[Snort-devel] Question about option function list

Charlie Hand charlieh at ...63...
Thu Apr 19 14:24:46 EDT 2001


OK, I see it now. At the end of ParseRuleOptions where it adds
OptListEnd
to the end of the list, which contains the functin {return 1}.

Yes, I'd say this is a wise architecture.

-Charlie

Martin Roesch wrote:
> 
> In rules.c the list is automatically terminated with a function that
> simply returns 1.  Since we're doing this recursively, I didn't want
> every test to have to check to see if it was at the end of the list.
> (Think of the overhead from all those "if" statements!) ;)  Since we are
> recursive in this part of the code, it made sense to me to just put a
> "terminator" on the end of the function list that would know that it was
> the end of the list and merely bounce a "successful detect" message back
> up the call chain.
> 
> This saves some code in each of the detection modules and makes the
> system more foolproof for people who are just getting into these sorts
> of things or that don't read this list regularly.  Architecturally
> speaking, it was a real win because we can check the integrity of the
> list pretty easily just by looking for that terminator function at the
> end of each list.
> 
>      -Marty
> 
> P.S. As a secondary effect of the design of this engine, if I ever run
> into any of my computer engineering professors from college I can now
> point them at Snort as proof that I really can write recursive
> functions, and I also understand how to properly use pointers in C now
> as well. ;)
> 
> Charlie Hand wrote:
> >
> > I see in the sp_template.c where the detector function
> > calls the next OptTestFunc in the list, but it doesn't
> > check to see if it's at the end of the list. How does that
> > work? It seems like the last guy in the list would try to
> > dereference a null pointer.
> >
> > -Charlie
> > --
> >  Charlie Hand - technical support engineer
> >       mailto:charlieh at ...63...
> >  Silicon Defense - Technical Support for Snort
> >       http://www.silicondefense.com
> >
> > --
> >  Charlie Hand - technical support engineer
> >       mailto:charlieh at ...63...
> >  Silicon Defense - Technical Support for Snort
> >       http://www.silicondefense.com
> >
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > http://lists.sourceforge.net/lists/listinfo/snort-devel
> 
> --
> Martin Roesch
> roesch at ...48...
> http://www.snort.org
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

-- 
 Charlie Hand - technical support engineer     
      mailto:charlieh at ...63...    
 Silicon Defense - Technical Support for Snort 
      http://www.silicondefense.com




More information about the Snort-devel mailing list