binpac usage of &length = -1

Development
1

Hi,

When I check the binpac source code related to FlowBuffer, I find this comment:

// A negative frame_length represents a frame till EOF
void NewFrame(int frame_length, bool chunked_);

My guess that this frame_length is record attribute &length.

So I played with an a record

type req = record{
header : uint8;
data : bytestring &restofdata;
}
&length = -1 ;

I defined the event handler to print out header values, but I found that in .cc file, the binpac NewData is called, but nothing is printed out.

So any one has idea how this &length = -1 is used?

2

So one thing is that I'm not sure the &length attribute transfers over
to the NewFrame() call, don't know the internals there. Second, the
&restofdata should already tell BinPAC++ that you want all the
remaining data; do you find that a &length is needed in addition? (As
usual, I'm arguing from the perspective here how I believe that binpac
*should* work; that doesn't always match what it actually
does/requires ..).

Robin

3

type req = record{
header : uint8;
data : bytestring &restofdata;
}
&length = -1 ;

So one thing is that I’m not sure the &length attribute transfers over
to the NewFrame() call, don’t know the internals there. Second, the
&restofdata should already tell BinPAC++ that you want all the
remaining data; do you find that a &length is needed in addition? (As
usual, I’m arguing from the perspective here how I believe that binpac
should work; that doesn’t always match what it actually
does/requires …).

Unfortunately, yes, you needed the &length field. Otherwise:

/home/****/bro/src/dnp3-protocol.pac:42: error : cannot handle incremental input

Then the interesting question is when binpac can handle incremental input?

4

Unfortunately, yes, you needed the &length field. Otherwise:

/home/****/bro/src/dnp3-protocol.pac:42: error : cannot handle incremental
input

Too bad, that sounds like a case it should be able to support rather
easily.

Then the interesting question is when binpac can handle incremental input?

I have no idea ... It might actually be worth looking at the code and
see where it stumbles. And/or try the dce_rpc approach as we
discussed.

Robin

5

Reaching a stuck point. I included some of my studies here and also my question.