snort3-261: snort can not stop on QUIT and TERM in NFQ mode.

--===============3208795395214519359==
Content-Type: multipart/alternative; boundary="00000000000071e3b50594911ece"

--00000000000071e3b50594911ece
Content-Type: text/plain; charset="UTF-8"

Hello, i run snort3 build 261 with nfq

Config concerning to daq :
*ips.mode="tap"*
*daq = { module_dirs = { "/usr/lib/daq" } }*
*daq.inputs = {'1'}   --my queue ID*
*daq.modules = { { name = 'nfq', mode='passive' } }*

When I try to kill snort I see in log:

*Oct  9 11:36:32 xxx snort[25483]:
--------------------------------------------------*
*Oct  9 11:36:32 xxx snort[25483]: nfq DAQ configured to passive.*
*Oct  9 11:36:32 xxx snort[25483]: initializing daemon mode*
*Oct  9 11:36:32 xxx snort[25483]: child process is 25484*
*Oct  9 11:36:32 xxx snort[25484]: Commencing packet processing*
*Oct  9 11:36:32 xxx snort[25484]: ++ [0] 1*
*Oct  9 11:36:32 xxx snort[25484]: Writing PID "25484" to file
"/var/run/snort.pid"*
*Oct  9 11:36:32 xxx snort[25484]: Chroot directory = /*
*Oct  9 11:38:02 xxx snort[25484]: ** caught term signal*
*Oct  9 11:38:02 xxx snort[25484]: == stopping*
*Oct  9 11:38:31 xxx snort[25484]: ** caught quit signal*
*Oct  9 11:38:31 xxx snort[25484]: == stopping*

And process remains running..
As I know* --dirty-pig* mode is ON when killing by QUIT, but even this
can'not help.

I even tried to not configure nfq in iptables . With iptables configured
for nfq - the same situation..

Is it dungerous to use *always exit_pronto = true *in sources? So quick
exit without cleanup can be done..

exit_pronto settled to false after some part of initialization done. May do
no set it to false for avalibilty of quick exist ?

Thanks.

--00000000000071e3b50594911ece
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div di=
r=3D"ltr"><div dir=3D"ltr">Hello, i run snort3 build 261 with nfq</div><div=
 dir=3D"ltr"><br><div>Config concerning to daq :</div><div><div><i>ips.mode=
=3D&quot;tap&quot;</i></div><div><i>daq =3D { module_dirs =3D { &quot;/usr/=
lib/daq&quot; } }</i></div><div><i>daq.inputs =3D {&#39;1&#39;} =C2=A0 --my=
 queue ID</i></div><div><i>daq.modules =3D { { name =3D &#39;nfq&#39;, mode=
=3D&#39;passive&#39; } }</i></div></div><div><br></div><div>When I try to k=
ill snort I see in log:</div><div><br></div><div><div><i>Oct =C2=A09 11:36:=
32 xxx snort[25483]: --------------------------------------------------</i>=
</div><div><i>Oct =C2=A09 11:36:32 xxx snort[25483]: nfq DAQ configured to =
passive.</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25483]: initializi=
ng daemon mode</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25483]: chil=
d process is 25484</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25484]: =
Commencing packet processing</i></div><div><i>Oct =C2=A09 11:36:32 xxx snor=
t[25484]: ++ [0] 1</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25484]: =
Writing PID &quot;25484&quot; to file &quot;/var/run/snort.pid&quot;</i></d=
iv><div><i>Oct =C2=A09 11:36:32 xxx snort[25484]: Chroot directory =3D /</i=
></div></div><div><div><i>Oct =C2=A09 11:38:02 xxx snort[25484]: ** caught =
term signal</i></div><div><i>Oct =C2=A09 11:38:02 xxx snort[25484]: =3D=3D =
stopping</i></div><div><i>Oct =C2=A09 11:38:31 xxx snort[25484]: ** caught =
quit signal</i></div><div><i>Oct =C2=A09 11:38:31 xxx snort[25484]: =3D=3D =
stopping</i></div><div><br></div><div>And process remains running..=C2=A0</=
div><div>As I know<b> --dirty-pig</b> mode is ON when killing by QUIT, but =
even this can&#39;not help.</div><div><br></div><div>I even tried to not co=
nfigure nfq in iptables . With iptables configured for nfq - the same situa=
tion..</div><div><br></div><div>Is it dungerous to use <b>always exit_pront=
o =3D true </b>in sources? So quick exit without cleanup can be done..</div=
><div><br></div><div>exit_pronto settled to false after some part of initia=
lization done. May do no set it to false for avalibilty of quick exist ?<br=
></div><div><br></div><div>Thanks.</div><div><br></div></div><div><br></div=
><div><br></div></div></div></div></div></div></div>

--00000000000071e3b50594911ece--

--===============3208795395214519359==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============3208795395214519359==--