john-users - Re: m3g9tr0n rules

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 03 Sep 2012 04:09:23 +0200
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: m3g9tr0n rules

On 09/03/2012 03:01 AM, Solar Designer wrote:
> On Mon, Sep 03, 2012 at 02:44:38AM +0200, magnum wrote:
>> Also, in Jumbo we have the ->N rule reject. Using that should help
>> performance, eg:
>>
>> ->[1-9A-Z] >\0 i\0[ -~]
>> ->[0-9A-Z] o\0[ -~] Q
>
> Yes, thanks.  I forgot that we had it.  BTW, I am not happy that its
> definition is a bit inconsistent with the similarly looking rule
> command.  The reject flag:
>
> ->N	reject this rule unless length N or longer is supported
>
> The command:
>
> > N	reject the word unless it is greater than N characters long
>
> Notice how it is "length N or longer" in one case and strictly "greater
> than N" in the other.  I agree that "length N or longer" may be more
> appropriate for practical use of the reject flag, though.

I think I recall this inconsistence is a good thing more often than not. 
I need to revisit my rules and see how "greater than" would affect 
ranges with \0 and \p (in this very case it would actually be better).

> Maybe I should use a character other than ">" when merging this feature
> into core.  Any suggestions?

IMHO you should keep it anyway. It's a mnemonic, not an actual operator.

magnum