[Snort-users] Bug(?): mysql reserved name usage

kliaaen at ...2792... kliaaen at ...2792...
Thu Sep 22 03:31:27 EDT 2005


[Please bear in mind that I'm not much of a programmer and that if this issue has been addressed already I'm just too thick to find it:)]

After upgrading to Snort 2.4.1 I discovered that when starting Snort it would die with a message about an incorrect DB schema version.
I deleted and re-created the database and when importing the SQL from schemas/create_mysql the database choked on a syntax error in the script. According to [http://dev.mysql.com/doc/mysql/en/reserved-words.html] the word SCHEMA is reserved and must be enclosed in quotes to be used.

This is solved by changing the syntax in schemas/create_mysql from "CREATE TABLE schema (...)" to "CREATE TABLE `schema` (...)" on line 23 and "INSERT INTO schema (...)" to "INSERT INTO `schema` (...)" on line 26.

To make Snort recognize the schema version it must be told to correctly quote the query on the schema table. There are already exceptions made for MS SQL in src/output-plugins/spo_database.c around line 1915.
I made the following addition at line 1933 (after the default schema query syntax) in the function CheckDBVersion(DatabaseData * data):
if (data->shared->dbtype_id == DB_MYSQL)
"SELECT vseq"
" FROM `schema`");

This overwrites the SQL query if the database is Mysql.
By making these simple changes Snort compiles cleanly and runs without problems.

I'm sure the Snort developers/maintainers can make a more suitable fix than the one I've outlined above.


Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp

More information about the Snort-users mailing list