Add a "contains" operator for byte-strings, strings, and tvbuffs (protocols).

The search uses a naive approach; more work is required to add a
Boyer-Moore Search algorithm.

svn path=/trunk/; revision=8280

11 files changed, 259 insertions, 42 deletions

diff --git a/epan/ftypes/ftype-bytes.c b/epan/ftypes/ftype-bytes.c
index 25c2f445ec..e0e859fab7 100644
--- a/epan/ftypes/ftype-bytes.c
+++ b/epan/ftypes/ftype-bytes.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-bytes.c,v 1.16 2003/07/25 03:44:02 gram Exp $
+ * $Id: ftype-bytes.c,v 1.17 2003/08/27 15:23:05 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -28,6 +28,7 @@
 #include <string.h>
 #include <ctype.h>
 #include <epan/resolv.h>
+#include <epan/strutil.h>
 #include <epan/int-64bit.h>
 
 #define ETHER_LEN	6
@@ -129,7 +130,7 @@ is_byte_sep(guint8 c)
 }
 
 static gboolean
-val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+bytes_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	GByteArray	*bytes;
 	guint8		val;
@@ -226,7 +227,7 @@ val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 }
 
 static gboolean
-ether_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+ether_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value, LogFunc logfunc)
 {
 	guint8	*mac;
 
@@ -235,7 +236,18 @@ ether_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 	 * up as an Ethernet host name if it does, and if that fails,
 	 * we'll log a message.
 	 */
-	if (val_from_unparsed(fv, s, NULL)) {
+	if (bytes_from_unparsed(fv, s, TRUE, NULL)) {
+		if (fv->value.bytes->len > ETHER_LEN) {
+			logfunc("\"%s\" contains too many bytes to be a valid Ethernet address.",
+			    s);
+			return FALSE;
+		}
+		else if (fv->value.bytes->len < ETHER_LEN && !allow_partial_value) {
+			logfunc("\"%s\" contains too few bytes to be a valid Ethernet address.",
+			    s);
+			return FALSE;
+		}
+
 		return TRUE;
 	}
 
@@ -251,7 +263,7 @@ ether_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 }
 
 static gboolean
-ipv6_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+ipv6_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	guint8	buffer[16];
 
@@ -265,7 +277,7 @@ ipv6_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 }
 
 static gboolean
-u64_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+u64_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	guint8	buffer[8];
 
@@ -279,7 +291,7 @@ u64_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 }
 
 static gboolean
-i64_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+i64_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	guint8	buffer[8];
 
@@ -577,6 +589,20 @@ cmp_le_i64(fvalue_t *fv_a, fvalue_t *fv_b)
 	return (memcmp(a->data, b->data, a->len) <= 0);
 }
 
+static gboolean
+cmp_contains(fvalue_t *fv_a, fvalue_t *fv_b)
+{
+	GByteArray	*a = fv_a->value.bytes;
+	GByteArray	*b = fv_b->value.bytes;
+
+	if (epan_memmem(a->data, a->len, b->data, b->len)) {
+		return TRUE;
+	}
+	else {
+		return FALSE;
+	}
+}
+
 void
 ftype_register_bytes(void)
 {
@@ -587,7 +613,7 @@ ftype_register_bytes(void)
 		0,				/* wire_size */
 		bytes_fvalue_new,		/* new_value */
 		bytes_fvalue_free,		/* free_value */
-		val_from_unparsed,		/* val_from_unparsed */
+		bytes_from_unparsed,		/* val_from_unparsed */
 		NULL,				/* val_from_string */
 		bytes_to_repr,			/* val_to_string_repr */
 		bytes_repr_len,			/* len_string_repr */
@@ -606,6 +632,7 @@ ftype_register_bytes(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,
 
 		len,
 		slice,
@@ -617,7 +644,7 @@ ftype_register_bytes(void)
 		0,				/* wire_size */
 		bytes_fvalue_new,		/* new_value */
 		bytes_fvalue_free,		/* free_value */
-		val_from_unparsed,		/* val_from_unparsed */
+		bytes_from_unparsed,		/* val_from_unparsed */
 		NULL,				/* val_from_string */
 		bytes_to_repr,			/* val_to_string_repr */
 		bytes_repr_len,			/* len_string_repr */
@@ -636,6 +663,7 @@ ftype_register_bytes(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,
 
 		len,
 		slice,
@@ -666,6 +694,7 @@ ftype_register_bytes(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,
 
 		len,
 		slice,
@@ -696,6 +725,7 @@ ftype_register_bytes(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,
 
 		len,
 		slice,
@@ -726,6 +756,7 @@ ftype_register_bytes(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		NULL,				/* cmp_contains */
 
 		len,
 		slice,
@@ -756,6 +787,7 @@ ftype_register_bytes(void)
 		cmp_ge_i64,
 		cmp_lt_i64,
 		cmp_le_i64,
+		NULL,				/* cmp_contains */
 
 		len,
 		slice,
diff --git a/epan/ftypes/ftype-double.c b/epan/ftypes/ftype-double.c
index fb1bfcd36f..27fba9aaf4 100644
--- a/epan/ftypes/ftype-double.c
+++ b/epan/ftypes/ftype-double.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-double.c,v 1.10 2003/07/31 03:52:43 guy Exp $
+ * $Id: ftype-double.c,v 1.11 2003/08/27 15:23:06 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -51,7 +51,7 @@ value_get_floating(fvalue_t *fv)
 }
 
 static gboolean
-val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	char    *endptr = NULL;
 
@@ -181,6 +181,7 @@ ftype_register_double(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,
 		NULL,
@@ -211,6 +212,7 @@ ftype_register_double(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,
 		NULL,
diff --git a/epan/ftypes/ftype-integer.c b/epan/ftypes/ftype-integer.c
index 818b6cce7a..0bba4d218b 100644
--- a/epan/ftypes/ftype-integer.c
+++ b/epan/ftypes/ftype-integer.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-integer.c,v 1.14 2003/07/25 03:44:02 gram Exp $
+ * $Id: ftype-integer.c,v 1.15 2003/08/27 15:23:06 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -49,7 +49,7 @@ get_integer(fvalue_t *fv)
 }
 
 static gboolean
-val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	char    *endptr;
 
@@ -78,7 +78,7 @@ val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 }
 
 static gboolean
-ipxnet_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+ipxnet_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	guint32 	val;
 	gboolean	known;
@@ -88,7 +88,7 @@ ipxnet_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 	 * up as an IPX network name if it does, and if that fails,
 	 * we'll log a message.
 	 */
-	if (val_from_unparsed(fv, s, NULL)) {
+	if (val_from_unparsed(fv, s, TRUE, NULL)) {
 		return TRUE;
 	}
 
@@ -242,6 +242,7 @@ ftype_register_integers(void)
 		u_cmp_ge,
 		u_cmp_lt,
 		u_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -271,6 +272,7 @@ ftype_register_integers(void)
 		u_cmp_ge,
 		u_cmp_lt,
 		u_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -300,6 +302,7 @@ ftype_register_integers(void)
 		u_cmp_ge,
 		u_cmp_lt,
 		u_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -329,6 +332,7 @@ ftype_register_integers(void)
 		u_cmp_ge,
 		u_cmp_lt,
 		u_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -358,6 +362,7 @@ ftype_register_integers(void)
 		s_cmp_ge,
 		s_cmp_lt,
 		s_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -387,6 +392,7 @@ ftype_register_integers(void)
 		s_cmp_ge,
 		s_cmp_lt,
 		s_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -416,6 +422,7 @@ ftype_register_integers(void)
 		s_cmp_ge,
 		s_cmp_lt,
 		s_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -445,6 +452,7 @@ ftype_register_integers(void)
 		s_cmp_ge,
 		s_cmp_lt,
 		s_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -474,6 +482,7 @@ ftype_register_integers(void)
 		NULL,				/* cmp_ge */
 		NULL,				/* cmp_lt */
 		NULL,				/* cmp_le */
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -504,6 +513,7 @@ ftype_register_integers(void)
 		u_cmp_ge,
 		u_cmp_lt,
 		u_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
@@ -534,6 +544,7 @@ ftype_register_integers(void)
 		u_cmp_ge,
 		u_cmp_lt,
 		u_cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,				/* len */
 		NULL,				/* slice */
diff --git a/epan/ftypes/ftype-ipv4.c b/epan/ftypes/ftype-ipv4.c
index cad03ef251..c5362bfbca 100644
--- a/epan/ftypes/ftype-ipv4.c
+++ b/epan/ftypes/ftype-ipv4.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-ipv4.c,v 1.12 2003/07/31 04:18:01 guy Exp $
+ * $Id: ftype-ipv4.c,v 1.13 2003/08/27 15:23:07 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -45,7 +45,7 @@ value_get(fvalue_t *fv)
 }
 
 static gboolean
-val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	guint32	addr;
 	unsigned int nmask_bits;
@@ -99,7 +99,7 @@ val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
 		}
 
 		/* XXX - this is inefficient */
-		nmask_fvalue = fvalue_from_unparsed(FT_UINT32, net_str, logfunc);
+		nmask_fvalue = fvalue_from_unparsed(FT_UINT32, net_str, FALSE, logfunc);
 		g_free(s_copy);
 		if (!nmask_fvalue) {
 			return FALSE;
@@ -202,6 +202,7 @@ ftype_register_ipv4(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		NULL,				/* cmp_contains */
 
 		NULL,
 		NULL,
diff --git a/epan/ftypes/ftype-none.c b/epan/ftypes/ftype-none.c
index bf6cd400eb..46c1822a80 100644
--- a/epan/ftypes/ftype-none.c
+++ b/epan/ftypes/ftype-none.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-none.c,v 1.6 2003/07/25 03:44:03 gram Exp $
+ * $Id: ftype-none.c,v 1.7 2003/08/27 15:23:07 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@zing.org>
@@ -57,6 +57,7 @@ ftype_register_none(void)
 		NULL,
 		NULL,
 		NULL,
+		NULL,				/* cmp_contains */
 
 		NULL,
 		NULL,
diff --git a/epan/ftypes/ftype-string.c b/epan/ftypes/ftype-string.c
index 5cac0e7966..bb2c088ebe 100644
--- a/epan/ftypes/ftype-string.c
+++ b/epan/ftypes/ftype-string.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-string.c,v 1.12 2003/07/30 22:25:35 guy Exp $
+ * $Id: ftype-string.c,v 1.13 2003/08/27 15:23:07 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -117,6 +117,32 @@ val_from_string(fvalue_t *fv, char *s, LogFunc logfunc _U_)
 	return TRUE;
 }
 
+static gboolean
+val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
+{
+	fvalue_t *fv_bytes;
+	/* Does this look like a byte-string? */
+	fv_bytes = fvalue_from_unparsed(FT_BYTES, s, TRUE, NULL);
+	if (fv_bytes) {
+		/* Copy the bytes over to a string and terminate it
+		 * with a NUL. XXX - what if the user embeds a NUL
+		 * in the middle of the byte string? */
+		int num_bytes = fv_bytes->value.bytes->len;
+
+		fv->value.string = g_malloc(num_bytes + 1);
+		memcpy(fv->value.string, fv->value.bytes->data, num_bytes);
+		fv->value.string[num_bytes] = '\0';
+
+		fvalue_free(fv_bytes);
+		return TRUE;
+	}
+	else {
+		/* Just turn it into a string */
+		return val_from_string(fv, s, logfunc);
+	}
+	g_assert_not_reached();
+}
+
 static guint
 len(fvalue_t *fv)
 {
@@ -170,6 +196,25 @@ cmp_le(fvalue_t *a, fvalue_t *b)
 	return (strcmp(a->value.string, b->value.string) <= 0);
 }
 
+static gboolean
+cmp_contains(fvalue_t *fv_a, fvalue_t *fv_b)
+{
+	/* According to
+	* http://www.introl.com/introl-demo/Libraries/C/ANSI_C/string/strstr.html
+	* strstr() returns a non-NULL value if needle is an empty
+	* string. We don't that behavior for cmp_contains. */
+	if (strlen(fv_b->value.string) == 0) {
+		return FALSE;
+	}
+
+	if (strstr(fv_a->value.string, fv_b->value.string)) {
+		return TRUE;
+	}
+	else {
+		return FALSE;
+	}
+}
+
 void
 ftype_register_string(void)
 {
@@ -180,7 +225,7 @@ ftype_register_string(void)
 		0,				/* wire_size */
 		string_fvalue_new,		/* new_value */
 		string_fvalue_free,		/* free_value */
-		val_from_string,		/* val_from_unparsed */
+		val_from_unparsed,		/* val_from_unparsed */
 		val_from_string,		/* val_from_string */
 		string_to_repr,			/* val_to_string_repr */
 		string_repr_len,		/* len_string_repr */
@@ -199,6 +244,7 @@ ftype_register_string(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,			/* cmp_contains */
 
 		len,
 		slice,
@@ -209,7 +255,7 @@ ftype_register_string(void)
 		0,
 		string_fvalue_new,
 		string_fvalue_free,
-		val_from_string,		/* val_from_unparsed */
+		val_from_unparsed,		/* val_from_unparsed */
 		val_from_string,		/* val_from_string */
 		NULL,				/* val_to_string_repr */
 		NULL,				/* len_string_repr */
@@ -228,6 +274,7 @@ ftype_register_string(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,			/* cmp_contains */
 
 		len,
 		slice,
@@ -238,7 +285,7 @@ ftype_register_string(void)
 		0,
 		string_fvalue_new,
 		string_fvalue_free,
-		val_from_string,		/* val_from_unparsed */
+		val_from_unparsed,		/* val_from_unparsed */
 		val_from_string,		/* val_from_string */
 		NULL,				/* val_to_string_repr */
 		NULL,				/* len_string_repr */
@@ -257,6 +304,7 @@ ftype_register_string(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		cmp_contains,			/* cmp_contains */
 
 		len,
 		slice,
diff --git a/epan/ftypes/ftype-time.c b/epan/ftypes/ftype-time.c
index dd04fa6cb9..d926d30365 100644
--- a/epan/ftypes/ftype-time.c
+++ b/epan/ftypes/ftype-time.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-time.c,v 1.20 2003/07/30 22:50:39 guy Exp $
+ * $Id: ftype-time.c,v 1.21 2003/08/27 15:23:07 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -167,7 +167,7 @@ get_nsecs(char *startp, int *nsecs)
 }
 
 static gboolean
-relative_val_from_unparsed(fvalue_t *fv, char *s, LogFunc logfunc)
+relative_val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
 {
 	char    *curptr, *endptr;
 
@@ -277,6 +277,12 @@ fail:
 	return FALSE;
 }
 
+static gboolean
+absolute_val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
+{
+	return absolute_val_from_string(fv, s, logfunc);
+}
+
 static void
 time_fvalue_new(fvalue_t *fv)
 {
@@ -337,7 +343,7 @@ ftype_register_time(void)
 		0,
 		time_fvalue_new,
 		NULL,
-		absolute_val_from_string,	/* val_from_unparsed */
+		absolute_val_from_unparsed,	/* val_from_unparsed */
 		absolute_val_from_string,	/* val_from_string */
 		absolute_val_to_repr,		/* val_to_string_repr */
 		absolute_val_repr_len,		/* len_string_repr */
@@ -356,6 +362,8 @@ ftype_register_time(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		NULL,				/* cmp_contains */
+
 		NULL,
 		NULL
 	};
@@ -384,6 +392,8 @@ ftype_register_time(void)
 		cmp_ge,
 		cmp_lt,
 		cmp_le,
+		NULL,				/* cmp_contains */
+
 		NULL,
 		NULL
 	};
diff --git a/epan/ftypes/ftype-tvbuff.c b/epan/ftypes/ftype-tvbuff.c
index 43050f9f9f..c648086a3f 100644
--- a/epan/ftypes/ftype-tvbuff.c
+++ b/epan/ftypes/ftype-tvbuff.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftype-tvbuff.c,v 1.9 2003/07/25 03:44:03 gram Exp $
+ * $Id: ftype-tvbuff.c,v 1.10 2003/08/27 15:23:08 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -27,10 +27,21 @@
 #include <ftypes-int.h>
 #include <epan/gdebug.h>
 
+#define tvb_is_private	fvalue_gboolean1
+
 static void
 value_new(fvalue_t *fv)
 {
 	fv->value.tvb = NULL;
+	fv->tvb_is_private = FALSE;
+}
+
+static void
+value_free(fvalue_t *fv)
+{
+	if (fv->tvb_is_private) {
+		tvb_free_chain(fv->value.tvb);
+	}
 }
 
 
@@ -41,6 +52,66 @@ value_set(fvalue_t *fv, gpointer value, gboolean already_copied)
 	fv->value.tvb = value;
 }
 
+static void
+free_tvb_data(void *data)
+{
+	g_free(data);
+}
+
+
+static gboolean
+val_from_string(fvalue_t *fv, char *s, LogFunc logfunc _U_)
+{
+	tvbuff_t *new_tvb;
+	guint8 *private_data;
+
+	/* Make a tvbuff from the string. We can drop the
+	 * terminating NUL. */
+	private_data = g_memdup(s, strlen(s)); 
+	new_tvb = tvb_new_real_data(private_data, 
+			strlen(s), strlen(s));
+
+	/* Let the tvbuff know how to delete the data. */
+	tvb_set_free_cb(new_tvb, free_tvb_data);
+
+	/* And let us know that we need to free the tvbuff */
+	fv->tvb_is_private = TRUE;
+	fv->value.tvb = new_tvb;
+	return TRUE;
+}
+
+static gboolean
+val_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value _U_, LogFunc logfunc)
+{
+	fvalue_t *fv_bytes;
+	tvbuff_t *new_tvb;
+	guint8 *private_data;
+
+	/* Does this look like a byte string? */
+	fv_bytes = fvalue_from_unparsed(FT_BYTES, s, TRUE, NULL);
+	if (fv_bytes) {
+		/* Make a tvbuff from the bytes */
+		private_data = g_memdup(fv_bytes->value.bytes->data,
+				fv_bytes->value.bytes->len);
+		new_tvb = tvb_new_real_data(private_data, 
+				fv_bytes->value.bytes->len,
+				fv_bytes->value.bytes->len);
+
+		/* Let the tvbuff know how to delete the data. */
+		tvb_set_free_cb(new_tvb, free_tvb_data);
+
+		/* And let us know that we need to free the tvbuff */
+		fv->tvb_is_private = TRUE;
+		fv->value.tvb = new_tvb;
+		return TRUE;
+	}
+	else {
+		/* Treat it as a string. */
+		return val_from_string(fv, s, logfunc);
+	}
+	g_assert_not_reached();
+}
+
 static gpointer
 value_get(fvalue_t *fv)
 {
@@ -74,18 +145,29 @@ slice(fvalue_t *fv, GByteArray *bytes, guint offset, guint length)
 	}
 }
 
+static gboolean
+cmp_contains(fvalue_t *fv_a, fvalue_t *fv_b)
+{
+	if (tvb_find_tvb(fv_a->value.tvb, fv_b->value.tvb, 0) > -1) {
+		return TRUE;
+	}
+	else {
+		return FALSE;
+	}
+}
+
 void
 ftype_register_tvbuff(void)
 {
 
 	static ftype_t protocol_type = {
-		"FT_PROTOCOL",
-		"protocol",
-		0,
-		value_new,
-		NULL,
-		NULL,				/* val_from_unparsed */
-		NULL,				/* val_from_string */
+		"FT_PROTOCOL",			/* name */
+		"protocol",			/* pretty_name */
+		0,				/* wire_size */
+		value_new,			/* new_value */
+		value_free,			/* free_value */
+		val_from_unparsed,		/* val_from_unparsed */
+		val_from_string,		/* val_from_string */
 		NULL,				/* val_to_string_repr */
 		NULL,				/* len_string_repr */
 
@@ -103,6 +185,7 @@ ftype_register_tvbuff(void)
 		NULL,
 		NULL,
 		NULL,
+		cmp_contains,			/* cmp_contains */
 
 		len,
 		slice,
diff --git a/epan/ftypes/ftypes-int.h b/epan/ftypes/ftypes-int.h
index d6922ef7c9..2ba2e2fde3 100644
--- a/epan/ftypes/ftypes-int.h
+++ b/epan/ftypes/ftypes-int.h
@@ -1,5 +1,5 @@
 /*
- * $Id: ftypes-int.h,v 1.9 2003/07/25 03:44:03 gram Exp $
+ * $Id: ftypes-int.h,v 1.10 2003/08/27 15:23:08 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -29,7 +29,7 @@
 typedef void (*FvalueNewFunc)(fvalue_t*);
 typedef void (*FvalueFreeFunc)(fvalue_t*);
 
-typedef gboolean (*FvalueFromUnparsed)(fvalue_t*, char*, LogFunc);
+typedef gboolean (*FvalueFromUnparsed)(fvalue_t*, char*, gboolean, LogFunc);
 typedef gboolean (*FvalueFromString)(fvalue_t*, char*, LogFunc);
 typedef void (*FvalueToStringRepr)(fvalue_t*, ftrepr_t, char*);
 typedef int (*FvalueStringReprLen)(fvalue_t*, ftrepr_t);
@@ -74,6 +74,7 @@ struct _ftype_t {
 	FvalueCmp		cmp_ge;
 	FvalueCmp		cmp_lt;
 	FvalueCmp		cmp_le;
+	FvalueCmp		cmp_contains;
 
 	FvalueLen		len;
 	FvalueSlice		slice;
diff --git a/epan/ftypes/ftypes.c b/epan/ftypes/ftypes.c
index aa2239397f..58f4afda60 100644
--- a/epan/ftypes/ftypes.c
+++ b/epan/ftypes/ftypes.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ftypes.c,v 1.10 2003/07/25 03:44:03 gram Exp $
+ * $Id: ftypes.c,v 1.11 2003/08/27 15:23:08 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -198,6 +198,15 @@ ftype_can_le(enum ftenum ftype)
 	return ft->cmp_le ? TRUE : FALSE;
 }
 
+gboolean
+ftype_can_contains(enum ftenum ftype)
+{
+	ftype_t	*ft;
+
+	ft = ftype_lookup(ftype);
+	return ft->cmp_contains ? TRUE : FALSE;
+}
+
 /* ---------------------------------------------------------- */
 
 /* Allocate and initialize an fvalue_t, given an ftype */
@@ -236,13 +245,13 @@ fvalue_free(fvalue_t *fv)
 }
 
 fvalue_t*
-fvalue_from_unparsed(ftenum_t ftype, char *s, LogFunc logfunc)
+fvalue_from_unparsed(ftenum_t ftype, char *s, gboolean allow_partial_value, LogFunc logfunc)
 {
 	fvalue_t	*fv;
 
 	fv = fvalue_new(ftype);
 	if (fv->ftype->val_from_unparsed) {
-		if (fv->ftype->val_from_unparsed(fv, s, logfunc)) {
+		if (fv->ftype->val_from_unparsed(fv, s, allow_partial_value, logfunc)) {
 			return fv;
 		}
 	}
@@ -507,3 +516,11 @@ fvalue_le(fvalue_t *a, fvalue_t *b)
 	g_assert(a->ftype->cmp_le);
 	return a->ftype->cmp_le(a, b);
 }
+
+gboolean
+fvalue_contains(fvalue_t *a, fvalue_t *b)
+{
+	/* XXX - check compatibility of a and b */
+	g_assert(a->ftype->cmp_contains);
+	return a->ftype->cmp_contains(a, b);
+}
diff --git a/epan/ftypes/ftypes.h b/epan/ftypes/ftypes.h
index 1e224cbf53..74f4f2b705 100644
--- a/epan/ftypes/ftypes.h
+++ b/epan/ftypes/ftypes.h
@@ -1,7 +1,7 @@
 /* ftypes.h
  * Definitions for field types
  *
- * $Id: ftypes.h,v 1.18 2003/07/25 03:44:04 gram Exp $
+ * $Id: ftypes.h,v 1.19 2003/08/27 15:23:08 gram Exp $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -120,6 +120,9 @@ ftype_can_lt(enum ftenum ftype);
 gboolean
 ftype_can_le(enum ftenum ftype);
 
+gboolean
+ftype_can_contains(enum ftenum ftype);
+
 /* ---------------- FVALUE ----------------- */
 
 #include <epan/ipv4.h>
@@ -141,6 +144,11 @@ typedef struct {
 		nstime_t	time;
 		tvbuff_t	*tvb;
 	} value;
+
+	/* The following is provided for private use
+	 * by the fvalue. */
+	gboolean	fvalue_gboolean1;
+
 } fvalue_t;
 
 fvalue_t*
@@ -152,10 +160,10 @@ fvalue_free(fvalue_t *fv);
 typedef void (*LogFunc)(char*,...);
 
 fvalue_t*
-fvalue_from_unparsed(ftenum_t ftype, char *s, LogFunc log);
+fvalue_from_unparsed(ftenum_t ftype, char *s, gboolean allow_partial_value, LogFunc logfunc);
 
 fvalue_t*
-fvalue_from_string(ftenum_t ftype, char *s, LogFunc log);
+fvalue_from_string(ftenum_t ftype, char *s, LogFunc logfunc);
 
 /* Returns the length of the string required to hold the
  * string representation of the the field value.
@@ -213,6 +221,9 @@ fvalue_lt(fvalue_t *a, fvalue_t *b);
 gboolean
 fvalue_le(fvalue_t *a, fvalue_t *b);
 
+gboolean
+fvalue_contains(fvalue_t *a, fvalue_t *b);
+
 guint
 fvalue_length(fvalue_t *fv);