Snort 2.9.2.3 pkg v. 2.5.0 Issues
-
ermal,
Oops Fesoj fixed
not really. If the sensitive rules are not active the file is not created and you do get a similar error message as before.
I got:
Jul 18 13:35:15 php[46772]:
/snort/snort_interfaces.php: The command '/usr/bin/sed -Ie -f /usr/local/etc/snort/snort_52344_em0/tmp/sedcmd /usr/local/etc/snort/snort_52344_em0/preproc_rules/preprocessor.rules' returned exit code '1', the output was 'sed: /usr/local/etc/snort/snort_52344_em0/tmp/sedcmd: No such file or directory' -
ermal,
consider adding an innocent mkdir {$snortcfgdir}/tmp if these dirs do not exist at the appropriate places.
-
I am having the same issue. Things will run ok until an auto update runs. Then I get the error
snort[11379]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(201) Unknown ClassType: sdf
-
updated this morning and now snort fails to start with this:
FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
Jul 18 14:27:03 snort[63840]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
Jul 18 14:27:03 snort[63840]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
Jul 18 14:27:03 snort[63840]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
Jul 18 14:27:03 snort[63840]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
Jul 18 14:27:03 snort[63840]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
Jul 18 14:27:03 snort[63840]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
Jul 18 14:27:03 snort[63840]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
Jul 18 14:27:03 snort[63840]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
Jul 18 14:27:03 snort[63840]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
Jul 18 14:27:03 snort[63840]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
Jul 18 14:27:03 snort[63840]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine… -
Had the same issue. Fixed it at least for now by:
1. uninstalling snort
2. from command line find / -name snort
3. rm -r all files left from snort found from the above command
4. reinstall snort. -
If you uncheck that specific list of rules snort will start, but I am still having my current issue with the preprocessor error. Any idea on how to resolve this?
-
-
Hi,
anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?Thanks,
Michele -
Hi,
anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?Thanks,
MicheleI'm having the same issue with src being selected. Its blocking my WAN IP. No matter which way its enter in HOME_NET and/or Whitelist.. It getting blocked. I believe ermal is looking into the issue
-
Hi,
anyone for the local IPs blocked when "block: both" is selected? Am I the only one having this issue?Thanks,
MicheleI'm having the same issue with src being selected. Its blocking my WAN IP. No matter which way its enter in HOME_NET and/or Whitelist.. It getting blocked. I believe ermal is looking into the issue
Ok, thanks. The important is that this issue is known and shared, because if I am the only one I have to ask myself what I am doing wrong…
Thanks,
Michele -
what version of pfSense btw?
-
-
@ermal:
I pushed a fix to the sensitive data rules.
Please test it after 30 minutes.@ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.
I would prefer not since its not needed and you are just reporting bugs here.
Ermal this is still not fixed.
If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update. Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.
Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 12:19:33 snort[31831]: Initializing rule chains…
Jul 18 12:19:33 snort[31831]: Initializing rule chains…
Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++A reinstall and snort will still not start with a different error:bad-traffic.so <- This rule is not even enabled.
Jul 18 12:33:12 snort[2130]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
Jul 18 12:33:12 snort[2130]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
Jul 18 12:33:12 snort[2130]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
Jul 18 12:33:12 snort[2130]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
Jul 18 12:33:12 snort[2130]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
Jul 18 12:33:12 snort[2130]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
Jul 18 12:33:12 snort[2130]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
Jul 18 12:33:12 snort[2130]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
Jul 18 12:33:12 snort[2130]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
Jul 18 12:33:12 snort[2130]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
Jul 18 12:33:12 snort[2130]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
Jul 18 12:33:12 snort[2130]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine… -
@ermal:
I pushed a fix to the sensitive data rules.
Please test it after 30 minutes.@ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.
I would prefer not since its not needed and you are just reporting bugs here.
Ermal this is still not fixed.
If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update. Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.
Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 18 12:19:33 snort[31831]: Initializing rule chains…
Jul 18 12:19:33 snort[31831]: Initializing rule chains…
Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++I am getting the same error. If I let it auto update this happens without fail. If I have the package removed and installed fresh, and manually update the rules I do not get this error. I do not have the sensitive data option enabled in the preprocessor section. (havent enabled it since it was an option on that tab) I generally do not change my rules/categories or options. They have been the same as they have been for a year or so now.
I am on the latest pfsense build that I can grab (official) and the latest snort version that has been pushed. FOr now I have disabled the auto update since its more important for me to have snort running at the moment rather than erroring out and not running due to this. -
same here. I disabled the auto update too.
-
same problem here:
i fixed it by doing this:
added the line: config classification: sdf,Sensitive Data was Transmitted Across the Network,2
at the end of: /usr/local/etc/snort/classification.configand disabled auto update for now
-
I have two installations working fine, (2.0.1) and autoupdates set for every six hours for testing. So far so good..however the error may return when the rules are actually updated. I suspect that there are no new rules yet which would have triggered an actual update.
EDIT: Yep, an update (emerging threats) triggered same error. Removed, erased snort bits, reinstalled and started fine. Turned off updates for now. The good news is that snort is behaving and blocking just fine otherwise :-) Thanks Ermal.
Btw, the WAN blocking issue has not re-occurred on two AMD64, 2.0.1 installations. Important to note that snort should be uninstalled, then run "find /* | grep -i snort | xargs rm -rv" , then reinstall. This ensures you get a new SNORT binary..at least for now, reinstalling won't replace the SNORT binary file.
Cheers,
Dennis. -
Should behave better if you just reinstall.
No new binary needed. -
After reinstall I got
FATAL ERROR: /usr/local/etc/snort/snort_4672_em1/preproc_rules/preprocessor.rules(202) Unknown ClassType: sdf
After complete reinstallation snort rules download failes. Not even the md5 file gets downloaded.
php: /snort/snort_download_rules.php: Snort rules file downloaded failed…
Maybe snort server is down...but I get message that there is a new set available.
EDIT: 7 hours later and after another reinstallation snorts starts up without error and snort.org rules were downloaded. Everything seems to work so far...
-
Can anyone tell why this is missing after auto rule update:
added the line: config classification: sdf,Sensitive Data was Transmitted Across the Network,2
At the end of: /usr/local/etc/snort/classification.config