Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.2.3 pkg v. 2.5.0 Issues

    Scheduled Pinned Locked Moved
    pfSense Packages
    38
    331
    205.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fragged
      last edited by

      No sensitive data preproc errors, snort starts again. Though I had to go to if settings -> categories and save settings again before I got snort to actually load rules. Instead of loading rules and end up using about 1.5 GB of ram, Snort just stayed at 400 MB'ish of memory usage.

      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by

        @dwood:

        After an automated update:

        Jul 18 01:05:10 php: /snort/snort_interfaces.php: Interface Rule START for CABLE(re1)…
        Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
        Jul 18 01:05:10 snort[46927]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
        Jul 18 01:05:10 snort[46927]: Initializing rule chains…
        Jul 18 01:05:10 snort[46927]: Initializing rule chains…

        and with sensitive data rules toggled off, starting snort fails with this:

        Jul 18 01:08:35 snort[219]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
        Jul 18 01:08:35 snort[219]: Initializing rule chains…

        I reported this yesterday and same thing happen again when I woke up this morning.. it failed the auto update…manual update after deleting the md5 files did the trick.

        1 Reply Last reply Reply Quote 0
        • F
          Fesoj
          last edited by

          After the latest update (2012-Jul-17 20:58:56) my system log shows the following unpleasant entry:

          Jul 18 11:16:33 php[46772]:
          /snort/snort_interfaces.php: The command '/usr/bin/sed -Ie -f 's/^alert(.)classtype:sdf;(.)/# alert^Aclasstype:sdf^B/g' /usr/local/etc/snort/snort_52344_em0/preproc_rules/preprocessor.rules' returned exit code '1', the output was 'sed: s/^alert(.)classtype:sdf;(.)/# alert^Aclasstype:sdf^B/g: No such file or directory'

          Since an expression is given on the cmd line, the -f causes the error. When ommitted, the cmd executes with 2 effects:
          (1) there is a backup file named preprocessor.rulese due to the -Ie option, and
          (2) the line alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )
          is replaced by # alert^Aclasstype:sdf^B, which was probably not intended.

          For my setup the error message has no consequences, but ermal should have a look at it at some point. Maybe the sed cmd should start with s.th. like this: /usr/bin/sed -I.bak -e ….

          PS: The lines 1298 ff in snort.inc are responsible for this.

          1 Reply Last reply Reply Quote 0
          • F
            Fesoj
            last edited by

            Cino,

            I reported this yesterday and same thing happen again when I woke up this morning.. it failed the auto update…manual update after deleting the md5 files did the trick.

            SDF sounds familiar. Please have a look at my post #74 and try removing the -f option (file and line is given in my post) and see what happens. Or, maybe comment out the sed command, because the intend could have been to comment out the SDF rule, which could then generate your error message.

            1 Reply Last reply Reply Quote 0
            • E
              eri--
              last edited by

              Oops Fesoj fixed :)

              1 Reply Last reply Reply Quote 0
              • F
                Fesoj
                last edited by

                ermal,

                Oops Fesoj fixed

                not really. If the sensitive rules are not active the file is not created and you do get a similar error message as before.

                I got:
                Jul 18 13:35:15 php[46772]:
                /snort/snort_interfaces.php: The command '/usr/bin/sed -Ie -f /usr/local/etc/snort/snort_52344_em0/tmp/sedcmd /usr/local/etc/snort/snort_52344_em0/preproc_rules/preprocessor.rules' returned exit code '1', the output was 'sed: /usr/local/etc/snort/snort_52344_em0/tmp/sedcmd: No such file or directory'

                1 Reply Last reply Reply Quote 0
                • F
                  Fesoj
                  last edited by

                  ermal,

                  consider adding an innocent mkdir {$snortcfgdir}/tmp if these dirs do not exist at the appropriate places.

                  1 Reply Last reply Reply Quote 0
                  • D
                    darklogic
                    last edited by

                    I am having the same issue. Things will run ok until an auto update runs. Then I get the error

                    snort[11379]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf

                    1 Reply Last reply Reply Quote 0
                    • _
                      _igor_
                      last edited by

                      updated this morning and now snort fails to start with this:

                      FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                      Jul 18 14:27:03 snort[63840]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                      Jul 18 14:27:03 snort[63840]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
                      Jul 18 14:27:03 snort[63840]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
                      Jul 18 14:27:03 snort[63840]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
                      Jul 18 14:27:03 snort[63840]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
                      Jul 18 14:27:03 snort[63840]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
                      Jul 18 14:27:03 snort[63840]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
                      Jul 18 14:27:03 snort[63840]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
                      Jul 18 14:27:03 snort[63840]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
                      Jul 18 14:27:03 snort[63840]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
                      Jul 18 14:27:03 snort[63840]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…

                      1 Reply Last reply Reply Quote 0
                      • M
                        mschiek01
                        last edited by

                        Had the same issue.  Fixed it at least for now by:
                        1. uninstalling snort
                        2. from command line find / -name snort
                        3. rm -r all files left from snort found from the above command
                        4. reinstall snort.

                        1 Reply Last reply Reply Quote 0
                        • D
                          darklogic
                          last edited by

                          If you uncheck that specific list of rules snort will start, but I am still having my current issue with the preprocessor error. Any idea on how to resolve this?

                          1 Reply Last reply Reply Quote 0
                          • M
                            miles267
                            last edited by

                            @digdug3:

                            @dwood: had the same problem.

                            Just removed and reinstalled with the latest binary and all is working again.

                            @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

                            This is an excellent suggestion.

                            1 Reply Last reply Reply Quote 0
                            • M
                              mdima
                              last edited by

                              Hi,
                              anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?

                              Thanks,
                              Michele

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cino
                                last edited by

                                @mdima:

                                Hi,
                                anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?

                                Thanks,
                                Michele

                                I'm having the same issue with src being selected. Its blocking my WAN IP. No matter which way its enter in HOME_NET and/or Whitelist.. It getting blocked. I believe ermal is looking into the issue

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mdima
                                  last edited by

                                  @Cino:

                                  @mdima:

                                  Hi,
                                  anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?

                                  Thanks,
                                  Michele

                                  I'm having the same issue with src being selected. Its blocking my WAN IP. No matter which way its enter in HOME_NET and/or Whitelist.. It getting blocked. I believe ermal is looking into the issue

                                  Ok, thanks. The important is that this issue is known and shared, because if I am the only one I have to ask myself what I am doing wrong…

                                  Thanks,
                                  Michele

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cino
                                    last edited by

                                    what version of pfSense btw?

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mdima
                                      last edited by

                                      @Cino:

                                      what version of pfSense btw?

                                      Mine is: 2.0.1-RELEASE (i386)

                                      (I love copy/paste)

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mschiek01
                                        last edited by

                                        @ermal:

                                        I pushed a fix to the sensitive data rules.
                                        Please test it after 30 minutes.

                                        @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

                                        I would prefer not since its not needed and you are just reporting bugs here.

                                        Ermal this is still not fixed.

                                        If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update.  Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.

                                        Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                        Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                        Jul 18 12:19:33 snort[31831]: Initializing rule chains…
                                        Jul 18 12:19:33 snort[31831]: Initializing rule chains…
                                        Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
                                        Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++

                                        A reinstall and snort will still not start with a different error:bad-traffic.so <-  This rule is not even enabled.

                                        Jul 18 12:33:12 snort[2130]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                                        Jul 18 12:33:12 snort[2130]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                                        Jul 18 12:33:12 snort[2130]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
                                        Jul 18 12:33:12 snort[2130]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
                                        Jul 18 12:33:12 snort[2130]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
                                        Jul 18 12:33:12 snort[2130]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
                                        Jul 18 12:33:12 snort[2130]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
                                        Jul 18 12:33:12 snort[2130]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
                                        Jul 18 12:33:12 snort[2130]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
                                        Jul 18 12:33:12 snort[2130]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
                                        Jul 18 12:33:12 snort[2130]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
                                        Jul 18 12:33:12 snort[2130]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kilthro
                                          last edited by

                                          @mschiek01:

                                          @ermal:

                                          I pushed a fix to the sensitive data rules.
                                          Please test it after 30 minutes.

                                          @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

                                          I would prefer not since its not needed and you are just reporting bugs here.

                                          Ermal this is still not fixed.

                                          If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update.  Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.

                                          Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                          Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                          Jul 18 12:19:33 snort[31831]: Initializing rule chains…
                                          Jul 18 12:19:33 snort[31831]: Initializing rule chains…
                                          Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
                                          Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++

                                          I am getting the same error. If I let it auto update this happens without fail. If I have the package removed and installed fresh, and manually update the rules I do not get this error. I do not have the sensitive data option enabled in the preprocessor section. (havent enabled it since it was an option on that tab) I generally do not change my rules/categories or options. They have been the same as they have been for a year or so now.
                                          I am on the latest pfsense build that I can grab (official) and the latest snort version that has been pushed. FOr now I have disabled the auto update since its more important for me to have snort running at the moment rather than erroring out and not running due to this.

                                          1 Reply Last reply Reply Quote 0
                                          • _
                                            _igor_
                                            last edited by

                                            same here. I disabled the auto update too.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post