Snort mailing list archives

[PATCH] Remove the variable modifiers section in the manual.


From: Joshua Kinard <kumba () gentoo org>
Date: Mon, 26 Dec 2011 19:24:51 -0500


I checked again to see if the bash-like variable modifiers work in Snort
with the newer releases.  They do not:

portvar HTTP_PORT 80

alert tcp any any -> any $(HTTP_PORT?FOOBAR) (msg:"HTTP GET for ~/hello";
flow:established,to_server; content:"GET"; http_method; content:"/~hello";
http_uri; sid:42000001; rev:1; classtype:misc-activity; )

$ ~/bin/snort -c local.rules -A console -k none -r tcp-http-tiny2.pcap -q
ERROR: local.rules(216) ***PortVar Lookup failed on '$(HTTP_PORT?FOOBAR)'.
Fatal Error, Quitting..

So, lets get rid of that section.


Changes:
 snort_manual.tex |   46 ----------------------------------------------
 1 file changed, 46 deletions(-)


Cheers!

-- 
Joshua Kinard
Gentoo/MIPS
kumba () gentoo org
4096R/D25D95E3 2011-03-28

"The past tempts us, the present confuses us, the future frightens us.  And
our lives slip away, moment by moment, lost in that vast, terrible in-between."

--Emperor Turhan, Centauri Republic

Attachment: snort-2.9.2-kill-variable-modifiers.patch
Description:

------------------------------------------------------------------------------
Write once. Port to many.
Get the SDK and tools to simplify cross-platform app development. Create 
new or port existing apps to sell to consumers worldwide. Explore the 
Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
http://p.sf.net/sfu/intel-appdev
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

Current thread: