dfilter: Fix parsing of value strings

If we have a STRING value in an expression and a numeric comparison
we must also check if it matches a value string before throwing
a type error.

Add appropriate tests to the test suite.

Fixes 4d2f469212.
This commit is contained in:
João Valverde 2021-10-08 17:33:36 +01:00
parent 39e0b3155f
commit 9d87c4712e
3 changed files with 13 additions and 1 deletions

View File

@ -800,7 +800,7 @@ check_relation_LHS_FIELD(dfwork_t *dfw, const char *relation_string,
}
if (type2 == STTYPE_STRING) {
fvalue = dfilter_fvalue_from_string(dfw, ftype1, st_arg2, NULL);
fvalue = dfilter_fvalue_from_string(dfw, ftype1, st_arg2, hfinfo1);
}
else if (type2 == STTYPE_CHARCONST &&
strcmp(relation_string, "contains") == 0) {

View File

@ -177,3 +177,11 @@ class case_string(unittest.TestCase):
def test_contains_unicode(self, checkDFilterCount):
dfilter = 'tcp.flags.str contains "·······AP···"'
checkDFilterCount(dfilter, 1)
def test_value_string_1(self, checkDFilterCount):
dfilter = 'tcp.checksum.status == "Unverified" || tcp.checksum.status == "Good"'
checkDFilterCount(dfilter, 1)
def test_value_string_2(self, checkDFilterCount):
dfilter = 'tcp.checksum.status in {"Unverified" "Good"}'
checkDFilterCount(dfilter, 1)

View File

@ -26,3 +26,7 @@ class case_syntax(unittest.TestCase):
def test_func_1(self, checkDFilterCount):
dfilter = "len(frame) == 207"
checkDFilterCount(dfilter, 1)
def test_value_string_1(self, checkDFilterSucceed):
dfilter = 'eth.fcs.status=="Bad"'
checkDFilterSucceed(dfilter)