[Snort-devel] Plugin API Feature Request

Steven Sturges steve.sturges at ...402...
Thu Feb 9 05:55:02 EST 2006


Thomas--

We are already working on rearranging the main loop and
using pcap dispatch.  We are also addressing the non-reentrant
nature of the 2.4.x signal handlers along with this set
of changes.

Cheers.
-steve

Thomas.Seiler at ...2736... wrote:
> Hi, 
> 
> Is really nobody interested in improving the snort plugin API ?
> 
> Recently, I discovered that the CleanExit() callback is being called
> from the signal handlers (!). It is therefore dangerous to call about
> any libc function from within the CleanExit handlers, because we are
> sill inside the signal handler.
> 
> At least one existing plugin (prelude ids) is suffering from this.
> It's the reason for zombie threads when using the prelude output plugin
> and issuing a kill -SIGHUP to cause snort to reload.
> 
> With the proposed changes to InterfaceThread() in one of my previous
> mails it would be possible to only set a global variable in the signal
> handlers and defer the calling of CleanExit to the Main Loop in
> InterfaceThread, so that it happens synchronously to packet processing,
> and that is is safe to call non-reentrance libc functions.
> 
> I would really appreciate any comments on this.
> 
> Best Regards,
> Thomas Seiler
> 
> -----------------------------
> Thomas Seiler
> Ing. sys. com. dipl. EPFL
> SWISSCOM AG
> Innovations
> Security and Service Management
> Ostermundigenstrasse 93
> CH - 3050 Bern
> SWITZERLAND
> 
> Phone:  +41 (0)31 342 42 69
> Mobile: +41 (0)79 427 97 26
> Fax:    +41 (0)31 892 62 27
> 
> thomas.seiler at ...2736...
> http://www.swisscom.com
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=k&kid3432&bid#0486&dat1642
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 





More information about the Snort-devel mailing list