Re: how to call my own function on snort - Help

[Ryan Jordan <ryan.jordan () sourcefire com>]

Hello ndritsos,

The best way to call your function from a rule is to write a Shared Object
(.so) rule. There are plenty of examples in
src/dynamic-plugins/sf_engine/examples to help you get started.

Some quick steps:

- Create a new .c file in the examples directory
- Declare a Rule struct (defined in
src/dynamic-plugins/sf_engine/sf_snort_plugin_api.h)
- Modify your function to fit the format:
      int myfunction(void *p)
  Where (void *p) can be cast to SFSnortPacket, defined in
src/dynamic-plugins/sf_engine/sf_snort_packet.h
- Set the "evalFunc" member of "Rule" to point to your function
- Modify src/dynamic-plugins/sf_engine/examples/Makefile.am to include your
.c file
- Modify src/dynamic-plugins/sf_engine/examples/rules.c to include a
reference to your Rule object

There's not a whole lot of documentation on writing shared object rules, but
the "Snort Devel" mailing list is a good place to ask questions. Check out
http://www.snort.org/community/mailing-lists/ .

-Ryan

On Mon, Sep 26, 2011 at 5:27 PM, ndritsos <ndritsos () gmail com> wrote:

> Hello Guys,
>
> i need your help , i have a function in c :
>
> void   myfunction( seqNUmber, ackNumber , srcIP, dstIP,srcPort,destPort ){
>
>    // here is the code , that is doing something
>
> }
>
>
> i want to know how can i call this function from a snort rule ,
> could you please give me hints / steps that i have to do ?
>
>
> thank you in advance
>
> ps: iam so sorry for my terribly English
------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!