Wireshark · Ethereal-dev: [Ethereal-dev] tap-protocolinfo fustration...

[Jason House <jhouse@xxxxxxxxx>]

Ok, I tried to use tap-protocolinfo this morning...  It seems that each
time I go to use it after not using it for a while, I use it
incorrectly...

The format:
-z proto,colinfo,<filter>,<field>

What I did this morning:
-z proto,colinfo,ip,ip.len

I forgot about the implementation detail that the filter must include
the field... -z proto,colinfo,ip.len,ip.len

This isn't truly required in that there could be some other filter that
has registered the required field for caching... 

The question comes down to, should the user be trusted to take advantage
of this special case?  

Yes: tap-protocolinfo.c.diff (attached) will warn the user who leaves
out the field that they should ensure that it is supplied somewhere.

No: tap-protocolinfo.c.diff2 (attached) will automatically add the field
to the filter expression if the user did not include it in the filter
(or had no filter at all)...

Index: tap-protocolinfo.c
===================================================================
RCS file: /cvsroot/ethereal/tap-protocolinfo.c,v
retrieving revision 1.3
diff -u -r1.3 tap-protocolinfo.c
--- tap-protocolinfo.c	23 Apr 2003 08:20:01 -0000	1.3
+++ tap-protocolinfo.c	1 May 2003 15:49:39 -0000
@@ -100,11 +100,23 @@
 	rs=g_malloc(sizeof(pci_t));
 	rs->hf_index=hfi->id;
 	if((field-filter)>1){
-		rs->filter=g_malloc(field-filter);
-		strncpy(rs->filter,filter,(field-filter)-1);
-		rs->filter[(field-filter)-1]=0;
+		if (strstr(filter,field) != field){
+			rs->filter=g_malloc(field-filter);
+			strncpy(rs->filter,filter,(field-filter)-1);
+			rs->filter[(field-filter)-1]=0;
+		}
+		else{
+			/* create filter of '(filter)&&field' */
+			rs->filter=g_malloc( (field-filter)+strlen(field)+4 );
+			rs->filter[0] = '(';
+			strncpy(&rs->filter[1],filter,(field-filter)-1);
+			strncpy(&rs->filter[(field-filter)], ")&&", 3);
+			strncpy(&rs->filter[(filed-filter)+3], field, 1+strlen(field));
+		}
 	} else {
-		rs->filter=NULL;
+		rs->filter=g_malloc(strlen(field)+1);
+		strncpy(rs->filter,field,strlen(field));
+		rs->filter[strlen(field)]=0;
 	}
 
 	error_string=register_tap_listener("frame", rs, rs->filter, NULL, protocolinfo_packet, NULL);

Index: tap-protocolinfo.c
===================================================================
RCS file: /cvsroot/ethereal/tap-protocolinfo.c,v
retrieving revision 1.3
diff -u -r1.3 tap-protocolinfo.c
--- tap-protocolinfo.c	23 Apr 2003 08:20:01 -0000	1.3
+++ tap-protocolinfo.c	1 May 2003 15:14:21 -0000
@@ -99,6 +99,10 @@
 
 	rs=g_malloc(sizeof(pci_t));
 	rs->hf_index=hfi->id;
+	if (strstr(filter,field)==field){
+		fprintf(stderr, "tethereal: Warning proto,colinfo needs the field '%s' to occur in a filter.  "
+			"It did not occur in the filter you supplied...", field);
+	}
 	if((field-filter)>1){
 		rs->filter=g_malloc(field-filter);
 		strncpy(rs->filter,filter,(field-filter)-1);