RE: Aurora Linux success?

After a little more digging & watching, it appears to bug out verifying
checksums.  Line 1861 in decode.c is the beginning of TCP checksumming...

--snip from decode.c--

if(pv.checksums_mode & DO_TCP_CHECKSUMS)
{
/* setup the pseudo header for checksum calculation */
ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);           <- line 1861
ph.dip = (u_int32_t)(p->iph->ip_dst.s_addr);
ph.zero = 0;
ph.protocol = p->iph->ip_proto;
ph.tcplen = htons((u_short)len);

/* if we're being "stateless" we probably don't care about the TCP
* checksum, but it's not bad to keep around for shits and giggles */
/* calculate the checksum */
csum = in_chksum_tcp((u_int16_t *)&ph, (u_int16_t *)(p->tcph), len);

if(csum)
{
p->csum_flags |= CSE_TCP;

DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Bad TCP checksum\n"););

}
else
{
DEBUG_WRAP(DebugMessage(DEBUG_DECODE,"TCP Checksum: OK\n"););
}
}


--/snip/--

Also, during compliation, I get two warnings.  One in decode.c...

gcc -DHAVE_CONFIG_H -I. -I. -I.. -I.. -I../src -I/usr/include/pcap -I../src/
output-plugins -I../src/detection-plugins -I../src/preprocessors  -I/usr/inc
lude/mysql -DENABLE_MYSQL  -g -O2 -Wall -c decode.c
decode.c: In function `DecodeUDP':
decode.c:1941: warning: `csum' might be used uninitialized in this function

and in snort.c...

gcc -DHAVE_CONFIG_H -I. -I. -I.. -I.. -I../src -I/usr/include/pcap -I../src/
output-plugins -I../src/detection-plugins -I../src/preprocessors  -I/usr/inc
lude/mysql -DENABLE_MYSQL  -g -O2 -Wall -c snort.c
snort.c: In function `InterfaceThread':
snort.c:1678: warning: long unsigned int format, unsigned int arg (arg 3)

By the way, the patch barfed on 1.9.1 since (I'm assuming) it said it was
for 1.9.0.

Anyone?  Bueller?

Is this also why it's absolutely ignoring my attempts at setting up output
plugins?


WARNING: unknown output plugin: 'alert_syslog'WARNING: unknown output
plugin: 'log_tcpdump'WARNING: unknown output plugin: 'database'WARNING:
unknown output plugin: 'xml'1321 Snort rules read...

Walter
-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Tom 'spot'
Callaway
Sent: Wednesday, March 05, 2003 7:00 PM
To: [email protected]
Subject: Re: [aurora-sparc-devel] Aurora Linux success?


On Wed, 2003-03-05 at 18:49, Ralf Ertzinger wrote:
> Hi.
>
> "Tom 'spot' Callaway" <[email protected]> wrote:
>
> > The fix in that URL looks sane. Please test this, and if it does resolve
> > the issue, file it in bugzilla along with the URL so that I'll remember
> > to fix it in the Aurora tree.
>
> Aurora ships snort? I'm baffled.

No, but it should. I've never understood why Red Hat didn't.

~spot
---
Tom "spot" Callaway <tcallawa(a)redhat*com> (SAIR LCA, RHCE)
GPG: D786 8B22 D9DB 1F8B 4AB7  448E 3C5E 99AD 9305 4260
Red Hat Field Sales Engineer :: http://www.redhat.com
Aurora SPARC Linux Project Leader :: http://www.auroralinux.org

The words and opinions reflected in this message do not necessarily
reflect those of my employer, Red Hat, or my project, Aurora
SPARC Linux and belong solely to me.

_______________________________________________
aurora-sparc-devel mailing list
[email protected]
http://lists.linuxpower.org/mailman/listinfo/aurora-sparc-devel