activate/dynamic bug with ruletypes..

[Erik Fichtner <emf () servervault com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

bug.....




if I do this:

activate tcp any any -> any 21 (msg: "test"; content: "user"; nocase; flags: A+; activates:1;)
dynamic tcp any any <> any 21 (msg: "test"; flags: A+; activated_by:1; count:20;)

everything works as expected.    

But, if I do this:

ruletype foobar
{
        type activate
        output log_tcpdump: foobar.log
}
foobar tcp any any -> any 21 (msg: "test"; content: "user"; nocase; flags: A+; activates:1;)
dynamic tcp any any <> any 21 (msg: "test"; flags: A+; activated_by:1; count:20;)

I get the following message:
WARNING: an activation rule with no dynamic rules matched!

and, yes, no further packets are logged.


the same also goes for:
ruletype blegh
{
        type dynamic
        output log_tcpdump: foobar.log
}

the dynamic rules parse without errors as they load, but the new activation
list chain is never linked to the dynamic list chain (or dynamic chains in the 
case of the latter) with SetLinks() in LinkDynamicRules()


- -- 
Erik Fichtner
Security Administrator, ServerVault, Inc.
703-333-5900
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7S4PyQ7EzrewLMS0RAl19AKCaUhkBDrwlhUi3MvKAff+xHcgupgCfTLmy
2FNLKEeUJtU7K2IqjP1aEjQ=
=FLPR
-----END PGP SIGNATURE-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users