[Snort-devel] [PATCH]: Fix Snort references parsing

Steven Sturges steve.sturges at ...402...
Fri Feb 17 13:42:01 EST 2006


We'll get this merged into the next release.

Please note, that without the proverbial rewrite of the entire
parser, it will only address this specific issue.  :)

Cheers
-steve

Frank Knobbe wrote:
> On Fri, 2006-02-17 at 09:13 -0600, BOfH wrote:
> 
>>>Yes, the 'reference: ' issue was seen with bleeding snort rulesets. I'd
>>>still suggest, however, that the spaces be stripped (as it is done for
>>>some others Snort keywords), for sanity.
>>
>> 
>>I'd rather see the rules themselves fixed.
> 
> 
> They are fixed.
> 
> The space got introduced by some scripts some time ago that assisted in
> reordering options for best performance. The spaces were recently
> removed from all reference tags, though there are spaces left behind
> other tags where Snorts parser is stripping them off (as it should do
> everywhere. I agree with Yoann's point about consistency. Then again,
> the Snort rule parser is in bad shape and dire need of a rewrite. Sadly,
> patches to fix certain issues go ignored with that exact same excuse. Oh
> well...)
> 
> Cheers,
> Frank
> 





More information about the Snort-devel mailing list