[Snort-users] Re: Errors with simultaneous outputs in database

Muad Dib bizou31 at ...1855...
Fri Jun 24 02:05:03 EDT 2005


For those interested, i made a patch for
spo_database.c to correct this issue

AFAIK, two bugs where presents :
1 - In postgres output, the return value from Select
is 0 if there are multiple tuples. Therefore, it
inserts in DB each time a 1+ tuple is returned. This
bug seems to not be present in the mysql output.
For this bug, i only give the select return value to
result.

2 - Bug (1) does not resolve the fact that several
request can be done simultaneously before the sensor
commit. Thus, multiple entries can be inserted the
first time an alert is being seen.
I corrected this bug by using a delay timer before
making a checking Select. This timer is depending from
hostname so ********* IT ONLY APPLY TO HOSTNAME =
[A-Za-z][0-9]* in regexp *****************

This is the diff file for spo_database.c

55a56
> #include <unistd.h>
247a249
> char TimeFactor[4]="";
350a353,355
> 
>     /* Using part of sensorname to generate a
delay_variable */
>     strcpy(TimeFactor,(char *)escapedSensorName+1);
2249a2255,2256
>               /* Whatever the result is, we return
the real value and not 0 if it's >1 */
>               /* If return=0 when result>1 it
inserts many alerts references tuples in DB */
2253d2259
<                     result = 0;
2255,2258c2261
<                 else
<                 {
<                     result =
atoi(PQgetvalue(data->p_result,0,0));
<                 } 
---
>                 result =
atoi(PQgetvalue(data->p_result,0,0));
2267a2271,2285
>           /* In case no result is received, we
insert a delay depending on hostname to prevent */
>           /* two snorters or more to insert
simultaneously in database. 100 milliseconds should */
>           /* be enough to have the first snort
insert and commit before the second doing select */
>           else
>           {
>             usleep(100000*atoi(TimeFactor));
>                     data->p_result =
PQexec(data->p_connection,query);
>               if((PQresultStatus(data->p_result) ==
PGRES_TUPLES_OK))
>                     {
>                 if(PQntuples(data->p_result))
>                 {
>                       result =
atoi(PQgetvalue(data->p_result,0,0));
>                 }
>             }
>              }




	

	
		
___________________________________________________________________________ 
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger 
Téléchargez cette version sur http://fr.messenger.yahoo.com




More information about the Snort-users mailing list