[Sguil-devel] Sguild CVS Bug in database insert

[Callan T. <cal...@se...>]

Hi list!

Ran into an error in the database insert, with the new barnyard sending
alerts via the CVS sensor_agent.tcl (IP addresses masked due to company
policy):

Sensor Data Rcvd: BYEventRcvd sock3 0 1 458 test-sensor 477 477
{1974-05-14 21:21:28} 1 483 0 {ICMP PING CyberKit 2.2 Windows}
{2005-05-10 04:39:09} 3 misc-activity 1134108336 xx.xxx.xxx.xxx
3399324716 xxx.xxx.xxx.xx 1 4 5 0 92 53090 0 0 107 48939 8 0 17917 512
23213 {} {} {} {} {} {} {} {} {} {} {} {}
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
DB Error during:
INSERT INTO icmphdr (sid, cid, icmp_csum, icmp_id, icmp_seq)  VALUES
('''1', '458', '17917'', '512'', '23213')
: mysqlexec/db server: You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right
syntax to use near '512'', '23213')' at line 1

I dug around the sguild/lib dir and found the bits of code that were
adding the additional quotes, and changed them. I've attached the patch.
The buggy bits were in SguildGenericDB.tcl.

Hope that was useful.

Cheers,
Callan