Merge pull request #63 in SNORT/snort3 from obfuscation1 to master

Squashed commit of the following:

commit 7eeb7325b1d300680f8502263a497464179572aa
Author: Tom Peters <thopeter@cisco.com>
Date:   Thu Oct 1 13:20:35 2015 -0400

    -B switch fixed

diff --git a/doc/bugs.txt b/doc/bugs.txt
index 6f00261c8b33ff95d16a63b6e26fcb42ee4bc6b7..6d0307c8aba66b0f7523f295dcb2efdec14e9010 100644 (file)
--- a/doc/bugs.txt
+++ b/doc/bugs.txt
@@ -50,9 +50,6 @@ warning as does metadata:service foo, service foo;
 * ip_proto doesn't work properly with reassembled packets so it can't be
 used to restrict the protocol of service rules.
 
-
-==== Rules
-
 * Inspector events generated while parsing TCP payload in non-IPS mode will
   indicate the wrong direction (ie they will be based on the ACK packet).
   (Same is true for Snort.)
@@ -81,3 +78,11 @@ etc.).
 * alert_fast and alert_full: output configuration includes "file = 'foo.bar'", but file is a bool
 and you cannot specify an output file name in the configuration.
 
+
+==== obfuscation
+
+* -B <mask> feature does not work. It does ordinary IP address obfuscation instead of using the
+mask.
+
+* Obfuscation does not work for csv format.
+

diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc
index 90f9680c38a6779644e45fde521be8d79d1bb614..eca0ef3617dd97cb41e36728ee4f4d3c8d18d1e1 100644 (file)
--- a/src/main/snort_module.cc
+++ b/src/main/snort_module.cc
@@ -129,7 +129,7 @@ static const Parameter s_params[] =
     { "-A", Parameter::PT_STRING, nullptr, nullptr,
       "<mode> set alert mode: none, cmg, or alert_*" },
 
-    { "-B", Parameter::PT_IMPLIED, nullptr, nullptr,
+    { "-B", Parameter::PT_ADDR, nullptr, "255.255.255.255/32",
       "<mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask" },
 
     { "-C", Parameter::PT_IMPLIED, nullptr, nullptr,