Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots
-
Sorry this is dragging along, but it turned out to be a bit more involved than I initially thought. I can see the light at the end of the tunnel, though. Hopefully it is not another oncoming train
.Currently fighting an issue with installs of the package when there is an existing previous configuration. Something in the new pfSense code is getting tripped up in this circumstance and it is not recognizing when the package installation is actually complete, so the installation status progress bar within pfSense never turns "green" to signal success.
-
We finally have the new Snort package for the 2.7.0-DEVEL CE and 23.01 pfSense Plus branches ready for preliminary testing. It should show up in the Package Manager as an update (package version 4.1.6_1). This update contains only fixes for PHP 8.1.
Note:
There is still a problem with the installation seeming to "hang" when you are installing with a prior existing configuration or when you upgrade (since the previous installation's configuration will be detected).The problem is a generic issue in pfSense's pkg installer system and is not specific to Snort or Suricata. The Netgate team is actively investigating the issue. It currently impacts Snort, Suricata, pfBlockerNG, and Squid.
To work around the problem when installing, follow these steps:
- Install or update as usual via SYSTEM > PACKAGE MANAGER.
- If the install stops scrolling text in the status update window, but the progress bar never turns green, and you don't see a SUCCESS message, you are probably experiencing the hang. This should only happen with an upgrade of the package when there is an existing configuration present. Give the install process several minutes to be sure it is hung as downloading and updating the Snort rules can also take a while.
- To clear the "hung" process and have the install complete, open a CLI session on the firewall either via the console or using SSH for a remote shell session. Issue this command:
ps -ax | grep rc.packages- You should see a single running instance of that process. Note its Process ID (PID).
- Kill the
rc.packagesprocess with this command:
kill <pid>where <pid> is the Process ID discovered in step 4 above.
6. Close the shell session and return to the pfSense GUI and you should see the installation status screen has a green progress bar. Snort should be installed and started if you had a valid previous configuration. -
A new Suricata package version for pfSense 2.7.0-DEVEL and 23.01 pfSense Plus DEVEL is now available. This package contains fixes for PHP 8.1. There are no new features and the binary, for the moment, remains at 6.0.6.
The new package version is 6.0.6_1 and should show up in the Package Manager for users on the 2.7.0 and 23.01 development snapshots.
Note:
There is still a problem with the installation seeming to "hang" when you are installing with a prior existing configuration or when you upgrade (since the previous installation's configuration will be detected).The problem is a generic issue in pfSense's pkg installer system and is not specific to Snort or Suricata. The Netgate team is actively investigating the issue. It currently impacts Snort, Suricata, pfBlockerNG, and Squid.
To work around the problem when installing, follow these steps:
- Install or update as usual via SYSTEM > PACKAGE MANAGER.
- If the install stops scrolling text in the status update window, but the progress bar never turns green, and you don't see a SUCCESS message, you are probably experiencing the hang. This should only happen with an upgrade of the package when there is an existing configuration present. Give the install process several minutes to be sure it is hung as downloading and updating the rules can also take a while.
- To clear the "hung" process and have the install complete, open a CLI session on the firewall either via the console or using SSH for a remote shell session. Issue this command:
ps -ax | grep rc.packages- You should see a single running instance of that process. Note its Process ID (PID).
- Kill the
rc.packagesprocess with this command:
kill <pid>where <pid> is the Process ID discovered in step 4 above.
6. Close the shell session and return to the pfSense GUI and you should see the installation status screen has a green progress bar. Suricata should be installed and started if you had a valid previous configuration.The next item on the list for Suricata is to update the binary to the latest 6.0.8 version from upstream.
-
@bmeeks I posted this somewhere else on the forms however I'm in the latest snapshot of November 8th 2022 still unable to install snort.
I still get the same error forgive me if I'm posting this in the wrong place. But maybe you have some insight on how I can fix this obviously running the command that it suggests breaks the web interface completely and I have to reinstall pfsense.
lua-resty-core: 0.1.23
lua-resty-lrucache: 0.13
luajit-openresty: 2.1.20220915
nginx: 1.22.0_9,3
pfSense: 2.7.0.a.20221108.0600New packages to be INSTALLED:
daq: 2.2.2_3 [pfSense]
libdnet: 1.13_3 [pfSense]
libpcap: 1.10.1_2 [pfSense]
luajit-devel: 2.1.0.20221004_1 [pfSense]
pfSense-pkg-snort: 4.1.6_1 [pfSense]
snort: 2.9.20_1 [pfSense]Number of packages to be removed: 5
Number of packages to be installed: 6The process will require 3 MiB more space.
pkg-static: Cannot delete vital package: pfSense!
pkg-static: If you are sure you want to remove pfSense,
pkg-static: unset the 'vital' flag with: pkg set -v 0 pfSense
Failed -
@nhscan, I am aware of the issue. It was caused by an upstream change in the FreeBSD ports tree. There is an open pfSense Redmine Issue here: https://redmine.pfsense.org/issues/13623. I am waiting on the Netgate developer team to tell me which of the available options for correcting this issue is best for the long term.
-
@bmeeks Thank you so much!
-
@bmeeks It also happens with suricata but I'm sure you're aware of that. Again thank you for the information and your help just glad somebody's looking into it. Thanks again.
-
@nhscan said in Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots:
@bmeeks It also happens with suricata but I'm sure you're aware of that. Again thank you for the information and your help just glad somebody's looking into it. Thanks again.
Yes. Anything using lua is going to be impacted by that upstream FreeBSD change.
-
@bmeeks Is there any update after reading some of the bug reports it looked like snort ver 4.1.6_1 snort-2.9.20_1 was the php fix however i am still unable to install it still getting this for an error. I am running Current Base System2.7.0.a.20221118.0600
Installing pfSense-pkg-snort...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking integrity... done (2 conflicting)- luajit-devel-2.1.0.20221004_1 [pfSense] conflicts with luajit-openresty-2.1.20220915 [installed] on /usr/local/bin/luajit
- luajit-devel-2.1.0.20221004_1 [pfSense] conflicts with luajit-openresty-2.1.20220915 [pfSense] on /usr/local/bin/luajit
Checking integrity... done (0 conflicting)
The following 12 package(s) will be affected (of 0 checked):
Installed packages to be REMOVED:
lua-resty-core: 0.1.23
lua-resty-lrucache: 0.13
luajit-openresty: 2.1.20220915
nginx: 1.22.0_9,3
pfSense: 2.7.0.a.20221118.0600New packages to be INSTALLED:
daq: 2.2.2_3 [pfSense]
libdnet: 1.13_3 [pfSense]
libpcap: 1.10.1_2 [pfSense]
luajit-devel: 2.1.0.20221004_1 [pfSense]
pfSense-pkg-snort: 4.1.6_1 [pfSense]
snort: 2.9.20_1 [pfSense]Installed packages to be REINSTALLED:
pkg-1.18.4_1 [pfSense]Number of packages to be removed: 5
Number of packages to be installed: 6
Number of packages to be reinstalled: 1The process will require 3 MiB more space.
pkg-static: Cannot delete vital package: pfSense!
pkg-static: If you are sure you want to remove pfSense,
pkg-static: unset the 'vital' flag with: pkg set -v 0 pfSense
Failed -
@nhscan said in Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots:
@bmeeks Is there any update after reading some of the bug reports it looked like snort ver 4.1.6_1 snort-2.9.20_1 was the php fix however i am still unable to install it still getting this for an error. I am running Current Base System2.7.0.a.20221118.0600
Installing pfSense-pkg-snort...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking integrity... done (2 conflicting)- luajit-devel-2.1.0.20221004_1 [pfSense] conflicts with luajit-openresty-2.1.20220915 [installed] on /usr/local/bin/luajit
- luajit-devel-2.1.0.20221004_1 [pfSense] conflicts with luajit-openresty-2.1.20220915 [pfSense] on /usr/local/bin/luajit
Checking integrity... done (0 conflicting)
The following 12 package(s) will be affected (of 0 checked):
Installed packages to be REMOVED:
lua-resty-core: 0.1.23
lua-resty-lrucache: 0.13
luajit-openresty: 2.1.20220915
nginx: 1.22.0_9,3
pfSense: 2.7.0.a.20221118.0600New packages to be INSTALLED:
daq: 2.2.2_3 [pfSense]
libdnet: 1.13_3 [pfSense]
libpcap: 1.10.1_2 [pfSense]
luajit-devel: 2.1.0.20221004_1 [pfSense]
pfSense-pkg-snort: 4.1.6_1 [pfSense]
snort: 2.9.20_1 [pfSense]Installed packages to be REINSTALLED:
pkg-1.18.4_1 [pfSense]Number of packages to be removed: 5
Number of packages to be installed: 6
Number of packages to be reinstalled: 1The process will require 3 MiB more space.
pkg-static: Cannot delete vital package: pfSense!
pkg-static: If you are sure you want to remove pfSense,
pkg-static: unset the 'vital' flag with: pkg set -v 0 pfSense
FailedUnfortunately, no news yet from the Netgate team. I suspect they are sort of covered up with bug fixes in the base system, and issues with add-on packages are taking a back seat at the moment. I will bump them up again to get a status.
-
@nhscan, the problem with library dependency errors when trying to install the latest Snort package on pfSense DEVEL snapshots should be fixed in the next snapshot build.
The fix was merged about 11:00 AM Eastern Time (USA) on 11/23/2022. So the fix should be in any snapshot update with a date and time after that time.
-
@bmeeks Does a similar change need to be made to the Suricata makefile as well? The pull request appears to apply only to Snort.
-
@rabidsasquatch said in Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots:
@bmeeks Does a similar change need to be made to the Suricata makefile as well? The pull request appears to apply only to Snort.
Yeah, probably so. Forgot about that one. I'll get one created in the next few days and submitted.
-
@rabidsasquatch said in Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots:
@bmeeks Does a similar change need to be made to the Suricata makefile as well? The pull request appears to apply only to Snort.
I submitted a fix for Suricata as well for the
luajit-openrestylibrary conflict. It was merged around 10:00 AM US Eastern on 11/28/2022, and so will appear in the next snapshot build after that time. The new Suricata binary version will be 6.0.8_2 (updated from 6.0.8_1). -
@bmeeks Suricata 6.0.8_2 not working (2.7) and log doesn't say why, just refresh and that does nothing...
-
Have you checked the pfSense System Log for anything that might be logged there?
I just fired up my 2.7.0 Snapshot Virtual Machine with Suricata installed and everything came up fine. Here is a screenshot of Suricata running on the WAN --
If Suricata does not get far enough along in its startup to create thesuricata.logfile and write to it, then something pretty drastic is messed up on the box.You can check the System Log to see what may be logged there. You could also try a remove and reinstall operation with the Suricata package.
-
@bmeeks said in Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots:
You can check the System Log to see what may be logged there. You could also try a remove and reinstall operation with the Suricata package.
I only reinstall once but did not completely remove before the reinstall...all pfSense system log says is that Suricata was stopped then upgraded. Will remove, reinstall, and report back.
Dec 15 11:37:34 pkg-static 67395 suricata upgraded: 6.0.8_1 -> 6.0.8_2
Dec 15 11:37:34 SuricataStartup 76447 Suricata STOP for WAN(25152_em0)... -
@nollipfsense, you are likely hitting the issue I described in this post way back at the top of this thread: https://forum.netgate.com/topic/174915/snort-and-suricata-problems-with-the-new-php-8-1-and-freebsd-main-snapshots/5.
The problem is with
pkgin pfSense and not with the Suricata (or Snort) packages themselves. There are also other pfSense packages that are currently impacted by this issue. The Netgate team is looking into it. -
@bmeeks Okay as I removed, reinstall, same, then removed settings, removed, reboot then reinstall and got the same result. One thing I noticed after the clean install was service status was showing Suricata had not started despite Suricata had not been enabled nor configured.
-
@nollipfsense said in Snort and Suricata problems with the new PHP 8.1 and FreeBSD Main Snapshots:
@bmeeks Okay as I removed, reinstall, same, then removed settings, removed, reboot then reinstall and got the same result. One thing I noticed after the clean install was service status was showing Suricata had not started despite Suricata had not been enabled nor configured.
Did you perform the steps outlined in the post I referenced from earlier? If not, go to Post #5 in this thread and perform the steps listed there after installing the package. Or, reboot your firewall after installing the package. Either of those steps will clear the block that the
pkgutility gets itself locked into when attempting to start a daemon as part of package installation.If Suricata is installed, it is perfectly normal for it to show up in the Services Status widget as it installs its binary part as a service that is started by the OS at boot.
