[Snort-devel] [snort-cvs] CVS: snort plugbase.h,1.8,1.9 rules.c,1.5,1.6 rules.h,1.2,1.3 sp_react.c,1.4,1.5 sp_react.h,1.5,1.6 sp_respond.c,1.2,1.3 sp_respond.h,1.2,1.3 (fwd)

Michael Davis mike at ...27...
Sat Sep 23 21:48:09 EDT 2000


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Should we modify plugin-data handling to be in `void *' pointer of 

If you do any pointer arithmetic in Win32 with a void pointer you
will get a compile error. I don't know if you want to make it a char
pointer or just let me ifdef WIN32 the code so it is a char pointer
instead of a void.

Just thought I would mention this.

Michael Davis
Chief Technical Officer
Data Nerds, LLC.
http://www.datanerds.net
> OptFpList as well, so we could just keep a pointer there and let
> the plugin to take care of the rest (istead of keeping an array in
> OptNodeTree for all the plugins). One of the reasons for this is
> that when we switch to dinamically loaded modules/plugins this way
> of handling data seems to be more acceptable (we don't have to
> hardcore parts of plugins in core system).
> 
> Any thoughts?
> 
> And of course review of committed code would be appreciated as
> well.. it's 8am here by the time I finish it, so funny things could
> be there :-P  
> 
> ---------- Forwarded message ----------
> Date: Sat, 23 Sep 2000 18:11:49 -0700
> From: Fyodor Yarochkin <fygrave at ...64...>
> To: snort-cvsinfo at lists.sourceforge.net
> Subject: [snort-cvs] CVS: snort plugbase.h,1.8,1.9 rules.c,1.5,1.6
> rules.h,1.2, 
>     1.3 sp_react.c,1.4,1.5 sp_react.h,1.5,1.6 sp_respond.c,1.2,1.3
> sp_respond.h, 
>     1.2,1.3
> 
> Update of /cvsroot/snort/snort
> In directory slayer.i.sourceforge.net:/tmp/cvs-serv24859
> 
> Modified Files:
> plugbase.h rules.c rules.h sp_react.c sp_react.h sp_respond.c 
> sp_respond.h 
> Log Message:
> Logical bug in `re*' handling keywords. The thing is that
> `response' would be sent no matter whether all of the `options' in
> rule match packet or not, if the keyword is not the last in the
> sequence. Hoperfully this change fixes this problem.  
> 
> It also introduces new sub-class of `keyword' plugins, which we can
> call `respond'  plugins. The difference is in plugin parameters
> handling (maybe we could switch to the same way in for `detection'
> plugins as well?) and the functions it has to call  to register
> response functions.
> 
> Review and feedback would be appreciated mucho ;-)
> 
> 
> [snip snip.. the rest in cvs tree ;-) ]
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-devel

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBOc1dWPiUqZ9dnoKsEQJYEgCg6BJC+8g3/jJ/vHW/DXPd+FG0AKIAn3OE
ADr+BGM3StRTOKgDKebeh6RV
=QLDN
-----END PGP SIGNATURE-----





More information about the Snort-devel mailing list