Project

General

Profile

Actions
Copy link

Bug #14986

closed

Snort's Legacy Blocking Mode custom plugin code causes a Signal 11 and core dump when "kill states" option is enabled

Added by Bill Meeks over 1 year ago. Updated over 1 year ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
2.7.x
Affected Plus Version:
23.09
Affected Architecture:
All

Description

It appears the changes in this commit approximately two weeks ago: https://github.com/pfsense/FreeBSD-ports/commit/4f0328385462efdd72f20ed4c037bc254630ebe4 introduced a bug in the Legacy Blocking module for Snort. Users on pfSense Plus 23.09 are reporting very frequent Signal 11 faults with a core dump since upgrading to the latest pfSense Plus version with the latest Snort binary.

Troubleshooting with a user having the issue on the Netgate forum, I had that user disable the "kill states" option in the package GUI. When that option disabled, the custom blocking module will still add the offending IP address to the pf snort2c table, but it will NOT call the code to clear any existing firewall states for the offender IP address. This mode of operation results in Snort running normally (albeit no longer killing open states for blocked IP addresses). Based on this result, I think there is an issue in the new code.

Files

Screenshot_20231115-224738.png (124 KB) Screenshot_20231115-224738.png Error log Jonathan Lee, 11/16/2023 06:48 AM
Actions
Copy link

Also available in: Atom PDF