[Snortsam-discussion] some small ssp_pf2 enhancements

[Frank Knobbe]

On Wed, 2009-10-07 at 20:22 +0200, Olli Hauer wrote:
> I made some changes in ssp_pf2.c, so tables in the main pf section
> can be used. This can be activated with  the keyword anchor=notused
> in snortsam.conf.
[...]
> I guess no one is using OpenBSD < 4.x these days so it will be save to
> remove ssp_pf.c and ssp_pf.h

Earlier this year I used ssp_pf and hacked that in shape to get it to
work on FBSD 7.2 since the ssp_pf2 didn't work for me. I think the old
method should indeed be abandoned and the newer version used. I just
wasn't able to figure out why ssp_pf2 didn't work, so I made ssp_pf
work. If ssp_pf2 works for everyone, I'll leave it as it is and add your
changes. 

> One thing that maybe documented is the strange thing to add an '_'
> to the table names and the defauls are block(in|out).

Not sure what you mean. Could you elaborate?

Thanks,
Frank