diff options
author | João Valverde <j@v6e.pt> | 2022-06-24 00:07:42 +0100 |
---|---|---|
committer | João Valverde <j@v6e.pt> | 2022-06-25 14:57:40 +0100 |
commit | aaff0d21aef1f4702b87c068900a8af48d9884b6 (patch) | |
tree | a9411eabe79b90470ba3b537f739c0196ea4108f /epan/dfilter/dfvm.h | |
parent | e9e6431d7b68e5ceacc41f3b3e1c8d290e55666b (diff) |
dfilter: Add layer support for references
This adds support for using the layers filter
with field references.
Before:
$ dftest 'ip.src != ${ip.src#2}'
dftest: invalid character in macro name
After:
$ dftest 'ip.src != ${ip.src#2}'
Filter: ip.src != ${ip.src#2}
Syntax tree:
0 TEST_ALL_NE:
1 FIELD(ip.src <FT_IPv4>)
1 REFERENCE(ip.src#[2:1] <FT_IPv4>)
Instructions:
00000 READ_TREE ip.src <FT_IPv4> -> reg#0
00001 IF_FALSE_GOTO 5
00002 READ_REFERENCE_R ${ip.src <FT_IPv4>} #[2:1] -> reg#1
00003 IF_FALSE_GOTO 5
00004 ALL_NE reg#0 != reg#1
00005 RETURN
This requires adding another level of complexity to references.
When loading references we need to copy the 'proto_layer_num'
and add the logic to filter on that.
The "layer" sttype is removed and replace by a new
field sttype with support for a range. This is a nice
cleanup for the semantic check and general simplification.
The grammar is better too with this design.
Range sttype is renamed to slice for clarity.
Diffstat (limited to 'epan/dfilter/dfvm.h')
-rw-r--r-- | epan/dfilter/dfvm.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/epan/dfilter/dfvm.h b/epan/dfilter/dfvm.h index 10fdff5d7d..7d7ba4edf4 100644 --- a/epan/dfilter/dfvm.h +++ b/epan/dfilter/dfvm.h @@ -56,6 +56,7 @@ typedef enum { READ_TREE, READ_TREE_R, READ_REFERENCE, + READ_REFERENCE_R, PUT_FVALUE, ALL_EQ, ANY_EQ, |