dfilter: make spaces around ".." optional in display filter

For numeric values such as port numbers, "4430..4434" looks more
natural than "4430 .. 4434", so support that.

To make this possible, the display filter syntax needs to be restricted.
Assume that neither field names nor values can contain "..". The display
filter `data contains ..` will now be considered a syntax error and must
be written as `data contains ".."` instead. More generally, all values
that contain ".." must be quoted.

Other than the ".." restriction, the scanner deliberately accepts more
characters that can potentially form invalid input. This is to prevent
accidentally splitting input in multiple tokens.  For example, "9.2." in
"frame.time_delta in {9.2.}" is currently parsed as one token and then
rejected because it cannot be parsed as time. If the scanner was made
stricter, it could treat it as two tokens (floats), "9." and "2." which
has different meaning for the set membership operator.

An unhandled edge case is "1....2" which is parsed as "1 .. ..  2" but
could have been parsed as "1. .. .2" instead. A float with trailing dots
followed by ".." seems sufficiently weird, so rejection is fine.

Ping-Bug: 14180
Change-Id: Ibad8e851b49346c9d470f09d5d6a54defa21bcb9
Reviewed-on: https://code.wireshark.org/review/26960
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/doc/wireshark-filter.pod b/doc/wireshark-filter.pod
index 84754ec173..c54e4ca353 100644
--- a/doc/wireshark-filter.pod
+++ b/doc/wireshark-filter.pod
@@ -294,8 +294,8 @@ To find HTTP requests using the HEAD or GET methods:
 
 The set of values can also contain ranges:
 
-    tcp.port in {443 4430 .. 4434}
-    ip.addr in {10.0.0.5 .. 10.0.0.9 192.168.1.1 .. 192.168.1.9}
+    tcp.port in {443 4430..4434}
+    ip.addr in {10.0.0.5 .. 10.0.0.9 192.168.1.1..192.168.1.9}
     frame.time_delta in {10 .. 10.5}
 
 =head2 Type conversions