Wireshark · Ethereal-cvs: [ethereal-cvs] cvs commit: ethereal dfilter-grammar.y dfilter-scanner.l dfilter.c dfilter.h

["Gilbert Ramirez Jr." <gram@xxxxxxxxxxxx>]

gram        1999/10/11 23:21:24 CDT

  Modified files:
    .                    dfilter-grammar.y dfilter-scanner.l 
                         dfilter.c dfilter.h file.c proto.c 
                         proto.h 
  Log:
  Re-implemented fix to keep display filter from reading data from outside
  the packet boundary. Now the field boundary is honored. The frame boundary
  is ignored, but of course we put proper field lengths in the proto_tree,
  right? :)
  
  Implemented negative offsets in byte-strings:
  	frame[-4:4] will read the last 4 bytes of a frame.
  
  Implemented "offset-only" byte-string comparisons, since the dfilter
  compiler knows the length of the byte-string you supplied. These are
  now legal:
  	frame[-4] == 0.0.0.1
  	tr.dst[0] == 00:06:29
  
  Implemented the use of integers if you're comparing one byte. These are
  legal:
  	llc[0] == 0xaa
  	llc[0:1] == 0xaa
  
  All these forms check against the length of the field, so these will be
  reported as bad to the user:
  	eth.src[5] == 00:06:29      (goes beyond field boundary)
  	eth.dst == 1.2.3.4.5.6.7    (too long, goes beyond field boundary)
  
  Thes is also reported as bad:
  	eth.dst[0:3] == 1.2          (incorrect number of bytes specified)
  	eth.dst[0:1] == eth.src[0:2] (disparate lengths)
  
  I had to add a new function, proto_registrar_get_length() in proto.c, which
  reports the length of a field as can be determined at registration time.
  
  There are some shift/reduce errors in the grammar that I need to get rid of.
  
  Revision  Changes    Path
  1.26      +164 -2    ethereal/dfilter-grammar.y
  1.19      +20 -1     ethereal/dfilter-scanner.l
  1.29      +44 -25    ethereal/dfilter.c
  1.13      +2 -2      ethereal/dfilter.h
  1.107     +4 -4      ethereal/file.c
  1.34      +54 -1     ethereal/proto.c
  1.16      +6 -1      ethereal/proto.h