• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Snort 2.9.2.3 pkg v. 2.5.0 Issues

Scheduled Pinned Locked Moved pfSense Packages
331 Posts 38 Posters 269.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C Offline
    Cino
    last edited by Jul 17, 2012, 9:44 PM

    @ermal:

    but i did another (de)install, saved every paged.. then rebooted

    That is not necessary anymore Cino :)
    Everything will just get magically applied.

    Good to know!!! Old habit from the old days

    @ermal:

    Fixed on 2.0.x you can just upgrade in 10 minutes.
    You need a new binary.
    The match of the ip against a CIDR net specification was being done wrong.

    Other than that it should behave now and you WAN shouold not be blocked.

    The only thing i am not sure is since HOME_NET contents are used for whitelist of alert_pf maybe that is a bit wide as whitelist by default?
    Probably just put listening interface IP all gateway/dns/vpns(what was clicked) and no include the CIDR and theother interfaces!

    EDIT: 2.1 is still building.
    EDIT2: There is a method to specify that the binary should be reinstalled but it would mean for us to keep a copy of each and every freebsd port that pfSense has pkg.

    i'm leaning to agree also.. interface IPs/gw/dns/vnps are the way to go.. If we need to add the subnet, then we manually do that via a whitelist. With the added Alias feature in snort, shouldnt be a big issue… Unless whitelist can't accept CIDR (which it noted it can't, haven't really tested that)... then there would be issue if you want to exclude a whole subnet (VPN, IPv6 Subnet)..

    idk, maybe by default HOME_NET would just be interfaces, then add a couple of options within whitelist/netlist page to add interface subnets also.

    1 Reply Last reply Reply Quote 0
    • D Offline
      dwood
      last edited by Jul 18, 2012, 1:10 AM Jul 18, 2012, 1:02 AM

      Fired up 2.5.0 on two different installations (AMD64, 2.0.1) So far, so good.

      Ermal, can you sort blocked IPs the same as in the alerts?  Alerts on both interfaces are listed so the most recent is at the top of the page (perfecto), however blocked IPs are randomly sorted.

      Question:  With all the new suppression entries required, is there a way to add a descriptor above each suppress entry?  I notice the add feature from the alerts list leaves a space between each entry added to the suppress list.  Could find nothing on this one in the docs.

      Cheers,
      Dennis.

      1 Reply Last reply Reply Quote 0
      • C Offline
        Cino
        last edited by Jul 18, 2012, 1:39 AM

        @dwood:

        Question:  With all the new suppression entries required, is there a way to add a descriptor above each suppress entry?  I notice the add feature from the alerts list leaves a space between each entry added to the suppress list.  Could find nothing on this one in the docs.

        sure:

        
        # **** Main Suppress List ****
        # ****************************
        #
        # HTTP INSPECT Suppress
        #
        # DOUBLE DECODING ATTACK
        suppress gen_id 119, sig_id 2
        # suppress gen_id 119, sig_id 3
        # NON-RFC DEFINED CHAR
        suppress gen_id 119, sig_id 14
        # suppress gen_id 119, sig_id 19
        # suppress gen_id 119, sig_id 32
        # suppress gen_id 119, sig_id 31
        # NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
        suppress gen_id 120, sig_id 3
        # HTTP RESPONSE GZIP DECOMPRESSION FAILED
        suppress gen_id 120, sig_id 6
        # INVALID CONTENT-LENGTH OR CHUNK SIZE
        suppress gen_id 120, sig_id 8
        
        
        1 Reply Last reply Reply Quote 0
        • C Offline
          Cino
          last edited by Jul 18, 2012, 1:50 AM

          If I disable all my suppression rules I'm able to reproduce the WAN IP blocking on the fly.. I did notice that new snort binary was built at 2012-Jul-17 21:37:45. Did this include the changes you made or will the next will?

          1 Reply Last reply Reply Quote 0
          • M Offline
            miles267
            last edited by Jul 18, 2012, 2:24 AM

            What happened to the snort Whitelist UI screen?  It used to allow you to input into unique dialog boxes a description and IP or CIDR.  No all Alias IPs are crammed into a single, narrow dialog box.  This seems like a step backward.

            1 Reply Last reply Reply Quote 0
            • D Offline
              dwood
              last edited by Jul 18, 2012, 2:29 AM Jul 18, 2012, 2:25 AM

              Thanks Cino :-)  Just what I was looking for.

              Miles, create an Alias list for your IPs. (under Firewall - Aliases).  Then reference that alias in your whitelist.  As soon as you start typing the name of your alias it will autofill in the whitelist box.

              1 Reply Last reply Reply Quote 0
              • M Offline
                miles267
                last edited by Jul 18, 2012, 2:41 AM

                @dwood:

                Thanks Cino :-)  Just what I was looking for.

                Miles, create an Alias list for your IPs. (under Firewall - Aliases).  Then reference that alias in your whitelist.  As soon as you start typing the name of your alias it will autofill in the whitelist box.

                Thanks so much dwood.  This is a great tip.  I didn't realize it changed and that you can use these alias lists.

                1 Reply Last reply Reply Quote 0
                • D Offline
                  dwood
                  last edited by Jul 18, 2012, 2:59 AM Jul 18, 2012, 2:55 AM

                  Miles, no worries. Ermal is the guy you need to thank for cooking up the code :-)

                  Ermal, I've noticed that when using the Alerts - Add to Suppress List feature, the signature is correctly added to the suppress list, but with a blank line preceding it.  I've also observed that Snort will fail to start if there is a blank line in the suppress list.  A bug?

                  Cheers,
                  Dennis.

                  1 Reply Last reply Reply Quote 0
                  • D Offline
                    dwood
                    last edited by Jul 18, 2012, 5:04 AM

                    After an automated update:

                    Jul 18 01:05:10 php: /snort/snort_interfaces.php: Interface Rule START for CABLE(re1)…
                    Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                    Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                    Jul 18 01:05:10 snort[46927]: Initializing rule chains…
                    Jul 18 01:05:10 snort[46927]: Initializing rule chains…

                    and with sensitive data rules toggled off, starting snort fails with this:

                    Jul 18 01:08:35 snort[219]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
                    Jul 18 01:08:35 snort[219]: Initializing rule chains…

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      digdug3
                      last edited by Jul 18, 2012, 7:06 AM

                      @dwood: had the same problem.

                      Just removed and reinstalled with the latest binary and all is working again.

                      @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

                      1 Reply Last reply Reply Quote 0
                      • M Offline
                        mdima
                        last edited by Jul 18, 2012, 8:16 AM

                        @ermal:

                        @dwood:

                        Same thing here..had to remove 2.5.0.  WAN IP x.x.x.0 network was being blocked.  PFsense log than alerted on WAN down, and removed it from routing group (dual wan).

                        Cheers,
                        Dennis.

                        As i put in the other thread.
                        There is an issue that was solved with blocking not parsing correctly the whitelist.
                        Just re-install the binary.

                        Hi Ermal,
                          well, unfortunately it's still doing that, I upgraded the package few hours ago. It is blocking IPs that are in the whitelist alias, and also CARP VIPs.

                        Btw, managing the whitelist with an alias is awesome!

                        Thanks,
                        Michele

                        1 Reply Last reply Reply Quote 0
                        • S Offline
                          simby
                          last edited by Jul 18, 2012, 8:28 AM

                          how do i use alias?

                          1 Reply Last reply Reply Quote 0
                          • E Offline
                            eri--
                            last edited by Jul 18, 2012, 8:38 AM

                            I pushed a fix to the sensitive data rules.
                            Please test it after 30 minutes.

                            @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

                            I would prefer not since its not needed and you are just reporting bugs here.

                            1 Reply Last reply Reply Quote 0
                            • E Offline
                              eri--
                              last edited by Jul 18, 2012, 8:40 AM

                              @dwood:

                              Fired up 2.5.0 on two different installations (AMD64, 2.0.1) So far, so good.

                              Ermal, can you sort blocked IPs the same as in the alerts?  Alerts on both interfaces are listed so the most recent is at the top of the page (perfecto), however blocked IPs are randomly sorted.

                              Normally youcan click on the headers to sort them

                              Question:  With all the new suppression entries required, is there a way to add a descriptor above each suppress entry?  I notice the add feature from the alerts list leaves a space between each entry added to the suppress list.  Could find nothing on this one in the docs.

                              Added the description

                              1 Reply Last reply Reply Quote 0
                              • J Offline
                                judex
                                last edited by Jul 18, 2012, 9:02 AM

                                @simby:

                                how do i use alias?

                                Go to the Firewall Tab and select Aliases. There you can add them for ports, servers, netlists, host, etc.

                                2.1-RELEASE (amd64)
                                built on Wed Sep 11 18:17:48 EDT 2013
                                FreeBSD 8.3-RELEASE-p11

                                1 Reply Last reply Reply Quote 0
                                • F Offline
                                  fragged
                                  last edited by Jul 18, 2012, 9:39 AM

                                  No sensitive data preproc errors, snort starts again. Though I had to go to if settings -> categories and save settings again before I got snort to actually load rules. Instead of loading rules and end up using about 1.5 GB of ram, Snort just stayed at 400 MB'ish of memory usage.

                                  1 Reply Last reply Reply Quote 0
                                  • C Offline
                                    Cino
                                    last edited by Jul 18, 2012, 9:40 AM

                                    @dwood:

                                    After an automated update:

                                    Jul 18 01:05:10 php: /snort/snort_interfaces.php: Interface Rule START for CABLE(re1)…
                                    Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                    Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                    Jul 18 01:05:10 snort[46927]: Initializing rule chains…
                                    Jul 18 01:05:10 snort[46927]: Initializing rule chains…

                                    and with sensitive data rules toggled off, starting snort fails with this:

                                    Jul 18 01:08:35 snort[219]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
                                    Jul 18 01:08:35 snort[219]: Initializing rule chains…

                                    I reported this yesterday and same thing happen again when I woke up this morning.. it failed the auto update…manual update after deleting the md5 files did the trick.

                                    1 Reply Last reply Reply Quote 0
                                    • F Offline
                                      Fesoj
                                      last edited by Jul 18, 2012, 10:12 AM Jul 18, 2012, 10:03 AM

                                      After the latest update (2012-Jul-17 20:58:56) my system log shows the following unpleasant entry:

                                      Jul 18 11:16:33 php[46772]:
                                      /snort/snort_interfaces.php: The command '/usr/bin/sed -Ie -f 's/^alert(.)classtype:sdf;(.)/# alert^Aclasstype:sdf^B/g' /usr/local/etc/snort/snort_52344_em0/preproc_rules/preprocessor.rules' returned exit code '1', the output was 'sed: s/^alert(.)classtype:sdf;(.)/# alert^Aclasstype:sdf^B/g: No such file or directory'

                                      Since an expression is given on the cmd line, the -f causes the error. When ommitted, the cmd executes with 2 effects:
                                      (1) there is a backup file named preprocessor.rulese due to the -Ie option, and
                                      (2) the line alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )
                                      is replaced by # alert^Aclasstype:sdf^B, which was probably not intended.

                                      For my setup the error message has no consequences, but ermal should have a look at it at some point. Maybe the sed cmd should start with s.th. like this: /usr/bin/sed -I.bak -e ….

                                      PS: The lines 1298 ff in snort.inc are responsible for this.

                                      1 Reply Last reply Reply Quote 0
                                      • F Offline
                                        Fesoj
                                        last edited by Jul 18, 2012, 10:23 AM Jul 18, 2012, 10:20 AM

                                        Cino,

                                        I reported this yesterday and same thing happen again when I woke up this morning.. it failed the auto update…manual update after deleting the md5 files did the trick.

                                        SDF sounds familiar. Please have a look at my post #74 and try removing the -f option (file and line is given in my post) and see what happens. Or, maybe comment out the sed command, because the intend could have been to comment out the SDF rule, which could then generate your error message.

                                        1 Reply Last reply Reply Quote 0
                                        • E Offline
                                          eri--
                                          last edited by Jul 18, 2012, 10:35 AM

                                          Oops Fesoj fixed :)

                                          1 Reply Last reply Reply Quote 0
                                          67 out of 331
                                          • First post
                                            67/331
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received