aaff0d21ae
This adds support for using the layers filter
with field references.
Before:
$ dftest 'ip.src != ${ip.src#2}'
dftest: invalid character in macro name
After:
$ dftest 'ip.src != ${ip.src#2}'
Filter: ip.src != ${ip.src#2}
Syntax tree:
0 TEST_ALL_NE:
1 FIELD(ip.src <FT_IPv4>)
1 REFERENCE(ip.src#[2:1] <FT_IPv4>)
Instructions:
00000 READ_TREE ip.src <FT_IPv4> -> reg#0
00001 IF_FALSE_GOTO 5
00002 READ_REFERENCE_R ${ip.src <FT_IPv4>} #[2:1] -> reg#1
00003 IF_FALSE_GOTO 5
00004 ALL_NE reg#0 != reg#1
00005 RETURN
This requires adding another level of complexity to references.
When loading references we need to copy the 'proto_layer_num'
and add the logic to filter on that.
The "layer" sttype is removed and replace by a new
field sttype with support for a range. This is a nice
cleanup for the semantic check and general simplification.
The grammar is better too with this design.
Range sttype is renamed to slice for clarity.
43 lines
813 B
C
43 lines
813 B
C
/** @file
|
|
*
|
|
* Wireshark - Network traffic analyzer
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
* Copyright 2001 Gerald Combs
|
|
*
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
|
|
#ifndef STTYPE_SLICE_H
|
|
#define STTYPE_SLICE_H
|
|
|
|
#include "syntax-tree.h"
|
|
#include "drange.h"
|
|
|
|
|
|
stnode_t *
|
|
sttype_slice_entity(stnode_t *node);
|
|
|
|
drange_t *
|
|
sttype_slice_drange(stnode_t *node);
|
|
|
|
drange_t *
|
|
sttype_slice_drange_steal(stnode_t *node);
|
|
|
|
/* Set a range */
|
|
void
|
|
sttype_slice_set(stnode_t *node, stnode_t *field, GSList* drange_list);
|
|
|
|
void
|
|
sttype_slice_set1(stnode_t *node, stnode_t *field, drange_node *rn);
|
|
|
|
void
|
|
sttype_slice_set_drange(stnode_t *node, stnode_t *field, drange_t *dr);
|
|
|
|
/* Clear the 'drange' variable to remove responsibility for
|
|
* freeing it. */
|
|
void
|
|
sttype_slice_remove_drange(stnode_t *node);
|
|
|
|
#endif
|