Snort fails to load/start with host_attribute_table
Using the PfSense gui to load and import an attribute table will cause Snort to error on startup. It will not start.
Previous troubleshooting done included running my hosts.xml against the DTD provided by snort.org, trying the same host.xml file on Snort installs on both Ubuntu and FreeBSD 12 (which both worked fine with the snort -Tv test command.)
It seems to be an issue with how php in the gui handle the file.
#1 Updated by Bill Meeks 18 days ago
This issue is fixed in the upcoming snort-2.9.13_1 package that will be available for pfSense-2.5-DEVEL in the near future.
The problem was actually within the Snort binary and was caused by the Poudriere builder environment using the older yacc instead of the newer bison program when building the code files that provide Host Attribute Table support in Snort.
The fix is to modify the USES= line in the Snort port Makefile to add bison as a requirement.