dfilter: Add support for unary arithmetic

This change implements a unary minus operator.

Filter: tcp.window_size_scalefactor == -tcp.dstport

Instructions:
00000 READ_TREE		tcp.window_size_scalefactor -> reg#0
00001 IF_FALSE_GOTO	6
00002 READ_TREE		tcp.dstport -> reg#1
00003 IF_FALSE_GOTO	6
00004 MK_MINUS		-reg#1 -> reg#2
00005 ANY_EQ		reg#0 == reg#2
00006 RETURN

It is supported for integer types, floats and relative time values.
The unsigned integer types are promoted to a 32 bit signed integer.

Unary plus is implemented as a no-op. The plus sign is simply ignored.

Constant arithmetic expressions are computed during compilation.

Overflow with constants is a compile time error. Overflow with
variables is a run time error and silently ignored. Only a debug
message will be printed to the console.

Related to #15504.

2 files changed, 30 insertions, 1 deletions

diff --git a/test/suite_dfilter/group_membership.py b/test/suite_dfilter/group_membership.py
index 20072e2db1..e3d1f37711 100644
--- a/test/suite_dfilter/group_membership.py
+++ b/test/suite_dfilter/group_membership.py
@@ -61,7 +61,7 @@ class case_membership(unittest.TestCase):
         checkDFilterCount(dfilter, 1)
 
     def test_membership_6_both_negative_range_float(self, checkDFilterCount):
-        dfilter = 'frame.time_delta in {-20 .. -.7}'
+        dfilter = 'frame.time_delta in {-20 .. -0.7}'
         checkDFilterCount(dfilter, 0)
 
     def test_membership_7_string(self, checkDFilterCount):
diff --git a/test/suite_dfilter/group_syntax.py b/test/suite_dfilter/group_syntax.py
index 06fdea2126..6149b0de93 100644
--- a/test/suite_dfilter/group_syntax.py
+++ b/test/suite_dfilter/group_syntax.py
@@ -160,3 +160,32 @@ class case_bitwise(unittest.TestCase):
     def test_equal_2(self, checkDFilterCount):
         dfilter = "tcp.srcport != tcp.dstport & 0x0F"
         checkDFilterCount(dfilter, 1)
+
+@fixtures.uses_fixtures
+class case_arithmetic(unittest.TestCase):
+    trace_file = "http.pcap"
+
+    def test_minus_const_1(self, checkDFilterCount):
+        dfilter = "tcp.window_size_scalefactor == -1"
+        checkDFilterCount(dfilter, 1)
+
+    def test_minus_const_2(self, checkDFilterCount):
+        dfilter = "tcp.window_size_scalefactor == -2"
+        checkDFilterCount(dfilter, 0)
+
+    def test_plus_const_1(self, checkDFilterCount):
+        dfilter = "tcp.window_size_scalefactor == +1"
+        checkDFilterCount(dfilter, 0)
+
+    def test_unary_1(self, checkDFilterCount):
+        dfilter = "tcp.window_size_scalefactor == -tcp.dstport"
+        checkDFilterCount(dfilter, 0)
+
+    def test_unary_2(self, checkDFilterCount):
+        dfilter = "tcp.window_size_scalefactor == +tcp.dstport"
+        checkDFilterCount(dfilter, 0)
+
+    def test_unary_3(self, checkDFilterFail):
+        error = 'Left side of "==" expression must be a field or function'
+        dfilter = "-2 == tcp.dstport"
+        checkDFilterFail(dfilter, error)