From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Mon, 5 Oct 2015 20:42:04 +0000 (-0400)
Subject: Merge pull request #63 in SNORT/snort3 from obfuscation1 to master
X-Git-Tag: 3.0.0-233~801
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=52ca97491536722fbd87876275d3e077e13db20b;p=thirdparty%2Fsnort3.git

Merge pull request #63 in SNORT/snort3 from obfuscation1 to master

Squashed commit of the following:

commit 7eeb7325b1d300680f8502263a497464179572aa
Author: Tom Peters <thopeter@cisco.com>
Date:   Thu Oct 1 13:20:35 2015 -0400

    -B switch fixed
---

diff --git a/doc/bugs.txt b/doc/bugs.txt
index 6f00261c8..6d0307c8a 100644
--- a/doc/bugs.txt
+++ b/doc/bugs.txt
@@ -50,9 +50,6 @@ warning as does metadata:service foo, service foo;
 * ip_proto doesn't work properly with reassembled packets so it can't be
 used to restrict the protocol of service rules.
 
-
-==== Rules
-
 * Inspector events generated while parsing TCP payload in non-IPS mode will
   indicate the wrong direction (ie they will be based on the ACK packet).
   (Same is true for Snort.)
@@ -81,3 +78,11 @@ etc.).
 * alert_fast and alert_full: output configuration includes "file = 'foo.bar'", but file is a bool
 and you cannot specify an output file name in the configuration.
 
+
+==== obfuscation
+
+* -B <mask> feature does not work. It does ordinary IP address obfuscation instead of using the
+mask.
+
+* Obfuscation does not work for csv format.
+
diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc
index 90f9680c3..eca0ef361 100644
--- a/src/main/snort_module.cc
+++ b/src/main/snort_module.cc
@@ -129,7 +129,7 @@ static const Parameter s_params[] =
     { "-A", Parameter::PT_STRING, nullptr, nullptr,
       "<mode> set alert mode: none, cmg, or alert_*" },
 
-    { "-B", Parameter::PT_IMPLIED, nullptr, nullptr,
+    { "-B", Parameter::PT_ADDR, nullptr, "255.255.255.255/32",
       "<mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask" },
 
     { "-C", Parameter::PT_IMPLIED, nullptr, nullptr,