Filters

The display filters: the active list, parsing, matching, printing, and the machine's own addresses.

Generated by make docs from the source and GCC's call graph. Back to the Function explorer.

src/filters/filter_match.c

Whether the active filters show a packet

packet_ipv4

static const uint8_t *packet_ipv4(fpacket_t *p, int1 src)

src/filters/filter_match.c:13 · static · both builds

The packet's IPv4 source (src set) or destination: from the IPv4 header, or the sender / target IP of an ARP packet. NULL otherwise.

Called by: me_match, filter_match

packet_ipv6

static const uint8_t *packet_ipv6(fpacket_t *p, int1 src)

src/filters/filter_match.c:23 · static · both builds

The packet's IPv6 source (src set) or destination, NULL if it's not IPv6

Called by: me_match, filter_match

ip_match

static int ip_match(const uint8_t *ip, const uint8_t *want, int len)

src/filters/filter_match.c:31 · static · both builds

1 if the packet has an address (ip not NULL) and it's want (IP or MAC)

Called by: filter_match
Library and system calls: memcmp

port_match

static int port_match(fpacket_t *p, uint16_t port, int1 src)

src/filters/filter_match.c:36 · static · both builds

Called by: filter_match

me_match

static int me_match(filter_t *f, local_addr_t *local, fpacket_t *p, int1 src)

src/filters/filter_match.c:45 · static · both builds

'me' filters: 1 if the packet's source (src set) or destination is one of the machine's addresses, on the filter's interface

Called by: filter_match
Calls: packet_ipv4, packet_ipv6, local_find

proto_match

static int proto_match(fpacket_t *p, uint8_t proto)

src/filters/filter_match.c:60 · static · both builds

The IPv4 protocol, or on IPv6 the first next header or the one after the extensions (proto hopopt still finds the packets that have them)

Called by: filter_match

etype_match

static int etype_match(fpacket_t *p, uint16_t etype)

src/filters/filter_match.c:70 · static · both builds

etype 0 stands for every 802.3 frame (an LLC length, not a type)

Called by: filter_match

packet_mac

static const uint8_t *packet_mac(fpacket_t *p, int1 src)

src/filters/filter_match.c:78 · static · both builds

The Ethernet source (src set) or destination MAC, NULL without one

Called by: filter_match

packet_ttl

static int packet_ttl(fpacket_t *p)

src/filters/filter_match.c:86 · static · both builds

The IPv4 TTL or IPv6 hop limit, -1 if the packet is neither

Called by: ttl_match

ttl_match

static int ttl_match(fpacket_t *p, uint8_t ttl, int1 min)

src/filters/filter_match.c:96 · static · both builds

TTL bounds: packets with no TTL (ARP, non-IP) never match

Called by: filter_match
Calls: packet_ttl

ifname_match

static int ifname_match(fpacket_t *p, const char *ifname)

src/filters/filter_match.c:105 · static · both builds

Called by: filter_match
Library and system calls: strcmp

anomaly_match

static int anomaly_match(const anomalies_t *anom, fpacket_t *p, uint8_t kind)

src/filters/filter_match.c:111 · static · both builds

'anomaly' filter: the packet is part of an anomaly of that kind

Called by: filter_match
Calls: anomaly_packet_kinds

filter_match

static int filter_match(filter_t *f, local_addr_t *local, const anomalies_t *anom, fpacket_t *p)

src/filters/filter_match.c:119 · static · both builds

1 if this one filter matches the packet

Called by: filters_match
Calls: packet_ipv4, packet_ipv6, ip_match, port_match, me_match, proto_match, etype_match, packet_mac, ttl_match, ifname_match, anomaly_match

filters_match

int filters_match(filter_t *list, enum FILTER_MODE mode, local_addr_t *local, const anomalies_t *anom, fpacket_t *packet)

src/filters/filter_match.c:164 · non-static · both builds

src/filters/filter_match.c 1 if the list shows this packet: no active filter, or any filter matches it (FM_OR), or every filter matches it (FM_AND). local is the machine's own addresses, for the 'me' filters, anom the anomalies found, for the 'anomaly' filter. (from includes/filters.h)

Called by: reverse_queue_lookups, is_saved, display_packets
Calls: filter_match

src/filters/filter_parse.c

Filter names and values (addresses, ports, protocols, sizes...) as typed

filter_kind

enum FILTER_KIND filter_kind(enum FILTER_TYPE type)

src/filters/filter_parse.c:16 · non-static · both builds

Called by: filters_print_names, filter_parse_value, filter_print, put_filter, get_filter

filter_type_name

const char *filter_type_name(enum FILTER_TYPE type)

src/filters/filter_parse.c:41 · non-static · both builds

The name of a filter type as typed, e.g. "ipv4src" (from includes/filters.h)

Called by: filter_print

kind_label

static char *kind_label(enum FILTER_KIND kind)

src/filters/filter_parse.c:47 · static · both builds

"<ipv4>", "<port>"...: what a filter of this kind takes

Called by: filters_print_names

in_shortcut

static int in_shortcut(int type)

src/filters/filter_parse.c:73 · static · both builds

1 if type is the src or dest filter of a shortcut

Called by: filters_print_names

filters_print_names

void filters_print_names(int output_buffer)

src/filters/filter_parse.c:84 · non-static · both builds

"Available filters: ipv4src <ipv4>, ipv4dest <ipv4>, ipv4 <ipv4>, ..." (from includes/filters.h)

Called by: print_commands, filter_lookup
Calls: filter_kind, kind_label, in_shortcut, my_putstr

filter_lookup

int filter_lookup(const char *name, enum FILTER_TYPE types[2])

src/filters/filter_parse.c:112 · non-static · both builds

The filter types a name sets: one for *src / *dest, two (src and dest) for the ipv4 / ipv6 / port shortcuts. Returns how many, 0 if the name is unknown (printed on stderr). (from includes/filters.h)

Called by: filter_apply
Calls: filters_print_names, my_putstr
Library and system calls: strcmp

filter_parse_ipv4

int filter_parse_ipv4(const char *str, uint8_t ip[4])

src/filters/filter_parse.c:134 · non-static · both builds

src/filters/filter_parse.c Dotted IPv4 address, 4 numbers from 0 to 255. 0 on success, 1 if it's malformed. (from includes/filters.h)

Called by: filter_parse_value, parse_net

hex_value

static int hex_value(char c)

src/filters/filter_parse.c:156 · static · both builds

Called by: parse_groups, parse_etype, parse_mac

parse_groups

static int parse_groups(const char *str, int len, uint16_t *groups, int max)

src/filters/filter_parse.c:169 · static · both builds

"1:2:abcd" (len chars of str) into groups, at most max of them. Returns how many, 0 for an empty string, -1 if it's malformed.

Called by: filter_parse_ipv6
Calls: hex_value

filter_parse_ipv6

int filter_parse_ipv6(const char *str, uint8_t ip[16])

src/filters/filter_parse.c:193 · non-static · both builds

IPv6 address: 8 groups of 1 to 4 hex digits, or fewer around one "::" (the zero groups it stands for). 0 on success, 1 if it's malformed. (from includes/filters.h)

Called by: filter_parse_value, parse_net
Calls: parse_groups
Library and system calls: strlen, strstr

parse_ifname

static int parse_ifname(const char *str, char ifname[16])

src/filters/filter_parse.c:226 · static · both builds

An interface name ("all" for every interface): 1 to 15 printable characters, no space. It doesn't have to exist now: a loaded capture can name an interface this machine doesn't have. 0 on success, 1 if it's malformed.

Called by: filter_parse_value
Calls: my_strlen
Library and system calls: memcpy

lower

static char lower(char c)

src/filters/filter_parse.c:240 · static · both builds

Called by: proto_name_is

proto_name_is

static int proto_name_is(const char *str, const char *name)

src/filters/filter_parse.c:247 · static · both builds

1 if str is the protocol name (padded with spaces in proto_names[]), ignoring case and the padding

Called by: parse_proto, parse_etype
Calls: lower, my_strlen

parse_proto

static int parse_proto(const char *str, uint8_t *proto)

src/filters/filter_parse.c:264 · static · both builds

An IP protocol: a number from 0 to 255, a name from proto_names[] ("tcp", "udp", "icmp", "icm6"... any case), or "icmpv6". 0 on success, 1 if it's unknown.

Called by: filter_parse_value
Calls: proto_name_is

parse_etype

static int parse_etype(const char *str, uint16_t *etype)

src/filters/filter_parse.c:294 · static · both builds

An EtherType: a name ("arp", "ipv4", "ipv6", "lldp"... any case), "llc" for 802.3 frames (stored as 0), or a number, decimal or 0x hex, from 1501 to 0xFFFF (up to 1500 it's an 802.3 length, not a type). 0 on success, 1 if it's malformed.

Called by: filter_parse_value
Calls: ethertype_from_name, hex_value, proto_name_is

parse_mac

static int parse_mac(const char *str, uint8_t mac[6])

src/filters/filter_parse.c:327 · static · both builds

MAC address: 6 groups of 2 hex digits, separated by ':' or '-'. 0 on success, 1 if it's malformed.

Called by: filter_parse_value
Calls: hex_value

parse_anomaly

static int parse_anomaly(const char *str, uint8_t *kind)

src/filters/filter_parse.c:344 · static · both builds

An anomaly kind name ("scan", "flood"...) or "all". 0 on success, 1 if it's unknown.

Called by: filter_parse_value
Library and system calls: strcmp

parse_number

static int parse_number(const char *str, uint32_t max, uint32_t *value)

src/filters/filter_parse.c:360 · static · both builds

A decimal number from 0 to max. 0 on success, 1 if it's malformed.

Called by: filter_parse_value

parse_port

static int parse_port(const char *str, uint16_t *port)

src/filters/filter_parse.c:377 · static · both builds

Port number, 1 to 65535: every non-TCP/UDP packet has port 0. 0 on success, 1 if it's malformed.

Called by: filter_parse_value

filter_parse_value

int filter_parse_value(enum FILTER_TYPE type, const char *arg, filter_t *f)

src/filters/filter_parse.c:394 · non-static · both builds

Parses arg as the value of a filter of this type into f->value (zeroed first). 0 on success, 1 if it's invalid (printed on stderr). (from includes/filters.h)

Called by: filter_apply
Calls: filter_kind, filter_parse_ipv4, filter_parse_ipv6, parse_ifname, parse_proto, parse_etype, parse_mac, parse_anomaly, parse_number, parse_port, my_putstr
Library and system calls: memset, strchr

src/filters/filter_print.c

Printing the active filters

print_proto_value

static void print_proto_value(uint8_t proto, int output_buffer)

src/filters/filter_print.c:14 · static · both builds

"TCP", or the number when the protocol has no name

Called by: filter_print
Calls: my_putunbr, my_write

print_etype_value

static void print_etype_value(uint16_t etype, int output_buffer)

src/filters/filter_print.c:29 · static · both builds

"ARP", "LLC", or "0x88e1" when the EtherType has no name

Called by: filter_print
Calls: ethertype_name, my_putstr

filter_print

static void filter_print(filter_t *f, int output_buffer)

src/filters/filter_print.c:45 · static · both builds

"ipv4src 1.2.3.4", "proto TCP", "me all"...

Called by: filters_print, filters_print_numbered
Calls: print_ipv4_raw, print_ipv6_raw, print_mac, filter_kind, filter_type_name, print_proto_value, print_etype_value, my_putunbr, my_putstr

filters_print

void filters_print(filter_t *list, enum FILTER_MODE mode, int output_buffer)

src/filters/filter_print.c:85 · non-static · both builds

src/filters/filter_print.c "Active filters (OR): ipv4src 1.2.3.4, port 443" or "No active filter" (from includes/filters.h)

Called by: start_program, list_command, apply_typed_filters, filters_command, remove_command, mode_command
Calls: filter_print, my_putstr, my_write

filters_print_numbered

void filters_print_numbered(filter_t *list, int output_buffer)

src/filters/filter_print.c:101 · non-static · both builds

One active filter per line with its id (1, 2, 3...): "2 - port 443" (from includes/filters.h)

Called by: remove_command
Calls: filter_print, my_putunbr, my_putstr, my_write

src/filters/filters.c

The active filter list: toggles, additions and removals

same_filter

static int same_filter(const filter_t *a, const filter_t *b)

src/filters/filters.c:12 · static · both builds

Called by: filter_link
Library and system calls: memcmp

filter_link

static filter_t **filter_link(filter_t **list, const filter_t *f)

src/filters/filters.c:20 · static · both builds

The link (list head or a next field) pointing to the active filter equal to f, or to the terminating NULL when there is none

Called by: filter_active, filter_remove
Calls: same_filter

filter_unlink

static void filter_unlink(filter_t **link)

src/filters/filters.c:28 · static · both builds

Unlinks and frees the filter *link points to

Called by: filter_remove, filters_remove_at, filters_clear
Library and system calls: free

filter_active

static int filter_active(filter_t *list, const filter_t *f)

src/filters/filters.c:36 · static · both builds

Called by: filter_apply, filters_append
Calls: filter_link

filter_add

static int filter_add(filter_t **list, const filter_t *f)

src/filters/filters.c:42 · static · both builds

Appends a copy of f. 0 on success, 1 if the allocation fails.

Called by: filter_apply, filters_append
Calls: my_putstr
Library and system calls: malloc

filter_remove

static void filter_remove(filter_t **list, const filter_t *f)

src/filters/filters.c:58 · static · both builds

Called by: filter_apply
Calls: filter_link, filter_unlink

filter_apply

int filter_apply(filter_t **list, const char *name, const char *arg)

src/filters/filters.c:66 · non-static · both builds

src/filters/filters.c Toggles the filter(s) a name sets: a *src / *dest filter is added, or removed if it was active. A shortcut adds its src and dest filters, keeping the one already active, or removes both if both were active. 0 on success, 1 on an unknown name or a bad value (printed on stderr). (from includes/filters.h)

Called by: filters_apply_args
Calls: filter_lookup, filter_parse_value, filter_active, filter_add, filter_remove

filters_append

int filters_append(filter_t **list, const filter_t *f)

src/filters/filters.c:93 · non-static · both builds

Adds a copy of f (type and value already set) unless it's already active, without toggling. 0 on success, 1 if the allocation fails. (from includes/filters.h)

Called by: load_filters
Calls: filter_active, filter_add

filters_apply_args

int filters_apply_args(filter_t **list, filter_arg_t *args)

src/filters/filters.c:100 · non-static · both builds

filter_apply() on every typed filter. Returns how many were invalid. (from includes/filters.h)

Called by: netotter, apply_typed_filters, filters_command
Calls: filter_apply

filters_remove_at

int filters_remove_at(filter_t **list, int id)

src/filters/filters.c:109 · non-static · both builds

Removes the active filter with this id (as filters_print_numbered shows it). 0 on success, 1 if there is none. (from includes/filters.h)

Called by: remove_command
Calls: filter_unlink

filters_clear

int filters_clear(filter_t **list)

src/filters/filters.c:119 · non-static · both builds

Removes every active filter. Returns how many there were. (from includes/filters.h)

Called by: netotter_delete, clear_command
Calls: filter_unlink

src/filters/local.c

The machine's own addresses, for the 'me' filter

local_find

local_addr_t *local_find(local_addr_t *list, const char *ifname, int1 v6, const uint8_t *ip)

src/filters/local.c:15 · non-static · both builds

src/filters/local.c The own address ip (4 bytes, 16 with v6) in list, on interface ifname (any interface when it's NULL or FILTER_ALL_IFACES). NULL if it's not. (from includes/filters.h)

Called by: me_match, local_add, anomalies_packet
Library and system calls: memcmp, strcmp

local_add

int local_add(local_addr_t **list, const char *ifname, int1 v6, const uint8_t *ip, int1 saved)

src/filters/local.c:27 · non-static · both builds

Appends an own address unless that interface already has it (a live address stays live). 1 if it was added, 0 if not (known, or out of memory). (from includes/filters.h)

Called by: load_local
Calls: local_find
Library and system calls: malloc, memcpy, memset, strncpy

local_addrs_free

void local_addrs_free(local_addr_t *list)

src/filters/local.c:48 · non-static · both builds

Called by: netotter_delete
Library and system calls: free

local_refresh

void local_refresh(netotter_t *netotter, lib_common_t *os_lib, int1 force)

src/filters/local.c:58 · non-static · both builds

Adds the interfaces' current addresses to netotter->local when force is set or LOCAL_REFRESH_S seconds passed since the last time (from includes/local.h)

Called by: run_cli, run_interactive, netotter
Calls: local_sync_renames, local_addresses_refresh, local_addresses_refresh
Library and system calls: time

local_sync_renames

void local_sync_renames(netotter_t *netotter)

src/filters/local.c:69 · non-static · both builds

Adds a "me" renaming (analysis view) for each own address that never got one: whole-address matches, not saved in .nto files, never replacing the user's own renamings (from includes/local.h)

Called by: local_refresh, load_local
Calls: format_ip_text, rename_set_auto

local_print

void local_print(local_addr_t *list, int output_buffer)

src/filters/local.c:84 · non-static · both builds

'M': one line per own address, "wlan0 2a02:...", "(from the file)" for the ones a loaded capture brought (from includes/local.h)

Called by: process_keybind
Calls: print_ipv4_raw, print_ipv6_raw, my_putstr, my_strlen, my_write