![João Valverde](/assets/img/avatar_default.png)
This adds support for using the layers filter with field references. Before: $ dftest 'ip.src != ${ip.src#2}' dftest: invalid character in macro name After: $ dftest 'ip.src != ${ip.src#2}' Filter: ip.src != ${ip.src#2} Syntax tree: 0 TEST_ALL_NE: 1 FIELD(ip.src <FT_IPv4>) 1 REFERENCE(ip.src#[2:1] <FT_IPv4>) Instructions: 00000 READ_TREE ip.src <FT_IPv4> -> reg#0 00001 IF_FALSE_GOTO 5 00002 READ_REFERENCE_R ${ip.src <FT_IPv4>} #[2:1] -> reg#1 00003 IF_FALSE_GOTO 5 00004 ALL_NE reg#0 != reg#1 00005 RETURN This requires adding another level of complexity to references. When loading references we need to copy the 'proto_layer_num' and add the logic to filter on that. The "layer" sttype is removed and replace by a new field sttype with support for a range. This is a nice cleanup for the semantic check and general simplification. The grammar is better too with this design. Range sttype is renamed to slice for clarity.
43 lines
813 B
C
43 lines
813 B
C
/** @file
|
|
*
|
|
* Wireshark - Network traffic analyzer
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
* Copyright 2001 Gerald Combs
|
|
*
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
|
|
#ifndef STTYPE_SLICE_H
|
|
#define STTYPE_SLICE_H
|
|
|
|
#include "syntax-tree.h"
|
|
#include "drange.h"
|
|
|
|
|
|
stnode_t *
|
|
sttype_slice_entity(stnode_t *node);
|
|
|
|
drange_t *
|
|
sttype_slice_drange(stnode_t *node);
|
|
|
|
drange_t *
|
|
sttype_slice_drange_steal(stnode_t *node);
|
|
|
|
/* Set a range */
|
|
void
|
|
sttype_slice_set(stnode_t *node, stnode_t *field, GSList* drange_list);
|
|
|
|
void
|
|
sttype_slice_set1(stnode_t *node, stnode_t *field, drange_node *rn);
|
|
|
|
void
|
|
sttype_slice_set_drange(stnode_t *node, stnode_t *field, drange_t *dr);
|
|
|
|
/* Clear the 'drange' variable to remove responsibility for
|
|
* freeing it. */
|
|
void
|
|
sttype_slice_remove_drange(stnode_t *node);
|
|
|
|
#endif
|