[Prelude Hybrid IDS] #145: prelude-manager trying to input text into bytea fields and failing

Prelude Hybrid IDS <[email protected]>
Newsgroups gmane.comp.security.ids.prelude.devel
Message-ID <[email protected]>
#145: prelude-manager trying to input text into bytea fields and failing
------------------------------------+---------------------------------------
 Reporter:  [email protected]  |       Owner:  yoann                
     Type:  defect                  |      Status:  new                  
 Priority:  high                    |   Milestone:                       
Component:  generic                 |     Version:  0.9                  
 Severity:  normal                  |    Keywords:  bytea additional_data
------------------------------------+---------------------------------------
 I found weird messages in my logs like this:

 prelude-manager: could not insert message into database: Query error:
 ERROR:  invalid input syntax for type bytea .

 I did some investigating, and these log entries are happening every time
 one of my prelude-lml entries derived from ntsyslog comes in.  Here's a
 dump from the manager's debug output:

         additional_data(0):
                 type: string (0)
                 meaning: Log received from
                 data: /var/log/winmessages
         additional_data(1):
                 type: string (0)
                 meaning: Original Log
                 data: Apr 17 00:26:35 123.123.123.123 security[failure]
 681 NT AUTHORITY\SYSTEM  The logon to account: Administrator  by:
 MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  from workstation: HOST-NAME
 failed. The error code was: 3221225578
 could not insert message into database: Query error: ERROR:  invalid input
 syntax for type bytea
 .

 In the database, prelude_additionaldata's data field is indeed bytea! A
 cursory googling for this shows that we need to be using PQescapeBytea for
 this type of field.. Can someone fix this?

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/145>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.