Disabling eval rules (was: Re: Testing Botnet)

[Karsten Bräckelmann <gu...@rudersport.de>]

On Sat, 2008-01-12 at 12:23 -0800, Robert - elists wrote:

> > Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct.
> > Setting rules scores to 0 did *not* prevent these tests from being
> > evaluated for SA 3.2.x before 3.2.3.
> > 
> > Fixed since 3.2.3.  Plugin eval rules with 0 scores are meant no not be
> > evaluated, and of course to not show up in the report.

> Interesting, does this mean that we should be changing scores we care about
> and want to see eval'd in the reports to .01 or something similar?
> 
> Any other implications in the bug and current or future fix methods?

AFAIK, nope. That should be all.  However...


I noticed that even my SA 3.2.4 still evaluates my URICountry plugin
rules, which are set to a score of 0.0 [1]. Which actually should *not*
happen since 3.2.3.

Anyone got a guess why?  Devs?

  guenther


[1] originally set up for exactly this testing purpose, btw

-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}