Fix filter valid/invalid test for multifield custom type

Check for "or" or "||" (also ignore whitespaces)
and check both arguments of this operator to be
fieldname (character check), then check whole filter is valid
for dfilter compiler.

Change-Id: I412b5dc1fca16fcd2b640aa74af81167300fd11e
Reviewed-on: https://code.wireshark.org/review/5848
Petri-Dish: Michal Labedzki <michal.labedzki@tieto.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Tested-by: Michal Labedzki <michal.labedzki@tieto.com>
Reviewed-by: Michal Labedzki <michal.labedzki@tieto.com>

4 files changed, 28 insertions, 3 deletions

diff --git a/ui/gtk/filter_dlg.c b/ui/gtk/filter_dlg.c
index ac08e6a240..6662bd8705 100644
--- a/ui/gtk/filter_dlg.c
+++ b/ui/gtk/filter_dlg.c
@@ -1347,6 +1347,28 @@ filter_te_syntax_check_cb(GtkWidget *w, gpointer user_data _U_)
         statusbar_pop_filter_msg();
     }
 
+    if (strval && g_object_get_data(G_OBJECT(w), E_FILT_MULTI_FIELD_NAME_ONLY_KEY)) {
+        gchar  **fields;
+        guint    i_field = 0;
+
+        fields = g_regex_split_simple(" *([^ ]+) *(?:(?:\\|\\|)|(?:or))? *",
+                strval, G_REGEX_ANCHORED, G_REGEX_MATCH_ANCHORED);
+
+        for (i_field =0; i_field < g_strv_length(fields); i_field += 1) {
+            if (fields[i_field] && *fields[i_field]) {
+                c = proto_check_field_name(fields[i_field]);
+                if (c != 0) {
+                    colorize_filter_te_as_invalid(w);
+                    if (use_statusbar)
+                        statusbar_push_filter_msg(" Invalid filter");
+                    g_strfreev(fields);
+                    return;
+                }
+            }
+        }
+        g_strfreev(fields);
+    }
+
     /* colorize filter string entry */
     if (g_object_get_data(G_OBJECT(w), E_FILT_FIELD_NAME_ONLY_KEY) &&
         strval && (c = proto_check_field_name(strval)) != 0)
diff --git a/ui/gtk/filter_dlg.h b/ui/gtk/filter_dlg.h
index 39e77e0597..40a781feeb 100644
--- a/ui/gtk/filter_dlg.h
+++ b/ui/gtk/filter_dlg.h
@@ -123,6 +123,9 @@ void filter_te_syntax_check_cb(GtkWidget *widget, gpointer user_data _U_);
 /** Only validate a single field entry. */
 #define E_FILT_FIELD_NAME_ONLY_KEY  "filter_field_name_only"
 
+/** Only validate a multi field entry. */
+#define E_FILT_MULTI_FIELD_NAME_ONLY_KEY  "filter_multi_field_name_only"
+
 /** Update statusbar when changing the filter entry. */
 #define E_FILT_FIELD_USE_STATUSBAR_KEY "filter_field_use_statusbar"
 
diff --git a/ui/gtk/packet_list.c b/ui/gtk/packet_list.c
index 0d996c6ad2..60305b9e6a 100644
--- a/ui/gtk/packet_list.c
+++ b/ui/gtk/packet_list.c
@@ -310,12 +310,12 @@ col_details_edit_dlg (gint col_id, GtkTreeViewColumn *col)
 			      "This string has the same syntax as a display filter string.");
 	field_te = gtk_entry_new();
 	ws_gtk_grid_attach_defaults(GTK_GRID(main_grid), field_te, 1, 2, 1, 1);
-	g_object_set_data (G_OBJECT(field_te), E_FILT_FIELD_NAME_ONLY_KEY, (gpointer)"");
+	g_object_set_data (G_OBJECT(field_te), E_FILT_MULTI_FIELD_NAME_ONLY_KEY, (gpointer)"");
 	g_signal_connect(field_te, "changed", G_CALLBACK(filter_te_syntax_check_cb), NULL);
 	g_signal_connect(field_te, "key-press-event", G_CALLBACK (filter_string_te_key_pressed_cb), NULL);
 	g_signal_connect(win, "key-press-event", G_CALLBACK (filter_parent_dlg_key_pressed_cb), NULL);
 	gtk_widget_set_tooltip_text(field_te,
-			      "Field name used when field type is \"Custom\". "
+			      "Field names used when field type is \"Custom\". "
 			      "This string has the same syntax as a display filter string.");
 
 	occurrence_lb = gtk_label_new("Occurrence:");
diff --git a/ui/gtk/prefs_column.c b/ui/gtk/prefs_column.c
index 474092a674..7e7018209f 100644
--- a/ui/gtk/prefs_column.c
+++ b/ui/gtk/prefs_column.c
@@ -271,7 +271,7 @@ column_prefs_show(GtkWidget *prefs_window) {
     gtk_widget_show(field_lb);
 
     field_te = gtk_entry_new();
-    g_object_set_data (G_OBJECT(field_te), E_FILT_FIELD_NAME_ONLY_KEY, (gpointer)"");
+    g_object_set_data (G_OBJECT(field_te), E_FILT_MULTI_FIELD_NAME_ONLY_KEY, (gpointer)"");
     g_signal_connect(field_te, "changed", G_CALLBACK(filter_te_syntax_check_cb), NULL);
 
     /* XXX: column_field_changed_cb will be called for every character entered in the entry box.      */