[Snort-devel] little fix in spo_alert_syslog.c

Alberto Dainotti alberto at ...68...
Wed Oct 11 13:55:56 EDT 2000


Hello, attached there's a patch against latest cvs. 
There's a little problem when LOG_AUTHPRIV facility is selected, it
is matched as LOG_AUTH! That's because: 

if (!strncasecmp("LOG_AUTH", toks[i], 8)) 

comes before: 

if (!strncasecmp("LOG_AUTHPRIV", toks[i], 12))

So I've inverted the order.

bye,	
					Alberto.

-------------- next part --------------
--- spo_alert_syslog.c	Wed Oct 11 19:16:33 2000
+++ snort/spo_alert_syslog.c	Mon Aug  7 04:42:28 2000
@@ -173,16 +173,16 @@
 
         /* possible openlog facilities */
 
-#ifdef LOG_AUTHPRIV 
-        else if (!strncasecmp("LOG_AUTHPRIV", toks[i], 12))
-        {
-            data->facility = LOG_AUTHPRIV;
-        }
-#endif
 #ifdef LOG_AUTH 
         else if (!strncasecmp("LOG_AUTH", toks[i], 8))
         {
             data->facility = LOG_AUTH;
+        }
+#endif
+#ifdef LOG_AUTHPRIV 
+        else if (!strncasecmp("LOG_AUTHPRIV", toks[i], 12))
+        {
+            data->facility = LOG_AUTHPRIV;
         }
 #endif
 #ifdef LOG_DAEMON 


More information about the Snort-devel mailing list