ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-commits: [Wireshark-commits] master-2.6 7a16851: dfilter: make spaces around ".." optiona

From: Wireshark code review <code-review-do-not-reply@xxxxxxxxxxxxx>
Date: Wed, 18 Apr 2018 10:34:18 +0000
URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=7a168512048af0c622233f14e93c696e86ee143b
Submitter: Stig Bjørlykke (stig@xxxxxxxxxxxxx)
Changed: branch: master-2.6
Repository: wireshark

Commits:

7a16851 by Peter Wu (peter@xxxxxxxxxxxxx):

    dfilter: make spaces around ".." optional in display filter
    
    For numeric values such as port numbers, "4430..4434" looks more
    natural than "4430 .. 4434", so support that.
    
    To make this possible, the display filter syntax needs to be restricted.
    Assume that neither field names nor values can contain "..". The display
    filter `data contains ..` will now be considered a syntax error and must
    be written as `data contains ".."` instead. More generally, all values
    that contain ".." must be quoted.
    
    Other than the ".." restriction, the scanner deliberately accepts more
    characters that can potentially form invalid input. This is to prevent
    accidentally splitting input in multiple tokens.  For example, "9.2." in
    "frame.time_delta in {9.2.}" is currently parsed as one token and then
    rejected because it cannot be parsed as time. If the scanner was made
    stricter, it could treat it as two tokens (floats), "9." and "2." which
    has different meaning for the set membership operator.
    
    An unhandled edge case is "1....2" which is parsed as "1 .. ..  2" but
    could have been parsed as "1. .. .2" instead. A float with trailing dots
    followed by ".." seems sufficiently weird, so rejection is fine.
    
    Ping-Bug: 14180
    Change-Id: Ibad8e851b49346c9d470f09d5d6a54defa21bcb9
    Reviewed-on: https://code.wireshark.org/review/26960
    Petri-Dish: Peter Wu <peter@xxxxxxxxxxxxx>
    Tested-by: Petri Dish Buildbot
    Reviewed-by: Anders Broman <a.broman58@xxxxxxxxx>
    (cherry picked from commit 699ee5dc529cc2be8a3d1721e506471321fdbc74)
    Reviewed-on: https://code.wireshark.org/review/26999
    Reviewed-by: Stig Bjørlykke <stig@xxxxxxxxxxxxx>
    

Actions performed:

    from  c46bc41   dfilter: add range support to set membership operator ("f in {x .. y}")
    adds  7a16851   dfilter: make spaces around ".." optional in display filter


Summary of changes:
 doc/wireshark-filter.pod                    |  4 ++--
 docbook/release-notes.asciidoc              |  2 +-
 docbook/wsug_src/WSUG_chapter_work.asciidoc |  4 ++--
 epan/dfilter/scanner.l                      | 11 +++++++++--
 tools/dftestlib/membership.py               |  9 +++++++--
 5 files changed, 21 insertions(+), 9 deletions(-)