Re: Question on port lists and negation

[Jason <security () brvenik com>]

> Your large table of operations confuses me greatly, but it may be
> because I don't understand your syntax.
>
> > (80 == !(80 || 80))     :       0
> > !(80 == (80 || 80))     :       1
>
> What are those two supposed to represent, logically speaking, and how do
> they differ?
>
> From my C-code centered view I read (80 == !(80 || 80)) as:
>
> (80 "is equal to" not ( 80 BOOLEAN OR 80))
>
> Which is nonsense. You don't boolean OR together two integers. You can,
> but it's pointless nonsense.
>
> using [80,81] in for a dport rule would be read as:
>
> match if dport is equal to 80 or dport is equal to 81.
>
> Which I would express as:
>
> (dport == 80 || dport == 81)

The intent of the table was to show the various operations, simple as
that. While much of it does not make sense it was sufficient to
illustrate the point while keeping it contextual, at lest I thought. I
missed the mark on that one. Here is a verbose version of what I
intended to get across.

I attached the redone code too. I included every method (well most),
including the ones that do not make logical sense. It's not uncommon for
a type to cause an | instead of an || or to use an & instead of an | etc...

For a of 80, b of 80, t of 80
========================================
(a|b)                           : 80
(a||b)                          : 1
!(a|b)                          : 0
!(a||b)                         : 0
(!a|!b)                         : 0
(!a||!b)                        : 0
(a|b)                           : 80
t == (a|b)                      : 1
t == !(a|b)                     : 0
(t == a || t == b)              : 1
!(t == a || t == b)             : 0
(!(t == a) || !(t == b))        : 0
(t == a && t == b)              : 1
!(t == a && t == b)             : 0
(!(t == a) && !(t == b))        : 0



For a of 80, b of 81, t of 80
========================================
(a|b)                           : 81
(a||b)                          : 1
!(a|b)                          : 0
!(a||b)                         : 0
(!a|!b)                         : 0
(!a||!b)                        : 0
(a|b)                           : 81
t == (a|b)                      : 0
t == !(a|b)                     : 0
(t == a || t == b)              : 1
!(t == a || t == b)             : 0
(!(t == a) || !(t == b))        : 1
(t == a && t == b)              : 0
!(t == a && t == b)             : 1
(!(t == a) && !(t == b))        : 0



For a of 80, b of 81, t of 8000
========================================
(a|b)                           : 81
(a||b)                          : 1
!(a|b)                          : 0
!(a||b)                         : 0
(!a|!b)                         : 0
(!a||!b)                        : 0
(a|b)                           : 81
t == (a|b)                      : 0
t == !(a|b)                     : 0
(t == a || t == b)              : 0
!(t == a || t == b)             : 1
(!(t == a) || !(t == b))        : 1
(t == a && t == b)              : 0
!(t == a && t == b)             : 1
(!(t == a) && !(t == b))        : 1


I'll be sure to spend more time on writing replies to there topics.
And... I've still not had time to look at the code to see what it is
really doing, now I'm just too curious. I'll try to get to that
tomorrow. My gut tells me it is in the negation of lists but you and the
other Matt have different opinions. Testing and/or code are the only
true ways to provide the real answer.

#include <stdio.h>
#include <sys/types.h>

void test_it(int t, int a,int b);

int main (int argc, char const *argv[])
{
  int a = 80;
  int b = 80;
  int t = 80;

  test_it(t,a,b);

  a = 80;
  b = 81;
  t = 80;

  test_it(t,a,b);

  a = 80;
  b = 81;
  t = 8000;

  test_it(t,a,b);

  return 0;
}

void test_it(int t, int a,int b) {
  printf("\n\n\n");
  printf("For a of %u, b of %u, t of %u\n", a,b,t);
  printf("========================================\n");
  printf("(a|b)\t\t\t\t: %u\n", (a|b));
  printf("(a||b)\t\t\t\t: %u\n", (a||b));
  printf("!(a|b)\t\t\t\t: %u\n", !(a|b));
  printf("!(a||b)\t\t\t\t: %u\n", !(a||b));
  printf("(!a|!b)\t\t\t\t: %u\n", (!a|!b));
  printf("(!a||!b)\t\t\t: %u\n", (!a||!b));
  printf("(a|b)\t\t\t\t: %u\n", (a|b));
  printf("t == (a|b)\t\t\t: %u\n", t == (a|b));
  printf("t == !(a|b)\t\t\t: %u\n", t == !(a|b));
  printf("(t == a || t == b)\t\t: %u\n", (t == a || t == b));
  printf("!(t == a || t == b)\t\t: %u\n", !(t == a || t == b));
  printf("(!(t == a) || !(t == b))\t: %u\n", (!(t == a) || !(t == b)));
  printf("(t == a && t == b)\t\t: %u\n", (t == a && t == b));
  printf("!(t == a && t == b)\t\t: %u\n", !(t == a && t == b));
  printf("(!(t == a) && !(t == b))\t: %u\n", (!(t == a) && !(t == b)));
   
}

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users