<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I am running on Fedora Core 9 on one of my boxes, and it works just fine.<div><br></div><div>FYI.</div><div><br><div><div>On Jul 1, 2010, at 11:03 AM, JJC wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Ok, well that rules those two out... yes, what distro are we all running that is having issues so that I can see if I can't reproduce!<br><br><div class="gmail_quote">On Thu, Jul 1, 2010 at 9:02 AM, Crook, Parker <span dir="ltr"><<a href="mailto:Parker_Crook@...2899...">Parker_Crook@...2899...</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">





<div lang="EN-US" link="blue" vlink="blue">
<div><p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy">JJ,</span></font></p><div><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy"> </span></font><br class="webkit-block-placeholder"></div><p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy">I just upgraded my LWP::Simple to 5.836 and still having this issue.  I also ran update-ca-certificates to cover that base.  Just curious,
 is this only happening on Debain and Debain-based distros?</span></font></p><div><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy"> </span></font><br class="webkit-block-placeholder"></div><p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy">-Parker
</span></font></p><div><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy"> </span></font><br class="webkit-block-placeholder"></div><p class="MsoNormal"><font size="2" color="navy" face="Arial"><span style="font-size:10.0pt;font-family:Arial;color:navy">P.S.  If I am still having an issue on this, I will setup a lab at home tonight to test this out on OS X, Debian, and if someone is having
 issues on another distro, let me know and Iíll see if canít test it out there too.</span></font></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">
<hr size="2" width="100%" align="center">
</span></font></div><p class="MsoNormal"><b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:Tahoma;font-weight:bold">From:</span></font></b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:Tahoma"> JJC [mailto:<a href="mailto:cummingsj@...253...2420..." target="_blank">cummingsj@...2420...</a>]
<br>
<b><span style="font-weight:bold">Sent:</span></b> Thursday, July 01, 2010 10:51 AM<br>
<b><span style="font-weight:bold">To:</span></b> John York<br>
<b><span style="font-weight:bold">Cc:</span></b> <a href="mailto:snort-sigs@lists.sourceforge.net" target="_blank">snort-sigs@...1744...net</a><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [Snort-sigs] still having download problems</span></font></p>
</div><div><div></div><div class="h5"><div><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> </span></font><br class="webkit-block-placeholder"></div><p class="MsoNormal" style="margin-bottom:12.0pt"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">Do you know what version of LWP::SImple you are using?</span></font></p>
<div><p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">On Thu, Jul 1, 2010 at 8:32 AM, John York <<a href="mailto:YorkJ@...855..." target="_blank">YorkJ@...855...</a>> wrote:</span></font></p><p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:12.0pt">I've updated to pulledpork 0.4.2 on my Ubuntu 8.04 box.  I also tried to update the CA certs with apt-get, but they are already up to date.  When I do a packet trace,
 I see the box go to Snort and ask for the rules.  Snort replies that the rules have moved to
<a href="http://s3.amazonaws.com/" target="_blank">s3.amazonaws.com</a>.  At that point, my box just gives up--I don't see any traffic where it even tries to connect with amazon.  Any ideas?  I tried manually changing pp so it asked for sub-rules instead of
 reg-rules, but both do the same thing.  The pp debug output and https conversation are below, mangled to protect the oinkcode.<br>
<br>
Thanks<br>
John<br>
<br>
PP debug<br>
<br>
me@...3503...:~$ sudo apt-get install ca-certificates<br>
[sudo] password for me:<br>
Reading package lists... Done<br>
Building dependency tree<br>
Reading state information... Done<br>
ca-certificates is already the newest version.<br>
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.<br>
<br>
me@...3503...:~$ sudo ./ppgo<br>
<br>
 <a href="http://code.google.com/p/pulledpork/" target="_blank">http://code.google.com/p/pulledpork/</a><br>
     _____ ____<br>
    `----,\    )<br>
     `--==\\  /    Pulled_Pork v0.4.2<br>
      `--==\\/<br>
    .-~~~~-.Y|\\_  Copyright (C) 2009-2010 JJ Cummings<br>
 @_/        /  66\_  <a href="mailto:cummingsj@...2420..." target="_blank">cummingsj@...2420...</a><br>
   |    \   \   _(")<br>
    \   /-| ||'--'  Rules give me wings!<br>
     \_\  \_\\<br>
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
<br>
Command Line Variable Debug:<br>
       Config Path is: /home/bryorkj/snortrules/pulledpork/etc/pulledpork.conf<br>
       Path to disablesid file: /home/bryorkj/snortrules/pulledpork/etc/disablesid.conf<br>
       Verbose Flag is Set<br>
       Extra Verbose Flag is Set<br>
Config File Variable Debug /home/bryorkj/snortrules/pulledpork/etc/pulledpork.conf<br>
       snort_path = /usr/local/bin/snort<br>
       pid_path = /var/run/snortd.pid<br>
       rule_path = /usr/local/etc/snort/rules/snort.rules<br>
       ignore = deleted,experimental,local<br>
       rule_file = snortrules-snapshot-2860.tar.gz<br>
       sid_changelog = /var/log/sid_changes.log<br>
       sid_msg = /usr/local/etc/snort/sid-msg.map<br>
       config_path = /usr/local/etc/snort/snort.conf<br>
       sostub_path = /usr/local/etc/snort/rules/so_rules.rules<br>
       oinkcode = 7025mangle-mangle7813<br>
       temp_path = /tmp<br>
       distro = Ubuntu-8.04<br>
       base_url = <a href="http://www.snort.org/" target="_blank">http://www.snort.org/</a><br>
       sorule_path = /usr/local/lib/snort_dynamicrules/<br>
       version = 0.4.2<br>
       disablesid = /usr/local/etc/snort/disablesid.conf<br>
       local_rules = /usr/local/etc/snort/rules/local.rules<br>
Checking latest MD5....<br>
       Fetching md5sum for: snortrules-snapshot-2860.tar.gz.md5<br>
       most recent rules file digest: d8b7b694e4f21b7406e3c86a32b362bf<br>
Rules tarball download....<br>
       Fetching rules file: snortrules-snapshot-2860.tar.gz<br>
       Error 501 when fetching snortrules-snapshot-2860.tar.gz at /home/bryorkj/snortrules/pulledpork/<a href="http://pulledpork.pl/" target="_blank">pulledpork.pl</a> line 264.<br>
       going to get this url:  <a href="http://www.snort.org/sub-rules/snortrules-snapshot-2860.tar.gz/7025mangle-mangle7813" target="_blank">http://www.snort.org/sub-rules/snortrules-snapshot-2860.tar.gz/7025mangle-mangle7813</a><br>

<br>
<br>
HTTP conversation<br>
<br>
GET /sub-rules/snortrules-snapshot-2860.tar.gz/7025mangle-mangle7813 HTTP/1.1<br>
TE: deflate,gzip;q=0.3<br>
Connection: TE, close<br>
Host: <a href="http://www.snort.org/" target="_blank">www.snort.org</a><br>
User-Agent: LWP::Simple/5.820<br>
<br>
HTTP/1.0 302 Moved Temporarily<br>
Date: Thu, 01 Jul 2010 13:57:15 GMT<br>
Server: Apache<br>
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.2.4<br>
X-Runtime: 448<br>
Cache-Control: no-cache<br>
Set-Cookie: _radiant_session=BAh7BjoPmangle-mangleDhmNDA%3D--777377mangle-mangled8cc; path=/; HttpOnly<br>
Location: <a href="https://s3.amazonaws.com/snort.org/rules/20100629/snortrules-snapshot-2860.tar.gz?AWSAccessKeyId=AKImangle-mangleQ&Expires=1277992665&Signature=mangle-mangle3D%0d%0aContent-Length" target="_blank">
https://s3.amazonaws.com/snort.org/rules/20100629/snortrules-snapshot-2860.tar.gz?AWSAccessKeyId=AKImangle-mangleQ&Expires=1277992665&Signature=mangle-mangle3D<br>
Content-Length</a>: 251<br>
Status: 302<br>
Content-Type: text/html; charset=utf-8<br>
X-Cache: MISS from <a href="http://web610.br.vccs.edu/" target="_blank">web610.br.vccs.edu</a><br>
Via: 1.0 <a href="http://web610.br.vccs.edu:8080/" target="_blank">web610.br.vccs.edu:8080</a> (http_scan/4.0.2.6.19)<br>
Connection: close<br>
<br>
<html><body>You are being <a href="<a href="https://s3.amazonaws.com/snort.org/rules/20100629/snortrules-snapshot-2860.tar.gz?AWSAccessKeyId=AKImangle-mangle&Expires=1277992665&Signature=7ZFmangle-mangle4%3D" target="_blank">https://s3.amazonaws.com/snort.org/rules/20100629/snortrules-snapshot-2860.tar.gz?AWSAccessKeyId=AKImangle-mangle&amp;Expires=1277992665&amp;Signature=7ZFmangle-mangle4%3D</a>">redirected</a>.</body></html><br>

<br>
<br>
<br>
------------------------------------------------------------------------------<br>
This <a href="http://SF.net">SF.net</a> email is sponsored by Sprint<br>
What will you do first with EVO, the first 4G phone?<br>
Visit <a href="http://sprint.com/first" target="_blank">sprint.com/first</a> -- <a href="http://p.sf.net/sfu/sprint-com-first" target="_blank">
http://p.sf.net/sfu/sprint-com-first</a><br>
_______________________________________________<br>
Snort-sigs mailing list<br>
<a href="mailto:Snort-sigs@lists.sourceforge.net" target="_blank">Snort-sigs@lists.sourceforge.net</a><br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-sigs" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-sigs</a></span></font></p>
</div><div><font size="3" face="Times New Roman"><span style="font-size:12.0pt"> </span></font><br class="webkit-block-placeholder"></div>
</div></div></div>
</div>

</blockquote></div><br>
------------------------------------------------------------------------------<br>This <a href="http://SF.net">SF.net</a> email is sponsored by Sprint<br>What will you do first with EVO, the first 4G phone?<br>Visit <a href="http://sprint.com/first">sprint.com/first</a> -- <a href="http://p.sf.net/sfu/sprint-com-first_______________________________________________">http://p.sf.net/sfu/sprint-com-first_______________________________________________</a><br>Snort-sigs mailing list<br><a href="mailto:Snort-sigs@...2724...s.sourceforge.net">Snort-sigs@lists.sourceforge.net</a><br>https://lists.sourceforge.net/lists/listinfo/snort-sigs<br></blockquote></div><br></div></body></html>