long jumps not supported

[Carter Bullard]

Hey Lenny,
   Argus used the libpcap compiler as a starting
point for its own compiler many years ago.  Since
then libpcap has made a few adjustments, and one
of them has been to remove the "long jump" limitation.

   Here are the new versions of the files that need
to be changed to solve your problem, ./include/gencode.h
and ./common/argus_util.c.  If you don't mind, could you
make the changes and give it a test?

Carter




> -----Original Message-----
> From: Lenny Zeltser [mailto:lenny at zeltser.com]
> Sent: Thursday, June 01, 2000 9:49 PM
> To: argus at lists.andrew.cmu.edu
> Subject: long jumps not supported
> 
> 
> Dear folks,
> 
> I am in the process of setting up my tcpdump-based filter to 
> perform basic 
> intrusion detection functions via "ra". The filter file documents all 
> traffic that is allowed, prefixed by a "not" as the 
> outer-most expression, 
> so that "ra" reports all traffic that should not be present.
> 
> The filter file is approximately 700 characters long. I have 
> reached a 
> point, however, where as soon as I add a new clause to the 
> filter, "ra" 
> responds with the following error:
> 
>    ra: expression: long jumps not supported
> 
> Is my filter file too long for the program to handle? If so, 
> how do people 
> specify complex rules to the program?
> 
> Thanks,
> 
> -- Lenny
> 
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20000602/82ab95d0/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gencode.h
Type: application/octet-stream
Size: 6007 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20000602/82ab95d0/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: argus_util.c
Type: application/octet-stream
Size: 97157 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20000602/82ab95d0/attachment-0001.obj>