[Snort-users] [Snort-sigs] Introduction to Shared Object Rules blog post

Patrick Mullen pmullen at ...1935...
Mon Feb 8 13:40:56 EST 2010


Guise,

Thanks for the questions; they brought up a very valid point.  The output header
has been updated to state the following:

/*
 * This code was automatically generated by the Sourcefire VRT Rules2C
web generator
 *
 * We make no claims to the correctness or fitness of the code
generated or of modifications
 * to the generated code.
 *
 * Use at your own risk.
 *
 * Please report any problems with this tool to research at ...1935...
 */


Of course, keep in mind the generator is only there to make life
easier.  I used to have to write SO rules completely by hand including
the rule structures.  It sucked and was very tedious.  But it would
get around any copyright concerns.  :)


Thanks,

~Patrick

On Fri, Feb 5, 2010 at 2:58 PM, Guise McAllaster
<guise.mcallaster at ...11827...> wrote:
> Very cool!  And helpful for templating a GID 3 rule.  But I have a
> question.  I see at the top of the generated C code is, "Copyright (C)
> 2005-2008 Sourcefire, Inc.
> ".  So if I used the rule generator to make some C code and then I
> modified the C code to add functionality, could I then license all
> that code under the GPL?  Who would own the copyright?  Is there a
> license that the original generated code is created under?  I am
> interested in making GID 3 rules but want to be sure I can open source
> them.
>
> Thanks and keep up the good work!
>
> Guise
>
> On 2/4/10, Matt Olney <molney at ...1935...> wrote:
>> One of the reasons Patrick and I have been so quiet here and on the
>> blog is we've been busting our asses on the SO stuff.  We have some
>> things coming up to get folks to the point where they can use the SO
>> rules and hopefully we'll have some SO tools that you guys might think
>> are useful.  Get your head wrapped around this, and we'll have more
>> goodies coming up.  We're both really excited about detailing out this
>> under-utilized feature in Snort.
>>
>> matt
>>
>> On Thu, Feb 4, 2010 at 5:48 PM, Patrick Mullen <pmullen at ...1935...>
>> wrote:
>>> All,
>>>
>>> I would like to direct your attention to a blog post that just went up
>>> that gives an introduction to shared object rules development and the
>>> snort text rule to shared object rule converter that is available on
>>> the VRT Labs site (http://labs.snort.org) --
>>>
>>> http://vrt-sourcefire.blogspot.com/2010/02/introduction-to-shared-object-rules.html
>>>
>>> Please give it a read and let me know what you think.  It's the first
>>> in a series that is intended to finally provide some documentation
>>> around SO rules, but as the post states this is an introduction that
>>> simply goes ahead and puts the idea out there and leaves a lot of
>>> interpretation to the reader.  My hope is that it spurs discussion, so
>>> please feel free to comment on the blog, on the list, or to me
>>> personally.  Questions about why something was done a particular way
>>> or why something was done (or not done) are welcomed and appreciated.
>>>
>>>
>>> Thanks!
>>>
>>> ~Patrick
>>>
>>> ------------------------------------------------------------------------------
>>> The Planet: dedicated and managed hosting, cloud storage, colocation
>>> Stay online with enterprise data centers and the best network in the
>>> business
>>> Choose flexible plans and management services without long-term contracts
>>> Personal 24x7 support from experience hosting pros just a phone call away.
>>> http://p.sf.net/sfu/theplanet-com
>>> _______________________________________________
>>> Snort-sigs mailing list
>>> Snort-sigs at lists.sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>>>
>>
>> ------------------------------------------------------------------------------
>> The Planet: dedicated and managed hosting, cloud storage, colocation
>> Stay online with enterprise data centers and the best network in the
>> business
>> Choose flexible plans and management services without long-term contracts
>> Personal 24x7 support from experience hosting pros just a phone call away.
>> http://p.sf.net/sfu/theplanet-com
>> _______________________________________________
>> Snort-sigs mailing list
>> Snort-sigs at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>>
>




More information about the Snort-users mailing list