Argus 1.8 Code Freeze Tarfile

[Carter Bullard]

Hey Peter,
So much for the code freeze %^}  You are right, but the topic
brings up an old dicussion as to what the signals should do.
Right now we catch them all and exit.

Chas wanted the ability to get an instantaneous report on
packets/flows for a ra() that is persistent and writing
output to a file.  This would be a good opportunity to
define what we want signals to do.

SIGINT would be a good one for the periodic report, if the
client supports it.  SIGQUIT and SIGKILL seem like they
should cause the client to exit().

Opinions are needed quickly, as I will be closing this up
soon.

Thanks again!!!

Carter

-----Original Message-----
From: Peter Van Epp [mailto:vanepp at sfu.ca]
Sent: Wednesday, September 15, 1999 6:33 PM
To: Carter Bullard
Subject: Re: Argus 1.8 Code Freeze Tarfile


> 
> Gentle people,
>    Here is the Argus-1.8 code release tarfile.
> The work that still needs to be done is to merge
> the CMU configure strategy and to update the documentation,
> which includes man pages for the new clients.  Notice that
> I renamed most of the clients to put ra at the beginning of
> all the names.  This helped me to remove and copy so, if
> that causes problems, please yell!!!
> 
> I still have some client testing to do, but ra(), racount(),
> rasort(), raservices(), radjaceny(), radnstats() and ratemplate()
> should be good to go.  Basically that just leaves raconnections().
> 
>    I believe that we deal with all the known bugs here,
> and so please feel free to prove me wrong, if possible ;o)
> 
> Best Regards,
> 
> Carter
> 

	The new tar file motivated me to look at the signal issue. It appears
that the really old 1.8 that works has no signal handling in ra and both the
newer ones have init which installs argus_parse_complete as the signal handler
for SIGINT (among others). While I'm hazy on signal handling, shouldn't there
be an exit() in argus_parse_complete otherwise it will return to the point of 
the signal having done its thing (in my case presumably because of no aflag or 
total_bytes flag, nothing) which matches the observed behavior? This might be
a difference in signal handling between SYSV and BSD as well since I'm running
on FreeBSD rather than SYSV. Other than that the new 1.8 went in without
trouble and appears to be running fine.

/usr/local/src/argus-1.8/clients (latest one from today)
% grep signal ra.c
#include <signal.h>
   (void) signal (SIGHUP,  (void (*)()) argus_parse_complete);
   (void) signal (SIGINT,  (void (*)()) argus_parse_complete);
   (void) signal (SIGTERM, (void (*)()) argus_parse_complete);
   (void) signal (SIGQUIT, (void (*)()) argus_parse_complete);

r2d2# pwd
/usr/local/src/argus-1.8.old/clients  (last 1.8 version that responded to 
interrupt by stopping output).

r2d2# grep signal ra.c
r2d2# 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada