Hi Laurentiu,<div><br></div><div>Is the padding always at the end? If so, you can use:</div><div><br></div><div>padding: bytestring &restofdata;</div><div><br></div><div>Ruoming<br><br><div class="gmail_quote">2008/12/1 Cucos, Laurentiu <span dir="ltr"><<a href="mailto:Laurentiu.Cucos@compuware.com">Laurentiu.Cucos@compuware.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div>
<p><font color="#000000" size="2" face="Arial">Hi All,</font>
</p>
<p><font face="Times New Roman">Tying to use binpac to create a new protocol analyzer I run into a small issue relative to byte alignment. I am thinking this must be a known aspect however I didn't find much documentation about it. </font></p>
<p><font face="Times New Roman">Padding in binpac works well inside the packet. However, sometime the packet ends with a structure that requires padding but the packet doesn't carry the extra bytes for the padding. As a result binpac fires an exception and the parsing is terminated before extracting the data. </font></p>
<p><font face="Times New Roman">Here is a sample code:</font>
<br><font face="Times New Roman">type ByteArray = record{</font>
<br> <font face="Times New Roman">len : uint32;</font>
<br> <font face="Times New Roman">data: uint8[len]; </font>
<br> <font face="Times New Roman">pad : padding align 4;</font>
<br><font face="Times New Roman">};</font>
</p>
<p><font face="Times New Roman">When the last 6 bytes of a packet that ends with the above record is: 00 00 00 02 AA BB (with: len=00 00 00 02; data ={AA, BB}) binpac throws: </font></p>
<p><font face="Times New Roman">0.000000 binpac exception: binpac exception: out_of_bound: ByteArray: 8 > 6</font>
</p>
<br>
<p><font face="Times New Roman">Removing the padding entry from the code above results in a correct execution, however the padding is needed for the case when ByteArray is strictly inside the packet. </font></p>
<p><font face="Times New Roman">The solution I am thinking is way too complex (pass some arguments that will help decide if the padding is needed), but I was wondering if there is a much more elegant approach.</font></p>
<p><font face="Times New Roman">Another option will be to change the binpac compiler code (pac_record.cc) in method: void RecordPaddingField::GenFieldEnd(Output* out_cc, Env* env, const DataPtr& field_begin) but I am thinking this case should be covered in a different way.</font></p>
<p><font face="Times New Roman">Any suggestions would be greatly appreciated.</font>
</p>
<p><font face="Times New Roman">Thank you,</font>
<br><font face="Times New Roman">Laurentiu Cucos</font>
</p>
<br>
<br><font face="Arial" size="1">
<font size="2">
<font size="1">The contents of this e-mail are intended for the named addressee only. It contains information that may be confidential. Unless you are the named addressee or an authorized designee, you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it</font>.</font><br>
<br></font>
</div></div>
<br>_______________________________________________<br>
Bro mailing list<br>
<a href="mailto:bro@bro-ids.org">bro@bro-ids.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro</a><br></blockquote></div><br></div>