Snort with OpenAppID and inline NFQ DAQ on Alpine Linux
Matt Cooper <[email protected]> Tue, 6 Aug 2019 10:10:41 +0000
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <DM5PR0401MB362313249B2E1CD553533ED3F2D50@DM5PR0401MB3623.namprd04.prod.outlook.com> |
--===============0636133300425139133==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_DM5PR0401MB362313249B2E1CD553533ED3F2D50DM5PR0401MB3623_"
--_000_DM5PR0401MB362313249B2E1CD553533ED3F2D50DM5PR0401MB3623_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
I am trying to run Snort 2.9.14 (with OpenAppID and inline NFQ DAQ) on Alpi=
ne Linux (v3.10). In order to get round some build problems with Snort I've=
added the libtirpc package (updating the CFLAGS & LDFLAGS accordingly) and=
built with the flags -enable-open-appid -enable-sourcefire.
Snort version info is:
,,_ -*> Snort! <*-
o" )~ Version 2.9.14 GRE (Build 15003)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#=
team
Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights =
reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.9.0-PRE-GIT (with TPACKET_V3)
Using PCRE version: 8.43 2019-02-23
Using ZLIB version: 1.2.11
It appears that the DAQ NFQ is set up correctly:
Available DAQ modules:
pcap(v3): readback live multi unpriv
nfq(v7): live inline multi
ipfw(v3): live inline multi unpriv
dump(v3): readback live inline multi unpriv
afpacket(v5): live inline multi unpriv
When I run Snort there is a problem with the dynamic pre-processor, which c=
an't find some symbols (getrpcent & endrpcent) the shared object libsf_appi=
d_preproc.so needs to locate. These functions are defined in the (Sun) RPC =
library that's part of glibc, but because Alpine uses musl libc which doesn=
't include the (Sun) RPC library, libtirpc is being used as a replacement f=
or it.
This is the output from running Snort:
# snort -A full -hqsQ -c /etc/snort/snort.conf --daq-dir=3D/usr/local/lib/d=
aq -K ascii
Running in IDS mode
--=3D=3D Initializing Snort =3D=3D--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
PortVar 'HTTP_PORTS' defined : [ 80:81 311 383 591 593 901 1220 1414 1741 =
1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001 7144:7145 =
7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180:8181 =
8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 3444=
3:34444 41080 50002 55555 ]
PortVar 'SHELLCODE_PORTS' defined : [ 0:79 81:65535 ]
PortVar 'ORACLE_PORTS' defined : [ 1024:65535 ]
PortVar 'SSH_PORTS' defined : [ 22 ]
PortVar 'FTP_PORTS' defined : [ 21 2100 3535 ]
PortVar 'SIP_PORTS' defined : [ 5060:5061 5600 ]
PortVar 'FILE_DATA_PORTS' defined : [ 80:81 110 143 311 383 591 593 901 12=
20 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:70=
01 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 81=
23 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 99=
99 11371 34443:34444 41080 50002 55555 ]
PortVar 'GTP_PORTS' defined : [ 2123 2152 3386 ]
Detection:
Search-Method =3D AC-Full-Q
Split Any/Any group =3D enabled
Search-Method-Optimizations =3D enabled
Maximum pattern length =3D 20
Tagged Packet Limit: 256
Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so..=
. done
Loading all dynamic detection libs from /usr/local/lib/snort_dynamicrules..=
.
WARNING: No dynamic libraries found in directory /usr/local/lib/snort_dynam=
icrules.
Finished Loading all dynamic detection libs from /usr/local/lib/snort_dyn=
amicrules
Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicprep=
rocessor/...
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreproce=
ssor//libsf_appid_preproc.so... ERROR: Failed to load /usr/local/lib/snort_=
dynamicpreprocessor//libsf_appid_preproc.so: Error relocating /usr/local/li=
b/snort_dynamicpreprocessor//libsf_appid_preproc.so: endrpcent: symbol not =
found
Fatal Error, Quitting.
The shared object dependencies for libsf_appid_preproc.so are:
# ldd /usr/local/lib/snort_dynamicpreprocessor/libsf_appid_preproc.so.0.0.0
/lib/ld-musl-aarch64.so.1 (0xffff9b671000)
libluajit-5.1.so.2 =3D> /usr/lib/libluajit-5.1.so.2 (0xffff=
9b032000)
libpcre.so.1 =3D> /usr/lib/libpcre.so.1 (0xffff9afcf000)
libcrypto.so.1.1 =3D> /lib/libcrypto.so.1.1 (0xffff9ad84000=
)
libc.musl-aarch64.so.1 =3D> /lib/ld-musl-aarch64.so.1 (0xff=
ff9b671000)
libgcc_s.so.1 =3D> /usr/lib/libgcc_s.so.1 (0xffff9ad62000)
Error relocating /usr/local/lib/snort_dynamicpreprocessor/libsf_appid_prepr=
oc.so.0.0.0: endrpcent: symbol not found
Error relocating /usr/local/lib/snort_dynamicpreprocessor/libsf_appid_prepr=
oc.so.0.0.0: getrpcent: symbol not found
How can I resolve this issue? Is Alpine Linux a supported distro for Snort?
When I build without the -enable-open-appid flag, Snort runs as expected.
Many thanks,
Matt
--_000_DM5PR0401MB362313249B2E1CD553533ED3F2D50DM5PR0401MB3623_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-GB" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">I am trying to run Snort 2.9.14 (with OpenAppID and =
inline NFQ DAQ) on Alpine Linux (v3.10). In order to get round some build p=
roblems with Snort I’ve added the libtirpc package (updating the CFLA=
GS & LDFLAGS accordingly) and built with
the flags –enable-open-appid –enable-sourcefire.<o:p></o:p></p=
>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Snort version info is:<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"> ,,_ -*> Snor=
t! <*-<o:p></o:p></p>
<p class=3D"MsoNormal"> o" )~ Version 2.9.14 G=
RE (Build 15003) <o:p></o:p></p>
<p class=3D"MsoNormal"> '''' By Martin R=
oesch & The Snort Team: <a href=3D"http://www.snort.org/contact#team">
http://www.snort.org/contact#team</a><o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights re=
served.<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; Copyright (C) 1998-2013 Sourcefire, Inc., et al.<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; Using libpcap version 1.9.0-PRE-GIT (with TPACKET_V3)<o:p></o:p></=
p>
<p class=3D"MsoNormal"> &nbs=
p; Using PCRE version: 8.43 2019-02-23<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; Using ZLIB version: 1.2.11<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">It appears that the DAQ NFQ is set up correctly:<o:p=
></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Available DAQ modules:<o:p></o:p></p>
<p class=3D"MsoNormal">pcap(v3): readback live multi unpriv<o:p></o:p></p>
<p class=3D"MsoNormal">nfq(v7): live inline multi<o:p></o:p></p>
<p class=3D"MsoNormal">ipfw(v3): live inline multi unpriv<o:p></o:p></p>
<p class=3D"MsoNormal">dump(v3): readback live inline multi unpriv<o:p></o:=
p></p>
<p class=3D"MsoNormal">afpacket(v5): live inline multi unpriv<o:p></o:p></p=
>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">When I run Snort there is a problem with the dynamic=
pre-processor, which can’t find some symbols (getrpcent & endrpc=
ent) the shared object libsf_appid_preproc.so needs to locate. These functi=
ons are defined in the (Sun) RPC library that’s
part of glibc, but because Alpine uses musl libc which doesn’t inclu=
de the (Sun) RPC library, libtirpc is being used as a replacement for it.<o=
:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">This is the output from running Snort:<o:p></o:p></p=
>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"># snort -A full -hqsQ -c /etc/snort/snort.conf --daq=
-dir=3D/usr/local/lib/daq -K ascii<o:p></o:p></p>
<p class=3D"MsoNormal">Running in IDS mode<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"> --=3D=3D =
Initializing Snort =3D=3D--<o:p></o:p></p>
<p class=3D"MsoNormal">Initializing Output Plugins!<o:p></o:p></p>
<p class=3D"MsoNormal">Initializing Preprocessors!<o:p></o:p></p>
<p class=3D"MsoNormal">Initializing Plug-ins!<o:p></o:p></p>
<p class=3D"MsoNormal">Parsing Rules file "/etc/snort/snort.conf"=
<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'HTTP_PORTS' defined : [ 80:81 311 383=
591 593 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 52=
50 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 80=
88 8090 8118 8123 8180:8181 8243 8280 8300
8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 34443:34444 41080 =
50002 55555 ]<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'SHELLCODE_PORTS' defined : [ 0:79 81:=
65535 ]<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'ORACLE_PORTS' defined : [ 1024:65535 =
]<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'SSH_PORTS' defined : [ 22 ]<o:p></o:p=
></p>
<p class=3D"MsoNormal">PortVar 'FTP_PORTS' defined : [ 21 2100 3535 ]=
<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'SIP_PORTS' defined : [ 5060:5061 5600=
]<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'FILE_DATA_PORTS' defined : [ 80:81 11=
0 143 311 383 591 593 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702=
4343 4848 5250 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028=
8080 8085 8088 8090 8118 8123 8180:8181
8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 344=
43:34444 41080 50002 55555 ]<o:p></o:p></p>
<p class=3D"MsoNormal">PortVar 'GTP_PORTS' defined : [ 2123 2152 3386=
]<o:p></o:p></p>
<p class=3D"MsoNormal">Detection:<o:p></o:p></p>
<p class=3D"MsoNormal"> Search-Method =3D AC-Full-Q<o:p></o:p><=
/p>
<p class=3D"MsoNormal"> Split Any/Any group =3D enabled<o=
:p></o:p></p>
<p class=3D"MsoNormal"> Search-Method-Optimizations =3D e=
nabled<o:p></o:p></p>
<p class=3D"MsoNormal"> Maximum pattern length =3D 20<o:p=
></o:p></p>
<p class=3D"MsoNormal">Tagged Packet Limit: 256<o:p></o:p></p>
<p class=3D"MsoNormal">Loading dynamic engine /usr/local/lib/snort_dynamice=
ngine/libsf_engine.so... done<o:p></o:p></p>
<p class=3D"MsoNormal">Loading all dynamic detection libs from /usr/local/l=
ib/snort_dynamicrules...<o:p></o:p></p>
<p class=3D"MsoNormal">WARNING: No dynamic libraries found in directory /us=
r/local/lib/snort_dynamicrules.<o:p></o:p></p>
<p class=3D"MsoNormal"> Finished Loading all dynamic detection libs f=
rom /usr/local/lib/snort_dynamicrules<o:p></o:p></p>
<p class=3D"MsoNormal">Loading all dynamic preprocessor libs from /usr/loca=
l/lib/snort_dynamicpreprocessor/...<o:p></o:p></p>
<p class=3D"MsoNormal"> Loading dynamic preprocessor library /usr/loc=
al/lib/snort_dynamicpreprocessor//libsf_appid_preproc.so... ERROR: Failed t=
o load /usr/local/lib/snort_dynamicpreprocessor//libsf_appid_preproc.so: Er=
ror relocating /usr/local/lib/snort_dynamicpreprocessor//libsf_appid_prepro=
c.so:
endrpcent: symbol not found<o:p></o:p></p>
<p class=3D"MsoNormal">Fatal Error, Quitting.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">The shared object dependencies for libsf_appid_prepr=
oc.so are:<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"># ldd /usr/local/lib/snort_dynamicpreprocessor/libsf=
_appid_preproc.so.0.0.0<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; /lib/ld-musl-aarch64.so.1 (0xffff9b6=
71000)<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; libluajit-5.1.so.2 =3D> /usr/lib/=
libluajit-5.1.so.2 (0xffff9b032000)<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; libpcre.so.1 =3D> /usr/lib/libpcr=
e.so.1 (0xffff9afcf000)<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; libcrypto.so.1.1 =3D> /lib/libcry=
pto.so.1.1 (0xffff9ad84000)<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; libc.musl-aarch64.so.1 =3D> /lib/=
ld-musl-aarch64.so.1 (0xffff9b671000)<o:p></o:p></p>
<p class=3D"MsoNormal"> &nbs=
p; libgcc_s.so.1 =3D> /usr/lib/libgc=
c_s.so.1 (0xffff9ad62000)<o:p></o:p></p>
<p class=3D"MsoNormal">Error relocating /usr/local/lib/snort_dynamicpreproc=
essor/libsf_appid_preproc.so.0.0.0: endrpcent: symbol not found<o:p></o:p><=
/p>
<p class=3D"MsoNormal">Error relocating /usr/local/lib/snort_dynamicpreproc=
essor/libsf_appid_preproc.so.0.0.0: getrpcent: symbol not found<o:p></o:p><=
/p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">How can I resolve this issue? Is Alpine Linux a supp=
orted distro for Snort?<o:p></o:p></p>
<p class=3D"MsoNormal">When I build without the –enable-open-appid fl=
ag, Snort runs as expected.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Many thanks,<o:p></o:p></p>
<p class=3D"MsoNormal">Matt<o:p></o:p></p>
</div>
</body>
</html>
--_000_DM5PR0401MB362313249B2E1CD553533ED3F2D50DM5PR0401MB3623_--
--===============0636133300425139133==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel
Please visit http://blog.snort.org for the latest news about Snort!
--===============0636133300425139133==--