Wireshark · Wireshark-dev: [Wireshark-dev] [Patch] Allow FT_NONE item to be filtered from menu

[Martin Mathieson <martin.mathieson@xxxxxxxxxxxx>]

Hi,

This patch allows FT_NONE items to be built into filter expressions 
(i.e. testing for their presence or absence rather than comparing with a 
value) using the Apply|Prepare a Filter menus.  What drove me to add 
this was having to type in !tcp.analysis.out_of_order.

Does this seem reasonable?

Regards,
Martin

Index: epan/proto.c
===================================================================
--- epan/proto.c	(revision 18772)
+++ epan/proto.c	(working copy)
@@ -5109,6 +5109,13 @@
 			 * These all have values, so we can match.
 			 */
 			return TRUE;
+            
+		case FT_NONE:
+			/*
+			 * Doesn't have a value, but may still want to test for its
+			 * presence in a trace
+			 */
+			 return TRUE;
 
 		default:
 			/*
@@ -5286,9 +5293,12 @@
 			break;
 
 		case FT_PROTOCOL:
+		case FT_NONE:
+			/* Just want to test for the presence of these */
 			buf = ep_strdup(finfo->hfinfo->abbrev);
 			break;
 
+
 		default:
 			/*
 			 * This doesn't have a value, so we'd match