Snort mailing list archives
Re: [Snort-sigs] Introduction to Shared Object Rules blog post
From: Patrick Mullen <pmullen () sourcefire com>
Date: Mon, 8 Feb 2010 13:40:56 -0500
Guise, Thanks for the questions; they brought up a very valid point. The output header has been updated to state the following: /* * This code was automatically generated by the Sourcefire VRT Rules2C web generator * * We make no claims to the correctness or fitness of the code generated or of modifications * to the generated code. * * Use at your own risk. * * Please report any problems with this tool to research () sourcefire com */ Of course, keep in mind the generator is only there to make life easier. I used to have to write SO rules completely by hand including the rule structures. It sucked and was very tedious. But it would get around any copyright concerns. :) Thanks, ~Patrick On Fri, Feb 5, 2010 at 2:58 PM, Guise McAllaster <guise.mcallaster () gmail com> wrote:
Very cool! And helpful for templating a GID 3 rule. But I have a question. I see at the top of the generated C code is, "Copyright (C) 2005-2008 Sourcefire, Inc. ". So if I used the rule generator to make some C code and then I modified the C code to add functionality, could I then license all that code under the GPL? Who would own the copyright? Is there a license that the original generated code is created under? I am interested in making GID 3 rules but want to be sure I can open source them. Thanks and keep up the good work! Guise On 2/4/10, Matt Olney <molney () sourcefire com> wrote:One of the reasons Patrick and I have been so quiet here and on the blog is we've been busting our asses on the SO stuff. We have some things coming up to get folks to the point where they can use the SO rules and hopefully we'll have some SO tools that you guys might think are useful. Get your head wrapped around this, and we'll have more goodies coming up. We're both really excited about detailing out this under-utilized feature in Snort. matt On Thu, Feb 4, 2010 at 5:48 PM, Patrick Mullen <pmullen () sourcefire com> wrote:All, I would like to direct your attention to a blog post that just went up that gives an introduction to shared object rules development and the snort text rule to shared object rule converter that is available on the VRT Labs site (http://labs.snort.org) -- http://vrt-sourcefire.blogspot.com/2010/02/introduction-to-shared-object-rules.html Please give it a read and let me know what you think. It's the first in a series that is intended to finally provide some documentation around SO rules, but as the post states this is an introduction that simply goes ahead and puts the idea out there and leaves a lot of interpretation to the reader. My hope is that it spurs discussion, so please feel free to comment on the blog, on the list, or to me personally. Questions about why something was done a particular way or why something was done (or not done) are welcomed and appreciated. Thanks! ~Patrick ------------------------------------------------------------------------------ The Planet: dedicated and managed hosting, cloud storage, colocation Stay online with enterprise data centers and the best network in the business Choose flexible plans and management services without long-term contracts Personal 24x7 support from experience hosting pros just a phone call away. http://p.sf.net/sfu/theplanet-com _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs------------------------------------------------------------------------------ The Planet: dedicated and managed hosting, cloud storage, colocation Stay online with enterprise data centers and the best network in the business Choose flexible plans and management services without long-term contracts Personal 24x7 support from experience hosting pros just a phone call away. http://p.sf.net/sfu/theplanet-com _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
------------------------------------------------------------------------------ The Planet: dedicated and managed hosting, cloud storage, colocation Stay online with enterprise data centers and the best network in the business Choose flexible plans and management services without long-term contracts Personal 24x7 support from experience hosting pros just a phone call away. http://p.sf.net/sfu/theplanet-com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Introduction to Shared Object Rules blog post Patrick Mullen (Feb 04)
- Re: [Snort-sigs] Introduction to Shared Object Rules blog post Matt Olney (Feb 04)
- Re: Introduction to Shared Object Rules blog post Guise McAllaster (Feb 05)
- Re: [Snort-sigs] Introduction to Shared Object Rules blog post Patrick Mullen (Feb 08)
- Re: Introduction to Shared Object Rules blog post Guise McAllaster (Feb 05)
- Re: [Snort-sigs] Introduction to Shared Object Rules blog post Matt Olney (Feb 04)