Hi list,
As Ethereal 0.10.2 seems stable I decided to check in support for
bitwise AND in display filters I wrote some time ago, and a README
that documents how an operator has to be added to Ethereal.
Regarding the 'bitwise AND', you can write "&" or "bitwise_and" as
operator name. I however don't know if things like endianness may
cause issues so test carefully :)
Below you'll find a patch to the display filter expression dialog I
did NOT check in, as it will almost always show that bitwise_and can
be used on a given field because ftype_can_slice(ftype) &&
ftype_can_bitwise_and(FT_BYTES) is true for almost all field types
support slicing as FT_BYTES supports bitwise_and. A correct fix needs
to tackle the following:
a. Distinguish between the case when a slice is specified an the
normal case (functional)
b. Separate displayed expression name from dfilter expression name
(cosmetic)
Regards,
Olivier
Index: gtk/dfilter_expr_dlg.c
===================================================================
RCS file: /usr/local/cvsroot/ethereal/gtk/dfilter_expr_dlg.c,v
retrieving revision 1.51
diff -u -r1.51 dfilter_expr_dlg.c
--- gtk/dfilter_expr_dlg.c 12 Feb 2004 22:24:28 -0000 1.51
+++ gtk/dfilter_expr_dlg.c 27 Feb 2004 11:49:38 -0000
@@ -278,6 +278,9 @@
if (ftype_can_le(ftype) ||
(ftype_can_slice(ftype) && ftype_can_le(FT_BYTES)))
add_relation_list(relation_list, "<=");
+ if (ftype_can_bitwise_and(ftype) ||
+ (ftype_can_slice(ftype) && ftype_can_bitwise_and(FT_BYTES)))
+ add_relation_list(relation_list, "bitwise_and");
if (ftype_can_contains(ftype) ||
(ftype_can_slice(ftype) && ftype_can_contains(FT_BYTES)))
add_relation_list(relation_list, "contains");
@@ -891,6 +894,8 @@
can_compare = ftype_can_ge(ftype);
else if (strcmp(item_str, "<=") == 0)
can_compare = ftype_can_le(ftype);
+ else if ((strcmp(item_str, "&") == 0) || (strcmp(item_str,
"bitwise_and") == 0))
+ can_compare = ftype_can_bitwise_and(ftype);
else if (strcmp(item_str, "contains") == 0)
can_compare = ftype_can_contains(ftype);
else if (strcmp(item_str, "matches") == 0)