|Main Archive Page > Month Archives > snort-devel archives|
I am working on an output plugin for Snort 2.8.4 and it would be handy to have access to metadata. However, looking at the code it appears that rule metadata that is not used by Snort is discarded and not available.
One approach would be to use some other parser logic to read the rule file, extract the metadata, and then use signature identifiers to match up but that seems a bit redundant, especially for something that is compiled in to Snort, whose parser already fully parses the metadata.
My current plan is to augment ParseMetadata to have a list of name/function pairs. After checking the known metadata keys, if unmatched it would traverse the list comparing the key to the strings. Upon a match, the corresponding function would be called and passed the OptTreeNode, the key, and the value (all of which are in local variables by this point). Then I would add a "RegisterMetadataHandler" function to allow plugins to populate the list.
I am left with three questions: