Skip to content
GitLab
    • GitLab: the DevOps platform
    • Explore GitLab
    • Install GitLab
    • How GitLab compares
    • Get started
    • GitLab docs
    • GitLab Learn
  • Pricing
  • Talk to an expert
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
    Projects Groups Topics Snippets
  • Register
  • Sign in
  • wireshark wireshark
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
    • Locked files
  • Issues 1.4k
    • Issues 1.4k
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 183
    • Merge requests 183
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Artifacts
    • Schedules
    • Test cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Model experiments
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • External wiki
    • External wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Wireshark FoundationWireshark Foundation
  • wiresharkwireshark
  • Issues
  • #17160
Closed
Open
Issue created Jan 16, 2021 by Ginny Spicer@GinnyS

Macro Filters Can't Handle Escaped Characters

Summary

Escaped characters cannot be used in a macro filter or else the filter will be rejected when the macro is invoked.

Steps to reproduce

Create a macro filter that escapes at least one character (ex: frame contains "some \"quotes\"" && ip.dst == $1) and invoke the macro in the filter bar.

What is the current bug behavior?

Wireshark to reject the filter when it is called, saying "The string _____ was unexpected in this context" if there were more parts of the filter after the escaped character. If the escaped character was part of the last condition, Wireshark displays a "syntax error". No error is shown when adding the filter as a macro and the filter with escapes can be used without a variable in the filter bar without issue.

What is the expected correct behavior?

The macro filter should be able to interpret character escapes in the same way that the filter bar can.

Build information

3.4.2 (v3.4.2-0-ga889cf1b1bf9)

Compiled (64-bit) with Qt 5.15.1, with libpcap, with GLib 2.52.3, with zlib
1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.3
and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB
resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with
Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic updates using
WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler).

Running on 64-bit Windows 10 (1903), build 18362, with Intel(R) Core(TM)
i7-1065G7 CPU @ 1.30GHz (with SSE4.2), with 16061 MB of physical memory, with
locale English_United States.utf8, with light display mode, with mixed DPI, with
Npcap version 1.00, based on libpcap version 1.9.1, with GnuTLS 3.6.3, with
Gcrypt 1.8.3, with brotli 1.0.2, without AirPcap, binary plugins supported (21
loaded).

Built using Microsoft Visual Studio 2019 (VC++ 14.28, build 29335).
Edited May 25, 2021 by João Valverde
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking