[Snort-devel] Question about option function list

Martin Roesch roesch at ...48...
Fri Apr 20 13:51:09 EDT 2001


In rules.c the list is automatically terminated with a function that
simply returns 1.  Since we're doing this recursively, I didn't want
every test to have to check to see if it was at the end of the list. 
(Think of the overhead from all those "if" statements!) ;)  Since we are
recursive in this part of the code, it made sense to me to just put a
"terminator" on the end of the function list that would know that it was
the end of the list and merely bounce a "successful detect" message back
up the call chain.  

This saves some code in each of the detection modules and makes the
system more foolproof for people who are just getting into these sorts
of things or that don't read this list regularly.  Architecturally
speaking, it was a real win because we can check the integrity of the
list pretty easily just by looking for that terminator function at the
end of each list.

     -Marty

P.S. As a secondary effect of the design of this engine, if I ever run
into any of my computer engineering professors from college I can now
point them at Snort as proof that I really can write recursive
functions, and I also understand how to properly use pointers in C now
as well. ;)

Charlie Hand wrote:
> 
> I see in the sp_template.c where the detector function
> calls the next OptTestFunc in the list, but it doesn't
> check to see if it's at the end of the list. How does that
> work? It seems like the last guy in the list would try to
> dereference a null pointer.
> 
> -Charlie
> --
>  Charlie Hand - technical support engineer
>       mailto:charlieh at ...63...
>  Silicon Defense - Technical Support for Snort
>       http://www.silicondefense.com
> 
> --
>  Charlie Hand - technical support engineer
>       mailto:charlieh at ...63...
>  Silicon Defense - Technical Support for Snort
>       http://www.silicondefense.com
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...48...
http://www.snort.org




More information about the Snort-devel mailing list