dfilter: add range support to set membership operator ("f in {x .. y}")

Allow "tcp.srcport in {1662 1663 1664}" to be abbreviated to
"tcp.srcport in {1662 .. 1664}". The range operator is supported for any
field value which supports the "<=" and "=>" operators and thus works
for integers, IP addresses, etc.

The naive mapping "tcp.srcport >= 1662 and tcp.srcport <= 1664" is not
used because it does not have the intended effect with fields that have
multiple occurrences (e.g. tcp.port). Each condition could be satisfied
by an other value. Therefore a new DVFM instruction (ANY_IN_RANGE) is
added to test the range condition against each individual field value.

Bug: 14180
Change-Id: I53c2d0f9bc9d4f0ffaabde9a83442122965c95f7
Reviewed-on: https://code.wireshark.org/review/26945
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

2 files changed, 43 insertions, 0 deletions

diff --git a/tools/dfilter-test.py b/tools/dfilter-test.py
index 8c2ab1209c..61cae97b58 100755
--- a/tools/dfilter-test.py
+++ b/tools/dfilter-test.py
@@ -21,6 +21,7 @@ from dftestlib.double import testDouble
 from dftestlib.integer import testInteger
 from dftestlib.integer_1byte import testInteger1Byte
 from dftestlib.ipv4 import testIPv4
+from dftestlib.membership import testMembership
 from dftestlib.range_method import testRange
 from dftestlib.scanner import testScanner
 from dftestlib.string_type import testString
diff --git a/tools/dftestlib/membership.py b/tools/dftestlib/membership.py
new file mode 100644
index 0000000000..f61bdd5cf8
--- /dev/null
+++ b/tools/dftestlib/membership.py
@@ -0,0 +1,42 @@
+# Copyright (c) 2018 Peter Wu <peter@lekensteyn.nl>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+
+from dftestlib import dftest
+
+class testMembership(dftest.DFTest):
+    trace_file = "http.pcap"
+
+    def test_membership_1_match(self):
+        dfilter = 'tcp.port in {80 3267}'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_membership_2_range_match(self):
+        dfilter = 'tcp.port in {80 .. 81}'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_membership_3_range_no_match(self):
+        dfilter = 'tcp.dstport in {1 .. 79 81 .. 65535}'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_membership_4_range_no_match_multiple(self):
+        # Verifies that multiple fields cannot satisfy different conditions.
+        dfilter = 'tcp.port in {1 .. 79 81 .. 3266 3268 .. 65535}'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_membership_5_negative_range_float(self):
+        dfilter = 'frame.time_delta in {-2.0 .. 0.0}'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_membership_6_both_negative_range_float(self):
+        dfilter = 'frame.time_delta in {-20 .. -.7}'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_membership_7_string(self):
+        dfilter = 'http.request.method in {"GET" "HEAD"}'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_membership_8_ip_range(self):
+        dfilter = 'ip.addr in { 10.0.0.5 .. 10.0.0.9 }'
+        self.assertDFilterCount(dfilter, 1)