filter: Functions for filtering data


Enumerations

enum  P_FILTER {
  FILTER_TYPE_LOCATION = 0x001, FILTER_TYPE_ID = 0x002, FILTER_TYPE_ACL = 0x004, FILTER_TYPE_ACL_POSITION = 0x008,
  FILTER_TYPE_FILTER = 0x010, FILTER_TYPE_MASK = 0x0ff, FILTER_CONCAT_AND = 0x0100, FILTER_CONCAT_OR = 0x0200,
  FILTER_CONCAT_MASK = 0x0300, FILTER_MODE_WILDCARD = 0x400, FILTER_MODE_NOT = 0x800000
}

Functions

int p_filter_create (const char *filter_name)
 Create a new filter.
int p_filter_destroy (int filter)
 Destroy a filter.
int p_filter_add (int filter, int type, const void *arg)
 Adds a new condition to a filter.
int p_filter_add_str (int filter, const char *char_type, const char *char_arg)
 Adds a new condition to a filter, takes strings as arguments.
int p_filter_apply (int filter, struct p_packet *packet)
 Applies a filter onto a packet.
void p_describe_filter (int filter)
 Prints out all information about a filter.
void * p_filter_arg (int filter)
 Get a pointer for a filter.

Enumeration Type Documentation

enum P_FILTER

Filter type

Enumerator:
FILTER_TYPE_LOCATION  location filteras argument
FILTER_TYPE_ID  id filteras argument
FILTER_TYPE_ACL  acl filteras argument
FILTER_TYPE_ACL_POSITION  acl filter with fixed position
FILTER_TYPE_FILTER  another filter as argument
FILTER_TYPE_MASK  filter mask
FILTER_CONCAT_AND  and concatenated
FILTER_CONCAT_OR  or concatenated
FILTER_CONCAT_MASK  concatenation mask
FILTER_MODE_WILDCARD  filter argument contains wildcard
FILTER_MODE_NOT  filter argument inverted

Definition at line 50 of file filter_enum.h.


Function Documentation

void p_describe_filter ( int  filter  ) 

Prints out all information about a filter.

Debug function, which prints out all internal information of filter to stdout.

Parameters:
filter Filter that should be described

int p_filter_add ( int  filter,
int  type,
const void *  arg 
)

Adds a new condition to a filter.

We have three types of conditions, which can be filtered: The sender-ID of a packet (FILTER_TYPE_ID), the location, where the sending particle is located (FILTER_TYPE_LOCATION) and the type of the ACL-tuples, which are inside a packet (FILTER_TYPE_ACL).

The use of FILTER_TYPE_ID and FILTER_TYPE_LOCATION is very similar, so I will only show some examples for FILTER_TYPE_ID. The simplest way to add a filter for an ID is to initialize an 8 byte long field with the ID and then adding this ID to the filter.

 uint8_t id[8] = { 1, 1, 1, 1, 129, 150, 24, 27 };
 p_filter_add(filter_nr, FILTER_TYPE_ID|FILTER_CONCAT_AND, id);

As you also can negate a filter, the following filter will return exactly the packets, the last one has not returned:

 uint8_t id[8] = { 1, 1, 1, 1, 129, 150, 24, 27 };
 p_filter_add(filter_nr, FILTER_TYPE_ID|FILTER_CONCAT_AND|FLTER_MODE_NOT, id);

Another feature is filtering with wildcards. There are two possible wildcard-operators: ? and *. If you just want to use a wildcard for one (or more) single bytes of the ID, you should use ?. A filter_add-operation for such a wildcard would look like this:

 p_filter_add(filter_nr, FILTER_TYPE_ID|FILTER_CONCAT_AND|FLTER_MODE_WILDCARD, "1.1.1.1.129.150.24.?");
This filter will return all packets with IDs between 1.1.1.1.129.150.24.0 and 1.1.1.1.129.150.24.255. Of course, you can use the ?-operator on every byte you want, not only the last one.

If you are interested in packet-IDs with a special prefix, you can also use *. The following filter will return exactly the same packets as the last one:

 p_filter_add(filter_nr, FILTER_TYPE_ID|FILTER_CONCAT_AND|FLTER_MODE_WILDCARD, "1.1.1.1.129.150.24.*");
You can use the *-operand for more than only one byte, for example, "1.1.1.1.*" would also be possible. But - as a difference to the ?-operator, which only stands for a single byte, you can not continue the searchstring after the *. A condition like "1.1.1.1.*.3.3.3.3" would not be legal. NOTE: As you already saw, the third argument of p_filter_add is not longer an already initialized filed as before, you must directly type in the search string.

As already said, filtering for locations goes exactly the same way as for IDs, you just have to take FILTER_TYPE_LOCATION instead of FILTER_TYPE_ID and you have to change the length of the conditions from 8 byte to 44 byte.

The third possibility is to filter by the ACL-types a packet contains. The following code would add a filter for the ACL-type ACM:

 uint8_t acl[8] = { 165,  14};
 p_filter_add(filter_nr, FILTER_TYPE_ACL|FILTER_CONCAT_AND, acl);
p_filter_add expects the 2to3-encoded version of the ACL-type.

If you want to put in a 3-byte ACL-string, you can use p_util_str2acl:

It's not possible to filter ACL-types with wildcards. Of cause, FILTER_TYPE_NOT is possible for FILTER_TYPE_ACL.

Of cause, you can add more than one condition to a filter, you must just use p_filter_add for several times.

Each filter condition can be contacted with a logical AND (FILTER_CONCAT_AND) or a logical OR (FILTER_CONCAT_OR) to the existing filter. The AND-operator is binding stronger than OR.

PLEASE NOTE: The first condition which is added to a filter must be conceded by AND. As every filter is initialized with "TRUE", concating the first condition with OR would result in "TRUE OR condition" which is always TRUE. Cause of this, p_filter_add will return -1, if the first condition is added with OR!

p_filter_add can also combine 2 existing filters by using FILTER_TYPE_FILTER. In this case, the 3rd argument of p_filter_add must be p_filter_arg(filter_xy) with filter_xy as the filter, which will be added to the filter in the first argument of p_filter_add.

The added filter (in this example, filter_nr2) will be destroyed while adding it into the first filter. If you try to free filter_nr2 after adding it into filter_nr, it will result in an error!

Parameters:
filter pointer to the filter, to which the new condition should be added
type a combination of the FILTER_ Constants.
arg the argument for the given FILTER_ type.
Returns:
0 on success, -1 on error

int p_filter_add_str ( int  filter,
const char *  char_type,
const char *  char_arg 
)

Adds a new condition to a filter, takes strings as arguments.

p_filter_add_str adds a new condition to a filter and takes strings as arguments.

The type argument indicates how the arg argument should be interpreted and added to the filter chain.

It must conform to the following Format:

   TYPE.CONCAT.[NOT].[WILDCARD]

   where TYPE is one of ID, LOC or ACL
   and CONCAT is AND or OR

NOT and WILDCARD are optional.

I is neccessary to hold this arguments in the given sequence. For example, OR.ACL.NOT is not allowed, it must be ACL.OR.NOT

The "arg" string holds the data you want to add to the filter.

Examples:

  int filter = p_filter_create("filter");
  p_filter_add_str( filter, "ID.AND.NOT", "1.2.3.4.5.6.7.8" );
This filter matches all packets not having the srcid 1.2.3.4.5.6.7 .

For detailed instructions on filter conditions, see documentation of p_filter_add

Parameters:
filter pointer to the filter, to which the new condition should be added
char_type the type of filter.
char_arg the argument for the filter condition.
See also:
p_filter_add

int p_filter_apply ( int  filter,
struct p_packet *  packet 
)

Applies a filter onto a packet.

Parameters:
filter Filter that should be applied
packet CL-packet that should be tested
Returns:
1 if the filter applies to the packet, otherwise 0; -1 on error.

void* p_filter_arg ( int  filter  ) 

Get a pointer for a filter.

Little util that is only needed when adding one filter into another.

Parameters:
filter Filter, for which the pointer should be get
See also:
: p_filter_add

int p_filter_create ( const char *  filter_name  ) 

Create a new filter.

Creates a new Filter. The filter will be initialized with "AND 1", so it will return true for every packet until no other conditions have been added.

Parameters:
filter_name Name of the new filter, only used by the p_filter_describe() function.
Returns:
Pointer to the new filter on success, -1 on error

int p_filter_destroy ( int  filter  ) 

Destroy a filter.

Destroys a filter and frees memory allocated for internal structures.

Parameters:
filter Pointer to the filter
Returns:
0 on success, -1 on error
See also:
p_filter_add, p_filter_add_str, p_filter_destroy


Generated on Tue Apr 10 15:22:26 2007 for libparticle by  doxygen 1.5.1