[Bro-Dev] [BinPac] ParserBuffer with case not producing correct code

Siwek, Jon jsiwek at illinois.edu
Thu Jun 5 08:13:23 PDT 2014


On Jun 5, 2014, at 5:54 AM, Martina Balintova <balint.martina at gmail.com> wrote:
> // foo-protocol.pac
> type FOO_PDU(is_orig: bool) = record {
>     header:        FOO_Header(is_orig);
>     xbody:        case header.flag of {
>         1 ->    plain_body: FOO_Body(header);
>         0 ->    encrypt_body: Encrypted_Body;
>     } &length = header.length &requires (header.flag);
> } &byteorder = bigendian;
> 

>  compiler is complaining that error: ‘xbody_’ was not declared in this scope. It is missing in constructor of FOO_PDU. When I checked snmp analyzer, It is doing this process correctly

One difference is that the xbody field of FOO_PDU has the &length attribute apply to the entire case field.  I’d be suspicious that the generated parser has a problem with that.  And it may make more sense to instead have each condition of the case use header.length however it needs to.  E.g.

type FOO_PDU(is_orig: bool) = record {
	header: FOO_Header(is_orig);
	xbody : case header.flag of {
		1 -> plain_body: FOO_Body(header);
		0 -> encrypt_body: Encrypted_Body(header);
	};
} &byteorder = bigendian;

# I’m just making up the following for demonstration:
type FOO_Body(header: FOO_Header) = record {
	tag: uint8;
	data: bytestring &length = header.length - 1;
};

type Encrypted_Body(header: FOO_Header) = record {
	data: bytestring &length = header.length &transient;
};

- Jon


More information about the bro-dev mailing list