Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.2.3 pkg v. 2.5.0 Issues

    Scheduled Pinned Locked Moved
    pfSense Packages
    38
    331
    205.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mschiek01
      last edited by

      @ermal:

      I pushed a fix to the sensitive data rules.
      Please test it after 30 minutes.

      @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

      I would prefer not since its not needed and you are just reporting bugs here.

      Ermal this is still not fixed.

      If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update.  Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.

      Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
      Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
      Jul 18 12:19:33 snort[31831]: Initializing rule chains…
      Jul 18 12:19:33 snort[31831]: Initializing rule chains…
      Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
      Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++

      A reinstall and snort will still not start with a different error:bad-traffic.so <-  This rule is not even enabled.

      Jul 18 12:33:12 snort[2130]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
      Jul 18 12:33:12 snort[2130]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
      Jul 18 12:33:12 snort[2130]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
      Jul 18 12:33:12 snort[2130]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
      Jul 18 12:33:12 snort[2130]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
      Jul 18 12:33:12 snort[2130]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
      Jul 18 12:33:12 snort[2130]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
      Jul 18 12:33:12 snort[2130]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
      Jul 18 12:33:12 snort[2130]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
      Jul 18 12:33:12 snort[2130]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
      Jul 18 12:33:12 snort[2130]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
      Jul 18 12:33:12 snort[2130]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…

      1 Reply Last reply Reply Quote 0
      • K
        kilthro
        last edited by

        @mschiek01:

        @ermal:

        I pushed a fix to the sensitive data rules.
        Please test it after 30 minutes.

        @ermail: is it possible to add the snort build number/date somewhere in the GUI? This way everybody nows exactly where they are.

        I would prefer not since its not needed and you are just reporting bugs here.

        Ermal this is still not fixed.

        If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update.  Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.

        Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
        Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
        Jul 18 12:19:33 snort[31831]: Initializing rule chains…
        Jul 18 12:19:33 snort[31831]: Initializing rule chains…
        Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
        Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++

        I am getting the same error. If I let it auto update this happens without fail. If I have the package removed and installed fresh, and manually update the rules I do not get this error. I do not have the sensitive data option enabled in the preprocessor section. (havent enabled it since it was an option on that tab) I generally do not change my rules/categories or options. They have been the same as they have been for a year or so now.
        I am on the latest pfsense build that I can grab (official) and the latest snort version that has been pushed. FOr now I have disabled the auto update since its more important for me to have snort running at the moment rather than erroring out and not running due to this.

        1 Reply Last reply Reply Quote 0
        • _
          _igor_
          last edited by

          same here. I disabled the auto update too.

          1 Reply Last reply Reply Quote 0
          • A
            aaronritter
            last edited by

            same problem here:

            i fixed it by doing this:

            added the line: config classification: sdf,Sensitive Data was Transmitted Across the Network,2
            at the end of: /usr/local/etc/snort/classification.config

            and disabled auto update for now

            1 Reply Last reply Reply Quote 0
            • D
              dwood
              last edited by

              I have two installations working fine, (2.0.1) and autoupdates set for every six hours for testing.  So far so good..however the error may return when the rules are actually updated.  I suspect that there are no new rules yet which would have triggered an actual update.

              EDIT:  Yep, an update (emerging threats) triggered same error.  Removed, erased snort bits, reinstalled and started fine.  Turned off updates for now.  The good news is that snort is behaving and blocking just fine otherwise :-) Thanks Ermal.

              Btw, the WAN blocking issue has not re-occurred on two AMD64, 2.0.1 installations.  Important to note that snort should be uninstalled, then run "find /* | grep -i snort | xargs rm -rv" , then reinstall.  This ensures you get a new SNORT binary..at least for now, reinstalling won't replace the SNORT binary file.

              Cheers,
              Dennis.

              1 Reply Last reply Reply Quote 0
              • E
                eri--
                last edited by

                Should behave better if you just reinstall.
                No new binary needed.

                1 Reply Last reply Reply Quote 0
                • J
                  judex
                  last edited by

                  After reinstall I got

                  FATAL ERROR: /usr/local/etc/snort/snort_4672_em1/preproc_rules/preprocessor.rules(202) Unknown ClassType: sdf

                  After complete reinstallation snort rules download failes. Not even the md5 file gets downloaded.

                  php: /snort/snort_download_rules.php: Snort rules file downloaded failed…

                  Maybe snort server is down...but I get message that there is a new set available.

                  EDIT: 7 hours later and after another reinstallation snorts starts up without error and snort.org rules were downloaded. Everything seems to work so far...

                  2.1-RELEASE (amd64)
                  built on Wed Sep 11 18:17:48 EDT 2013
                  FreeBSD 8.3-RELEASE-p11

                  1 Reply Last reply Reply Quote 0
                  • A
                    aaronritter
                    last edited by

                    Can anyone tell why this is missing after auto rule update:

                    added the line: config classification: sdf,Sensitive Data was Transmitted Across the Network,2
                    At the end of: /usr/local/etc/snort/classification.config

                    1 Reply Last reply Reply Quote 0
                    • M
                      mschiek01
                      last edited by

                      @ermal:

                      Should behave better if you just reinstall.
                      No new binary needed.

                      Ermal this is still not working.  I reinstalled the latest. downloaded the rules clicked start same error as before.

                      bad-traffic.so is not selected in snort rules.

                      Jul 18 19:44:28 snort[50712]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                      Jul 18 19:44:28 snort[50712]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                      Jul 18 19:44:28 snort[50712]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
                      Jul 18 19:44:28 snort[50712]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…
                      Jul 18 19:44:28 snort[50712]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
                      Jul 18 19:44:28 snort[50712]: Loading all dynamic detection libs from /usr/local/lib/snort/dynamicrules…
                      Jul 18 19:44:28 snort[50712]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
                      Jul 18 19:44:28 snort[50712]: Finished Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine
                      Jul 18 19:44:28 snort[50712]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
                      Jul 18 19:44:28 snort[50712]: WARNING: No dynamic libraries found in directory /usr/local/lib/snort/dynamicengine.
                      Jul 18 19:44:28 snort[50712]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…
                      Jul 18 19:44:28 snort[50712]: Loading all dynamic engine libs from /usr/local/lib/snort/dynamicengine…

                      1 Reply Last reply Reply Quote 0
                      • T
                        tester_02
                        last edited by

                        It's so close now…  I'm still on 2.9.1 and waiting for the list of issues to die down and I can see it's almost there.   
                        Just wanted to thank all Ermal AND all the users doing the testing.  Everyone's help is appreciated by the rest of us.

                        1 Reply Last reply Reply Quote 0
                        • C
                          Cino
                          last edited by

                          ^^^ he was the smart one  ::)

                          all my testing is on my home box, so i dont care if it breaks here and there… now the wife on the other hand is a different story... But she is best user tester... I know within seconds if the internet is down... In this case, snort blocking facebook or pinterest because it didn't like the http packets that were sent over..

                          1 Reply Last reply Reply Quote 0
                          • M
                            mschiek01
                            last edited by

                            @Cino:

                            @ermal:

                            Should behave better if you just reinstall.
                            No new binary needed.

                            I couldn't wait for my box to auto update but wanted to test your changes before i leave for my annual military training. So I ran the the cron job from shell and seems to work.. It downloaded a new set of rules and started snort… I love the fact now we dont have to download a new ruleset went we do a reinstall.. Thank you again!!!

                            
/root(1): /usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php >> /tmp/snort_update.log
rm: /usr/local/etc/snort/snortrules: No such file or directory
/root(2):

                            P.S I sent a small donation in today for beer  ;D

                            Are you sure when you ran the rule update there was indeed an update downloaded?

                            1 Reply Last reply Reply Quote 0
                            • D
                              dwood
                              last edited by

                              Ermal, reinstalled (AMD64, 2.0.1) and got this:

                              Jul 18 22:04:22 snort[23595]: FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"
                              Jul 18 22:04:22 snort[23595]: Loading dynamic detection library /usr/local/lib/snort/dynamicrules/bad-traffic.so…

                              However, an uninstall, manual delete, and reinstall worked.  Will set to autoupdate and see what happens.

                              1 Reply Last reply Reply Quote 0
                              • D
                                digdug3
                                last edited by

                                Had the same issues with auto-update. I didn't reinstall, but just updated manually and the manually restarted the Snort interface(s).
                                This worked for me this time. Will disable auto-update in the meanwhile.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  Cino
                                  last edited by

                                  @mschiek01:

                                  @Cino:

                                  @ermal:

                                  Should behave better if you just reinstall.
                                  No new binary needed.

                                  I couldn't wait for my box to auto update but wanted to test your changes before i leave for my annual military training. So I ran the the cron job from shell and seems to work.. It downloaded a new set of rules and started snort… I love the fact now we dont have to download a new ruleset went we do a reinstall.. Thank you again!!!

                                  
/root(1): /usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php >> /tmp/snort_update.log
rm: /usr/local/etc/snort/snortrules: No such file or directory
/root(2):

                                  P.S I sent a small donation in today for beer  ;D

                                  Are you sure when you ran the rule update there was indeed an update downloaded?

                                  Looks like I spoke too soon, check again this morning. And it failed

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    judex
                                    last edited by

                                    At the moment snort ist working ok.

                                    Autoupdates fail but snort keeps on snorting on my system.

                                    Manual update works, if I delete snortrules MD5 file before.

                                    WAN blocking does not occur any more.

                                    Greets, Judex

                                    2.1-RELEASE (amd64)
                                    built on Wed Sep 11 18:17:48 EDT 2013
                                    FreeBSD 8.3-RELEASE-p11

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mdima
                                      last edited by

                                      @judex:

                                      WAN blocking does not occur any more.

                                      Hi, I was updating this morning, few hours ago, and my WAN IPs were still get blocked (block: Both), even if they are on the whitelist (both choosing a whitelist then leaving "default" as whitelist)…

                                      Thanks,
                                      Michele

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        breusshe
                                        last edited by

                                        @mschiek01:

                                        Ermal this is still not fixed.

                                        If snort is running and downloads a new rule update then tries to apply it, the same will occur. I have the latest version update.  Of course if I uninstall snort and reinstall it will start again and run fine but it is still not fixed as the next rule update will cause the same error.

                                        Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                        Jul 18 12:19:33 snort[31831]: FATAL ERROR: /usr/local/etc/snort/snort_27588_em1/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
                                        Jul 18 12:19:33 snort[31831]: Initializing rule chains…
                                        Jul 18 12:19:33 snort[31831]: Initializing rule chains…
                                        Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++
                                        Jul 18 12:19:33 snort[31831]: +++++++++++++++++++++++++++++++++++++++++++++++++++

                                        I'm still getting this too.  I delete the md5 files and redownload the snort rules, snort starts fine after that.  But, next time new rules are downloaded, I'll get this error again.

                                        1 Reply Last reply Reply Quote 0
                                        • F
                                          Fesoj
                                          last edited by

                                          Hi,

                                          I am just curious about how you are updating (System packages or Git repository). The regular package update is about 2 days old, but ermal has updated the sources since then.

                                          A quick check to find out what you are running is to check select the "Rules" tab of one of the snort interfaces. If there is visual glitch on top of the page, then you are still running an "old" version.

                                          I had some of the messages reported here a couple of days ago, but not lately. If someone is not sure what is currently installed a diff -u for a candidate file (e.g. snort.inc) and the corresponding one from https://github.com/bsdperimeter/pfsense-packages/tree/master/config/snort should clarify the situation.

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            Fesoj,

                                            When you see updates on git and/or announces on forum, just wait 15 minutes after the update date-time and then re-install the package.

                                            att,
                                            Marcello Coutinho

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post