Igalia / pflua

Packet filtering in Lua
Other
313 stars 39 forks source link

len == 4 doesn't parse #133

Closed kbara closed 9 years ago

kbara commented 9 years ago

This should work, but doesn't.

% tcpdump -d "len == 4"
(000) ld       #pktlen
(001) jeq      #0x4             jt 2    jf 3
(002) ret      #65535
(003) ret      #0
% ./pflua-match ../tests/data/wingolog.pcap "len == 4" 
luajit: ../src/pf/parse.lua:290: 
Error: In expression "len == 4"
                            ^
bad token while parsing arithmetic expression =

stack traceback:
        [C]: in function 'primitive_error'
        ../src/pf/parse.lua:290: in function 'error'
        ../src/pf/parse.lua:709: in function 'parse_primary_arithmetic'
        ../src/pf/parse.lua:723: in function 'parse_arithmetic'
        ../src/pf/parse.lua:869: in function 'parse_logical_or_arithmetic'
        ../src/pf/parse.lua:891: in function 'parse_logical'
        ../src/pf/parse.lua:899: in function 'parse'
        ../src/pf.lua:32: in function 'get_predicate'
        ./pflua-match:58: in function 'main'
        ./pflua-match:84: in main chunk
        [C]: at 0x00404bc0

The semantics in tcpdump are that "len = N" and "len == N" are equivalent, where N is an arbitrary math expression.

kbara commented 9 years ago

This shows up in less contrived examples as well, such as this filter from the tcpdump man page:

tcp[13] == 2
kbara commented 9 years ago

Fixed in ed868439aafbc12f14b401649760f4a2d3a960e3