pfSense » pfSense Packages

Christian McDonald wrote in #note-1:

This also impacts 23.05 snapshots.

We currently build nginx with LUA support (which we don't use). Snort also depends on LUA. However, nginx and snort depend on different (conflicting) packages that provide LUA.

This would also mean that even on upstream FreeBSD, one could not both have snort and nginx (with LUA option on) installed at the same time.

We need to either fix the dependency conflict and upstream it, or just disable LUA option on our nginx build.

If I recall from some earlier experimentation I did during the Fall last year, Snort and Suricata both don't really care which LUA they use (real LUA Devel or open-resty). But at the time there was something in the pfSense build (and maybe it was nginx, but I don't recall) that wanted LUA and not LUA Devel. My understanding, from very limited Google research, is that LUA Devel is really the "maintained branch" now and generic LUA has stagnated. At the time of my Google research last Fall, most developers were using LUA Devel.

I'm running off old memory now, and there may be "bit rot", so I may not have all my facts 100% aligned <grin>. I do recall that to get Snort and Suricata to compile in 2.7 DEVEL at the time (back in late November last year), I had to specifically link luajit to open-resty . Here are the two pull requests from that period that did this:

https://github.com/pfsense/FreeBSD-ports/pull/1195
https://github.com/pfsense/FreeBSD-ports/pull/1197

Perhaps it's now time to undo that change to open-resty ??? I can say that when I tested in my private repo, Snort and Suricata worked fine with luajit instead of open-resty . But they both do NEED LUA to function. LUA is used in the OpenAppID module of Snort.

If you want to revert those two commits in the 23.05 and 2.7 CE snapshots, it's fine with me. I think that will solve the issue (unless nginx does not like LUA Devel).

Christian McDonald wrote in #note-3:

Thanks Bill for the history, that was helpful.

I set the luajit-openresty option on snort again. That is a quick fix here.

Suricata will need the same change as Snort. If not changed, it will also throw the library conflict error during package installation.

I checked the Suricata port and it still uses luajit:luajit-openresty. Both work now.

Yes, now I could install snort, thanks!!!