idmef criteria parsing
Olaf Gellert <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi all, I am calling "idmef_criteria_new_from_string" for a few strings. Here are my expressions: alert.classification.text = "whatever" alert. = alert.classification.text = "whatever" alert.classification.text = "whatever" Note, that the first, third and 4th expressions are valid (and all the same), the second one is invalid. Calling idmef_criteria_new_from_string with the first string returns 0, ok. The second expression returns an error, saying "syntax error". Ok. But now on the third one I still get an error: "syntax error". It seems there is some state left in the lex parsing of the string??? This does not happen if I modify the second string to "alert. = bla" which is still invalid (gives an error "Unknown IDMEF child ''"), but then the third string is parsed ok... Unfortunately I am not firm enough wih LEX to find the reason... By the way, after each error I call idmef_criteria_destroy if the returned criteria is not NULL and I set the pointer to the criteria to "NULL", just to make sure... Any hints? Cheers, Olaf -- Dipl.Inform. Olaf Gellert INTRUSION-LAB.NET Senior Researcher, www.intrusion-lab.net PKI - and IDS - Services [email protected] _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel