Key Pages: [ Rope Home Page | Basics (tutorial) | Language Reference | Download ]

ROPE Language Reference - "expect_one"

"expect_one" is used to apply a number of alternative tests to the packet, and verify that one of them is passed.

The "expect_one" action takes any number of blocks (and therefore must be called with AnchorBrackets). It executes each block in turn until a block returns with a yes status. When a block returns yes, expect_one stops processing and returns the portion of the $packet that was spanned by the block.

Moreover, when expect_one starts it's execution, it takes an internal note of the value of $offset, and then resets it to it's original value at the start of each block.

If none of the blocks return yes, the expect_one returns no to IpTables.

All of which means ... you can use expect_one to check whether the packet matches one of a number of alternatives.

For example, the following script checks that the packet contains either a set of uppercase letters, or a set of four or more digits. If either of these patterns matches the packet, then that portion of it is printed. If neither pattern matches then the script terminates with a no status.

expect_one(
   {
      # Check for one or more letters
      expect_while( {isupper} )
      yes
   } {
      # Check for four or more digits
      expect_while( {isdigit} )
      strlen 4 ge assert
      yes
   }
)
println

Note that..

expect_one "catches" yes and no returns from the blocks it calls and processes them itself - they dont cause the script to terminate immediately.
if one of the blocks returns a yes, expect_one stops processing the blocks but allows the script execution to continue. ie: a yes inside an expect_while does not terminate the script.
if none of the blocks returns a yes then expect_one returns a no to IpTables.
A block that returns neither yes nor no is treated as if it returned no.
if a block returns a no (or nothing), expect_one continues to the next block. ie: a no inside an expect_one does not terminate the script by itself. But if all blocks return no or nothing, then expect_one returns a no.

ROPE Language Reference - "expect_one"

See Also