Re: problem with RecvIDMEF (C++ binding)

Bartek 'BaSz' Szurgot <[email protected]> Tue, 17 May 2011 10:18:29 +0200
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <[email protected]>
This is a cryptographically signed message in MIME format.

--===============2042537839912602027==
Content-type: multipart/signed; protocol="application/pkcs7-signature";
 micalg=sha1; boundary=------------ms080609040702050806050209

This is a cryptographically signed message in MIME format.

--------------ms080609040702050806050209
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable

On 05/16/2011 11:11 AM, Jens De Wit wrote:
> Hello everyone,
>
> I'm trying to write a simple sensor that reads and processes IDMEF usin=
g the
> C++ easy bindings.
> The problem is I'm experiencing strange behaviour when calling the Recv=
IDMEF
> method: after a few calls I get the following warning "WARNING: Failove=
r
> enabled: connection error with 127.0.0.1:4690: End of file", after whic=
h the
> sensor doens't receive anything anymore. When I restart the sensor the =
same
> happens; it reads a few messages then the warning pops up and it stops
> working again.
> Am I doing something stupid or missing something obvious here? I went
> through the code of the official sensors but I couldn't find any exampl=
es of
> using the RecvIDMEF call, except for the correlator but that's written =
using
> the Python bindings.
>
> Any help would be greatly appreciated.
>
> Regards,
> Jens


hi,

we had similar problem with our implementation (though we used C=20
binding). i was not the one who worked with it directly, but AFAIR it=20
was some non-obvious trick related to enabling a sort of a keep-alive=20
mechanism in libprelude, to prevent connection closing every few seconds.=


you can take a look at our C++ implementation of libprelude data=20
handling in ACARM-ng system (http://www.acarm.wcss.wroc.pl). the part=20
you're interested in is Input::Prelude namespace, namely:
http://repo.acarm.wcss.wroc.pl/main/src/inputprelude/Input/Prelude/

hope that will help!

--=20
pozdrawiam serdecznie / best regards,
Bartek 'BaSz' Szurgot

Wroclaw Centre for Networking and Supercomputing
Wroclaw University of Technology,
PWr, C-3 / 131A
tel. +48 71 320 2013
http://www.wcss.wroc.pl


--------------ms080609040702050806050209
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIITzzCC
A/AwggLYoAMCAQICCQDUcMQJTNgiHzANBgkqhkiG9w0BAQUFADA9MQswCQYDVQQGEwJQTDEQ
MA4GA1UEChMHUElPTklFUjEcMBoGA1UEAxMTUElPTklFUiBQS0kgUm9vdCBDQTAeFw0xMDEx
MjMxMzQwMDhaFw0zMDExMjMxMzQwMDhaMEkxCzAJBgNVBAYTAlBMMRAwDgYDVQQKEwdQSU9O
SUVSMSgwJgYDVQQDEx9QSU9OSUVSIFBLSSBTdWIgUm9vdCBDQSBMZXZlbCAxMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA23qGxAs+fbng6BCsTGH4eh+TOUcBkkeHjYZIfr29
HgzydAEbRafLY4eEjdI24WgGdZbp6lOiUn9fVDKybuIGI8pdym5rhjyjU/Hwjds93JUsebLF
mXgKcdc8n63HLOyGk8D55hyIIcw5+7RdjiJoAL5KFT6zx4xGmqtEDLC7GUWinRdm0oNvdONj
8F2tLjVDlzZfwtCdNciLlFuGsGlia9EcUhUuQdbqPEVjSE9+v/aRLf6M/IIPiuLQNOiLxGui
mmvOEsaSuVTt8Xfs1flg6gt7AKZaXJ+r+UAP06OggOeu5vu7bFbrb8YYvVIHiWQgzeJU3JQ3
ov4WK5JF6w9WRQIDAQABo4HmMIHjMA8GA1UdEwEB/wQFMAMBAf8wOwYDVR0fBDQwMjAwoC6g
LIYqaHR0cC8vc3ViLXJvb3QtY2EtMS5wa2kucGlvbmllci5uZXQucGwvY3JsMFMGA1UdIARM
MEowSAYNKwYBBAGCmWEBAQEAATA3MDUGCCsGAQUFBwIBFilodHRwLy9zdWItcm9vdC1jYS0x
LnBraS5waW9uaWVyLm5ldC5wbC9jcDAdBgNVHQ4EFgQU8Nar4afvjSx4/BXjL4dQAv77L74w
HwYDVR0jBBgwFoAUQ3ZizDyIr8DFc5wK+7eoqhPqWW0wDQYJKoZIhvcNAQEFBQADggEBAA7+
4khR3zE5OFrHyCnT3jRXT41gmMyNWbjQRuRK+n2Q8/brg8rIdBXL5cahwDD15P+yegPDHNNF
w7t8riTfJGL6Xcilpr3a5K/qVNyFkfTe6/oViN3Szq+nRZ/9pEVeWsc85a0OZR8L9pMIIuMD
waZd4xbOt/i9VDe0INF5qSjQbC7qcs+xafiC2fWE5nzqbTf0KSjFOcgGZ4MUMdpsyxiXqHAF
nUnuXJ3gt3nDDZCEY+mX2khhbSKQ8XOj7d7sf53ohgeY+yQTehLZNj9tP6hNYfyu92mMg05W
r/64h5+66f9pMNAj00pp791tOq66PbHBU+OD20LGC9WxqOxEHQEwggQPMIIC96ADAgECAgkA
6aW3CiFepUcwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UEBhMCUEwxEDAOBgNVBAoTB1BJT05J
RVIxKDAmBgNVBAMTH1BJT05JRVIgUEtJIFN1YiBSb290IENBIExldmVsIDEwHhcNMTAxMjEw
MTExNzE3WhcNMjAxMjA3MTExNzE3WjBOMQswCQYDVQQGEwJQTDEQMA4GA1UECgwHUElPTklF
UjENMAsGA1UECgwEV0NTUzEeMBwGA1UEAwwVUElPTklFUiBQS0kgQ0EtV0NTUy0xMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn/AYjHbqBNQWH4kTaxk1lB8f5mucZs8ewUkj
exh5ngxdq10nZOk+kZcelEB9YPt0cTCxb1Ddq5dfzr3NfcbbCh4x/Yjbf3u0H1H9532JT3OR
IimgGC9i2zo+v2VmrkrVXVVheAW3a0DDrpk+OcQNt0hE138oR88FkgVBnsf+ZM+9jkdBCezB
RJcZiZJMt218yjtUH0OvGemGihuQ0FuZEN+vHwpnX9PL4U4SO+3Wz4eItLP1Qw7gYgOQpD8Q
VT4Q1wdaKku8T8rPWX6q7nq4D6fm+XCTCsCQGpWMpEFKxWsPOVpOLITJi2laai4qgtbyUbIC
dE2tReUqdt6GYnWazwIDAQABo4H0MIHxMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEG
MDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHAvL3N1Yi1yb290LWNhLTEucGtpLnBpb25pZXIubmV0
LnBsL2NybDBUBgNVHSAETTBLMEkGDSsGAQQBgplhAQEBAAEwODA2BggrBgEFBQcCARYqaHR0
cDovL3N1Yi1yb290LWNhLTEucGtpLnBpb25pZXIubmV0LnBsL2NwMB0GA1UdDgQWBBQttAMu
HKzHG5UU0h9cdmJ9ogpfUDAfBgNVHSMEGDAWgBTw1qvhp++NLHj8FeMvh1AC/vsvvjANBgkq
hkiG9w0BAQUFAAOCAQEAUQ21erAnCHk8WBJDdqmqRrBpvvQL0udZk9X5/S5RDcstLJWfsXOK
WC6YKqWymBwQEMKv9Q4GFMZAEJ/dqeu98nXOwNYHoV34t0kX5YRcNHM23E+ppnbQKQbwDbhc
DWCLSLZljwA94HuUg/Oib3n4h1pcwCjg6Gx6ZE48t3wlchovcM+STZLlgw8DU72P1wphYY+J
BYwLXk0eBkZFWaYkI+Bvp2TveJfhZAfIPVt+KNTRGZAiYwcheTXvSbbHHyHeeNQrDJglf2vR
Zo6Q7ubOAjM64hms+yz4bezh+7XBUiYpNJPe0yKA1pOkrUKC026+fCLg0qva5+cxHoPpakHB
mDCCBeAwggTIoAMCAQICCFL4RNKpYKnUMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlBM
MRAwDgYDVQQKDAdQSU9OSUVSMQ0wCwYDVQQKDARXQ1NTMR4wHAYDVQQDDBVQSU9OSUVSIFBL
SSBDQS1XQ1NTLTEwHhcNMTAxMjIxMTE1OTA5WhcNMTExMjIxMTE1OTA5WjCB7zEqMCgGCSqG
SIb3DQEJARYbYmFydG9zei5zenVyZ290QHB3ci53cm9jLnBsMSwwKgYDVQQDDCNiYXJ0b3N6
X3N6dXJnb3RfNjA0NDYwMjYyNTc0MDUxNTE5ODEYMBYGA1UEAwwPQmFydG9zeiBTenVyZ290
MTcwNQYDVQQLDC5Xcm9jxYJhd3NraWUgQ2VudHJ1bSBTaWVjaW93by1TdXBlcmtvbXB1dGVy
b3dlMSEwHwYDVQQKDBhQb2xpdGVjaG5pa2EgV3JvY8WCYXdza2ExEDAOBgNVBAoMB1BJT05J
RVIxCzAJBgNVBAYTAlBMMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2tVwQabp
Qmzjci6hHQUIXaKb8wmasPfbsc4WQp5uG/nwDYtEZ1P54INqVqTgsi8gPKUno5fzvAeHXLeq
v8hy98meLD/zRf+U8EepGcyNZj//fM66qq0ibv3qeMfPttST554PWvZIiyds5C2OHodU2enS
SvZvKVpW6Q7x+W83J9PZ87zPLNPmZC3aaitaNNNJvpnEn1O+IPuNQubg7/e6/8clKHpuyQUS
lhhLiOsFje0BAG+1vZ9TAfZ5WJgbLSH9o8vLPMj7ug+R3rnkkT54vNoI+Nd+lj5GR2ZdwTOJ
TWfVJ8/fAddP0aCgqTuAWcBQg1aS02ghnaEHDD3eRRdrMQIDAQABo4ICHjCCAhowgY0GCCsG
AQUFBwEBBIGAMH4wLwYIKwYBBQUHMAKGI2h0dHA6Ly9jYS0xLndjc3MucGtpLnBpb25pZXIu
bmV0LnBsMEsGCCsGAQUFBzABhj9odHRwOi8vb2NzcC5wa2kucGlvbmllci5uZXQucGw6ODA4
MC9lamJjYS9wdWJsaWN3ZWIvc3RhdHVzL29jc3AwHQYDVR0OBBYEFJUHHH8hF9hfGNYf30Ts
XFscDAiaMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAULbQDLhysxxuVFNIfXHZifaIKX1Aw
UQYDVR0gBEowSDBGBg0rBgEEAYKZYQEEAQABMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly9jYS0x
Lndjc3MucGtpLnBpb25pZXIubmV0LnBsL2NwczCBjwYDVR0fBIGHMIGEMIGBoCugKYYnaHR0
cDovL2NhLTEud2Nzcy5wa2kucGlvbmllci5uZXQucGwvY3JsolKkUDBOMR4wHAYDVQQDDBVQ
SU9OSUVSIFBLSSBDQS1XQ1NTLTExDTALBgNVBAoMBFdDU1MxEDAOBgNVBAoMB1BJT05JRVIx
CzAJBgNVBAYTAlBMMA4GA1UdDwEB/wQEAwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYB
BQUHAwQwJgYDVR0RBB8wHYEbYmFydG9zei5zenVyZ290QHB3ci53cm9jLnBsMA0GCSqGSIb3
DQEBBQUAA4IBAQA4RE3C4xlstDGi9J16OFDiGbwTEfst9/2096nIEuwYTJzzt3FvxbAY/hvb
7OPmOEXVmXLgV4vm5uhWlBcdDryS+GMXDKi+4sbmtb+CwLYeaIMeHDTDgFO1lTKfYJZ8tpQh
WWnxc/xBp1E6anC/XanFGI5s9j/l/zJecSKk9nAoyEzpLc4MmXc+lVjqQnwHkzCjgIZMQQz9
q+OkElZXkLICje07qfSfte6/bt1K6S8Vk3K4SH9yrM1xWS0spPAJtcFj5YRLujiJ0DzONlrD
KmKpzvISDNRH4eHCZLl7msoG68ksv/CUsc2PUbTdkHO2K53dUxxZ4Vsz+aGGFVn3Sg1PMIIF
4DCCBMigAwIBAgIIUvhE0qlgqdQwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCUEwxEDAO
BgNVBAoMB1BJT05JRVIxDTALBgNVBAoMBFdDU1MxHjAcBgNVBAMMFVBJT05JRVIgUEtJIENB
LVdDU1MtMTAeFw0xMDEyMjExMTU5MDlaFw0xMTEyMjExMTU5MDlaMIHvMSowKAYJKoZIhvcN
AQkBFhtiYXJ0b3N6LnN6dXJnb3RAcHdyLndyb2MucGwxLDAqBgNVBAMMI2JhcnRvc3pfc3p1
cmdvdF82MDQ0NjAyNjI1NzQwNTE1MTk4MRgwFgYDVQQDDA9CYXJ0b3N6IFN6dXJnb3QxNzA1
BgNVBAsMLldyb2PFgmF3c2tpZSBDZW50cnVtIFNpZWNpb3dvLVN1cGVya29tcHV0ZXJvd2Ux
ITAfBgNVBAoMGFBvbGl0ZWNobmlrYSBXcm9jxYJhd3NrYTEQMA4GA1UECgwHUElPTklFUjEL
MAkGA1UEBhMCUEwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDa1XBBpulCbONy
LqEdBQhdopvzCZqw99uxzhZCnm4b+fANi0RnU/ngg2pWpOCyLyA8pSejl/O8B4dct6q/yHL3
yZ4sP/NF/5TwR6kZzI1mP/98zrqqrSJu/ep4x8+21JPnng9a9kiLJ2zkLY4eh1TZ6dJK9m8p
WlbpDvH5bzcn09nzvM8s0+ZkLdpqK1o000m+mcSfU74g+41C5uDv97r/xyUoem7JBRKWGEuI
6wWN7QEAb7W9n1MB9nlYmBstIf2jy8s8yPu6D5HeueSRPni82gj4136WPkZHZl3BM4lNZ9Un
z98B10/RoKCpO4BZwFCDVpLTaCGdoQcMPd5FF2sxAgMBAAGjggIeMIICGjCBjQYIKwYBBQUH
AQEEgYAwfjAvBggrBgEFBQcwAoYjaHR0cDovL2NhLTEud2Nzcy5wa2kucGlvbmllci5uZXQu
cGwwSwYIKwYBBQUHMAGGP2h0dHA6Ly9vY3NwLnBraS5waW9uaWVyLm5ldC5wbDo4MDgwL2Vq
YmNhL3B1YmxpY3dlYi9zdGF0dXMvb2NzcDAdBgNVHQ4EFgQUlQccfyEX2F8Y1h/fROxcWxwM
CJowDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQttAMuHKzHG5UU0h9cdmJ9ogpfUDBRBgNV
HSAESjBIMEYGDSsGAQQBgplhAQQBAAEwNTAzBggrBgEFBQcCARYnaHR0cDovL2NhLTEud2Nz
cy5wa2kucGlvbmllci5uZXQucGwvY3BzMIGPBgNVHR8EgYcwgYQwgYGgK6AphidodHRwOi8v
Y2EtMS53Y3NzLnBraS5waW9uaWVyLm5ldC5wbC9jcmyiUqRQME4xHjAcBgNVBAMMFVBJT05J
RVIgUEtJIENBLVdDU1MtMTENMAsGA1UECgwEV0NTUzEQMA4GA1UECgwHUElPTklFUjELMAkG
A1UEBhMCUEwwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
BDAmBgNVHREEHzAdgRtiYXJ0b3N6LnN6dXJnb3RAcHdyLndyb2MucGwwDQYJKoZIhvcNAQEF
BQADggEBADhETcLjGWy0MaL0nXo4UOIZvBMR+y33/bT3qcgS7BhMnPO3cW/FsBj+G9vs4+Y4
RdWZcuBXi+bm6FaUFx0OvJL4YxcMqL7ixua1v4LAth5ogx4cNMOAU7WVMp9glny2lCFZafFz
/EGnUTpqcL9dqcUYjmz2P+X/Ml5xIqT2cCjITOktzgyZdz6VWOpCfAeTMKOAhkxBDP2r46QS
VleQsgKN7Tup9J+17r9u3UrpLxWTcrhIf3KszXFZLSyk8Am1wWPlhEu6OInQPM42WsMqYqnO
8hIM1Efh4cJkuXuaygbrySy/8JSxzY9RtN2Qc7Yrnd1THFnhWzP5oYYVWfdKDU8xggMbMIID
FwIBATBaME4xCzAJBgNVBAYTAlBMMRAwDgYDVQQKDAdQSU9OSUVSMQ0wCwYDVQQKDARXQ1NT
MR4wHAYDVQQDDBVQSU9OSUVSIFBLSSBDQS1XQ1NTLTECCFL4RNKpYKnUMAkGBSsOAwIaBQCg
ggGWMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTExMDUxNzA4
MTgyOVowIwYJKoZIhvcNAQkEMRYEFPGfks69drC+TA3i3Bt8rhLOBaP4MF8GCSqGSIb3DQEJ
DzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG
9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDBpBgkrBgEEAYI3EAQxXDBaME4xCzAJ
BgNVBAYTAlBMMRAwDgYDVQQKDAdQSU9OSUVSMQ0wCwYDVQQKDARXQ1NTMR4wHAYDVQQDDBVQ
SU9OSUVSIFBLSSBDQS1XQ1NTLTECCFL4RNKpYKnUMGsGCyqGSIb3DQEJEAILMVygWjBOMQsw
CQYDVQQGEwJQTDEQMA4GA1UECgwHUElPTklFUjENMAsGA1UECgwEV0NTUzEeMBwGA1UEAwwV
UElPTklFUiBQS0kgQ0EtV0NTUy0xAghS+ETSqWCp1DANBgkqhkiG9w0BAQEFAASCAQCffr3U
ptMY8S19z6UZMtUpCkRnlWCjWFANGcXaAfyvHu10AVzNBGSddu2RdrGMZxdRn5wXfpNFKng2
+iA6J/MJGDGFYtZE6ul2CwiZZeTiQnQOdX87PWRDIh9DdAb/84je6b+9cMYmQms2tKjRYcLs
xK9XAj/tJ5b44bldH0PS1jSACvaOsA6Y3XRK9PXjL8GSVGwGlOQMzqQEDql+GgckeE27zR/M
dci+14pN8AKIhwQ4sZnJHYDc6654/bo9Qun7GZGPB50pbdIAjjNzx+Thu2Kj8ODt0/XemsmM
otK6CMtMubwiT4yUWfsHZCauA06eHVYfsMXW4s03gqFlU959AAAAAAAA
--------------ms080609040702050806050209--

--===============2042537839912602027==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
--===============2042537839912602027==--