[Snort-devel] File descriptor leak

Chris Green cmg at ...402...
Thu Apr 18 10:36:12 EDT 2002


Borja Marcos <borjam at ...843...> writes:

> 	Hello,
>
> 	I am running snort 1.8.6 on FreeBSD 4.5-RELEASEp2.
>
> 	I have noticed a file descriptor leak in Snort. Each time it receives a 
> SIGHUP to reload the configuration, it opens a new bpf device, leaving the 
> bpf it was using still open. After some reloads, it will run out of bpf 
> devices.


Does this patch work for you? I think it's that we are initializing 2x
and only closing 1.

Index: snort.c
===================================================================
RCS file: /cvsroot/snort/snort/Attic/snort.c,v
retrieving revision 1.124.2.12
diff -u -r1.124.2.12 snort.c
--- snort.c	9 Apr 2002 18:06:24 -0000	1.124.2.12
+++ snort.c	18 Apr 2002 17:33:30 -0000
@@ -240,11 +240,12 @@
     {
         DebugMessage(DEBUG_INIT, "Entering daemon mode\n");
         GoDaemon();
-
+	/* 
 #ifndef HPUX
         /* kludge for Linux */
         InitializeInterfaces();
 #endif /* HPUX */
+	*/
     }
 
     /*

-- 
Chris Green <cmg at ...402...>
A good pun is its own reword.





More information about the Snort-devel mailing list