Skip to content
This repository has been archived by the owner on Apr 14, 2023. It is now read-only.

Extract function cannot export entire string at end of packet #14

Open
corbers opened this issue Sep 22, 2017 · 1 comment
Open

Extract function cannot export entire string at end of packet #14

corbers opened this issue Sep 22, 2017 · 1 comment
Assignees
Labels

Comments

@corbers
Copy link

corbers commented Sep 22, 2017

I believe there is an issue when writing a fingerprint to extract some data from the end of a packet. The schema for an Extract node is that it should contain a From and a To attribute. The From indicates the index into the data where the extraction begins and the To attribute indicates the index up to which data is extracted. E.g. If the packet contains a stream of numbers...
0123456789
Then to extract the first character the Extract XML should be
<Extract From="0" To="1" ...>
To extract the first two characters the Extract XML should be
<Extract From="0" To="2" ...>
And then to extract the entire string the Extract XML should be
<Extract From="0" To="10" ...>
This XML instructs that the data from index 0 to 9 will be extracted. "To" means up to, but not including index 10. This is fine. However, the extract function in PacketData.java requires that the To value must be less than the payload size. This test always fails and so no data is extracted. I hope this makes sense.

@iadgovuser22
Copy link

Hi corbers,

Sorry it took so long to get back to you.

This does make sense and you are indeed correct. There is an off-by-one error on the end of the range that leaves the last byte inaccessible. The fix for this will be coming in the 3.2.2 patch, which we hope to release before December 2017.

Thanks

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

5 participants