dfilter: add string() function.

This function can convert non-string fields into strings. This allows the
user to apply string functions (like contains and matches) to non-string fields.

Examples:

string(frame.number) matches "[13579]$" => for odd frames
string(eth.dst) matches "aa\.bb\.cc\.dd\.ee\..." => to match a group of stations
string(snmp.name) matches "^1.2.3.4" => for all OIDs under a specific node

Change-Id: I18173f50ba5314ecdcd1e4b66c7e8ba5b44257ee
Reviewed-on: https://code.wireshark.org/review/31427
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>

1 files changed, 135 insertions, 4 deletions

diff --git a/epan/dfilter/dfunctions.c b/epan/dfilter/dfunctions.c
index 6f71c23d40..e8cfb33e26 100644
--- a/epan/dfilter/dfunctions.c
+++ b/epan/dfilter/dfunctions.c
@@ -99,6 +99,70 @@ df_func_count(GList* arg1list, GList *arg2junk _U_, GList **retval)
     return TRUE;
 }
 
+/* dfilter function: string() */
+static gboolean
+df_func_string(GList* arg1list, GList *arg2junk _U_, GList **retval)
+{
+    GList    *arg1 = arg1list;
+    fvalue_t *arg_fvalue;
+    fvalue_t *new_ft_string;
+    char     *s;
+
+    while (arg1) {
+        arg_fvalue = (fvalue_t *)arg1->data;
+        switch (fvalue_type_ftenum(arg_fvalue))
+        {
+        case FT_UINT8:
+        case FT_UINT16:
+        case FT_UINT24:
+        case FT_UINT32:
+        case FT_UINT40:
+        case FT_UINT48:
+        case FT_UINT56:
+        case FT_UINT64:
+        case FT_INT8:
+        case FT_INT16:
+        case FT_INT32:
+        case FT_INT40:
+        case FT_INT48:
+        case FT_INT56:
+        case FT_INT64:
+        case FT_IPv4:
+        case FT_IPv6:
+        case FT_FLOAT:
+        case FT_DOUBLE:
+        case FT_ETHER:
+        case FT_FRAMENUM:
+        case FT_AX25:
+        case FT_IPXNET:
+        case FT_GUID:
+        case FT_OID:
+        case FT_EUI64:
+        case FT_VINES:
+        case FT_REL_OID:
+        case FT_SYSTEM_ID:
+        case FT_FCWWN:
+        case FT_IEEE_11073_SFLOAT:
+        case FT_IEEE_11073_FLOAT:
+            s = fvalue_to_string_repr(NULL, arg_fvalue, FTREPR_DFILTER, BASE_NONE);
+            /* Ensure we have an allocated string here */
+            if (!s)
+                s = wmem_strdup(NULL, "");
+            break;
+        default:
+            return TRUE;
+        }
+
+        new_ft_string = fvalue_new(FT_STRING);
+        fvalue_set_string(new_ft_string, s);
+        wmem_free(NULL, s);
+        *retval = g_list_append(*retval, new_ft_string);
+
+        arg1 = arg1->next;
+    }
+
+    return TRUE;
+}
 
 /* For upper() and lower() checks that the parameter passed to
  * it is an FT_STRING */
@@ -174,13 +238,80 @@ ul_semcheck_field_param(dfwork_t *dfw, int param_num, stnode_t *st_node)
     }
 }
 
+static void
+ul_semcheck_string_param(dfwork_t *dfw, int param_num, stnode_t *st_node)
+{
+    sttype_id_t type;
+    ftenum_t    ftype;
+    header_field_info *hfinfo;
+    const char* msg = "To string conversion for this field is not supported";
+
+    type = stnode_type_id(st_node);
+
+    if (param_num == 0) {
+        switch(type) {
+            case STTYPE_FIELD:
+                hfinfo = (header_field_info *)stnode_data(st_node);
+                ftype = hfinfo->type;
+                switch (ftype)
+                {
+                case FT_UINT8:
+                case FT_UINT16:
+                case FT_UINT24:
+                case FT_UINT32:
+                case FT_UINT40:
+                case FT_UINT48:
+                case FT_UINT56:
+                case FT_UINT64:
+                case FT_INT8:
+                case FT_INT16:
+                case FT_INT32:
+                case FT_INT40:
+                case FT_INT48:
+                case FT_INT56:
+                case FT_INT64:
+                case FT_IPv4:
+                case FT_IPv6:
+                case FT_FLOAT:
+                case FT_DOUBLE:
+                case FT_ETHER:
+                case FT_FRAMENUM:
+                case FT_AX25:
+                case FT_IPXNET:
+                case FT_GUID:
+                case FT_OID:
+                case FT_EUI64:
+                case FT_VINES:
+                case FT_REL_OID:
+                case FT_SYSTEM_ID:
+                case FT_FCWWN:
+                case FT_IEEE_11073_SFLOAT:
+                case FT_IEEE_11073_FLOAT:
+                    break;
+                default:
+                    dfilter_fail(dfw, "%s", msg);
+                    THROW(TypeError);
+                    break;
+                }
+                break;
+            default:
+                dfilter_fail(dfw, "%s", msg);
+                THROW(TypeError);
+        }
+    }
+    else {
+        g_assert_not_reached();
+    }
+}
+
 /* The table of all display-filter functions */
 static df_func_def_t
 df_functions[] = {
-    { "lower", df_func_lower, FT_STRING, 1, 1, ul_semcheck_params },
-    { "upper", df_func_upper, FT_STRING, 1, 1, ul_semcheck_params },
-    { "len",   df_func_len,   FT_UINT32, 1, 1, ul_semcheck_len_params },
-    { "count", df_func_count, FT_UINT32, 1, 1, ul_semcheck_field_param },
+    { "lower",  df_func_lower,  FT_STRING, 1, 1, ul_semcheck_params },
+    { "upper",  df_func_upper,  FT_STRING, 1, 1, ul_semcheck_params },
+    { "len",    df_func_len,    FT_UINT32, 1, 1, ul_semcheck_len_params },
+    { "count",  df_func_count,  FT_UINT32, 1, 1, ul_semcheck_field_param },
+    { "string", df_func_string, FT_STRING, 1, 1, ul_semcheck_string_param },
     { NULL, NULL, FT_NONE, 0, 0, NULL }
 };