[Snort-devel] [PATCH]: Fix Snort references parsing

Frank Knobbe frank at ...2134...
Fri Feb 17 09:33:11 EST 2006


On Fri, 2006-02-17 at 09:13 -0600, BOfH wrote:
> > Yes, the 'reference: ' issue was seen with bleeding snort rulesets. I'd
> > still suggest, however, that the spaces be stripped (as it is done for
> > some others Snort keywords), for sanity.
>  
> I'd rather see the rules themselves fixed.

They are fixed.

The space got introduced by some scripts some time ago that assisted in
reordering options for best performance. The spaces were recently
removed from all reference tags, though there are spaces left behind
other tags where Snorts parser is stripping them off (as it should do
everywhere. I agree with Yoann's point about consistency. Then again,
the Snort rule parser is in bad shape and dire need of a rewrite. Sadly,
patches to fix certain issues go ignored with that exact same excuse. Oh
well...)

Cheers,
Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20060217/e1ab80dd/attachment.sig>


More information about the Snort-devel mailing list