…as it's a 'uint32_t'.
when the decoded IP header is supposed to have a TCP/UDP packet but the decoded packet does not contain such information. A pointer validation check has been added and behavior has been changed for ICMP handling which was already considering this case but would lead to a processing fault. (DB_DEBUG information messages where also added). Bumped: Build to 319
… exhaustion on connection problems
This modification can allow to detect a dead VPN tunnel (Requested fix) Fix: configure directive disable_alert_on_each_packet_in_stream, will work properly.
acknowledge receipt. This means in sync mode it requires a SOCK_SEQPACKET type socket instead of plain SOCK_DGRAM. It also complains about failures during sending.
…e they came from.
…et at startup. This should allow multiple sockets to be used at the same time. This also checks the socket name, whereas previously incorrect filenames were simply ignored.
…on into the structure created for it.
This patch adds a check to the unlink() call made in util.c, which is not currently done. If the return value isn't zero, an error in unlinking or removing the file has occurred. This new code adds the proper check, though I don't know if you want to add a different return value in case unlink() fails.
…the event data if a packet does not exist for the event
The barnyard2 repo sources exclude all of the files which result from the run of autogen.sh which is necessary before compilation. As a result, 'git status' is cluttered with automatically generated files. The included .gitgnore file lets git ignore all those intermediates. Signed-off-by: Thorsten Fischer <email@example.com>
…mmand and sumbmission protocols.
Bumped: revision to 315 Fix: enable alert-on-each-packet-in-stream by default, to disable use --disable-alert-on-each-packet-in-stream or use config disable_alert_on_each_packet_in_stream Fix: spo_database.c: Was never resolved shared object (SO_RULE) signature message. Fix: Call to GetSigByGidSid now use event revision and generate correct Snort Alert [gid:sid:rev] messages. Fix: spo_syslog_full i) operation_mode complete display ip in doted notation instead of host alligned integers for alert_ and log_ ii) Signature will also by default be prefixed with [gid:sid:rev] block iii) missing break statement that was causing the output plugin to output ALERT AND LOG in complete mode.
Bumped revision to 313 Fix: Enable compilation without error with --enable-ipv6 Fix to spo_syslog_full Fix: operation_mode parsing (strcasecmp return value) Fix: defined values (literals instead of 0 and 1) for clarity. Fix: in complete mode used a } instead of a ] at one place in a output literal. Fix: Check for input data in spo_database.c where revision is 0, we do not log and we print messages Modified: Replaced WARNING database by INFO database so people are less alarmed when those pop-up.
- Update event/record names for identifiers that Bro uses in its Barnyard2 integration scripts. - Fix ICMP type/code byte ordering. - Fix segfault when an alert has no classification. - Fix for Broccoli expecting 64-bit count values. - Support for IPv6 addresses (needs Bro > v2.0).
Bumped revision to 310
changed bzero() to memset() as bzero is deprecated. replaced bzero() with memset() replaced calls to bzero() with memset() as bzero is deprecated. replaced bcopy() with memmove() Replaced deprecated bcopy() with memmove(), memmove is guaranteed to work even if memory areas overlap, where as memcpy is designed so that the memory areas MUST not overlap. replaced bzero() with memset() Replaced bzero() with memset() as bzero is deprecated. replaced bzero() with memset() changed bzero() which is deprecated to memset(). replaced deprecated function calls replaced bzero() with memset() and bcopy() with memmove(). changed bzero to memset changed bzero() to memset in #define, bzero deprecated. replaced bzero() with memset() replaced bzero() with memset() as bzero is deprecated. changed function prototype corrected function prototype for PlatypusAgentReceive to match actual function later in file. corrected function prototype and deprecated calls changed function prototype for SguilRecvAgentMsg() and changed bzero() to memset() as bzero() is deprecated replaced bzero() with memset() replaced bzero() with memset() since bzero() is deprecated.
-Bumped: Build to 309 Fix sguil compile issue
… as there is data in the database -Bumped version to 208