diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2018-04-14 18:07:22 +0200 |
|---|---|---|
| committer | Anders Broman <a.broman58@gmail.com> | 2018-04-18 03:47:02 +0000 |
| commit | 1ff82572ca62096520d0c6529fcc0ecee518206d (patch) | |
| tree | 51d0894d456188ceca615cb677d4f7996abe8f3f /epan/dfilter/dfvm.h | |
| parent | 4a156da068269aae75d79cd08e579754c52a0c43 (diff) | |
dfilter: add range support to set membership operator ("f in {x .. y}")
Allow "tcp.srcport in {1662 1663 1664}" to be abbreviated to
"tcp.srcport in {1662 .. 1664}". The range operator is supported for any
field value which supports the "<=" and "=>" operators and thus works
for integers, IP addresses, etc.
The naive mapping "tcp.srcport >= 1662 and tcp.srcport <= 1664" is not
used because it does not have the intended effect with fields that have
multiple occurrences (e.g. tcp.port). Each condition could be satisfied
by an other value. Therefore a new DVFM instruction (ANY_IN_RANGE) is
added to test the range condition against each individual field value.
Bug: 14180
Change-Id: I53c2d0f9bc9d4f0ffaabde9a83442122965c95f7
Reviewed-on: https://code.wireshark.org/review/26945
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'epan/dfilter/dfvm.h')
| -rw-r--r-- | epan/dfilter/dfvm.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/epan/dfilter/dfvm.h b/epan/dfilter/dfvm.h index 4014c8784d..68a65dd734 100644 --- a/epan/dfilter/dfvm.h +++ b/epan/dfilter/dfvm.h @@ -59,7 +59,8 @@ typedef enum { ANY_CONTAINS, ANY_MATCHES, MK_RANGE, - CALL_FUNCTION + CALL_FUNCTION, + ANY_IN_RANGE } dfvm_opcode_t; |