dfilter: Add support for negation of arithmetic expressions

docbook/release-notes.adoc

@@ -60,6 +60,8 @@ The following features are new (or have been significantly updated) since versio
   This can be useful to filter on malformed UTF-8 strings, among other use cases where it is necessary to
   look at the field's raw data.
 
+* Negation (unary minus) now works with any display filter arithmetic expression.
+
 * ciscodump support Cisco IOS XE 17.x
 
 // === Removed Features and Support

epan/dfilter/dfvm.c

@@ -438,7 +438,7 @@ dfvm_dump_str(wmem_allocator_t *alloc, dfilter_t *df, gboolean print_references)
 				break;
 
 			case DFVM_UNARY_MINUS:
-				wmem_strbuf_append_printf(buf, "%05d %s\t\t-%s -> %s\n",
+				wmem_strbuf_append_printf(buf, "%05d %s\t-%s -> %s\n",
 					id, opcode_str, arg1_str, arg2_str);
 				break;
 

epan/dfilter/grammar.lemon

@@ -234,12 +234,12 @@ arithmetic_expr(T) ::= entity(N).
     T = N;
 }
 
-arithmetic_expr(T) ::= PLUS entity(N).  [UNARY_PLUS]
+arithmetic_expr(T) ::= PLUS arithmetic_expr(N).  [UNARY_PLUS]
 {
     T = N;
 }
 
-arithmetic_expr(T) ::= MINUS(M) entity(N). [UNARY_MINUS]
+arithmetic_expr(T) ::= MINUS(M) arithmetic_expr(N). [UNARY_MINUS]
 {
     T = M;
     sttype_oper_set1(T, STNODE_OP_UNARY_MINUS, N);

epan/dfilter/semcheck.c

@@ -1206,7 +1206,7 @@ check_arithmetic_expr(dfwork_t *dfw, stnode_t *st_node, ftenum_t lhs_ftype)
 	}
 
 	if (st_op == STNODE_OP_UNARY_MINUS) {
-		ftype1 = check_arithmetic_entity(dfw, st_arg1, lhs_ftype);
+		ftype1 = check_arithmetic_expr(dfw, st_arg1, lhs_ftype);
 		if (!ftype_can_unary_minus(ftype1)) {
 			FAIL(dfw, st_arg1, "%s %s.",
 				ftype_name(ftype1), op_to_error_msg(st_op));

test/suite_dfilter/group_syntax.py

@@ -232,6 +232,10 @@ class case_unary_minus(unittest.TestCase):
         dfilter = "-2 == tcp.dstport"
         checkDFilterFail(dfilter, error)
 
+    def test_unary_4(self, checkDFilterCount):
+        dfilter = "tcp.window_size_scalefactor == -{tcp.dstport * 20}"
+        checkDFilterCount(dfilter, 0)
+
 @fixtures.uses_fixtures
 class case_arithmetic(unittest.TestCase):
     trace_file = "dhcp.pcap"