* command line and conf file syntax made more uniform
* removed unused and deprecated features
* remove as many barriers to successful run as possible
- (eg: no upper bounds on memcaps)
+ (e.g.: no upper bounds on memcaps)
* assume the simplest mode of operation
- (eg: never assume input from or output to some hardcoded filename)
+ (e.g.: never assume input from or output to some hardcoded filename)
* all Snort config options are grouped into Snort++ modules
=== Build Options
* Snort++ has a default unicode.map
* Snort++ will not enforce an upper bound on memcaps and the like within 64 bits
* Snort++ will supply a default *_global config if not specified
- (Snort would fatal; eg http_inspect_server w/o http_inspect_global)
+ (Snort would fatal; e.g. http_inspect_server w/o http_inspect_global)
* address list syntax changes: [[ and ]] must be [ [ and ] ] to avoid Lua string
parsing errors (unless in quoted string)
* because the Lua conf is live code, we lose file:line locations in app error messages
* fastpattern_offset, fast_pattern_length
* no ; separated content suboptions
* offset, depth, distance, and within must use a space separator not colon
- (eg. offset:5; becomes offset 5;)
+ (e.g. offset:5; becomes offset 5;)
* rule option sequence: <stub> soid <hidden>
* sid == 0 not allowed
* soid is now a non-metadata option
* deleted unused http_encode option
* urilen replaced with generic bufferlen which applies to current sticky
buffer
-* added optional selector to http_header, eg http_header:User-Agent;
+* added optional selector to http_header, e.g. http_header:User-Agent;
* multiline rules w/o \n
* #begin ... #end comments
_ERROR can't find xyz_
* if xyz is the name of a module, make sure you are not assigning a scalar
- where a table is required (eg xyz = 2 should be xyz = { }).
+ where a table is required (e.g. xyz = 2 should be xyz = { }).
_ERROR can't find x.y_
=== New Http Inspector
-*TBD*
+ TBD
=== Binder
* String values are case sensitive too; use lower case only.
* Numeric ranges may be of the form low:high where low and high are
bounds included in the range. If either is omitted, there is no hard
- bound. Eg 0: means any x where x >= 0.
+ bound. E.g. 0: means any x where x >= 0.
* Strings may have a numeric range indicating a length limit; otherwise
there is no hard limit.
* bit_list is typically used to store a set of byte, port, or VLAN ID
* pcap from http://www.tcpdump.org for tcpdump logging.
-* pcre from http://www.pcre.org for regex pattern matching.
+* pcre from http://www.pcre.org for regular expression pattern matching.
* zlib from http://www.zlib.net for decompression.
Optional:
-* asciidoc from http://www.methods.co.nz/asciidoc/ to build the html
+* asciidoc from http://www.methods.co.nz/asciidoc/ to build the HTML
manual.
* dblatex from http://dblatex.sourceforge.net to build the pdf manual (in
* Use camel case for namespaces, classes, and types like WhizBangPdfChecker.
-* Use lower case identifiers with underscore separators, eg some_function()
+* Use lower case identifiers with underscore separators, e.g. some_function()
and my_var.
* Use lower case filenames with underscores.
==== Logging
-* Messages intended for the user should not look like debug messages. Eg,
- the function name should not be included.
+* Messages intended for the user should not look like debug messages. In,
+ other words, the function name should not be included.
* Most debug messages should just be deleted.
problems. typedef uint16_t Port; bool foo(Port) is way better than
int foo(int port).
-* Use forward declarations (eg struct SnortConfig;) instead of void*.
+* Use forward declarations (e.g. struct SnortConfig;) instead of void*.
* Try not to use extern data unless absolutely necessary and then put the
extern in an appropriate header.
#define SEQ_LT(a,b) ((int)((a) - (b)) < 0)
-* Multiline macros should be blocked (ie inside { }) to avoid if-else type
+* Multiline macros should be blocked (i.e. inside { }) to avoid if-else type
surprises.
==== Formatting