dfilter: Add bitwise masking of bits

Add support for masking of bits. Before the bitwise operator
could only test bits, it did not support clearing bits.

This allows testing if any combination of bits are set/unset
more naturally with a single test. Previously this was only
possible by combining several bitwise predicates.

Bitwise is implemented as a test node, even though it is not.
Maybe the test node should be renamed to something else.

Fixes #17246.

1 files changed, 16 insertions, 0 deletions

diff --git a/test/suite_dfilter/group_syntax.py b/test/suite_dfilter/group_syntax.py
index 3c828464c3..b6ceae779c 100644
--- a/test/suite_dfilter/group_syntax.py
+++ b/test/suite_dfilter/group_syntax.py
@@ -140,3 +140,19 @@ class case_equality(unittest.TestCase):
     def test_literal_2(self, checkDFilterCount):
         dfilter = "udp contains <ce:13>"
         checkDFilterCount(dfilter, 1)
+
+@fixtures.uses_fixtures
+class case_bitwise(unittest.TestCase):
+    trace_file = "http.pcap"
+
+    def test_exists_1(self, checkDFilterCount):
+        dfilter = "tcp.flags & 0x8"
+        checkDFilterCount(dfilter, 1)
+
+    def test_exists_1(self, checkDFilterCount):
+        dfilter = "tcp.flags & 0x0F == 8"
+        checkDFilterCount(dfilter, 1)
+
+    def test_exists_1(self, checkDFilterCount):
+        dfilter = "eth[0] & 1"
+        checkDFilterCount(dfilter, 0)