_TEXT_ONLY in favor of FT_NONE, and have protocols registered as FT_PROTOCOL. Thus, FT_NONE is used only for simple labels in the proto tree, while FT_PROTOCOL is used for protocols. This was necessary for being able to make byte slices (ranges) out of protocols, like "frame[0:3]" Win32 Makefile.nmake's will be added tonight. svn path=/trunk/; revision=2967
2001-02-01 20:21:25 +00:00
}
epan/dfilter/*.c: As needed: Add editor modelines & Fix indentation Change-Id: I410839329a98bd806c60961dfb9693d5eeeeb702 Reviewed-on: https://code.wireshark.org/review/7104 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-02-13 19:02:43 +00:00
/*
HTTPS (almost) everywhere. Change all wireshark.org URLs to use https. Fix some broken links while we're at it. Change-Id: I161bf8eeca43b8027605acea666032da86f5ea1c Reviewed-on: https://code.wireshark.org/review/34089 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-07-26 18:43:17 +00:00
* Editor modelines - https://www.wireshark.org/tools/modelines.html
epan/dfilter/*.c: As needed: Add editor modelines & Fix indentation Change-Id: I410839329a98bd806c60961dfb9693d5eeeeb702 Reviewed-on: https://code.wireshark.org/review/7104 Reviewed-by: Bill Meier <wmeier@newsguy.com>
2015-02-13 19:02:43 +00:00
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/