[Snort-devel] (PATCH for...) old problem seems back

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Thu Oct 17 12:50:05 EDT 2002


To help save you time, here's the patch for spp_portscan2 -Nu'd like you
like it.

--- spp_portscan2.c	Thu Oct 17 14:43:36 2002
+++ new_spp_portscan2.c	Thu Oct 17 14:47:13 2002
@@ -869,7 +869,6 @@
     strlcpy(src, inet_ntoa(p->iph->ip_src), 16);
     strlcpy(dst, inet_ntoa(p->iph->ip_dst), 16);
     ts_print((struct timeval *) &p->pkth->ts, timestamp);
-    /* if (p->tcph->th_flags) */
     if (p->tcph)
     { 
         CreateTCPFlagString(p, flagString);
@@ -878,14 +877,12 @@
                  dst, p->sp, p->dp, ps->target_count, ps->port_count, 
                  flagString, ps->event_id);
     }
-    /* else if(p->udph->uh_sport) */
     else if(p->udph)
     {
         snprintf(msg, STD_BUF, "%s UDP src: %s dst: %s sport: %u dport:
%u "
                  "tgts: %u ports: %u event_id: %u\n", timestamp, src,
dst, 
                  p->sp, p->dp, ps->target_count, ps->port_count,
ps->event_id);
     }
-    /* else if(p->icmph->type) */
     else if(p->icmph)
     {
         snprintf(msg, STD_BUF, "%s ICMP src: %s dst: %s type: %u code:
%u "
@@ -895,7 +892,6 @@
 
     fwrite(msg, strlen(msg), 1, ps2data.logfile);
     fflush(ps2data.logfile);
-        
 }
 
 /*********************************************************************/
@@ -1071,8 +1067,6 @@
 
 static void DeletePortscanner(Portscanner *ps)
 {
-    ScanTarget *st = (ScanTarget *)
ubi_btFirst((ubi_btNodePtr)ps->targetRootPtr);
-    ScanTarget *old, *same;
     Portscanner *oldps;
     
     /* need to do a walk and delete all the targets */
@@ -1088,22 +1082,7 @@
 
                );
 
-    while(st != NULL)
-    {
-        old = st;
-        
-        st = (ScanTarget *) ubi_btNext((ubi_btNodePtr) old);
-
-        same = (ScanTarget *) ubi_sptRemove(ps->targetRootPtr, 
-                                            (ubi_btNodePtr) old);
-
-        /* same as the old one ;-) */
-        DEBUG_WRAP(DebugMessage(DEBUG_PORTSCAN2,
-                                "freeing MemBucket %p\n",
old->bucket););
-
-        /* this deletes the membucket */
-        DeleteTarget(old);
-    }
+    (void)ubi_trKillTree(ps->targetRootPtr, DeleteTarget);
 
     
     oldps = (Portscanner *) ubi_sptRemove(ps2data.ScannersPtr,
@@ -1136,7 +1115,7 @@
 
         do
         {
-            if((idx->last_time.tv_sec + ps2data.timeout) < now)
+            if((idx->last_time.tv_sec + ps2data.timeout) > now)
             {
                 ScanTarget *savidx = idx;
 
@@ -1148,6 +1127,7 @@
 
                     p->port_count -= savidx->port_count;
                     p->target_count--;              
+                    savidx = (ScanTarget
*)ubi_sptRemove(p->targetRootPtr, (ubi_btNodePtr) savidx);
                     DeleteTarget(savidx);
                     pruned++;
                 }
@@ -1155,6 +1135,7 @@
                 {
                     p->port_count -= savidx->port_count;
                     p->target_count--;
+                    savidx = (ScanTarget
*)ubi_sptRemove(p->targetRootPtr, (ubi_btNodePtr) savidx);
                     DeleteTarget(savidx);
                     pruned++;
                     return pruned;
@@ -1225,7 +1206,7 @@
                 continue;
             }
 
-            if((idx->last_time.tv_sec+ps2data.timeout) < now)
+            if((idx->last_time.tv_sec+ps2data.timeout) > now)
             {
                 Portscanner *savidx = idx;
 




More information about the Snort-devel mailing list