Re-implemented fix to keep display filter from reading data from outside

the packet boundary. Now the field boundary is honored. The frame boundary
is ignored, but of course we put proper field lengths in the proto_tree,
right? :)

Implemented negative offsets in byte-strings:
	frame[-4:4] will read the last 4 bytes of a frame.

Implemented "offset-only" byte-string comparisons, since the dfilter
compiler knows the length of the byte-string you supplied. These are
now legal:
	frame[-4] == 0.0.0.1
	tr.dst[0] == 00:06:29

Implemented the use of integers if you're comparing one byte. These are
legal:
	llc[0] == 0xaa
	llc[0:1] == 0xaa

All these forms check against the length of the field, so these will be
reported as bad to the user:
	eth.src[5] == 00:06:29      (goes beyond field boundary)
	eth.dst == 1.2.3.4.5.6.7    (too long, goes beyond field boundary)

Thes is also reported as bad:
	eth.dst[0:3] == 1.2          (incorrect number of bytes specified)
	eth.dst[0:1] == eth.src[0:2] (disparate lengths)

I had to add a new function, proto_registrar_get_length() in proto.c, which
reports the length of a field as can be determined at registration time.

There are some shift/reduce errors in the grammar that I need to get rid of.

svn path=/trunk/; revision=811

0 files changed, 0 insertions, 0 deletions