wireshark/epan/dfilter/sttype-pointer.c

163 lines
3.1 KiB
C
Raw Normal View History

/*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 2001 Gerald Combs
*
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "config.h"
#include "ftypes/ftypes.h"
#include "syntax-tree.h"
#include <epan/proto.h> // For BASE_NONE
static void
sttype_fvalue_free(gpointer value)
{
fvalue_t *fvalue = value;
/* If the data was not claimed with stnode_steal_data(), free it. */
if (fvalue) {
fvalue_free(fvalue);
}
}
static void
pcre_free(gpointer value)
{
2021-11-12 15:55:14 +00:00
ws_regex_t *pcre = value;
/* If the data was not claimed with stnode_steal_data(), free it. */
if (pcre) {
2021-11-12 15:55:14 +00:00
ws_regex_free(pcre);
}
}
static char *
sttype_fvalue_tostr(const void *data, gboolean pretty)
{
const fvalue_t *fvalue = data;
char *s, *repr;
s = fvalue_to_string_repr(NULL, fvalue, FTREPR_DFILTER, BASE_NONE);
if (pretty)
repr = g_strdup(s);
else
repr = ws_strdup_printf("%s[%s]", fvalue_type_name(fvalue), s);
g_free(s);
return repr;
}
static char *
field_tostr(const void *data, gboolean pretty _U_)
{
const header_field_info *hfinfo = data;
return g_strdup(hfinfo->abbrev);
}
static char *
2021-11-12 10:11:25 +00:00
pcre_tostr(const void *data, gboolean pretty _U_)
{
2021-11-12 15:55:14 +00:00
return g_strdup(ws_regex_pattern(data));
}
static char *
charconst_tostr(const void *data, gboolean pretty _U_)
{
unsigned long num = *(const unsigned long *)data;
if (num > 0x7f)
goto out;
switch (num) {
case 0: return g_strdup("'\\0'");
case '\a': return g_strdup("'\\a'");
case '\b': return g_strdup("'\\b'");
case '\f': return g_strdup("'\\f'");
case '\n': return g_strdup("'\\n'");
case '\r': return g_strdup("'\\r'");
case '\t': return g_strdup("'\\t'");
case '\v': return g_strdup("'\\v'");
case '\'': return g_strdup("'\\''");
case '\\': return g_strdup("'\\\\'");
default:
break;
}
if (g_ascii_isprint(num))
return ws_strdup_printf("'%c'", (int)num);
out:
return ws_strdup_printf("'\\x%02lx'", num);
}
void
sttype_register_pointer(void)
{
static sttype_t field_type = {
STTYPE_FIELD,
"FIELD",
NULL,
NULL,
NULL,
field_tostr
};
dfilter: Refactor macro tree references This replaces the current macro reference system with a completely different implementation. Instead of a macro a reference is a syntax element. A reference is a constant that can be filled in the dfilter code after compilation from an existing protocol tree. It is best understood as a field value that can be read from a fixed tree that is not the frame being filtered. Usually this fixed tree is the currently selected frame when the filter is applied. This allows comparing fields in the filtered frame with fields in the selected frame. Because the field reference syntax uses the same sigil notation as a macro we have to use a heuristic to distinguish them: if the name has a dot it is a field reference, otherwise it is a macro name. The reference is synctatically validated at compile time. There are two main advantages to this implementation (and a couple of minor ones): The protocol tree for each selected frame is only walked if we have a display filter and if the display filter uses references. Also only the actual reference values are copied, intead of loading the entire tree into a hash table (in textual form even). The other advantage is that the reference is tested like a protocol field against all the values in the selected frame (if there is more than one). Currently the reference fields are not "primed" during dissection, so the entire tree is walked to find a particular reference (this is similar to the previous implementation). If the display filter contains a valid reference and the reference is not loaded at the time the filter is run the result is the same as a non existing field for a regular READ_TREE instruction. Fixes #17599.
2022-03-27 14:26:46 +00:00
/* A field reference is a *constant* prototocol field value read directly
* from the currently selected frame in the protocol tree when a filter is
* applied to it. */
static sttype_t reference_type = {
STTYPE_REFERENCE,
"REFERENCE",
NULL,
NULL,
NULL,
field_tostr
};
static sttype_t fvalue_type = {
STTYPE_FVALUE,
"FVALUE",
NULL,
sttype_fvalue_free,
NULL,
sttype_fvalue_tostr
};
static sttype_t pcre_type = {
STTYPE_PCRE,
"PCRE",
NULL,
pcre_free,
NULL,
pcre_tostr
};
static sttype_t charconst_type = {
STTYPE_CHARCONST,
"CHARCONST",
NULL,
g_free,
NULL,
charconst_tostr
};
sttype_register(&field_type);
dfilter: Refactor macro tree references This replaces the current macro reference system with a completely different implementation. Instead of a macro a reference is a syntax element. A reference is a constant that can be filled in the dfilter code after compilation from an existing protocol tree. It is best understood as a field value that can be read from a fixed tree that is not the frame being filtered. Usually this fixed tree is the currently selected frame when the filter is applied. This allows comparing fields in the filtered frame with fields in the selected frame. Because the field reference syntax uses the same sigil notation as a macro we have to use a heuristic to distinguish them: if the name has a dot it is a field reference, otherwise it is a macro name. The reference is synctatically validated at compile time. There are two main advantages to this implementation (and a couple of minor ones): The protocol tree for each selected frame is only walked if we have a display filter and if the display filter uses references. Also only the actual reference values are copied, intead of loading the entire tree into a hash table (in textual form even). The other advantage is that the reference is tested like a protocol field against all the values in the selected frame (if there is more than one). Currently the reference fields are not "primed" during dissection, so the entire tree is walked to find a particular reference (this is similar to the previous implementation). If the display filter contains a valid reference and the reference is not loaded at the time the filter is run the result is the same as a non existing field for a regular READ_TREE instruction. Fixes #17599.
2022-03-27 14:26:46 +00:00
sttype_register(&reference_type);
sttype_register(&fvalue_type);
sttype_register(&pcre_type);
sttype_register(&charconst_type);
}
/*
* Editor modelines - https://www.wireshark.org/tools/modelines.html
*
* Local variables:
* c-basic-offset: 8
* tab-width: 8
* indent-tabs-mode: t
* End:
*
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
* :indentSize=8:tabSize=8:noTabs=false:
*/