[Snort-devel] [PATCH]: Fix Snort references parsing

Steven Sturges steve.sturges at ...402...
Fri Feb 17 13:42:01 EST 2006

We'll get this merged into the next release.

Please note, that without the proverbial rewrite of the entire
parser, it will only address this specific issue.  :)


Frank Knobbe wrote:
> On Fri, 2006-02-17 at 09:13 -0600, BOfH wrote:
>>>Yes, the 'reference: ' issue was seen with bleeding snort rulesets. I'd
>>>still suggest, however, that the spaces be stripped (as it is done for
>>>some others Snort keywords), for sanity.
>>I'd rather see the rules themselves fixed.
> They are fixed.
> The space got introduced by some scripts some time ago that assisted in
> reordering options for best performance. The spaces were recently
> removed from all reference tags, though there are spaces left behind
> other tags where Snorts parser is stripping them off (as it should do
> everywhere. I agree with Yoann's point about consistency. Then again,
> the Snort rule parser is in bad shape and dire need of a rewrite. Sadly,
> patches to fix certain issues go ignored with that exact same excuse. Oh
> well...)
> Cheers,
> Frank

More information about the Snort-devel mailing list