evaluate: use flagcmp for single RHS bitmask expression

Always use flagcmp for RHS bitmask expressions, independant of whether
only one or an entire list of bitmask expression is specified.

This makes sure that f.i. "tcp flags ack" will match any combinations
of ACK instead of ACK and only ACK.

Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/src/evaluate.c b/src/evaluate.c
index 8e51a63b4486fdddfc7c697f3dbf48b2046e96d2..f10d0d98ab64eab2e538fb86b98f98b36cc904a6 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -885,7 +885,11 @@ static int expr_evaluate_relational(struct eval_ctx *ctx, struct expr **expr)
                        rel->op = OP_FLAGCMP;
                        break;
                default:
-                       rel->op = OP_EQ;
+                       if (right->dtype->basetype != NULL &&
+                           right->dtype->basetype->type == TYPE_BITMASK)
+                               rel->op = OP_FLAGCMP;
+                       else
+                               rel->op = OP_EQ;
                        break;
                }
        }