[Snort-devel] small "-z" fix

Jeff Nathan jeff at ...835...
Mon May 13 04:28:02 EDT 2002


Alberto Dainotti wrote:
> 
> On Mon, 13 May 2002, Jeff Nathan wrote:
> 
> > Greetings
> >
> > Not to stomp on anyone's toes, but do not commit or apply Alberto's
> > patch to modify -z back to accepting arguments.
> 
> Hem, not to stomp on your toes Jeff, but you didn't read my patch :-)
> My patch doesn't do this at all.
> 
> > The modification was done on purpose as ASSURE_ALL is the proper default
> > assumption
> > and -z should switch to ASSURE_EST.
> >
> > I sent in the original patch on 3/5 and it was committed though I
> > neglected to updated the FAQ.
> 
> also neglected to update snort.conf . And snort.c in the stable branch.
> My patch simply fixed stable branch to be updated to your modifications.
> 
> Regards,
>                                                 Alberto.
> 
> Alberto Dainotti
> URIZEN - Internetworking & Digital Security    http://www.urizen.it
> PGP Key available at: http://www.urizen.it/pgp
> Key Fingerprint: 87CF D95A CE0F 3188 3950  4B1F 3B56 DE69 D05F B8F5
> 

Gaah, you're right, I didn't look at it immediately.  Sorry.

I think the correct behavior is to switch the -z behavior back in the
SNORT_1_8 tagged source, which requires a little extra code (thank you
for your patch, by the way.)  The old behavior requries a little extra
code that wasn't in your patch - a little strncasecmp() action)

I think I've discovered the point of confusion.  I sent a message a
minute ago about it.  Hopefully chris will just back up a version and
recommit.

-Jeff

-- 
http://jeff.wwti.com            (pgp key available)
"Common sense is the collection of prejudices acquired by age eighteen."
- Albert Einstein




More information about the Snort-devel mailing list