snort3/snort3_extra

[API Question] How to use per rule arguments for a new ips action plugin

Closed this issue · 1 comments

Hello,

I'm trying to develop a simple ips_action plugin. I need to use arguments per rule for action.

newaction tcp any any -> any any ( msg: "new action test", newvar: "abc" )

Is it possible to access newvar variable within void NewAction::exec(Packet* p) function?
Or do you suggest another way to pass per rule arguments to action?

Thanks

Apology for returning late on this but I think you already asked this question on snort-users mail list.

Also this issue tracker is meant for bug reports and feature enhancement requests. For general questions and discussions about Snort usage, please use the Snort-Users mailing list. For discussion about Snort code development, use the Snort-Devel mailing list. Information about the mailing lists can be found here: https://snort.org/community#mailing_lists.