Closed sharksforarms closed 4 years ago
Agreed, this causes a lot of code duplication, and I can't remember the original reason for that. 4.0 may be a good opportunity to factorize the code
I'll look into that
I found no good reason for fields duplication, so this is now implemented. Thanks!
That said, if you need that for the suricata PR, you'll have to wait for der-parser
4.0 release [*], which is a major (and API-breaking) upgrade. I'm still running some checks, documenting upgrade, and looking at the resulting API (for ex in x509-parser
) before the final release.
[*] especially since 3.0 is used in other dependencies in suricata, like kerberos, snmp, x509 etc. They all need to be upgraded before 4.0 can be used!
Currently looking at: https://redmine.openinfosecfoundation.org/issues/2977
I've run into an issue where to be able to implement the detect-asn1 checks, some fields cannot be accessed with the current API, such as the length
len
of the BerObjectHeader.The
parse_ber
function currently returns a BerObjectNote, the similarities with BerObjectHeader
And the following which is called in
parse_ber
after both the header/content are parsed:(Note, the
len
from hdr is not copied and can no longer be accessed, the.to_header()
method on the BerObject explicitly sets this value to 0)What if a BerObject looked like this?
Let me know what you think and I can start working on it!