[Snort-devel] modification in parser.c

Federico Castañeda F_CASTANEDA at ...2487...
Mon Apr 19 11:12:01 EDT 2004


Hi,

I made a modification to the file parser.c to support multiple variable
reference like this one:

var	AAA	1.1.1.1
var 	BBB 	1.1.1.2
var	CCC	2.2.2.1
var 	DDD	2.2.2.2

var 	AABB	[$AAA,$BBB]
var	CCDD	[$CCC,$DDD]

var	ZZZ 	[$AABB,$CCDD]

De modification was in function ProcessIP() line 2001:

replace:

enbracket = strrchr(tmp, (int)']'); /* null out the en-bracket */
if(enbracket) 
      *enbracket = '\x0';

with:

while ( enbracket = strrchr(tmp, (int)']')) 
	*enbracket = '\x0';


Please take in consideration to include in next release of Snort.

Thanks in advance,

Best regards,

Federico.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20040419/0a32e299/attachment.html>


More information about the Snort-devel mailing list