Lua: Comparing a boolean value

Question

I've been trying to get a comparison going on my code, but can't seem to manage the way to do it:

I have this field:

f.bitmap1_b1_10000000 = ProtoField.bool("f.bitmap1_b1_10000000","condition present?",8,{"Present","Not Present"},0x80)

I then eventually set it's value:

local bitmap1_b1_10000000 = data(offset,1)
subtree:add(f.bitmap1_b1_10000000,bitmap1_b1_10000000)

And the value shows up correctly on the dissector window (I've checked, and it works for every one of the 128 fields.. >_<)

Now, onto parsing the rest of the data, I'm trying to conditionally execute my code based upon the boolean fields, but cannot seem to:

These DO work on the GUI, but DO NOT work on the code(devel 1.7.0):

if f.bitmap1_b1_10000000 == 1 then
    offset = offset + 8
end
if f.bitmap1_b1_10000000 == "Present" then
offset = offset + 8
end

This too does not work (for some reason beyond my comprehension):

if (data(correct_offset,1):uint() and 0x80) then
offset = offset + 8
end

Neither does this:

if (data(correct_offset,1):uint() % (2*0x80) >= 0x80) then
offset = offset + 8
end

(the offsets are correct on the code, I’m just simplifing them here)

So, is there a way to actually do it? What am I doing wrong?

Accepted Answer

Display Filters != Lua

By "work on the GUI", are you referring to the Display Filter Textbox? As in: you enter "f.bitmap1_b1_10000000 == 1" into the textbox, which filters your packet list accordingly, but when you try that same predicate in Lua, it does not evaluate to true. Correct? If so, then you're incorrectly assuming the syntax is the same.

In your Lua, this line:

if f.bitmap1_b1_10000000 == 1 then

is comparing whether the ProtoField defined by f.bitmap1_b1_10000000 is equal to 1, which is nonsense because of a type mismatch. That should be a syntax error.

Maybe you meant to use the variable (with a similar name) you had declared earlier:

if bitmap1_b1_10000000 == 1 then

but that would be comparing a TvbRange with a number, which is the same syntax error as before.

I'm not sure why this filter:

f.bitmap1_b1_10000000 == "Present"

does anything for you. That's comparing a boolean field (which presumably only accepts 0, 1, false, and true) to a string. I guess it could be comparing only the first byte of the string (empty string is false, else true).

Use `bit.band`

The and keyword is logical AND; not bitwise AND. You're looking for bit.band (which Wireshark Lua supports natively):

if (bit.band( data(correct_offset,1):uint(), 0x80 ) == 0x80) then

Your original line always evaluates to true:

if (data(correct_offset,1):uint() and 0x80) then

In Lua, when non-nil objects are logically AND-ed, the result is always the last object. For example, (1 and 0) is true and results in 0; and (1 and nil) is false and results in nil.

So, assuming uint() is never nil, the above line is equivalent to:

if 0x80 then

which is also:

if true then

Lua: Comparing a boolean value

Display Filters != Lua

Use bit.band

Use `bit.band`