* ipt_string+udp...
@ 2002-09-23 18:12 Mark Steele
2002-09-23 18:53 ` ipt_string+udp Antony Stone
0 siblings, 1 reply; 2+ messages in thread
From: Mark Steele @ 2002-09-23 18:12 UTC (permalink / raw)
To: netfilter
Doh!
My bad, disregard the last post I sent. Removing the dot
fixed the problem. Just to enlighten me a bit, what
string would I use if I wanted to use the whole
domain name?
--
Mark Steele
Vice president recherche et developpement
Inet Technologies Inc.
email: msteele@inet-technologies.com
tel: (514) 397-4638 ext. 252
>Yes. You are assuming that a UDP port 53 packet corresponding to a >lookup
>of militaire.org actually contains the literal string "militaire.org".
>
>In fact it doesn't. Specifically, the dot separating the domain name >from
>the org is not an Ascii 46 (0x2E).
>
>Try changing your string match to look for just "militaire" and see if >that
>works.
>
>Antony.
>
>--
>
>Software development can be quick, high-quality, or low-cost.
>
>The customer gets to pick any two out of three.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: ipt_string+udp...
2002-09-23 18:12 ipt_string+udp Mark Steele
@ 2002-09-23 18:53 ` Antony Stone
0 siblings, 0 replies; 2+ messages in thread
From: Antony Stone @ 2002-09-23 18:53 UTC (permalink / raw)
To: netfilter
On Monday 23 September 2002 7:12 pm, Mark Steele wrote:
> Doh!
>
> My bad, disregard the last post I sent. Removing the dot
> fixed the problem. Just to enlighten me a bit, what
> string would I use if I wanted to use the whole
> domain name?
It depends on the domain name you're trying to match.
Suppose you're looking up www.domain.org
There's a binary value immediately before each part of the name you're
resolving (www, domain, and org), which is the number of characters in that
part of the name.
Therefore in this case the string is: 0x03 w w w 0x06 d o m a i n 0x03 o r g
If you were resolving lists.netfilter.org it would be:
0x05 l i s t s 0x09 n e t f i l t e r 0x03 o r g
Antony.
--
Most people are aware that the Universe is big.
- Paul Davies, Professor of Theoretical Physics
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2002-09-23 18:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-09-23 18:12 ipt_string+udp Mark Steele
2002-09-23 18:53 ` ipt_string+udp Antony Stone
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox