snort3: Active: active.device is mandatory

Meridoff via Snort-devel <[email protected]> Tue, 15 Oct 2019 14:08:50 +0300
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <CAFfuDwy5vnhO0Rg+NWsGSN-CmhPF7Cd0gFHusnwES_G3QjjFyw@mail.gmail.com>
--===============5712828166872966881==
Content-Type: multipart/alternative; boundary="000000000000015e100594f1039c"

--000000000000015e100594f1039c
Content-Type: text/plain; charset="UTF-8"

Hello, if I not configured active.device we have in Active::open (char
*dev) :

*    if ( dev && strcasecmp(dev, "ip") )*
*    {*
*        s_link = eth_open(dev);*
*...*
So here we trying to eth_open for empty device.

May be change for that if no device specifed - we using "ip":

For example:
*    if ( dev && strlen(dev)  && strcasecmp(dev, "ip") )*
*    {*
*        s_link = eth_open(dev);*

...

--000000000000015e100594f1039c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Hello, if I not configur=
ed active.device we have in Active::open (char *dev) :<div><i><br></i></div=
><div><div><i>=C2=A0 =C2=A0 if ( dev &amp;&amp; strcasecmp(dev, &quot;ip&qu=
ot;) )</i></div><div><i>=C2=A0 =C2=A0 {</i></div><div><i>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 s_link =3D eth_open(dev);</i></div></div><div><i>...</i></div><d=
iv>So here we trying to eth_open for empty device.</div><div><br></div><div=
>May be change for that if no device specifed - we using &quot;ip&quot;:</d=
iv><div><br></div><div><div>For example:</div><div><div><i>=C2=A0 =C2=A0 if=
 ( dev &amp;&amp; strlen(dev) =C2=A0&amp;&amp; strcasecmp(dev, &quot;ip&quo=
t;) )</i></div><div><i>=C2=A0 =C2=A0 {</i></div><div><i>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 s_link =3D eth_open(dev);</i></div></div><div><br></div><div>...=
</div></div></div></div></div>

--000000000000015e100594f1039c--

--===============5712828166872966881==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============5712828166872966881==--