Quantalytics / pulledpork

Automatically exported from code.google.com/p/pulledpork
GNU General Public License v2.0
0 stars 0 forks source link

Allow gid:3 to be modified through modifysid.conf #84

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Adding an entry for gid:3 rule in modifysid.conf and executing pulledpork 
will not modify that rule (It works for gid:1 perfectly)
2.
3.

What is the expected output? What do you see instead?
any rule of gid:3 modified through modifysid should hold modified values. Old 
values appear instead

What version of the product are you using? On what operating system?
Pulledpork 0.6.1 on Scientific Linux 5.5

Please provide any additional information below.

Original issue reported on code.google.com by dheeraj....@gmail.com on 23 Jun 2011 at 4:41

GoogleCodeExporter commented 9 years ago

Original comment by Cummin...@gmail.com on 23 Jun 2011 at 4:59

GoogleCodeExporter commented 9 years ago
GID:3 rules are compiled, modifying the stub rule makes no sense as it would 
affect nothing.  The only "modification" that snort will read for a GID:3 rule 
is enable/disable.. as such this is an invalid feature request.

Original comment by Cummin...@gmail.com on 6 Feb 2012 at 5:22

GoogleCodeExporter commented 9 years ago
But as per the post in snort users' list, you had accepted a valid use-case 
wherein a user may want to change the PORTS and/or IPs of the stubs. These 
changes are not overwritten during rule compilation (as far as I can tell)

Original comment by dheeraj....@gmail.com on 14 Aug 2012 at 5:24