Snort 2.9.2.3 pkg v. 2.5.0 Issues

bmeeks

Remove and Install latest v2.5.3

Got this behind the install frame window

Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953

Got this when I stop and started the snort interface

22:55 mardi 22 janvier 2013
Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 129 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 130 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 131 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 132 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 133 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 136

I can add some more robust error checking to prevent this. Did you by chance make any rule category changes during the uninstall/re-install process? Just asking to help me better isolate where the problem might be.

Thanks,
Bill

Supermule

I havent had a rule update yet, so will revert back as soon as I have :)

@bmeeks:

@Supermule:

Can we get Snort to save blocked hosts that can survive a reboot??

I can take a look at this. I don't use that feature, and thus have never investigated it. How are enabled/disabled rules holding up now? Do your changes survive rule updates and restarts?

Supermule

Snort doesnt respect whitelisted Alias on the WAN side. Got blocked out and had to use the back entrance :D

Supermule

And another thing….everytime I enable/disable a rule, it throws me back to the top of the page....that makes a lot of scrolling all the time!! Can it be changed somehow? So you either go back to where you were or not move at all?

bmeeks

@Supermule:

And another thing….everytime I enable/disable a rule, it throws me back to the top of the page....that makes a lot of scrolling all the time!! Can it be changed somehow? So you either go back to where you were or not move at all?

I will try. That one may be a bit difficult to pull off with the way PHP handles POST back with forms. I agree on it being a pain with scrolling.

Supermule

Thanks mate!! You are doing the PFSense community a big favor here!

Thank you :)

Supermule

Dude…..Can you give me your account number so I can transfer some funds for your work? I would like to donate a little to your working efforts!

bmeeks

@Supermule:

Dude…..Can you give me your account number so I can transfer some funds for your work? I would like to donate a little to your working efforts!

Thank you for the offer, but I don't have one. I'm contributing my efforts gratis since I also use the product. I made the changes originally for my own benefit, and decided to see if the community could benefit from them as well.

I still have a few little quirks to clean up that some folks have identified.

Supermule

Its always there if you need it ;)

Have you considered the ability to sort all coloumns of the blocked IP's tab??

So one can sort it on number, IP Alert description and time?

And the same on the alerts tab?

bmeeks

@Supermule:

Its always there if you need it ;)

Have you considered the ability to sort all coloumns of the blocked IP's tab??

So one can sort it on number, IP Alert description and time?

And the same on the alerts tab?

Yes on that, and also to sort the SIDs on the RULES tab. Tried to pull that off to begin with, but the way PHP handles multidimension arrays and sorting was giving me fits. Decided to put the changes out first to introduce the functionality, and then come back and add the bells and whistles.

Bill

bmeeks

@RonpfS:

Remove and Install latest v2.5.3

Got this behind the install frame window

Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953

Got this when I stop and started the snort interface

22:55 mardi 22 janvier 2013
Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 129 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 130 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 131 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 132 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 133 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 136

However snort seems to be running fine.

I cycle power on the DSL modem and it did not block the WAN IP. Its seems to behave ok.

Update on this report: I found the cause. I was doing some poor error checking. Basically what's happening is that upon package remove and re-install, the Rules directory is empty of all files, but your saved "selected categories" (which are really just the filenames with no content) are saved in the pfSense config.xml file. So when you remove and re-install Snort with the "save configuration option" checked, it remembers your previous rule categories.

Upon the first startup following the package re-installation, it tries to read those files to get the rule contents, but because a Rules update has not been done and the Rules directory is empty, it pops up the error you see. This error will show different files for different folks depending on what rule categories they had previously enabled.

I can add an easy fix for this to basically check that the files exist before trying to read them. My mistake for not thinking of that to start with… :-[

I am collecting up the fixes for these little glitches and will submit them to Ermal for an update.

Bill

Supermule

Damn nice!! Nothing more to say :)

eri--

I fixed the missing file issue by just adding the checks.

Supermule you can already sort afaik in the gui by clcking on the headers, no?

eri--

@Supermule:

Snort doesnt respect whitelisted Alias on the WAN side. Got blocked out and had to use the back entrance :D

Can you explain here and you are taling about pfblocker or about the default homelist generated?

Supermule

¨Whitelist in Snort…you create an alias and use that as whitelist. IP adresses listed in this doesnt get respected if on the WAN side. Local servers are fine, but external IP doesnt get whitelisted.

Supermule

Nope…

@ermal:

I fixed the missing file issue by just adding the checks.

Supermule you can already sort afaik in the gui by clcking on the headers, no?

bmeeks

@ermal:

I fixed the missing file issue by just adding the checks.

Supermule you can already sort afaik in the gui by clcking on the headers, no?

Hi Ermal:

By my count, there were four places in the code where this potential issue existed. Three in snort.inc, and one in snort_check_for_rule_updates.php. They are in the following functions:

snort_build_sid_msg_map()
snort_load_rules_map()
snort_generate_conf()
snort_apply_customizations()

Bill

iFloris

Have been following this closely & This is awesome. Thanks bmeeks!

bmeeks

@iFloris:

Have been following this closely & This is awesome. Thanks bmeeks!

No problem. Enjoyed tinkering with the code and trying to make Snort work even better.

I submitted a small batch of changes last evening that Ermal and team merged to fix the remaining glitches with the missing files warning messages, and to make sure that flowbit rules get included (if enabled) during the initial Rules Update after a re-install or a fresh install. These last fixes should make the package 100% functional. Please post if any other bugs show up.

There are some outstanding to-do features/improvements on my list. Supermule and others have posted some of them in this thread such as some problems with external IP whitelisting surviving reboots, column sorting, etc. A move to the Snort 2.9.4.x binary is needed as well, but I have some more to learn about how binary packages are built and tested with the pfSense platform.

Bill

Supermule

No problems Bill!

I think you should work closely with Ermal to get this going asap! Combine talents :)