Snort mailing list archives

Patch for bug in Acid criteria removal


From: Mark Vevers <mark () ifl net>
Date: Wed, 10 Apr 2002 11:36:17 +0100

Roman,

The sensor, ag & tcp_flags criteria have bugs in them that once they
have been created they can't be removed.   The following is a patch to
fix this behaviour against the current CVS.  I have also spotted what
looks like a bug in acid_state_common.inc - please confirm ...

Cheers
Mark

Index: acid_state_citems.inc
===================================================================
RCS file: /cvsroot/acidlab/acid/acid/acid_state_citems.inc,v
retrieving revision 1.2
diff -r1.2 acid_state_citems.inc
476c476
<       $this->ag = "";
---
>       $this->criteria = "";
528c528
<      $this->sensor = "";
---
>      $this->criteria = "";
980c980
< InitArray($this->tcp_flags, $GLOBALS['MAX_ROWS'], TCPFLAGS_CFCNT, "");
---
>       InitArray($this->criteria, TCPFLAGS_CFCNT,0, "");



Index: acid_state_common.inc
===================================================================
RCS file: /cvsroot/acidlab/acid/acid/acid_state_common.inc,v
retrieving revision 1.9
diff -r1.9 acid_state_common.inc
20c20
<       for ( $i = 0; $i < $dim2; $i++ )
---
>       for ( $i = 0; $i < $dim1; $i++ )


--
Mark Vevers.    mark () ifl net / mvevers () rm com
Internet Backbone Engineering Team
Internet for Learning, Research Machines Plc
Tel: +44 1235 823380,   Fax: +44 1235 823424



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: