[Snort-sigs] snortrules-stable bug patches

Matt Kettler mkettler at ...189...
Fri Apr 4 13:49:02 EST 2003


At 01:49 PM 4/4/2003 -0500, Michael Scheidell wrote:
>Ok, I don't understand.. is this a patch if I want to put bugs into my
>rules?

No, that's a patch that takes typographical bugs out of your rules.. but 
most of those rules are in "deleted.rules".

What I'm guessing "snort user" did was to concatenate all the *.rules files 
together into one file (including deleted.rules). Then found the "bugs" and 
was fixing them.

Snort user, please make sure that in the future you do not use the rules 
that exist in the file "deleted.rules".. They are there because they are 
known to be buggy in the first place.. If you want to submit fixes, please 
note that you are fixing a rule that was deleted, and explain why you 
believe that the rule is fixed (note: the typo problems are _not_ why these 
rules are buggy and were removed).

For example, the extra space in sid 113 was introduced when the rule was 
moved from backdoor.rules to deleted.rules, but is a side effect of it's 
removal, not the cause of it.









More information about the Snort-sigs mailing list