kliaaennetscape.net
Date: Thu Sep 22 2005 - 05:29:41 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello

[Please bear in mind that I'm not much of a programmer and that if this issue has been addressed already I'm just too thick to find it:)]

After upgrading to Snort 2.4.1 I discovered that when starting Snort it would die with a message about an incorrect DB schema version.
I deleted and re-created the database and when importing the SQL from schemas/create_mysql the database choked on a syntax error in the script. According to [http://dev.mysql.com/doc/mysql/en/reserved-words.html] the word SCHEMA is reserved and must be enclosed in quotes to be used.

This is solved by changing the syntax in schemas/create_mysql from "CREATE TABLE schema (...)" to "CREATE TABLE `schema` (...)" on line 23 and "INSERT INTO schema (...)" to "INSERT INTO `schema` (...)" on line 26.

To make Snort recognize the schema version it must be told to correctly quote the query on the schema table. There are already exceptions made for MS SQL in src/output-plugins/spo_database.c around line 1915.
I made the following addition at line 1933 (after the default schema query syntax) in the function CheckDBVersion(DatabaseData * data):
---
if (data->shared->dbtype_id == DB_MYSQL)
{
snprintf(select0,MAX_QUERY_LENGTH,
"SELECT vseq"
" FROM `schema`");
}
---

This overwrites the SQL query if the database is Mysql.
By making these simple changes Snort compiles cleanly and runs without problems.

I'm sure the Snort developers/maintainers can make a more suitable fix than the one I've outlined above.

Cheers!

__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]