snort with Oracle

[Gongya Yu <yu () gongya net>]

Hi, anyone has succeeded in using Oracle as snort output plugin ? I am
trying to use Oracle, but it failed to connect to Oracle with the
following messages;

database: compiled support for ( oracle )
database: configured to use oracle
database:          user = snort
database: password is set
database: database name = DREAM
database:   sensor name = 192.168.1.5

database: oracle_error: Error while trying to retrieve text for error
ORA-12154

database: Connection to database 'DREAM' failed
Fatal Error, Quitting..

After checking the source code, I located the problem in spo_database.c

#ifdef ENABLE_ORACLE
    if(!strcasecmp(data->shared->dbtype,ORACLE))
    {
      if (OCIInitialize(OCI_DEFAULT, NULL, NULL, NULL, NULL) ||
         OCIEnvInit(&data->o_environment, OCI_DEFAULT, 0, NULL) ||
         OCIEnvInit(&data->o_environment, OCI_DEFAULT, 0, NULL) ||
         OCIHandleAlloc(data->o_environment, (dvoid **)&data->o_error,
OCI_HTYPE_ERROR, (size_t) 0, NULL) ||
         OCILogon(data->o_environment, data->o_error,
&data->o_servicecontext,
data->user, strlen(data->user), data->password, strlen(data->password),
data->shared->dbname, strlen(data->shared->dbname)) ||
         OCIHandleAlloc(data->o_environment, (dvoid
**)&data->o_statement, OCI_HTYPE_STMT, 0, NULL))
      {
         OCIErrorGet(data->o_error, 1, NULL, &data->o_errorcode,
data->o_errormsg, sizeof(data->o_errormsg), OCI_HTYPE_ERROR);
         ErrorMessage("database: oracle_error: %s\n", data->o_errormsg);

         FatalError("database: Connection to database '%s' failed\n",
data->shared->dbname);
      }
    }
#endif

Question 1:  OCIEnvInit(&data->o_environment, OCI_DEFAULT, 0, NULL) ||
is extra ?

Question 2: Do I have to use OCIEnvCreate to replace OCIInitialize and
OCIEnvInit if I use Oracle 8.1.7. I read the documentation that says the
OCIInitialize and OCI EnvInit still can be used as backward.

thanks in advanced !!




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users