Re: Regarding dynamic (so_rules) rules

[John York <YorkJ () brcc edu>]

Pretty much...

Just got time to rebuild my 2.8.6 with pulledpork 0.4 to 2.9.0.5 and pulledpork 0.6.1.  It's not in the doc's that I 
could find (I tend to miss a lot when I try to RTFM, tho), but you also need to comment out all the includes for the 
rules files in snort.conf, and include the two that pulledpork makes (snort.rules and so_rules.rules).  Everything else 
happens automagically once you get pulledpork.conf set up correctly.

I did have one weird thing happen.  I ran pp before I had all the errors out of my snort.conf, so when pp called snort 
for SO rules, snort quit.  I fixed the errors and then snort would complain that it couldn't find 
/usr/local/etc/snort//user/local/etc/snort/somefile.rules.  Somehow, the rules path was getting repeated/duplicated.  
This happened even if I ran snort -T by itself.  I couldn't find anything wrong, so I commented out all the rules 
includes in snort.conf and ran pp again.  It completed without snort errors, and I never saw the problem again after 
that.

Anyway, I agree.  SO rules are much easier with pulledpork.  Thanks JJ!

John

From: Joel Esler [mailto:jesler () sourcefire com]
Sent: Thursday, May 12, 2011 7:57 AM
To: Dheeraj Gupta
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Regarding dynamic (so_rules) rules

There's a couple blog posts and snort.org<http://snort.org> I could point you to, but the easiest way, really, to get 
Shared Object rules running (which is what you are referring to below "dynamic", in this context) is to use pulledpork.

Pulledpork will download, compile, and generally take care of everything you need for shared object rules to function.

J

On May 12, 2011, at 5:41 AM, Dheeraj Gupta wrote:


Hi,
I am sorry if this has been answered before, but I really couldn't find an appropriate answer to a host pf troubles I 
am having.
I can't seem to trigger dynamic rules for my snort installation.
I configure snort with  ./configure -with-mysql --enable-zlib --enable-decoder-preprocessor-rules

The snort.conf file has all include so_rules/ lines at the end uncommented, so it should be picking up those rules.
I think I am missing something about the dynamic rules

Relevant Sections of snort.conf are
# Path to your rules files (this can be a relative path)
# Note for Windows users:  You are advised to make this an absolute path,
# such as:  c:\snort\rules
var RULE_PATH /home/dheeraj/installs/snort-2.9.0.5/etc/rules
var SO_RULE_PATH /home/dheeraj/installs/snort-2.9.0.5/etc/so_rules
var PREPROC_RULE_PATH /home/dheeraj/installs/snort-2.9.0.5/etc/preproc_rules

# path to dynamic preprocessor libraries
dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/

# path to base preprocessor engine
dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so

# path to dynamic rules libraries
dynamicdetection directory /usr/local/lib/snort_dynamicrules

I look into my /var/log/messages and see the following (relevant) entries

May 12 14:46:58 redbaronpc snort[20793]: Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]: Loading all dynamic detection libs from /usr/local/lib/snort_dynamicrules...
May 12 14:46:58 redbaronpc snort[20793]: Warning: No dynamic libraries found in directory 
/usr/local/lib/snort_dynamicrules!
May 12 14:46:58 redbaronpc snort[20793]:   Finished Loading all dynamic detection libs from 
/usr/local/lib/snort_dynamicrules
May 12 14:46:58 redbaronpc snort[20793]: Loading all dynamic preprocessor libs from 
/usr/local/lib/snort_dynamicpreprocessor/...
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
/usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so...
May 12 14:46:58 redbaronpc snort[20793]: done
May 12 14:46:58 redbaronpc snort[20793]:   Finished Loading all dynamic preprocessor libs from 
/usr/local/lib/snort_dynamicpreprocessor/

May 12 14:46:59 redbaronpc snort[20793]: +++++++++++++++++++++++++++++++++++++++++++++++++++
May 12 14:46:59 redbaronpc snort[20793]: Initializing rule chains...
May 12 14:47:00 redbaronpc snort[20793]: 5360 Snort rules read
May 12 14:47:00 redbaronpc snort[20793]:     5360 detection rules
May 12 14:47:00 redbaronpc snort[20793]:     0 decoder rules
May 12 14:47:00 redbaronpc snort[20793]:     0 preprocessor rules
May 12 14:47:00 redbaronpc snort[20793]: 5360 Option Chains linked into 479 Chain Headers
May 12 14:47:00 redbaronpc snort[20793]: 0 Dynamic rules
May 12 14:47:00 redbaronpc snort[20793]: +++++++++++++++++++++++++++++++++++++++++++++++++++

May 12 14:47:01 redbaronpc snort[20793]: Encoded Rule Plugin SID: 15210, GID: 3 not registered properly.  Disabling 
this rule.
(The above message is repated about 700 times for different SIDs. COuld someone also explain why this message comes?)

How do I remove No dynamic libraries found in directory /usr/local/lib/snort_dynamicrules! warning? and get the dynamic 
rules t fire on this installation



Regards,
Dheeraj

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users