diff options
| author | João Valverde <j@v6e.pt> | 2023-01-02 01:42:55 +0000 |
|---|---|---|
| committer | João Valverde <j@v6e.pt> | 2023-01-02 02:54:38 +0000 |
| commit | f37c7c4062db513bd4dc6fffa36a0c90c74a4339 (patch) | |
| tree | ed985dcb6337e44dcb7d8d7cc275fc6af629d852 /epan/ftypes/ftype-protocol.c | |
| parent | c762d8492bea567241268d5bcbff64b8ded7596a (diff) | |
dfilter: Tweak representation for length-1 byte array
Make dfilter byte representation always use ':' for consistency.
Make 1 byte be represented as "XX:" with the colon suffix to
make it nonambiguous that is is a byte and not other type,
like a protocol.
The difference is can be seen in the following programs. In the
before representation it is not obvious at all that the second
"fc" value is a literal bytes value and not the value of the
protocol "fc", although it can be inferred from the lack of
a READ_TREE instruction. In the After we know that "fc:" must
be bytes and not a protocol.
Note that a leading colon is a syntactical expedient to say
"this value with any type is a literal value and not a protocol
field." A terminating colon is just a part of the dfilter
literal bytes syntax.
Before:
Filter: fc == :fc
Syntax tree:
0 TEST_ANY_EQ:
1 FIELD(fc <FT_PROTOCOL>)
1 FVALUE(fc <FT_PROTOCOL>)
Instructions:
00000 READ_TREE fc <FT_PROTOCOL> -> reg#0
00001 IF_FALSE_GOTO 3
00002 ANY_EQ reg#0 == fc <FT_PROTOCOL>
After:
Filter: fc == :fc
Syntax tree:
0 TEST_ANY_EQ:
1 FIELD(fc <FT_PROTOCOL>)
1 FVALUE(fc: <FT_PROTOCOL>)
Instructions:
00000 READ_TREE fc <FT_PROTOCOL> -> reg#0
00001 IF_FALSE_GOTO 3
00002 ANY_EQ reg#0 == fc: <FT_PROTOCOL>
Diffstat (limited to 'epan/ftypes/ftype-protocol.c')
| -rw-r--r-- | epan/ftypes/ftype-protocol.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/epan/ftypes/ftype-protocol.c b/epan/ftypes/ftype-protocol.c index 25571e3407..f1274066e1 100644 --- a/epan/ftypes/ftype-protocol.c +++ b/epan/ftypes/ftype-protocol.c @@ -169,7 +169,7 @@ val_from_charconst(fvalue_t *fv, unsigned long num, gchar **err_msg) } static char * -val_to_repr(wmem_allocator_t *scope, const fvalue_t *fv, ftrepr_t rtype _U_, int field_display _U_) +val_to_repr(wmem_allocator_t *scope, const fvalue_t *fv, ftrepr_t rtype, int field_display _U_) { guint length; char *volatile buf = NULL; @@ -183,8 +183,12 @@ val_to_repr(wmem_allocator_t *scope, const fvalue_t *fv, ftrepr_t rtype _U_, int else length = tvb_captured_length(fv->value.protocol.tvb); - if (length) - buf = bytes_to_str_punct_maxlen(scope, tvb_get_ptr(fv->value.protocol.tvb, 0, length), length, ':', 0); + if (length) { + if (rtype == FTREPR_DFILTER) + buf = bytes_to_dfilter_repr(scope, tvb_get_ptr(fv->value.protocol.tvb, 0, length), length); + else + buf = bytes_to_str_punct_maxlen(scope, tvb_get_ptr(fv->value.protocol.tvb, 0, length), length, ':', 0); + } } CATCH_ALL { /* nothing */ |