userguide: fix explanation about bsize ranges

Our code handles Uint ranges as exclusive, but for bsize, our
documentation stated that they're inclusive.

Cf. from uint.rs:

    DetectUintMode::DetectUintModeRange => {
        if val > x.arg1 && val < x.arg2 {
            return true;
        }
    }

Task #6708
pull/10277/head
Juliana Fajardini 1 year ago committed by Victor Julien
parent b8bc2c7e0f
commit 244a35d539

@ -284,7 +284,7 @@ bsize uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>`.
An optional operator can be specified; if no operator is present, the operator will An optional operator can be specified; if no operator is present, the operator will
default to '='. When a relational operator is used, e.g., '<', '>' or '<>' (range), default to '='. When a relational operator is used, e.g., '<', '>' or '<>' (range),
the bsize value will be compared using the relational operator. Ranges are inclusive. the bsize value will be compared using the relational operator. Ranges are exclusive.
If one or more ``content`` keywords precedes ``bsize``, each occurrence of ``content`` If one or more ``content`` keywords precedes ``bsize``, each occurrence of ``content``
will be inspected and an error will be raised if the content length and the bsize will be inspected and an error will be raised if the content length and the bsize
@ -327,6 +327,9 @@ Examples of ``bsize`` in a rule:
alert dns any any -> any any (msg:"test bsize rule"; dns.query; content:"middle"; bsize:6<>15; sid:126; rev:1;) alert dns any any -> any any (msg:"test bsize rule"; dns.query; content:"middle"; bsize:6<>15; sid:126; rev:1;)
To emphasize how range works: in the example above, a match will occur if
``bsize`` is greater than 6 and less than 15.
dsize dsize
----- -----

Loading…
Cancel
Save