Snort 2.9.2.3 pkg v. 2.5.0 Issues
-
After an automated update:
Jul 18 01:05:10 php: /snort/snort_interfaces.php: Interface Rule START for CABLE(re1)…
Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 01:05:10 snort[46927]: Initializing rule chains…
Jul 18 01:05:10 snort[46927]: Initializing rule chains…and with sensitive data rules toggled off, starting snort fails with this:
Jul 18 01:08:35 snort[219]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
Jul 18 01:08:35 snort[219]: Initializing rule chains… -
@dwood: had the same problem.
Just removed and reinstalled with the latest binary and all is working again.
@ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.
-
@ermal:
Same thing here..had to remove 2.5.0. WAN IP x.x.x.0 network was being blocked. PFsense log than alerted on WAN down, and removed it from routing group (dual wan).
Cheers,
Dennis.As i put in the other thread.
There is an issue that was solved with blocking not parsing correctly the whitelist.
Just re-install the binary.Hi Ermal,
well, unfortunately it's still doing that, I upgraded the package few hours ago. It is blocking IPs that are in the whitelist alias, and also CARP VIPs.Btw, managing the whitelist with an alias is awesome!
Thanks,
Michele -
how do i use alias?
-
I pushed a fix to the sensitive data rules.
Please test it after 30 minutes.@ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.
I would prefer not since its not needed and you are just reporting bugs here.
-
Fired up 2.5.0 on two different installations (AMD64, 2.0.1) So far, so good.
Ermal, can you sort blocked IPs the same as in the alerts? Alerts on both interfaces are listed so the most recent is at the top of the page (perfecto), however blocked IPs are randomly sorted.
Normally youcan click on the headers to sort them
Question: With all the new suppression entries required, is there a way to add a descriptor above each suppress entry? I notice the add feature from the alerts list leaves a space between each entry added to the suppress list. Could find nothing on this one in the docs.
Added the description
-
how do i use alias?
Go to the Firewall Tab and select Aliases. There you can add them for ports, servers, netlists, host, etc.
-
No sensitive data preproc errors, snort starts again. Though I had to go to if settings -> categories and save settings again before I got snort to actually load rules. Instead of loading rules and end up using about 1.5 GB of ram, Snort just stayed at 400 MB'ish of memory usage.
-
After an automated update:
Jul 18 01:05:10 php: /snort/snort_interfaces.php: Interface Rule START for CABLE(re1)…
Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 01:05:10 snort[46927]: Initializing rule chains…
Jul 18 01:05:10 snort[46927]: Initializing rule chains…and with sensitive data rules toggled off, starting snort fails with this:
Jul 18 01:08:35 snort[219]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
Jul 18 01:08:35 snort[219]: Initializing rule chains…I reported this yesterday and same thing happen again when I woke up this morning.. it failed the auto update…manual update after deleting the md5 files did the trick.
-
After the latest update (2012-Jul-17 20:58:56) my system log shows the following unpleasant entry:
Jul 18 11:16:33 php[46772]:
/snort/snort_interfaces.php: The command '/usr/bin/sed -Ie -f 's/^alert(.)classtype:sdf;(.)/# alert^Aclasstype:sdf^B/g' /usr/local/etc/snort/snort_52344_em0/preproc_rules/preprocessor.rules' returned exit code '1', the output was 'sed: s/^alert(.)classtype:sdf;(.)/# alert^Aclasstype:sdf^B/g: No such file or directory'Since an expression is given on the cmd line, the -f causes the error. When ommitted, the cmd executes with 2 effects:
(1) there is a backup file named preprocessor.rulese due to the -Ie option, and
(2) the line alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )
is replaced by # alert^Aclasstype:sdf^B, which was probably not intended.For my setup the error message has no consequences, but ermal should have a look at it at some point. Maybe the sed cmd should start with s.th. like this: /usr/bin/sed -I.bak -e ….
PS: The lines 1298 ff in snort.inc are responsible for this.
-
Cino,
I reported this yesterday and same thing happen again when I woke up this morning.. it failed the auto update…manual update after deleting the md5 files did the trick.
SDF sounds familiar. Please have a look at my post #74 and try removing the -f option (file and line is given in my post) and see what happens. Or, maybe comment out the sed command, because the intend could have been to comment out the SDF rule, which could then generate your error message.
-
Oops Fesoj fixed :)
-
ermal,
Oops Fesoj fixed
not really. If the sensitive rules are not active the file is not created and you do get a similar error message as before.
I got:
Jul 18 13:35:15 php[46772]:
/snort/snort_interfaces.php: The command '/usr/bin/sed -Ie -f /usr/local/etc/snort/snort_52344_em0/tmp/sedcmd /usr/local/etc/snort/snort_52344_em0/preproc_rules/preprocessor.rules' returned exit code '1', the output was 'sed: /usr/local/etc/snort/snort_52344_em0/tmp/sedcmd: No such file or directory' -
ermal,
consider adding an innocent mkdir {$snortcfgdir}/tmp if these dirs do not exist at the appropriate places.
-
I am having the same issue. Things will run ok until an auto update runs. Then I get the error
snort[11379]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
-
updated this morning and now snort fails to start with this:
FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
Jul 18 14:27:03 snort[63840]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
Jul 18 14:27:03 snort[63840]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
Jul 18 14:27:03 snort[63840]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
Jul 18 14:27:03 snort[63840]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
Jul 18 14:27:03 snort[63840]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
Jul 18 14:27:03 snort[63840]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
Jul 18 14:27:03 snort[63840]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
Jul 18 14:27:03 snort[63840]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
Jul 18 14:27:03 snort[63840]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
Jul 18 14:27:03 snort[63840]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
Jul 18 14:27:03 snort[63840]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine… -
Had the same issue. Fixed it at least for now by:
1. uninstalling snort
2. from command line find / -name snort
3. rm -r all files left from snort found from the above command
4. reinstall snort. -
If you uncheck that specific list of rules snort will start, but I am still having my current issue with the preprocessor error. Any idea on how to resolve this?
-
-
Hi,
anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?Thanks,
Michele