[Snort-devel] [PATCH]: Introduce 'SnortStrToNumRng' -- Parse a ranged numeric value

Joshua.Kinard at ...3108... Joshua.Kinard at ...3108...
Thu Sep 8 01:11:58 EDT 2011


Hi snort-devel,

I've never liked the duplication of the range parsing code across the
dsize, icode, itype, and urilen functions (ttl is special because of the
different delimiter).  So, I am taking a stab at cleaning that up.  The
two attached patches tackle:

1. The first patch introduces SnortStrToNumRng in src/util.c (and struct
NumericRange in src/util.h).  This function handles the parsing of a
value in the form of "300<>400", currently used by dsize, icode, itype,
and urilen.  It takes three arguments, the string to parse, the
delimiter as a string, and a NumericRange structure (typedef'ed).  If
successful, the 'min' and 'max' members of NumericRange will hold the
parsed value, swapped in the odd case if min > max.

2. The second patch modifies JUST dsize to use the new function, as well
as perform a general cleanup of the parsing function.  The eval function
was also renamed from 'CheckDsize' to 'DsizeCheckEval', which lines up
with other uses across the codebase.

If the devs like these changes, I will prepare patches for the remaining
keywords (icode, itype, and urilen) and send in patches to those.
Otherwise, if anyone sees any bugs, please let me know so I can correct
them and resend.


Thanks!,

--J
-------------- next part --------------
A non-text attachment was scrubbed...
Name: snort-291-util_add-SnortStrToNumRng.patch
Type: application/octet-stream
Size: 3324 bytes
Desc: snort-291-util_add-SnortStrToNumRng.patch
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20110908/001db9b0/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: snort-291-dsize_use-SnortStrToNumRng.patch
Type: application/octet-stream
Size: 6123 bytes
Desc: snort-291-dsize_use-SnortStrToNumRng.patch
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20110908/001db9b0/attachment-0001.obj>


More information about the Snort-devel mailing list