dfilter: Fix RHS bias for literal values

Fixes a3b76138f0.
This commit is contained in:
João Valverde 2022-04-06 21:59:02 +01:00
parent 7429832db4
commit 0313cd02bc
2 changed files with 79 additions and 6 deletions

View File

@ -186,6 +186,56 @@ dfilter_fvalue_from_literal(dfwork_t *dfw, ftenum_t ftype, stnode_t *st,
return fv;
}
static fvalue_t *
dfilter_fvalue_from_unparsed(dfwork_t *dfw, ftenum_t ftype, stnode_t *st,
gboolean allow_partial_value, header_field_info *hfinfo_value_string)
{
fvalue_t *fv;
const char *s = stnode_data(st);
/* Don't set the error message if it's already set. */
fv = fvalue_from_literal(ftype, s, allow_partial_value,
dfw->error_message == NULL ? &dfw->error_message : NULL);
if (fv != NULL) {
/* converted to fvalue successfully. */
return fv;
}
if (hfinfo_value_string) {
/* check value_string */
fv = mk_fvalue_from_val_string(dfw, hfinfo_value_string, s);
if (fv != NULL) {
/*
* Ignore previous errors if this can be mapped
* to an item from value_string.
*/
g_free(dfw->error_message);
dfw->error_message = NULL;
return fv;
}
}
header_field_info *hfinfo = dfilter_resolve_unparsed(dfw, s);
if (hfinfo == NULL) {
/* This node is neither a valid fvalue nor a valid field. */
/* The parse failed. Error message is already set. */
THROW(TypeError);
}
/* Successfully resolved to a field. */
/* Free the error message for the failed fvalue_from_literal() attempt. */
g_free(dfw->error_message);
dfw->error_message = NULL;
stnode_replace(st, STTYPE_FIELD, hfinfo);
/* Return NULL to signal we have a field. */
return NULL;
}
/* Gets an fvalue from a string, and sets the error message on failure. */
WS_RETNONNULL
static fvalue_t *
@ -657,9 +707,11 @@ again:
}
if (type2 == STTYPE_UNPARSED) {
if (resolve_unparsed(dfw, st_arg2))
fvalue = dfilter_fvalue_from_unparsed(dfw, ftype1, st_arg2, allow_partial_value, hfinfo1);
if (fvalue == NULL) {
/* We have a protocol or protocol field. */
goto again;
fvalue = dfilter_fvalue_from_literal(dfw, ftype1, st_arg2, allow_partial_value, hfinfo1);
}
}
else if (type2 == STTYPE_STRING) {
fvalue = dfilter_fvalue_from_string(dfw, ftype1, st_arg2, hfinfo1);
@ -763,9 +815,11 @@ again:
stnode_replace(st_arg2, STTYPE_FVALUE, fvalue);
}
else if (type2 == STTYPE_UNPARSED) {
if (resolve_unparsed(dfw, st_arg2))
fvalue = dfilter_fvalue_from_unparsed(dfw, FT_BYTES, st_arg2, allow_partial_value, NULL);
if (fvalue == NULL) {
/* We have a protocol or protocol field. */
goto again;
fvalue = dfilter_fvalue_from_literal(dfw, FT_BYTES, st_arg2, allow_partial_value, NULL);
}
stnode_replace(st_arg2, STTYPE_FVALUE, fvalue);
}
else if (type2 == STTYPE_LITERAL) {
@ -868,9 +922,11 @@ again:
stnode_replace(st_arg2, STTYPE_FVALUE, fvalue);
}
else if (type2 == STTYPE_UNPARSED) {
if (resolve_unparsed(dfw, st_arg2))
fvalue = dfilter_fvalue_from_unparsed(dfw, ftype1, st_arg2, allow_partial_value, NULL);
if (fvalue == NULL) {
/* We have a protocol or protocol field. */
goto again;
fvalue = dfilter_fvalue_from_literal(dfw, ftype1, st_arg2, allow_partial_value, NULL);
}
stnode_replace(st_arg2, STTYPE_FVALUE, fvalue);
}
else if (type2 == STTYPE_LITERAL) {

View File

@ -158,6 +158,23 @@ class case_equality(unittest.TestCase):
dfilter = "frame[0:10] contains :00-01-6c"
checkDFilterCount(dfilter, 1)
def test_rhs_literal_bias_1(self, checkDFilterCount):
dfilter = 'frame[37] == fc'
checkDFilterCount(dfilter, 1)
def test_rhs_literal_bias_2(self, checkDFilterCount):
dfilter = 'frame[37] == :fc'
checkDFilterCount(dfilter, 1)
def test_rhs_literal_bias_3(self, checkDFilterCount):
dfilter = 'frame[37] == <fc>'
checkDFilterCount(dfilter, 1)
def test_rhs_literal_bias_4(self, checkDFilterCount):
# This is Fibre Channel on the RHS
dfilter = 'frame[37] == .fc'
checkDFilterCount(dfilter, 0)
@fixtures.uses_fixtures
class case_bitwise(unittest.TestCase):
trace_file = "http.pcap"