bug in web-accesslog decoder

[Holger Gläß]

hi

our apache admin ( guru ) found a bug insider of the web-accesslog
decoder around line 1216.

orginal = <regex>"\w+ (\S+) HTTP\S+ (\d+) </regex>

fixed = <regex>"\w+ (\S+) HTTP\S+" (\d+) </regex>

there was an missed closing cuote.

holger

[Daniel Cid]

Hi,

That's not a bug, since the \S+ matches any non-space character, so it
would match the quotes
after the HTTP. Both cases will work...

Thanks for looking into that.

--
Daniel B. Cid
dcid ( at ) ossec.net

[Holger Gläß]

hi

it ist possible to make following changes to the pf.sh script or in
similar manner?

after define of $PFCTL

. /etc/rc.conf
. /etc/rc.conf.local

and after
if [ "X${PFCTL_RULES}" = "X" ]; then
fi

if [ -n $pf_rules ] ; then
PFCTL_RULES=$pf_rules;
fi

it makes more sense in recommended configuration way in openbsd you have
to use rc.conf.local for change settings
and not the rc.conf file which replaced by an update .

also you can use other pf.conf file like the default one , in mycase i
use an diffrent path for my firewall config.

holger