[Oisf-users] Suricata - test rule ignored/not dropping.

Anas.B a.bouhsaina at gmail.com
Tue Jul 27 08:54:14 UTC 2010


Good morning,

This is my case :

Bridging is successful since I have net connection in my host

---Net-Router(172.20.81.1)-----<- Bridge (suricata in computer (with 2
cards) ->------ my host (172.20.81.101)

br0 eth1 eth0
*But* when i tried this rule :

drop tcp 172.20.81.101 any -> any any (content:"facebook"; msg:"Attention,
Facebook !!!"; sid:1000002; rev:1;)
or :
drop tcp any any -> any any (content:"facebook"; msg:"Attention, Facebook
!!!"; sid:1000002; rev:1;)


I just have an alert, but I can enter to facebook.........!!!

07/26/10-08:28:07.517395  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1740 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:08.206148  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1742 ->
72.14.235.100:80 <http://72.14.235.100/>
07/26/10-08:28:08.380125  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1740 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:09.079290  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1741 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:28:09.544135  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1745 ->
87.248.218.92:80 <http://87.248.218.92/>
07/26/10-08:28:09.639904  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1746 ->
68.87.64.116:80 <http://68.87.64.116/>
07/26/10-08:28:09.653826  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1744 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:28:09.830274  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1748 ->
4.71.209.15:80 <http://4.71.209.15/>
07/26/10-08:28:10.008049  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1747 ->
209.85.227.100:80 <http://209.85.227.100/>
07/26/10-08:28:10.300653  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1749 ->
68.87.78.149:80 <http://68.87.78.149/>
07/26/10-08:28:11.977590  [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:28:17.931527  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1740 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:21.189125  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1750 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:28:38.168496  [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:28:42.299672  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1770 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:44.941011  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1804 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:47.559393  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1839 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:49.628545  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1848 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:51.678339  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1862 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:28:52.378889  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1799 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:54.486073  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1875 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:28:56.420210  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1889 ->
87.98.130.52:80 <http://87.98.130.52/>
07/26/10-08:29:04.413680  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1926 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:29:08.820362  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1946 ->
72.14.235.100:80 <http://72.14.235.100/>
07/26/10-08:29:09.216669  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1949 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:29:12.252341  [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:29:13.124177  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1964 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:29:13.709394  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1967 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:29:13.997069  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1974 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:14.158277  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1976 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:14.191434  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1976 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:14.206014  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1976 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:15.576897  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1974 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:21.263951  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1997 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:29:24.106282  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2027 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:29:43.536743  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:44.225171  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:44.269318  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:44.582251  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:46.024928  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2049 ->
80.157.170.80:80 <http://80.157.170.80/>
07/26/10-08:29:46.158738  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:46.778466  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2050 ->
80.157.170.73:80 <http://80.157.170.73/>
07/26/10-08:29:46.850379  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2050 ->
80.157.170.73:80 <http://80.157.170.73/>
07/26/10-08:29:47.447351  [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:29:50.837632  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2054 ->
196.12.213.57:80 <http://196.12.213.57/>
07/26/10-08:29:51.511817  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:51.578581  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:51.649844  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:51.973257  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:52.343481  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:53.313476  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:54.678733  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:55.056374  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:55.398719  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:55.733208  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:57.166266  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:57.293175  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:57.812568  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2058 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:58.522060  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:58.589148  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:58.657140  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:59.509121  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.129142  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.194528  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.555942  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.646232  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.874448  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2058 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.396735  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.491180  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.560120  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.939659  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:02.238916  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:02.838980  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:04.038863  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:04.822896  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2075 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:30:05.234740  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:05.995330  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2078 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:30:06.429322  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2080 ->
208.80.152.2:80 <http://208.80.152.2/>
07/26/10-08:30:06.438720  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:08.541125  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2077 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:30:13.636323  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:13.892064  [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2095 ->
67.18.23.65:80 <http://67.18.23.65/>

Packets are not dropped ! can someone explain to me why ?

this is the iptables configurtion of the bridge

iptables -A INPUT -j NFQUEUE
iptables -A FORWARD -j NFQUEUE
iptables -A OUTPUT -j NFQUEUE


Thank you,
Cheers.

A..


2010/7/27 Victor Julien <victor at inliniac.net>

> The dropping appears to work if a 'content:"/";' is added like this:
>
> drop tcp any any -> any 80 (msg:"Snort_Inline is blocking the http
> link"; sid:1; content:"/";)
>
> It should work without it as well though, so opened a bug ticket for it:
>
> https://redmine.openinfosecfoundation.org/issues/221
>
> Thanks for the report Morgan!
>
> Cheers,
> Victor
>
> Morgan Cox wrote:
> > Hi.
> >
> > I am quite familiar with running snort in inline mode.
> >
> > I have setup bridging mode on Ubuntu Lucid  = eth0+eth1 = br0
> >
> > , I have added emerging and VRS rules.
> >
> > It is running ok - but ignoring my test (drop) rule
> >
> > I want suricata to examine all traffic (including to the Suricata server)
> >
> > I have used a startup script:-
> >
> > /sbin/iptables -A INPUT -j NFQUEUE --queue-num 0
> > /sbin/iptables -A FORWARD -j NFQUEUE --queue-num 0
> > /sbin/iptables -A OUTPUT -j NFQUEUE --queue-num 0
> > sleep 1
> > /usr/local/bin/suricata -c /etc/suricata/suricata.yaml -q 0 -D
> > --pidfile=/var/run/suricata.pid
> >
> > For my test rule I just want it to drop all attempts to go to port 80
> > (for the Bridge + the Suricata server)
> >
> > Previously I have used
> >
> >
> > drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
> > connection initiated";)
> >
> > But it errors:-
> >
> > [1296] 26/7/2010 -- 14:53:01 - (detect.c:301) <Error>
> > (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Error
> > parsing signature "drop tcp any any -> any 80 (msg:"Snort_Inline is
> > blocking the http link";) " from file
> > /etc/suricata/rules/emerging-malware.rules at line 1314
> >
> > - somehow the syntax isn't working.
> >
> >
> >
> > If I use:-
> >
> > drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
> > connection initiated";)
> >
> > I get no errors (in the log) but can still access port 80 on the
> > Suricate server - i.e :-
> >
> > http://ipaddressofsuricataserver.com:80
> >
> > And I get nothing in the logs, no alert + no drop - so my test rule
> > isn't working.
> >
> >
> > Lastly I have tried (from the blog)
> >
> > drop tcp any any -> any 80 (msg:"testing drop"; content:"*";
> > http_header; sid:123321;)
> >
> > This does trigger an 'alert' when I go to
> >
> > http://ipaddressofsuricataserver.com:80
> >
> > in fast.log :-
> >
> > 07/26/10-14:01:54.377706  [**] [1:123321:0] testing drop [**]
> > [Classification: (null)] [Priority: 3] {6} (clientIP):49769 ->
> (serverip):80
> >
> > The issue is is that it is NOT blocking - I can still access it.
> >
> > Can anyone suggest how to make it drop correctly ?
> >
> > Cheers
> >
> >
> >
> >
> >
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Oisf-users mailing list
> > Oisf-users at openinfosecfoundation.org
> > http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20100727/e03eb395/attachment-0002.html>


More information about the Oisf-users mailing list