Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 12184] MATE AVPL match modes "Loose" and "Every" do not work correctly

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 2 on bug 12184 from Pavel Sindelka

(In reply to Peter Wu from comment #1)

Seems it is going to be a language issue, as I've never used English to discuss
matters of mathematics.

For Every and Strict, I've either misunderstood Luis or you, or maybe you've
just swapped the mapping between the names and the descriptions in your
Comment?

Loose is fine - there is at least one matching data AVP for at least one of the
conditions in the list, here we agree.

To me, what Luis wrote about "Every" means that "for each attribute on the
condition list which exists at least once also in the data list, at least one
of the values of that attribute on the data list must match the condition for
that attribute. Any attribute on the condition list which has no counterpart on
the data list is ignored".

So using the set theory vernacular, you examine the conditions only on the
intersection of the two lists, except that it is hard to talk about an
intersection here: if you take the complete elements, they are different in the
two sets so the intersection is always empty, if you take just their
"attribute" part, some elements may exist twice in each of the operand sets
which I doubt is compatible with set theory - at least it makes it impossible
to represent sets of finite counts of elements as bitmaps).

So let's describe it algorithmically instead: you set the "total result" bit to
1 and start a foreach walk through the list of conditions. For each condition
on the list, you first check whether there is any compatible data element
available; if not, you do nothing and move to the next condition. If data
elements compatible with that condition are available, you set the "local
result" bit to 0 and examine all of them for a match (i.e. you must not stop
the evaluation on first match). For each compatible data element which matches,
you "or" the local result with 1 and mark that data element as part of the
result list. When finished, you "and" the "total result" bit with the value of
the "local result". If the "total result" becomes 0, you may break the outer
foreach because if the total result is "no match", nobody cares about the match
list.

For Strict, at least one compatible data attribute must exist for each
condition, and at least one of all the compatible data attributes must match
its condition.

I haven't dug too deep in this case, but theoretically you can have the
following:

data list: (a=10, a=12, a=20)
conditions list: (a<15)

In this case, a Strict match succeeds, and the result list is (a=10, a=12)

If you'd add (b=7) to the conditions list, a Strict match would fail on the
same data list, while an Every match would still succeed, yielding the same
result list. Every would still succeed if you'd add b=7 to the data list, but
it would fail if you'd add b=10 instead.

Just for the case, two conditions dealing with the same attribute may exist on
the conditions list, so it may look like this:
(a<11,a>15)

Both Every and Strict would match on the data list above, yielding a result
list (a=10,a=20) and both would fail if you'd remove any of (a=10, a=20) from
the data list; a Loose match with the same conditions and data would still
succeed if you'd remove either a=10 or a=20 from the original list but fail if
you'd remove both.

---

      You are receiving this mail because:

• You are watching all bug changes.