Default server/port in bropipe.cc not handled correctly, patch for url encoding string types

[sychan@…]

Per the email to the bro-ids mailing list, I found that default host/ports were not being properly parsed in the bropipe code. I've patched it to handle default IP and port.

This patch also included code to support a new type "urlstring", which is similar to the "string" type, except that it is url encoded so that spaces and other special characters can be embedded in the string.

[sychan@…]

diff of bropipe.cc that fixes defaults and adds a urlstring type for encoding strings to be passed over broccoli

[seth]

Replying to sychan@…:

This patch also included code to support a new type "urlstring", which is similar to the "string" type, except that it is url encoded so that spaces and other special characters can be embedded in the string.

I just ran into this problem yesterday too. How about instead of a urlstring type, we change the tokenizer to use a variable field separating character? My thought is that you could then specify a tab as the field separating character. Or, maybe just have an option to make tabs the field separating character instead of spaces.

[anonymous]

So, looking at the tradeoffs, url encoding gets you a commonly implemented and fairly human readable encoding scheme, that causes some increase in size of the string, but which will happily encode almost anything you feed it.

A variable delimiter buys you no increase in string size, but puts you in an either/or situation where you can have either spaces or tabs, but not both, unless you introduce an escaped form of the delimiter, and then write the encoder/decoder to properly handle this escaped delimiter and distinguish it from the possibility of the escaped delimiter being a legit part of the string. This latter possibility starts to look like more trouble than its worth to save some space in the output to bropipe - especially since mature url encoding functions are easy to find.

We basically decided that we'd rather just buy convenience with some extra space in the output to bropipe. Once it gets into broccoli, and goes out over the wire, there's no increase in size.

[seth]

Replying to anonymous:

We basically decided that we'd rather just buy convenience with some extra space in the output to bropipe. Once it gets into broccoli, and goes out over the wire, there's no increase in size.

Fair enough. As long as it's possible to transmit strings with spaces in them, I'm happy.

[kreibich]

Thanks for the patch.

Note, the point of the contrib/ directory is that it's code I'm not maintaining. Thus, I'd like to restrict my involvement to compatibility edits only. In this particular case, Scott, if the patch looks fine to you, then I'll go ahead and apply it.

[scampbell@…]

I looked over the patch before Steve sent it in and it looks good.

thanks!

scott

[kreibich]

I have applied the patch.