% tcpdump -d "len == 4"
(000) ld #pktlen
(001) jeq #0x4 jt 2 jf 3
(002) ret #65535
(003) ret #0
% ./pflua-match ../tests/data/wingolog.pcap "len == 4"
luajit: ../src/pf/parse.lua:290:
Error: In expression "len == 4"
^
bad token while parsing arithmetic expression =
stack traceback:
[C]: in function 'primitive_error'
../src/pf/parse.lua:290: in function 'error'
../src/pf/parse.lua:709: in function 'parse_primary_arithmetic'
../src/pf/parse.lua:723: in function 'parse_arithmetic'
../src/pf/parse.lua:869: in function 'parse_logical_or_arithmetic'
../src/pf/parse.lua:891: in function 'parse_logical'
../src/pf/parse.lua:899: in function 'parse'
../src/pf.lua:32: in function 'get_predicate'
./pflua-match:58: in function 'main'
./pflua-match:84: in main chunk
[C]: at 0x00404bc0
The semantics in tcpdump are that "len = N" and "len == N" are equivalent, where N is an arbitrary math expression.
This should work, but doesn't.
The semantics in tcpdump are that "len = N" and "len == N" are equivalent, where N is an arbitrary math expression.