diff options
| -rw-r--r-- | docbook/release-notes.adoc | 7 | ||||
| -rw-r--r-- | docbook/wsug_src/WSUG_chapter_work.adoc | 10 | ||||
| -rw-r--r-- | epan/dfilter/scanner.l | 9 | ||||
| -rw-r--r-- | test/suite_dfilter/group_syntax.py | 14 |
4 files changed, 15 insertions, 25 deletions
diff --git a/docbook/release-notes.adoc b/docbook/release-notes.adoc index 5042ac43c8..53865d4a1b 100644 --- a/docbook/release-notes.adoc +++ b/docbook/release-notes.adoc @@ -47,7 +47,12 @@ The following features are new (or have been significantly updated) since versio * Wireshark now builds with Qt6 by default. To use Qt5 instead pass USE_qt6=OFF to CMake. -// === Removed Features and Support +=== Removed Features and Support + +* The experimental display filter syntax for literals using angle brackets <...> + that was introduced in Wireshark 4.0.0 has been removed. For byte arrays a colon prefix + can be used instead. + See the https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html#_some_protocol_names_can_be_ambiguous[User’s Guide] for details. // === Removed Dissectors diff --git a/docbook/wsug_src/WSUG_chapter_work.adoc b/docbook/wsug_src/WSUG_chapter_work.adoc index 456af0462c..6952ad6e25 100644 --- a/docbook/wsug_src/WSUG_chapter_work.adoc +++ b/docbook/wsug_src/WSUG_chapter_work.adoc @@ -918,13 +918,11 @@ language syntax) and there is no protocol registered with the filter name 'fd'. How ambiguous values are interpreted may change in the future. To avoid this problem and resolve the ambiguity there is additional syntax available. -Values in-between angle brackets are always and only treated as literal -values. Bytes arrays and numeric values can also be prefixed with a colon to -force interpretation as a literal value. Values prefixed with a dot are always -treated as a protocol name. The dot stands for the root of the protocol namespace -and is optional) +Values prefixed with a dot are always treated as a protocol name. The +dot stands for the root of the protocol namespace and is optional). Values +prefixed with a colon are always interpreted as a byte array. ---- -frame[10:] contains .fc or frame[10] == :fc and not frame contains <cafe.face> +frame[10:] contains .fc or frame[10] == :fc ---- If you are writing a script, or you think your expression may not be giving the expected results because of the syntactical ambiguity of some filter expression diff --git a/epan/dfilter/scanner.l b/epan/dfilter/scanner.l index 963e76b409..41935dce00 100644 --- a/epan/dfilter/scanner.l +++ b/epan/dfilter/scanner.l @@ -448,15 +448,6 @@ hyphen-bytes {hex2}(-{hex2})+ return set_lval_literal(yyextra, yytext + 1); /* Skip leading colon. */ } -"<"[^>=]+">" { - /* Literal in-between angle brackets (cannot be parsed as a protocol field). */ - /* Strip brackets. */ - update_location(yyextra, yytext); - char *end = strchr(yytext, '>'); - *end = '\0'; - return set_lval_literal(yyextra, yytext + 1); -} - \.?{Identifier} { /* Identifier or unparsed. */ update_location(yyextra, yytext); diff --git a/test/suite_dfilter/group_syntax.py b/test/suite_dfilter/group_syntax.py index 010a8a990e..f13aaa82f2 100644 --- a/test/suite_dfilter/group_syntax.py +++ b/test/suite_dfilter/group_syntax.py @@ -119,6 +119,11 @@ class case_syntax(unittest.TestCase): dfilter = "tcp.flags.push == FALSE" checkDFilterCount(dfilter, 0) + def test_misc_1(self, checkDFilterSucceed): + # Issue #18418 + dfilter = "icmp and ((icmp.type > 0 and icmp.type < 8) or icmp.type > 8)" + checkDFilterSucceed(dfilter) + @fixtures.uses_fixtures class case_equality(unittest.TestCase): trace_file = "sip.pcapng" @@ -147,10 +152,6 @@ class case_equality(unittest.TestCase): dfilter = "udp.port == :5070" checkDFilterCount(dfilter, 3) - def test_literal_2(self, checkDFilterCount): - dfilter = "udp contains <ce:13>" - checkDFilterCount(dfilter, 1) - def test_literal_3(self, checkDFilterCount): dfilter = "frame[0:10] contains :00:01:6c" checkDFilterCount(dfilter, 1) @@ -177,11 +178,6 @@ class case_equality(unittest.TestCase): dfilter = 'frame[37] == :fc' checkDFilterCount(dfilter, 1) - def test_rhs_literal_bias_3(self, checkDFilterCount): - # Byte 0xFC on the RHS - dfilter = 'frame[37] == <fc>' - checkDFilterCount(dfilter, 1) - def test_rhs_literal_bias_4(self, checkDFilterCount): # Protocol "Fibre Channel" on the RHS dfilter = 'frame[37] == .fc' |