Conversation
as is done for u8 and u32
Ie inequality test for integer Also adds prefilter functions for u16
In case of greater/lesser or equal
Despite what the comment said 1<>2 is not a valid range as it is empty and cannot have any match. Maybe we should even consider 1<>3 an invalid range as it should rather be written as =2
from http2 to a generic file so that it can be reused by dcerpc and others
aka DetectUintModeNe
ie <0 is impossible
| } | ||
|
|
||
| #[derive(Debug)] | ||
| pub struct DetectU32Data { |
There was a problem hiding this comment.
@jasonish how do you recommend doing this ?
We will need the same structure and code for u8, u16, u32 and u64
There was a problem hiding this comment.
I guess one could use an enum?
enum UintValue {
U8(u8),
U16(u6),
U32(u32),
}
struct DetectUintData {
pub val: UintValue,
pub valrange: UintValue,
}
it will at least reduce non-common code that is only size specific.
There was a problem hiding this comment.
With this, val could be u8 and valrange u16 ...
I will look into it a bit more, see how other crates handled it...
There was a problem hiding this comment.
I see that num-integer (used by suricata) uses macros for such as case cf https://github.com/rust-num/num-integer/blob/master/src/roots.rs#L165
@jasonish is not there a derive thing like suricata_derive::AppLayerEvent ?
Or maybe use crate https://docs.rs/num/0.4.0/num/integer/trait.Integer.html ?
There was a problem hiding this comment.
I see that num-integer (used by suricata) uses macros for such as case cf https://github.com/rust-num/num-integer/blob/master/src/roots.rs#L165
@jasonish is not there a derive thing like
suricata_derive::AppLayerEvent?
No, we'd have to write that.
Or maybe use crate
https://docs.rs/num/0.4.0/num/integer/trait.Integer.html?
If these fit your needs, then I think they are good to use. We already have them in our deps. I don't think I've used them myself though.
There was a problem hiding this comment.
Managing something with rust generics... let's talk in next version of PR ;-)
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4112
Describe changes:
DetectUintstructure fordsizeanddcerpcStill TODO: