prelude-lml/master: Fixes rules ordering : prevent regression testing false positive
[email protected] Mon, 11 Jan 2010 17:51:03 +0100 (CET)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit bfbd6b449225a2a11b03d2013a9ce50c72038d84 Author: Yoann Vandoorselaere <[email protected]> Date: Mon Jan 4 12:32:00 2010 +0100 Fixes rules ordering : prevent regression testing false positive Fixes rules ordering so that '#LOG' are extracted in the correct order for regression testing when using 'make check'. This fixes an invalid 'rule unmatched' warning. ======================================== plugins/pcre/ruleset/ppp.rules | 28 +++++++++++++--------------- 1 files changed, 13 insertions(+), 15 deletions(-) ======================================== diff --git a/plugins/pcre/ruleset/ppp.rules b/plugins/pcre/ruleset/ppp.rules index 294645d..0cbcfc5 100644 --- a/plugins/pcre/ruleset/ppp.rules +++ b/plugins/pcre/ruleset/ppp.rules @@ -25,9 +25,9 @@ ##### -#LOG: Dec 4 23:01:24 beorc pptpd[24795]: CTRL: Client 1.2.3.4 control connection started -#LOG: Dec 4 23:01:24 beorc pptpd[24795]: CTRL: Starting call (launching pppd, opening GRE) -#LOG: Dec 4 23:01:25 beorc ppp[24796]: tun2: IPCP: Selected IP address 5.6.7.8 +# Dec 4 23:01:24 beorc pptpd[24795]: CTRL: Client 1.2.3.4 control connection started +# Dec 4 23:01:24 beorc pptpd[24795]: CTRL: Starting call (launching pppd, opening GRE) +# Dec 4 23:01:25 beorc ppp[24796]: tun2: IPCP: Selected IP address 5.6.7.8 # Logging succeed @@ -52,6 +52,16 @@ regex=ppp\[(\d+)\]: \S+: Phase: \S+ Output: SUCCESS; \ assessment.impact.type=user; \ silent; +#LOG: Dec 4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Output: FAILURE +regex=ppp\[(\d+)\]: \S+: Phase: \S+ Output: FAILURE; \ + require_context=PPP_$1; \ + id=10101; \ + revision=1; \ + assessment.impact.severity=medium; \ + assessment.impact.completion=failed; \ + assessment.impact.type=user; \ + silent; + #LOG: Dec 4 23:01:49 beorc pptpd[24795]: CTRL: Reaping child PPP[24796] regex=pptpd\[(\d+)\]: CTRL: \S+ \S+ PPP\[(\d+)\]; \ require_context=PPP_$2; \ @@ -68,15 +78,3 @@ regex=pptpd\[(\d+)\]: CTRL: Client (\S+) control; \ source(0).node.address(0).address=$2; \ last; -# Logging failed - -#LOG: Dec 4 23:01:36 beorc ppp[24796]: tun2: Phase: Chap Output: FAILURE -regex=ppp\[(\d+)\]: \S+: Phase: \S+ Output: FAILURE; \ - require_context=PPP_$1; \ - id=10101; \ - revision=1; \ - assessment.impact.severity=medium; \ - assessment.impact.completion=failed; \ - assessment.impact.type=user; \ - silent; - _______________________________________________ Prelude-cvslog site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog