Re: New Snort breaks pulled pork

[Michael Shirk via Snort-users <snort-users () lists snort org>]

I have updated the master branch on github, and the following patch
will work for anyone running 0.7.2 (using git apply):

diff --git a/pulledpork.pl b/pulledpork.pl
index 8a61439..97b735f 100755
--- a/pulledpork.pl
+++ b/pulledpork.pl
@@ -1512,10 +1512,10 @@ sub snort_version {
     open( FH, "$cmd 2>&1 |" );
     while (<FH>) {
         next unless $_ =~ /Version/;
-        if ( $_ =~ /\d\.\d\.\d\.\d/ ) {
+        if ( $_ =~ /\d+\.\d+\.\d+\.(\d|\d+)/ ) {
             $version = $&;
         }
-        elsif ( $_ =~ /\d\.\d\.\d/ ) {
+        elsif ( $_ =~ /\d+\.\d+\.\d+(?!\.)/ ) {
             $version = $& . ".0";
         }
     }

On Thu, Oct 12, 2017 at 6:45 PM, Michael Shirk <shirkdog.bsd () gmail com> wrote:
> I am taking a look at this.
>
> --
> Michael Shirk
> Daemon Security, Inc.
> https://www.daemon-security.com
>
> On Oct 12, 2017 18:10, "James Lay" <jlay () slave-tothe-box net> wrote:
> > FYI:
> >
> > https://github.com/shirkdog/pulledpork/issues/282
> >
> > James
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest Snort
> > news!



-- 
Michael Shirk
Daemon Security, Inc.
http://www.daemon-security.com
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!