[Snort-sigs] What is the & operator in byte_test for?

Matt Kettler mkettler at ...189...
Mon Aug 2 15:07:04 EDT 2004


At 05:30 PM 7/29/2004, Jeff Dell wrote:
>There is also an undocumented operator for bitwise OR that is the ^
>character.
>
>Cheers,
>Jeff

The C programmer in me cringes at this :) I'd have assumed ^ to be XOR 
(exclusive-or).

Actually, looking at the source code, it IS an XOR not an OR operator, 
despite the name of the #define being BT_OR.

          case '^': idx->operator = BT_OR;
<snip>

         case BT_OR: if ((value ^ btd->cmp_value) > 0)

The second bit is the actual implementation, and it's using ^ as a C 
operator, which is bitwise-XOR.





More information about the Snort-sigs mailing list