wireshark/test
João Valverde 0662a3f6ac dfilter: Amend a numeric pattern in the scanner
We amend the :<numeric> pattern to not eat the leading
colon. Because the colon can be part of the value (with IPv6 addresses
for example) we want to avoid doing that.

IPv6 addresses are covered by their own rules but this removes the
requirement in the future to handle any special cases and avoids
surprises.

For this reason the colon-prefix syntax is already explicitly defined to
work only for byte arrays and there is currently no universal
syntax for all literal values or even all numbers.

Other numbers can keep using the lexical type "unparsed".

```
run/dftest "_ws.ftypes.uint8 == :fd"
Filter: _ws.ftypes.uint8 == :fd
dftest: ":fd" is not a valid number.
	_ws.ftypes.uint8 == :fd
	                    ^~~

run/dftest "_ws.ftypes.uint8 == fd"
Filter: _ws.ftypes.uint8 == fd
dftest: "fd" is not a valid number.
	_ws.ftypes.uint8 == fd
	                    ^~

run/dftest "_ws.ftypes.uint8 == 0xfd"
Filter: _ws.ftypes.uint8 == 0xfd

Syntax tree:
 0 TEST_ANY_EQ:
   1 FIELD(_ws.ftypes.uint8 <FT_UINT8>)
   1 FVALUE(253 <FT_UINT8>)

Instructions:
00000 READ_TREE		_ws.ftypes.uint8 <FT_UINT8> -> reg#0
00001 IF_FALSE_GOTO	3
00002 ANY_EQ		reg#0 == 253 <FT_UINT8>
00003 RETURN

run/dftest "_ws.ftypes.bytes == fd"
Filter: _ws.ftypes.bytes == fd

Syntax tree:
 0 TEST_ANY_EQ:
   1 FIELD(_ws.ftypes.bytes <FT_BYTES>)
   1 FVALUE(fd <FT_BYTES>)

Instructions:
00000 READ_TREE		_ws.ftypes.bytes <FT_BYTES> -> reg#0
00001 IF_FALSE_GOTO	3
00002 ANY_EQ		reg#0 == fd <FT_BYTES>
00003 RETURN

run/dftest "_ws.ftypes.bytes == :fd"
Filter: _ws.ftypes.bytes == :fd

Syntax tree:
 0 TEST_ANY_EQ:
   1 FIELD(_ws.ftypes.bytes <FT_BYTES>)
   1 FVALUE(fd <FT_BYTES>)

Instructions:
00000 READ_TREE		_ws.ftypes.bytes <FT_BYTES> -> reg#0
00001 IF_FALSE_GOTO	3
00002 ANY_EQ		reg#0 == fd <FT_BYTES>
00003 RETURN
```
2022-10-08 09:51:49 +00:00
..
baseline ip: ip.flags field are 3 high bits not full byte 2022-06-14 20:28:17 +00:00
captures TCP: Use RFC 6994 for experimental options 2022-08-17 21:33:31 +00:00
config dot11decrypt: Add partial FT-EAP decryption support 2021-01-20 16:10:12 +00:00
keys Add support for RSA decryption using PKCS #11 tokens 2018-12-29 10:40:16 +00:00
lua Lua: Add lrexlib-pcre2 Lua regex bindings 2022-05-26 10:09:13 +00:00
protobuf_lang_files GRPC: Add support for gRPC-Web 2022-03-01 10:19:47 +00:00
suite_dfilter dfilter: Amend a numeric pattern in the scanner 2022-10-08 09:51:49 +00:00
suite_dissectors asterix: output format fix 2022-01-23 08:45:04 +00:00
README.test Qt: Add a packet diagram view. 2020-08-10 18:17:50 +00:00
conftest.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
fixtures.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
fixtures_ws.py Version info: Do not show plugin count 2022-06-05 21:31:36 +00:00
hosts.custom
hosts.global
hosts.personal
matchers.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
sampleif.py test: fix sampleif.py on weird systems using Python 3.6 and older 2019-04-16 03:28:43 +00:00
subprocesstest.py tests: Add argument to trim output to a reasonable size 2021-02-04 17:00:36 +00:00
suite_capture.py MSYS2: Test commands in pipes need quoting 2021-09-27 16:45:58 +00:00
suite_clopts.py elastic: fix mapping with recent es versions. 2022-03-14 08:34:48 +00:00
suite_decryption.py test: Remove libgcrypt checks for 1.8 and below 2022-04-21 06:32:44 -04:00
suite_dissection.py tcp: Fix handling of retransmission for reassembly 2022-08-30 21:44:11 +00:00
suite_extcaps.py extcap: new interface, wifidump, to capture Wi-Fi frames using a remote SSH host 2022-03-09 08:01:39 +00:00
suite_external.py Test: Add external tests. 2021-10-01 23:40:17 +00:00
suite_fileformats.py file-pcapng: redo the way we dissect the data in blocks. 2021-06-04 16:46:40 -07:00
suite_follow.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
suite_follow_dccp.py tests: fix the test case running warning. 2021-11-18 07:55:22 +00:00
suite_follow_multistream.py HTTP2: Send headers to the follow tap after decompression 2022-08-08 23:50:20 +00:00
suite_io.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
suite_mergecap.py editcap/mergecap: swap 'v'|'V' options to match other CLI utilities 2022-06-16 02:13:50 +00:00
suite_nameres.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
suite_netperfmeter.py Using col_append_sep_fstr() instead of prepending "NetPerfMeter" label. 2021-06-28 14:39:04 +00:00
suite_outputformats.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
suite_release.py Tools+test: Call python3 explicitly. 2020-11-05 06:46:35 +00:00
suite_sharkd.py Use wtap_blocks for packet comments 2021-07-07 18:40:24 +00:00
suite_text2pcap.py test: Update text2pcap test to use new hexdump option 2022-01-12 23:22:39 -05:00
suite_unittests.py COSE dissector from dtn-wireshark project 2021-09-29 08:51:13 +00:00
suite_wslua.py Lua: Remove on-life-support GRegex bindings 2022-05-26 10:09:13 +00:00
test.py Test: Add external tests. 2021-10-01 23:40:17 +00:00
travis-upload-artifacts.sh test,travis: dump a screenshot for hanging GUI tests 2019-01-24 00:26:22 +00:00
util_dump_dhcp_pcap.py Dumpcap+Qt: Add support for `-a packets:NUM` and `-b packets:NUM`. 2018-11-09 05:55:11 +00:00

README.test

Wireshark Tests

The recommended steps to prepare for and to run tests:

* Install two Python packages, pytest: `pip install pytest pytest-xdist`
* Build programs (“wireshark”, “tshark”, etc.): `ninja`
* Build additional programs for the “unittests” suite: `ninja test-programs`
* Run tests in the build directory: `pytest`

Replace `ninja test-programs` by `make test-programs` as needed.

See the “Wireshark Tests” chapter of the Developer's Guide for details:
https://www.wireshark.org/docs/wsdg_html_chunked/ChapterTests.html

If you need to update the baseline files use the following commands (on a Linux system)
mkdir ~/.config/wireshark/profiles/ctest
TZ=UTC WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1 build/run/tshark -C ctest -T ek -r test/captures/dhcp.pcap > test/baseline/dhcp.ek
TZ=UTC WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1 build/run/tshark -C ctest -T json -r test/captures/dhcp.pcap > test/baseline/dhcp.json
TZ=UTC WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1 build/run/tshark -C ctest -T jsonraw -r test/captures/dhcp.pcap > test/baseline/dhcp.jsonraw
TZ=UTC WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1 build/run/tshark -C ctest -T ek -r test/captures/dhcp.pcap -x > test/baseline/dhcp-raw.ek