[Snort-sigs] Re: nocase

nick black dank at ...1581...
Fri Jun 27 05:06:06 EDT 2003


In gmane.comp.security.ids.snort.sigs, you wrote:
> Do the nocase option affect all the contents in the rule or do I have to
> add a nocase option after every content tag?

tagging to PayloadSearchNocase() will show you that it applies only to
the last PatternMatchData structure, setting its search method to
uniSearchCI() (a default of uniSearch is provided in ParsePattern).

incidently, this iterating code appears to have been cut-and-pasted from
PayloadSearchDepth(); PayloadSearchOffset() shares the same, although
lacking the dubious c++ style cast from void *.  a bit of a mess, that.

-- 
nick black <dank at ...1582...>
"np:  nondeterministic polynomial-time
the class of dashed hopes and idle dreams." - the complexity zoo




More information about the Snort-sigs mailing list