[Snort-devel] [snort-cvs] CVS: snort plugbase.h,1.8,1.9 rules.c,1.5,1.6 rules.h,1.2,1.3sp_react.c,1.4,1.5 sp_react.h,1.5,1.6 sp_respond.c,1.2,1.3 sp_respond.h,1.2,1.3(fwd)

Fyodor fygrave at ...1...
Sun Sep 24 19:52:43 EDT 2000


~ :Um, the ds_list is hyper important to the decode plugins, they allow a
~ :particular node on the OTN list to have its own data associated with it, so
~ :that one rule can look for dsize = 128 and the next can look for dsize = 256. 
~ :Maybe I missed it, but you've got a replacement that'll allow the rules to
~ :have their own per-node data associated with each OTN?
~ :

 yep, I am suggesting the data to be stored in OptFpList structure, so
each appearance of a keyword, will have it's own piece stored there (have
a look on implementation of sp_re*.c/h plugins). This model seems to
work. ;)




More information about the Snort-devel mailing list