Project

General

Profile

Bug #9546

Snort fails to load/start with host_attribute_table

Added by Bill B 3 months ago. Updated 3 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
05/23/2019
Due date:
% Done:

0%

Estimated time:
Affected Version:
2.4.4-p3
Affected Architecture:
amd64

Description

Using the PfSense gui to load and import an attribute table will cause Snort to error on startup. It will not start.
Previous troubleshooting done included running my hosts.xml against the DTD provided by snort.org, trying the same host.xml file on Snort installs on both Ubuntu and FreeBSD 12 (which both worked fine with the snort -Tv test command.)

It seems to be an issue with how php in the gui handle the file.

History

#1 Updated by Bill Meeks 3 months ago

This issue is fixed in the upcoming snort-2.9.13_1 package that will be available for pfSense-2.5-DEVEL in the near future.

The problem was actually within the Snort binary and was caused by the Poudriere builder environment using the older yacc instead of the newer bison program when building the code files that provide Host Attribute Table support in Snort.

The fix is to modify the USES= line in the Snort port Makefile to add bison as a requirement.

#2 Updated by Bill Meeks 3 months ago

This issue is now fixed in both the RELEASE and DEVEL branches of pfSense. In pfSense 2.4.4.x the fixed package version is pfSense-pkg-snort-3.2.9.8_6, and on pfSense 2.5.x the fixed package version is pfSense-pkg-snort-4.0.

This issue can be closed.

#3 Updated by Jim Pingle 3 months ago

  • Status changed from New to Resolved

Also available in: Atom PDF