Re: [mod-security-users] modsecurity s390x id

[Christian B. <ch...@jw...>]

Hi Carlo,

I don't think it is related to the sizes of types, rather than a possible
byte-ordering issue. The System-Z is big-endian, whereas the Intel platforms
are little-endian.

With the byte-level conversion of the bytes2hex function, the function uses
bitwise AND and shifting for creating the hex string. 
My guess is that the "shift" operation with your byte-order simply "shifts in"
0's from the left, which then explains the 0's in your event IDs.

If we have a look at the for-loop in bytes2hex (msc_util.c, lines 964-968):

    j = 0;
    for(i = 0; i < len; i++) {
        hex[j++] = b2hex[data[i] >> 4];   // divide data[i] by 2^4 = 16
        hex[j++] = b2hex[data[i] & 0x0f]; // gives the "remainder"
    }

if the byte-order on your machine is reversed, then this *should* rather be

    for(i = 0; i < len; i++) {
        hex[j++] = b2hex[data[i] << 4];   // divide data[i] by 2^4 = 16
        hex[j++] = b2hex[data[i] & 0xf0]; // gives the "remainder"
    }


But I am no C programmer nor do I have a big-endian system available for
testing. So this is just a "guess".

Chris


Am 27.10.2012 um 19:49 schrieb carlo beccaria <be...@st...>:

> On Fri, Oct 26, 2012 at 3:11 PM, Breno Silva Pinto <BP...@tr...> wrote:
>> Right,
>> 
>> I think it should be related to some low-level byte conversion issue on
>> s390x.
>> 
>> Could you print the size of char, int, unsigned char, unsigned long ?
> 
> Hi,
> 
> printf("int %d\n",sizeof(int));
> printf("char %d\n",sizeof(char));
> printf("uchar %d\n",sizeof(unsigned char));
> printf("ulong %d\n",sizeof(unsigned long));
> 
> s390x
> int 4
> char 1
> uchar 1
> ulong 8
> 
> x86_64
> int 4
> char 1
> uchar 1
> ulong 8
> 
> thanks!
> 
> -- 
> cb
> 
> ------------------------------------------------------------------------------
> WINDOWS 8 is here. 
> Millions of people.  Your app in 30 days.
> Visit The Windows 8 Center at Sourceforge for all your go to resources.
> http://windows8center.sourceforge.net/
> join-generation-app-and-make-money-coding-fast/
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/