next up previous contents index
Next: Patterns Up: Values, Types, and Constants Previous: Enumerations   Contents   Index

Subsections


Strings

The string type holds character-string values, used to represent and manipulate text.


String Constants

You create string constants by enclosing text within double (") quotes. A backslash character (\) introduces an escape sequence. The following ANSI C escape sequences are recognized: \a yields an alert (bell) character, \b yields a backspace character, \f yields a formfeed character, \n yields a newline character, \r yields a carriage return character, \t a tab character, \octal-digits the 8-bit ASCII character with code octal-digits, and \xhex-digits the 8-bit ASCII character with code hex-digits. Bro string constants currently cannot be continued across multiple lines by escaping newlines in the input. This may change in the future. Any other character following a \ is passed along literally.

Unlike with C, strings are represented internally as a count and a vector of bytes, rather than a NUL-terminated series of bytes. This difference is important because NULs can easily be introduced into strings derived from network traffic, either by the nature of the application, inadvertently, or maliciously by an attacker attempting to subvert the monitor. An example of the latter is sending the following to an FTP server:

    USER nice\0USER root
where ``\0'' represents a NUL. Depending on how it is written, the FTP application receiving this text might well interpret it as two separate commands, ``USER nice'' followed by ``USER root''. But if the monitoring program uses NUL-terminated strings, then it will effectively see only ``USER nice'' and have no opportunity to detect the subversive action.

Note that Bro string constants are automatically NUL-terminated.

Note: While Bro itself allows NULs in strings, their presence in arguments to many Bro functions results in a run-time error, as often their presence (or, conversely, lack of a NUL terminator) indicates some sort of problem (particularly for arguments that will be passed to C functions). See §  for discussion.

String Operators

Currently the only string operators provided are the comparison operators discussed in §  and pattern-matching as discussed in § . These operators perform character by character comparisons based on the native character set, usually ASCII.

Some functions for manipulating strings are also available. See § .


next up previous contents index
Next: Patterns Up: Values, Types, and Constants Previous: Enumerations   Contents   Index
Vern Paxson 2002-11-17