yookd / pulledpork

Automatically exported from code.google.com/p/pulledpork
GNU General Public License v2.0
0 stars 0 forks source link

Pulledpork error on ETPro rule set #69

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1.  we have purchased an ETPro Subscription.  Running pulledpork.pl -vvc 
"ConfigFile" we get the following error

Checking latest MD5 for etpro.rules.tar.gz....
        Fetching md5sum for: etpro.rules.tar.gz.md5
** GET 
https://rules.emergingthreats.net/8583156868465486/snort-2.8.6/etpro.rules.tar.g
z.md5 ==> SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
404 Not Found
        A 404 error occurred, please verify your filenames and urls for your tarball!
        Error 404 when fetching https://rules.emergingthreats.net/8583156868465486/snort-2.8.6/etpro.rules.tar.gz.md5 at /usr/local/bin/pulledpork.pl line 423
        main::md5file(8583156868465486, 'etpro.rules.tar.gz', '/tmp/', 'https://rules.emergingthreats.net/8583156868465486/snort-2.8.6/') called at /usr/local/bin/pulledpork.pl line 1593

What is the expected output? What do you see instead?
When using only the ET rules everything works great.  Am I missing something

What version of the product are you using? On what operating system?
just updated to version .60 on Ubuntu

Please provide any additional information below.
I can attach our pulledpork.conf if neccessary

Original issue reported on code.google.com by tmcal...@gmail.com on 10 Mar 2011 at 4:11

GoogleCodeExporter commented 9 years ago
Update.  When turning off the md5 verification and running verbose I get the 
following error.

Rules tarball download of etpro.rules.tar.gz....
        Fetching rules file: etpro.rules.tar.gz
But not verifying MD5
** GET http://rules.emergingthreatspro.com/etpro.rules.tar.gz ==> 404 Not Found
        A 404 error occurred, please verify your filenames and urls for your tarball!

It would appear that pulledpork is not putting in the oinkcode to pull down the 
etpro rules and the version number.  I am working my way through your code to 
find the problem but I am not currently having any luck

Original comment by tmcal...@gmail.com on 10 Mar 2011 at 7:49

GoogleCodeExporter commented 9 years ago
work around:

in the ETPro download section of pulledpork.conf I entered the following line

rule_url=http://rules.emergingthreatspro.com/<oinkcode>/<Version>/|etpro.rules.t
ar.gz|<oinkcode>

Original comment by tmcal...@gmail.com on 10 Mar 2011 at 7:54

GoogleCodeExporter commented 9 years ago
This issue is not reproducible (in older versions of PP it may exist, but has 
been fixed / does not exist in the current 0.6.0 Dev version in svn..)  I am 
marking this as a dup and not invalid because it's likely a dup of the previous 
ET Pro request.

jj@zeus:~/$ ./pulledpork.pl -c ../pulledpork.conf -vvT

    http://code.google.com/p/pulledpork/
      _____ ____
     `----,\    )
      `--==\\  /    PulledPork v0.6.0 Dev
       `--==\\/
     .-~~~~-.Y|\\_  Copyright (C) 2009-2011 JJ Cummings
  @_/        /  66\_  cummingsj@gmail.com
    |    \   \   _(")
     \   /-| ||'--'  Rules give me wings!
      \_\  \_\\

Config File Variable Debug ../pulledpork.conf snort_path = /usr/local/bin/snort distro = Ubuntu-10-4 temp_path = /tmp version = 0.6.0 pid_path = /var/run/snort_eth0.pid sorule_path = /home/jj/snort_dynamicrules/ rule_path = /home/jj/snort.rules ignore = deleted.rules,experimental.rules,local.rules,imap.so,multimedia.so rule_url = ARRAY(0x2bbdd40) snort_version = 2.8.6 sid_changelog = /home/jj/sid_changes.log sid_msg = /home/jj/sid-msg.map local_rules = /home/jj/local.rules ips_policy = security config_path = /usr/local/etc/snort/snort.conf MISC (CLI and Autovar) Variable Debug: arch Def is: x86-64 Config Path is: ../pulledpork.conf Distro Def is: Ubuntu-10-4 security policy specified local.rules path is: /home/jj/local.rules Rules file is: /home/jj/snort.rules sid changes will be logged to: /home/jj/sid_changes.log sid-msg.map Output Path is: /home/jj/sid-msg.map Snort Version is: 2.8.6 Snort Config File: /usr/local/etc/snort/snort.conf Snort Path is: /usr/local/bin/snort Text Rules only Flag is Set Extra Verbose Flag is Set Verbose Flag is Set Base URL is: https://rules.emergingthreats.net/|etpro.rules.tar.gz| Checking latest MD5 for etpro.rules.tar.gz.... Fetching md5sum for: etpro.rules.tar.gz.md5 * GET https://rules.emergingthreats.net//snort-2.8.6/etpro.rules.tar.gz.md 5 ==> SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server key exchange A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A 200 OK (1s) most recent rules file digest: 4baeeda8eb4685cbe039421ca8ec9a68 Rules tarball download of etpro.rules.tar.gz.... Fetching rules file: etpro.rules.tar.gz * GET https://rules.emergingthreats.net//snort-2.8.6/etpro.rules.tar.gz ==> SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server key exchange A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A 200 OK (3s) storing file at: /tmp/etpro.rules.tar.gz


Original comment by `Cummin...@gmail.com` on 11 Mar 2011 at 5:53
* Changed state: **Duplicate**
GoogleCodeExporter commented 9 years ago
Hi,

Finally got "Fly Piggy Fly!"
I got solve this problem by using pulledpork-0.7.0.tar.gz instead of 
pulledpork-0.6.1.tar.gz.

Regards,
Aziz Ul Haq

Original comment by Mr.Azizu...@gmail.com on 2 Jan 2014 at 8:37