Snort 2.9.2.3 pkg v. 2.4.2 Issues

Fesoj

ermal,

I'd rather fixed the ioctl problem, but the clearing issue is within my capabilities. See whether you can live with this (/usr/local/www/snort/snort_alerts.php, line 82ff):

if ($_GET['action'] == "clear" || $_POST['delete']) {
  $log_this = FALSE;
  $fname = '/tmp/snort_alerts_clear.txt';
  foreach ($a_instance as $id => $instance) {
    $snort_uuid_loop = $instance['uuid'];
    $if_real_loop = snort_get_real_interface($instance['interface']);
    if ($log_this) {
      file_put_contents($fname, "if_real = $if_real_loop\r\nsnort_uuid = $snort_uuid_loop\r\n", FILE_APPEND);
    }
    if (file_exists("/var/log/snort/snort_{$if_real_loop}{$snort_uuid_loop}/alert")) {
      if ($log_this) {
        file_put_contents($fname, "alert file = /var/log/snort/snort_{$if_real_loop}{$snort_uuid_loop}/alert\r\n\r\n", FILE_APPEND);
      }
      conf_mount_rw();
      snort_post_delete_logs($snort_uuid_loop);
      @file_put_contents("/var/log/snort/snort_{$if_real_loop}{$snort_uuid_loop}/alert", "");
      /* XXX: This is needed is snort is run as snort user */
      //mwexec('/usr/sbin/chown snort:snort /var/log/snort/*', true);
      mwexec('/bin/chmod 660 /var/log/snort/*', true);
      mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real_loop}{$snort_uuid_loop}.pid -a");
      conf_mount_ro();
    }
  }
  header("Location: /snort/snort_alerts.php?instance={$instanceid}");
  exit;
}

dwood

Ermal, with regard to post #42, what config file are you looking for? If you can provide a path/name I'll post the file. I did install 2.4.2 with previous save settings toggled off. I also ran find /* | grep -i snort | xargs rm -rv to remove any snort references after removing the previous version. This is as clean an install I can figure out :-)

The error I posted occurs when attempting to start snort, either manually or after an update:

Jul 12 21:34:54 php: /snort/snort_interfaces.php: Interface Rule START for CABLE(re1)…
Jul 12 21:34:54 snort[8220]: FATAL ERROR: /usr/local/etc/snort/snort_7680_re1/snort.conf(101) Maximum number of loaded libriaries of this dynamic library type exceeded: 16.
Jul 12 21:34:54 snort[8220]: FATAL ERROR: /usr/local/etc/snort/snort_7680_re1/snort.conf(101) Maximum number of loaded libriaries of this dynamic library type exceeded: 16.

Other than this error..corrected by unchecking two .so rules, 2.4.2 has been running and blocking fine on two live AMD64 2.01 installations.

EDIT: It looks like both installations of 2.4.2 failed to start after a daily scheduled update. Starting interfaces manually worked OK.

Cheers,
Dennis.

eri--

Please reinstall again!
You need a new snort binary for the alerts to be displayed correctly.

fragged

Snort won't start after a reinstallation.


[2.0.1-RELEASE][admin@pfsense.localdomain]/root(33): /usr/local/bin/snort
/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

I've tried to pkg_delete libdnet and install snort again, but it still won't work. Is the package broken?

mdima

Also this: after an update, at the first event it looks crashing:

Jul 14 12:08:36	kernel: pid 47584 (snort), uid 0: exited on signal 11
Jul 14 12:08:36	snort[47584]: [1:2404102:2763] ET CNC Zeus/Spyeye/Palevo Tracker Reported CnC Server TCP (group 2) [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 212.239.73.15:22445 -> 141.8.224.61:25
Jul 14 12:08:36	snort[47584]: [1:2404102:2763] ET CNC Zeus/Spyeye/Palevo Tracker Reported CnC Server TCP (group 2) [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 212.239.73.15:22445 -> 141.8.224.61:25

Ciao,
Michele

eri--

mdima nothing else on the logs?

judex

I do not exactly know, if this is a feature or a bug:

When I leave Home NEt set as default in the GUI the Home Net variable is automagically set in the interfaces snort.conf.
There the whole subnet of the WAN interface gets added. Not only my WAN IP and the gateway, but the subnet with a 24 netmask. That can't be by design!?!

Greetings, Judex

dwood

reinstalling 2.4.2, snort fails to start:

*** Welcome to pfSense 2.0.1-RELEASE-pfSense (amd64) on pfsense ***

[2.0.1-RELEASE][admin@pfsense.localdomain]/root(1): /usr/local/bin/snort
/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

Also, all .so rules were missing on this version, so not available to select.

Cheers,
Dennis.

mdima

@ermal:

Please reinstall again!
You need a new snort binary for the alerts to be displayed correctly.

Hi Ermal, nothing else AFAIK. If you want I can send you in private the full system log where that happened (I just saved it for reference).

Thanks,
Michele

eri--

Please reinstall again in 30 minutes.
You need a new binary again.

I think i fixed the alert_pf issues with the ioctl.

simby

where is all snot rules? I have only 10-15 and i have premium account :(

eri--

@judex:

I do not exactly know, if this is a feature or a bug:

When I leave Home NEt set as default in the GUI the Home Net variable is automagically set in the interfaces snort.conf.
There the whole subnet of the WAN interface gets added. Not only my WAN IP and the gateway, but the subnet with a 24 netmask. That can't be by design!?!

Greetings, Judex

Judex, it seems it was there since the beginning like this.
Removed the subnet cause i do not think is right as well.

Actually i am not sure if all the other interfaces ips need to be there apart the one snort is listening.

eri--

@HOD:

I did a complete reinstall of snort (10min ago) and i have the same error of my last post.

snort[23088]: FATAL ERROR: s2c_parse_load_wl() => Invalid data in whitelist file: Invalid argument

@ermal:

For all the others having issues with blocking please whenever you have system log of 'unable to parse', get the file under the /usr/local/etc/snort/snort_$iface*/$whitelistname and post it here.

cat /usr/local/etc/snort/snort_18407_pppoe0/whitlsit
suppress gen_id 119, sig_id 2
suppress gen_id 119, sig_id 31
suppress gen_id 119, sig_id 32
suppress gen_id 120, sig_id 3
suppress gen_id 120, sig_id 6
suppress gen_id 120, sig_id 8
suppress gen_id 120, sig_id 10
suppress gen_id 122, sig_id 26
suppress gen_id 137, sig_id 1

greetz HOD

EDIT: my System 2.0.1-RELEASE (amd64) Snort 2.9.2.3 pkg v. 2.4.2

This should have been fixed also.
HOD can yo uconfirm that you have the same name for the suppress and whitelist selected?

dhatz

Ermal, I'm happy to finally see you working on the Snort package.

Could you provide some info about how Snort interfaces with PF, in order to provide IPS functionality (ie to auto block offending IPs ) ? When I last checked some weeks ago, it seemed that both SnortSam and your enhanced version of spoink were enabled.

Cino

@simby:

where is all snot rules? I have only 10-15 and i have premium account :(

i dont have a premium account but we are missing a lot of rules and all the shared .so ones.

mdima

Hi Ermal,
just updated. If I have again problems I will report it.

Btw, I confirm that I lost half of the snort.org rules after the update.

Thanks,
Michele

breusshe

@mschiek01:

@miles267:

1.) 2.4.2 log returns the following error:

snort[62803]: FATAL ERROR: /usr/local/etc/snort/snort_60243_em3/snort.conf(235) Unknown rule type: FILE_DATA_PORTS.

The only entry in my Advanced Config Pass Through dialog box is as follows (on both WAN and LAN interfaces):

FILE_DATA_PORTS [$HTTP_PORTS,110,143]

2.) if I enter any ports into the Define SSL_Ignore box (for example: 443 563 995 etc) when i attempt to start the interface, it returns the following error:

snort[37766]: FATAL ERROR: /usr/local/etc/snort/snort_9414_em2/snort.conf(55) Missing argument to SSL_PORTS_IGNORE

3.) BLOCKED page only shows the IP address but all Alert Descriptions are blank

snort[37766]: FATAL ERROR: /usr/local/etc/snort/snort_9414_em2/snort.conf(55) Missing argument to SSL_PORTS_IGNORE

I had the same error, someone suggested that commas are now required even though it says spaces this corrected the problem.

I had the same error. Quotes fixed it for me.

breusshe

@mschiek01:

@miles267:

1.) 2.4.2 log returns the following error:

snort[62803]: FATAL ERROR: /usr/local/etc/snort/snort_60243_em3/snort.conf(235) Unknown rule type: FILE_DATA_PORTS.

The only entry in my Advanced Config Pass Through dialog box is as follows (on both WAN and LAN interfaces):

FILE_DATA_PORTS [$HTTP_PORTS,110,143]

2.) if I enter any ports into the Define SSL_Ignore box (for example: 443 563 995 etc) when i attempt to start the interface, it returns the following error:

snort[37766]: FATAL ERROR: /usr/local/etc/snort/snort_9414_em2/snort.conf(55) Missing argument to SSL_PORTS_IGNORE

3.) BLOCKED page only shows the IP address but all Alert Descriptions are blank

snort[37766]: FATAL ERROR: /usr/local/etc/snort/snort_9414_em2/snort.conf(55) Missing argument to SSL_PORTS_IGNORE

I had the same error, someone suggested that commas are now required even though it says spaces this corrected the problem.

I had the same error. Quotes fixed it for me.

breusshe

@ermal:

Can you put the alert file here and tell me if its full alert style logging or fast?

There is no more alert type. There was until I removed the package and reinstalled to see if that would fix the issues I'm seeing, but since then, no more alert type. Tried uninstall and reinstall again (without saving snort xml configuration each time) with same results. No alert type available. I can also confirm other's findings that a good deal of the snort rules are not showing up any longer. I also have a new one, I think. I have snort configured twice on my WAN interface. One for block only rules, one for alert only rules. This worked fine until the v2.4.2 upgrade. Now I can only have one instance of Snort per interface, so I can either have blocking rules or alert only rules, but not both.

eri--

@breusshe:

@ermal:

Can you put the alert file here and tell me if its full alert style logging or fast?

There is no more alert type. There was until I removed the package and reinstalled to see if that would fix the issues I'm seeing, but since then, no more alert type. Tried uninstall and reinstall again (without saving snort xml configuration each time) with same results. No alert type available. I can also confirm other's findings that a good deal of the snort rules are not showing up any longer. I also have a new one, I think. I have snort configured twice on my WAN interface. One for block only rules, one for alert only rules. This worked fine until the v2.4.2 upgrade. Now I can only have one instance of Snort per interface, so I can either have blocking rules or alert only rules, but not both.

I do not understand the both instances and blocking vs alerting one?