Update dfilter-test.py to use a much more modern test harness,

the "unittest" module that comes with Python. Specifically, this
takes advantage of a couple of features in the "unittest" in
Python 2.7. The tests are all the same as before, but much
better managed.

This is in preparation for some work on the display filter code.

svn path=/trunk/; revision=52136

doc/README.display_filter

@@ -554,45 +554,51 @@ expression generator.
 
 How to add a new test to dfilter-test.py
 ========================================
-If you need a new packet, create an instance of Packet()
-inside dfilter-test.py, and add its hexdump as you see in the
-existing Packet instances.
+Note: dfilter-test.py requires Python 2.7
 
-Add a method to run your tests to an existing class which is
-a sub-class of Test, or add your own new sub-class of Test.
-The 'tests' field in each class must list the test methods that
-are to be called. Each test must return the result of:
+"tools/dfilter-test.py" is the main test script. It includes
+the test from files in tools/dftestlib. You can add a test
+to a file in tools/dftestlib, or you can create a new file
+in tools/dftestlib. If you do add a new file, you must
+import it (and the class it defines) in "tools/dfilter-test.py"
 
-    self.DFilterCount(packet_object, dfilter_text, expected_count)
+Each new test class must define "trace_file", which names
+a capture file in "tools/dftestfiles". All the tests
+run in that class will use that one capture file.
 
-If you have added a new sub-class of Test, it must be added
-to the global all_tests variable.
+There are 2 methods you can use for testing:
+
+assertDfilter(dfilter_text, expected_count)
+
+    This will run the display filter through tshark, on the
+    file named by "trace_file", and assert that the
+    number of resulting packets equals "expected_count". This
+    also asserts that tshark does not fail; success with zero
+    matches is not the same as failure to compile the display
+    filter string.
+
+assertDFilterFail(dfilter_text)
+
+    This will run tshark with the display filter, and
+    asser that tshark fails. This is useful when expecting
+    display filter syntax errors to be caught.
 
 Then, simply run "dfilter-test.py". You can run the tests
-in a single Test sub-class by naming that sub-class on the
-dfilter-test.py command-line, like:
+in a single Test class by naming that -class on the
+dfilter-test.py command-line, or even run a single
+test by naming it. E.g., the following are all valid ways
+of running dfilter-test.py:
 
-$ ./tools/dfilter-test.py TVB
-Note: Bytes test does not yet test FT_INT64.
-Note: Scanner test does not yet test embedded double-quote.
-TVB
-        ck_eq_1 ... OK
-        ck_slice_1 ... OK
-        ck_slice_2 ... OK
-        ck_slice_3 ... OK
-        ck_contains_1 ... OK
-        ck_contains_2 ... OK
-        ck_contains_3 ... OK
-        ck_contains_4 ... OK
-        ck_contains_5 ... OK
+# Run all tests
+$ ./tools/dfilter-test.py
 
+# Run all tests in "testTVB"
+$ ./tools/dfilter-test.py testTVB
 
-Total Tests Run: 9
-Total Tests Succeeded: 9
-Total Tests Failed: 0
-
+# Run the the "test_contains_1" test from testTVB
+$ ./tools/dfilter-test.py testTVB.test_contains_1
 
 Note that dfilter-test.py should be run from the top of the
 Wireshark distribution, so it knows where to find the default
-text2pcap and tshark executables.
+tshark executable.
 

tools/dftestlib/bytes_ether.py

@@ -0,0 +1,104 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testBytesEther(dftest.DFTest):
+    trace_file = "ipx_rip.cap"
+
+    ### Note: Bytes test does not yet test FT_INT64.
+
+    def test_eq_1(self):
+        dfilter = "eth.dst == ff:ff:ff:ff:ff:ff"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_2(self):
+        dfilter = "eth.src == ff:ff:ff:ff:ff:ff"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ne_1(self):
+        dfilter = "eth.dst != ff:ff:ff:ff:ff:ff"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ne_2(self):
+        dfilter = "eth.src != ff:ff:ff:ff:ff:ff"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_gt_1(self):
+        dfilter = "eth.src > 00:aa:00:a3:e3:ff"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_2(self):
+        dfilter = "eth.src > 00:aa:00:a3:e3:a4"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_3(self):
+        dfilter = "eth.src > 00:aa:00:a3:e3:00"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_1(self):
+        dfilter = "eth.src >= 00:aa:00:a3:e3:ff"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ge_2(self):
+        dfilter = "eth.src >= 00:aa:00:a3:e3:a4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_3(self):
+        dfilter = "eth.src >= 00:aa:00:a3:e3:00"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_lt_1(self):
+        dfilter = "eth.src < 00:aa:00:a3:e3:ff"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_lt_2(self):
+        dfilter = "eth.src < 00:aa:00:a3:e3:a4"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_3(self):
+        dfilter = "eth.src < 00:aa:00:a3:e3:00"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_le_1(self):
+        dfilter = "eth.src <= 00:aa:00:a3:e3:ff"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_2(self):
+        dfilter = "eth.src <= 00:aa:00:a3:e3:a4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_3(self):
+        dfilter = "eth.src <= 00:aa:00:a3:e3:00"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_slice_1(self):
+        dfilter = "eth.src[0:3] == 00:aa:00"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_2(self):
+        dfilter = "eth.src[-3:3] == a3:e3:a4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_3(self):
+        dfilter = "eth.src[1:4] == aa:00:a3:e3"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_4(self):
+        dfilter = "eth.src[0] == 00"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_1(self):
+        dfilter = "ipx.src.node contains a3"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_2(self):
+        dfilter = "ipx.src.node contains a3:e3"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_3(self):
+        dfilter = "ipx.src.node contains 00:aa:00:a3:e3:a4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_4(self):
+        dfilter = "ipx.src.node contains aa:e3"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/bytes_ipv6.py

@@ -0,0 +1,14 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testBytesIPv6(dftest.DFTest):
+    trace_file = "ipv6.cap"
+
+    def test_ipv6_1(self):
+        dfilter = "ipv6.dst == ff05::9999"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ipv6_2(self):
+        dfilter = "ipv6.dst == ff05::9990"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/bytes_type.py

@@ -0,0 +1,14 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testBytes(dftest.DFTest):
+    trace_file = "arp.cap"
+
+    def test_bytes_1(self):
+        dfilter = "arp.dst.hw == 00:64"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ipv6_2(self):
+        dfilter = "arp.dst.hw == 00:00"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/dftest.py

@@ -0,0 +1,76 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+import os
+import tempfile
+import unittest
+
+from dftestlib import util
+
+# The binaries to use. We assume we are running
+# from the top of the wireshark distro
+TSHARK = os.path.join(".", "tshark")
+
+class DFTest(unittest.TestCase):
+    """Base class for all tests in this dfilter-test collection."""
+
+    # Remove these file when finished (in tearDownClass)
+    files_to_remove = []
+
+    @classmethod
+    def setUpClass(cls):
+        """Create the trace file to be used in the tests."""
+        assert cls.trace_file
+
+        # if the class sets the 'trace_file' field, then it
+        # names the trace file to use for the tests. It *should*
+        # reside in dftestfiles
+        assert not os.path.isabs(cls.trace_file)
+        cls.trace_file = os.path.join(".", "tools", "dftestfiles",
+                cls.trace_file)
+
+    @classmethod
+    def tearDownClass(cls):
+        """Remove the trace file used in the tests."""
+        for filename in cls.files_to_remove:
+            if os.path.exists(filename):
+                try:
+                    os.remove(filename)
+                except OSError:
+                    pass
+
+
+    def runDFilter(self, dfilter):
+        # Create the tshark command
+        cmdv = [TSHARK,
+                "-n",       # No name resolution
+                "-r",       # Next arg is trace file to read
+                self.trace_file,
+                "-Y",       # packet display filter (used to be -R)
+                dfilter]
+
+        (status, output) = util.exec_cmdv(cmdv)
+        return status, output
+
+
+    def assertDFilterCount(self, dfilter, expected_count):
+        """Run a display filter and expect a certain number of packets."""
+        
+        (status, output) = self.runDFilter(dfilter)
+
+        # tshark must succeed
+        self.assertEqual(status, util.SUCCESS, output)
+        
+        # Split the output (one big string) into lines, removing
+        # empty lines (extra newline at end of output)
+        lines = [L for L in output.split("\n") if L != ""]
+
+        msg = "Expected %d, got: %s" % (expected_count, output)
+        self.assertEqual(len(lines), expected_count, msg)
+
+    def assertDFilterFail(self, dfilter):
+        """Run a display filter and expect tshark to fail"""
+
+        (status, output) = self.runDFilter(dfilter)
+
+        # tshark must succeed
+        self.assertNotEqual(status, util.SUCCESS, output)

tools/dftestlib/double.py

@@ -0,0 +1,63 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testDouble(dftest.DFTest):
+
+    trace_file = "ntp.cap"
+
+    def test_eq_1(self):
+        dfilter = "ntp.rootdelay == 0.0626983642578125"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_2(self):
+        dfilter = "ntp.rootdelay == 0.0626"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_1(self):
+        dfilter = "ntp.rootdelay > 1.0626"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_2(self):
+        dfilter = "ntp.rootdelay >  0.0626983642578125"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_3(self):
+        dfilter = "ntp.rootdelay >  0.0026"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_1(self):
+        dfilter = "ntp.rootdelay >= 1.0026"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ge_2(self):
+        dfilter = "ntp.rootdelay >=  0.0626983642578125"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_3(self):
+        dfilter = "ntp.rootdelay >=  0.0026"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_lt_1(self):
+        dfilter = "ntp.rootdelay < 1.0026"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_lt_2(self):
+        dfilter = "ntp.rootdelay <  0.0626983642578125"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_3(self):
+        dfilter = "ntp.rootdelay <  0.0026"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_le_1(self):
+        dfilter = "ntp.rootdelay <= 1.0026"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_2(self):
+        dfilter = "ntp.rootdelay <=  0.0626983642578125"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_3(self):
+        dfilter = "ntp.rootdelay <=  0.0026"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/integer.py

@@ -0,0 +1,134 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testInteger(dftest.DFTest):
+    trace_file = "ntp.cap"
+
+    def test_eq_1(self):
+        dfilter = "ip.version == 4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_2(self):
+        dfilter = "ip.version == 6"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ne_1(self):
+        dfilter = "ip.version != 0"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ne_2(self):
+        dfilter = "ip.version != 4"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_gt_1(self):
+        dfilter = "ip.version > 3"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_u_gt_2(self):
+        dfilter = "ip.version > 4"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_gt_3(self):
+        dfilter = "ip.version > 5"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_ge_1(self):
+        dfilter = "ip.version >= 3"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_u_ge_2(self):
+        dfilter = "ip.version >= 4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_u_ge_3(self):
+        dfilter = "ip.version >= 5"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_lt_1(self):
+        dfilter = "ip.version < 3"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_lt_2(self):
+        dfilter = "ip.version < 4"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_lt_3(self):
+        dfilter = "ip.version < 5"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_u_le_1(self):
+        dfilter = "ip.version <= 3"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_u_le_2(self):
+        dfilter = "ip.version <= 4"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_u_le_3(self):
+        dfilter = "ip.version <= 5"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_s_gt_1(self):
+        dfilter = "ntp.precision > -12"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_s_gt_2(self):
+        dfilter = "ntp.precision > -11"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_s_gt_3(self):
+        dfilter = "ntp.precision > -10"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_s_ge_1(self):
+        dfilter = "ntp.precision >= -12"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_s_ge_2(self):
+        dfilter = "ntp.precision >= -11"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_s_ge_3(self):
+        dfilter = "ntp.precision >= -10"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_s_lt_1(self):
+        dfilter = "ntp.precision < -12"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_s_lt_2(self):
+        dfilter = "ntp.precision < -11"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_s_lt_3(self):
+        dfilter = "ntp.precision < -10"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_s_le_1(self):
+        dfilter = "ntp.precision <= -12"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_s_le_2(self):
+        dfilter = "ntp.precision <= -11"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_s_le_3(self):
+        dfilter = "ntp.precision <= -10"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_bool_eq_1(self):
+        dfilter = "ip.flags.df == 0"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_bool_eq_2(self):
+        dfilter = "ip.flags.df == 1"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_bool_ne_1(self):
+        dfilter = "ip.flags.df != 1"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_bool_ne_2(self):
+        dfilter = "ip.flags.df != 0"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/integer_1byte.py

@@ -0,0 +1,15 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testInteger1Byte(dftest.DFTest):
+
+    trace_file = "ipx_rip.cap"
+
+    def test_ipx_1(self):
+        dfilter = "ipx.src.net == 0x28"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ipx_2(self):
+        dfilter = "ipx.src.net == 0x29"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/ipv4.py

@@ -0,0 +1,108 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testIPv4(dftest.DFTest):
+    trace_file = "nfs.cap"
+
+    def test_uint64_1(self):
+        dfilter = "nfs.fattr3.size == 264032"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_1(self):
+        dfilter = "ip.src == 172.25.100.14"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_2(self):
+        dfilter = "ip.src == 255.255.255.255"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ne_1(self):
+        dfilter = "ip.src != 172.25.100.14"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ne_2(self):
+        dfilter = "ip.src != 255.255.255.255"
+        self.assertDFilterCount(dfilter, 2)
+
+    def test_gt_1(self):
+        dfilter = "ip.dst > 198.95.230.200"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_2(self):
+        dfilter = "ip.dst > 198.95.230.20"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_3(self):
+        dfilter = "ip.dst > 198.95.230.10"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_1(self):
+        dfilter = "ip.dst >= 198.95.230.200"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ge_2(self):
+        dfilter = "ip.dst >= 198.95.230.20"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_3(self):
+        dfilter = "ip.dst >= 198.95.230.10"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_lt_1(self):
+        dfilter = "ip.src < 172.25.100.140"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_lt_2(self):
+        dfilter = "ip.src < 172.25.100.14"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_3(self):
+        dfilter = "ip.src < 172.25.100.10"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_le_1(self):
+        dfilter = "ip.src <= 172.25.100.140"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_2(self):
+        dfilter = "ip.src <= 172.25.100.14"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_3(self):
+        dfilter = "ip.src <= 172.25.100.10"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_cidr_eq_1(self):
+        dfilter = "ip.src == 172.25.100.14/32"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_eq_2(self):
+        dfilter = "ip.src == 172.25.100.0/24"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_eq_3(self):
+        dfilter = "ip.src == 172.25.0.0/16"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_eq_4(self):
+        dfilter = "ip.src == 172.0.0.0/8"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_ne_1(self):
+        dfilter = "ip.src != 172.25.100.14/32"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_ne_2(self):
+        dfilter = "ip.src != 172.25.100.0/24"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_ne_3(self):
+        dfilter = "ip.src != 172.25.0.0/16"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_cidr_ne_4(self):
+        dfilter = "ip.src != 200.0.0.0/8"
+        self.assertDFilterCount(dfilter, 2)
+
+

tools/dftestlib/range_method.py

@@ -0,0 +1,30 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testRange(dftest.DFTest):
+    trace_file = "ipx_rip.cap"
+
+    def test_slice_1_pos(self):
+        dfilter = "ipx.src.node[1] == aa"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_1_neg(self):
+        dfilter = "ipx.src.node[1] == bb"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_slice_1_hex_pos(self):
+        dfilter = "ipx.src.node[1] == 0xaa"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_1_hex_neg(self):
+        dfilter = "ipx.src.node[1] == 0xbb"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_slice_2_pos(self):
+        dfilter = "ipx.src.node[3:2] == a3:e3"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_2_neg(self):
+        dfilter = "ipx.src.node[3:2] == cc:dd"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/scanner.py

@@ -0,0 +1,30 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testScanner(dftest.DFTest):
+    trace_file = "http.cap"
+
+    def test_dquote_1(self):
+        dfilter = 'http.request.method == "HEAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_dquote_2(self):
+        dfilter = 'http.request.method == "\\x48EAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_dquote_3(self):
+        dfilter = 'http.request.method == "\\x58EAD"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_dquote_4(self):
+        dfilter = 'http.request.method == "\\110EAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_dquote_5(self):
+        dfilter = 'http.request.method == "\\111EAD"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_dquote_6(self):
+        dfilter = 'http.request.method == "\\HEAD"'
+        self.assertDFilterCount(dfilter, 1)

tools/dftestlib/string_type.py

@@ -0,0 +1,159 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testString(dftest.DFTest):
+    trace_file = "http.cap"
+
+    def test_eq_1(self):
+        dfilter = 'http.request.method == "HEAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_2(self):
+        dfilter = 'http.request.method == "POST"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_1(self):
+        dfilter = 'http.request.method > "HEAC"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_gt_2(self):
+        dfilter = 'http.request.method > "HEAD"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_3(self):
+        dfilter = 'http.request.method > "HEAE"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ge_1(self):
+        dfilter = 'http.request.method >= "HEAC"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_2(self):
+        dfilter = 'http.request.method >= "HEAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_3(self):
+        dfilter = 'http.request.method >= "HEAE"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_1(self):
+        dfilter = 'http.request.method < "HEAC"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_2(self):
+        dfilter = 'http.request.method < "HEAD"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_3(self):
+        dfilter = 'http.request.method < "HEAE"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_1(self):
+        dfilter = 'http.request.method <= "HEAC"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_le_2(self):
+        dfilter = 'http.request.method <= "HEAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_3(self):
+        dfilter = 'http.request.method <= "HEAE"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_1(self):
+        dfilter = 'http.request.method[0] == "H"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_2(self):
+        dfilter = 'http.request.method[0] == "P"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_slice_3(self):
+        dfilter = 'http.request.method[0:4] == "HEAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_4(self):
+        dfilter = 'http.request.method[0:4] != "HEAD"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_slice_5(self):
+        dfilter = 'http.request.method[1:2] == "EA"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_6(self):
+        dfilter = 'http.request.method[1:2] > "EA"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_slice_7(self):
+        dfilter = 'http.request.method[-1] == "D"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_slice_8(self):
+        dfilter = 'http.request.method[-2] == "D"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def xxxtest_stringz_1(self):
+            return self.DFilterCount(pkt_tftp,
+                    'tftp.type == "octet"', 1)
+
+    def xxxtest_stringz_2(self):
+            return self.DFilterCount(pkt_tftp,
+                    'tftp.type == "junk"', 0)
+
+    def test_contains_1(self):
+        dfilter = 'http.request.method contains "E"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_2(self):
+        dfilter = 'http.request.method contains "EA"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_3(self):
+        dfilter = 'http.request.method contains "HEAD"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_4(self):
+        dfilter = 'http.request.method contains "POST"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_contains_5(self):
+        dfilter = 'http.request.method contains 50:4f:53:54' # "POST"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_contains_6(self):
+        dfilter = 'http.request.method contains 48:45:41:44' # "HEAD"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_fail_0(self):
+        dfilter = 'http.user_agent contains "update"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_contains_fail_1(self):
+        dfilter = 'http.user_agent contains "UPDATE"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_contains_upper_0(self):
+        dfilter = 'upper(http.user_agent) contains "UPDATE"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_upper_1(self):
+        dfilter = 'upper(http.user_agent) contains "update"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_contains_upper_2(self):
+        dfilter = 'upper(tcp.seq) == 4'
+        self.assertDFilterFail(dfilter)
+
+    def test_contains_lower_0(self):
+        dfilter = 'lower(http.user_agent) contains "UPDATE"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_contains_lower_1(self):
+        dfilter = 'lower(http.user_agent) contains "update"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_contains_lower_2(self):
+        dfilter = 'lower(tcp.seq) == 4'
+        self.assertDFilterFail(dfilter)
+

tools/dftestlib/stringz.py

@@ -0,0 +1,19 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testStringz(dftest.DFTest):
+    trace_file = "tftp.cap"
+
+    def test_stringz_1(self):
+        dfilter = 'tftp.type == octet'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_stringz_2(self):
+        dfilter = 'tftp.type == "octet"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_stringz_3(self):
+        dfilter = 'tftp.type == junk'
+        self.assertDFilterCount(dfilter, 0)
+

tools/dftestlib/time_relative.py

@@ -0,0 +1,19 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testTimeRelative(dftest.DFTest):
+    trace_file = "nfs.cap"
+
+    def test_relative_time_1(self):
+        dfilter = "frame.time_delta == 0.7"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_relative_time_2(self):
+        dfilter = "frame.time_delta > 0.7"
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_relative_time_3(self):
+        dfilter = "frame.time_delta < 0.7"
+        self.assertDFilterCount(dfilter, 1)
+

tools/dftestlib/time_type.py

@@ -0,0 +1,71 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testTime(dftest.DFTest):
+    trace_file = "http.cap"
+
+    def test_eq_1(self):
+        dfilter = 'frame.time == "Dec 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_eq_2(self):
+        dfilter = 'frame.time == "Jan 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ne_1(self):
+        dfilter = 'frame.time != "Dec 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ne_2(self):
+        dfilter = 'frame.time != "Jan 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_gt_1(self):
+        dfilter = 'frame.time > "Dec 31, 2002 07:54:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_gt_2(self):
+        dfilter = 'frame.time > "Dec 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_gt_3(self):
+        dfilter = 'frame.time > "Dec 31, 2002 07:56:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_ge_1(self):
+        dfilter = 'frame.time >= "Dec 31, 2002 07:54:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_2(self):
+        dfilter = 'frame.time >= "Dec 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_ge_3(self):
+        dfilter = 'frame.time >= "Dec 31, 2002 07:56:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_1(self):
+        dfilter = 'frame.time < "Dec 31, 2002 07:54:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_2(self):
+        dfilter = 'frame.time < "Dec 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_lt_3(self):
+        dfilter = 'frame.time < "Dec 31, 2002 07:56:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_1(self):
+        dfilter = 'frame.time <= "Dec 31, 2002 07:54:31.3"'
+        self.assertDFilterCount(dfilter, 0)
+
+    def test_le_2(self):
+        dfilter = 'frame.time <= "Dec 31, 2002 07:55:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_le_3(self):
+        dfilter = 'frame.time <= "Dec 31, 2002 07:56:31.3"'
+        self.assertDFilterCount(dfilter, 1)
+

tools/dftestlib/uint64.py

@@ -0,0 +1,14 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+from dftestlib import dftest
+
+class testUINT64(dftest.DFTest):
+    trace_file = "nfs.cap"
+
+    def test_uint64_1(self):
+        dfilter = "nfs.fattr3.size == 264032"
+        self.assertDFilterCount(dfilter, 1)
+
+    def test_uint64_2(self):
+        dfilter = "nfs.fattr3.size == 264000"
+        self.assertDFilterCount(dfilter, 0)

tools/dftestlib/util.py

@@ -0,0 +1,29 @@
+# Copyright (c) 2013 by Gilbert Ramirez <gram@alumni.rice.edu>
+
+import subprocess
+
+SUCCESS = 0
+def exec_cmdv(cmdv, cwd=None, stdin=None):
+    """Run the commands in cmdv, returning (retval, output),
+    where output is stdout and stderr combined.
+    If cwd is given, the child process runs in that directory.
+    If a filehandle is passed as stdin, it is used as stdin.
+    If there is an OS-level error, None is the retval."""
+
+    try:
+        output = subprocess.check_output(cmdv, stderr=subprocess.STDOUT,
+                cwd=cwd, stdin=stdin)
+        retval = SUCCESS
+
+    # If file isn't executable
+    except OSError, e:
+        output = str(e)
+        retval = None
+
+    # If process returns non-zero
+    except subprocess.CalledProcessError, e:
+        output = e.output
+        retval = e.returncode
+
+    return (retval, output)
+