-
Notifications
You must be signed in to change notification settings - Fork 750
Description
For expressions using in (a, b, c, d), matching is done using a set membership test instead of a sequence of single comparisons. As an initial quick comparison, when building the set it keeps track of the shortest and longest member of the set. When matching, if a subject value is not within those lengths, the set membership test is skipped.
#1049 got this working with non-string values like ports. In these cases, the port values are converted to 16 bit values and the binary values are added to the set.
However, sinsp_filter_check::add_filter_value had a bug, where the lengths used to consider the shortest and longest value were of the string value e.g. 4 bytes for "2222" and not 2 bytes for the parsed 16 bit port.
So if you had an in expression consisting only of 3 or 4 digit ports, the in matching wouldn't work, as the range of lengths wouldn't include 2, which was the length of the actual port.