ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 12184] MATE AVPL match modes "Loose" and "Every" do not wo

Date: Sun, 18 Sep 2016 16:23:52 +0000

Comment # 7 on bug 12184 from
I have pushed some buggy WIP to implement the (wrong) idea following the
updated wiki/bug comments, it will be modified as things become clearer.

The current code has one fatal flaw, it compares attributes by their memory
address. Should we have data (a=1,b=2) then it is possible that Loose (b=2)
does not match depending on whether &a < &b or &a > &b (where '&' denotes
address-of operator). After fixing this, the Loose case seems fixed.
(Additionally, I no longer return an empty list if the match fails, it now
returns NULL (=failed match)).

From
https://wiki.wireshark.org/Mate/Reference?action="">
:
>> PDUS, GoPs and GoGs use an AVPL to contain the tracing information.
>> An AVPL is an unsorted set of AVPs that can be matched against other AVPLs.

All matching functions however expect sorted AVPLs (this is enforced at
insertion time). Perhaps it refers to the MATE configuration file where
"Gop sess On pdu_name (a, a, b)" is the same as
"Gop sess On pdu_name (a, b, a)".

"Strict" seems to have a totally diferent meaning than assumed before.
Apparently it only consumes the first AVP from the data AVPL (such that it
cannot be matched by other conditions). With this assumption,
"Match Strict (a, a)" would fail on (a=1), but succeed on (a=1,a=2).

The current (modified) wording of the wiki is contradictory (or at least
confusing). The original revision says:
>> "Every" Match: Will match if none of the AVPs of the operator AVPL fails to
>> match a present AVP in the operand AVPL, even if not all of the operator's
>> AVPs have a match. If it matches it will return an AVPL containing all AVPs
>> from the operand AVPL that did match one AVP in the operator AVPL.

I think this is the same as the "Strict" behavior I described before.

Maybe you could jump on #wireshark on Freenode IRC for some faster feedback?


You are receiving this mail because:
  • You are watching all bug changes.