Snort mailing list archives

[PATCH]: Introduce 'SnortStrToNumRng' -- Parse a ranged numeric value


From: <Joshua.Kinard () us-cert gov>
Date: Thu, 8 Sep 2011 00:11:58 -0500


Hi snort-devel,

I've never liked the duplication of the range parsing code across the
dsize, icode, itype, and urilen functions (ttl is special because of the
different delimiter).  So, I am taking a stab at cleaning that up.  The
two attached patches tackle:

1. The first patch introduces SnortStrToNumRng in src/util.c (and struct
NumericRange in src/util.h).  This function handles the parsing of a
value in the form of "300<>400", currently used by dsize, icode, itype,
and urilen.  It takes three arguments, the string to parse, the
delimiter as a string, and a NumericRange structure (typedef'ed).  If
successful, the 'min' and 'max' members of NumericRange will hold the
parsed value, swapped in the odd case if min > max.

2. The second patch modifies JUST dsize to use the new function, as well
as perform a general cleanup of the parsing function.  The eval function
was also renamed from 'CheckDsize' to 'DsizeCheckEval', which lines up
with other uses across the codebase.

If the devs like these changes, I will prepare patches for the remaining
keywords (icode, itype, and urilen) and send in patches to those.
Otherwise, if anyone sees any bugs, please let me know so I can correct
them and resend.


Thanks!,

--J

Attachment: snort-291-util_add-SnortStrToNumRng.patch
Description: snort-291-util_add-SnortStrToNumRng.patch

Attachment: snort-291-dsize_use-SnortStrToNumRng.patch
Description: snort-291-dsize_use-SnortStrToNumRng.patch

------------------------------------------------------------------------------
Doing More with Less: The Next Generation Virtual Desktop 
What are the key obstacles that have prevented many mid-market businesses
from deploying virtual desktops?   How do next-generation virtual desktops
provide companies an easier-to-deploy, easier-to-manage and more affordable
virtual desktop model.http://www.accelacomm.com/jaw/sfnl/114/51426474/
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

Current thread: