dfilter: Fix raw slices

Fix raw slices to always have FT_BYTES type.

Before:

    Filter:
     @_ws.ftypes.string[3:4] == ff:ff

    Instructions:
     0000 READ_TREE        @_ws.ftypes.string <FT_STRING> -> R0
     0001 IF_FALSE_GOTO    4
     0002 SLICE            R0[3:4]          -> R1
     0003 ANY_EQ           R1 == ff:ff <FT_BYTES>
     0004 RETURN

After:

    Filter:
     @_ws.ftypes.string[3:4] == ff:ff

    Instructions:
     0000 READ_TREE        @_ws.ftypes.string <FT_BYTES> -> R0
     0001 IF_FALSE_GOTO    4
     0002 SLICE            R0[3:4]          -> R1
     0003 ANY_EQ           R1 == ff:ff <FT_BYTES>
     0004 RETURN

1 files changed, 19 insertions, 0 deletions

diff --git a/test/suite_dfilter/group_syntax.py b/test/suite_dfilter/group_syntax.py
index 63fb94fbeb..be6ab52928 100644
--- a/test/suite_dfilter/group_syntax.py
+++ b/test/suite_dfilter/group_syntax.py
@@ -396,3 +396,22 @@ class TestDfilterRawModifier:
         dfilter = '@s7comm.blockinfo.blocktype == ${@s7comm.blockinfo.blocktype}'
         # select frame 3, expect 2 frames out of 3.
         checkDFilterCountWithSelectedFrame(dfilter, 2, 3)
+
+class TestDfilterRawSlice:
+    trace_file = "http.pcap"
+
+    def test_raw_slice1(self, checkDFilterFail):
+        dfilter = 'tcp.port[1] == 0xc3'
+        checkDFilterFail(dfilter, "cannot be sliced")
+
+    def test_raw_slice2(self, checkDFilterCount):
+        dfilter = '@tcp.port[1] == 0xc3'
+        checkDFilterCount(dfilter, 1)
+
+    def test_raw_slice3(self, checkDFilterFail):
+        dfilter = 'tcp.port[0:] == 0c:c3'
+        checkDFilterFail(dfilter, "cannot be sliced")
+
+    def test_raw_slice4(self, checkDFilterCount):
+        dfilter = '@tcp.port[0:] == 0c:c3'
+        checkDFilterCount(dfilter, 1)