Question on compiled (.so) rules with Snort3 from the LightSPD ruleset

I'm working on adding functionality to PulledPork3, and I have a few
questions on the pre-compiled (.so) rules.

I'm focused specifically on Snort 3 with the LightSPD ruleset format, but I
think these questions are fairly generic.

let me start with what i know about how this works (so anyone can correct
any misconceptions i have):

For a few supported platforms (centos-x64  debian-x64  fc-x64  opensuse-x64
 ubuntu-x64 ) to use the precompiled rules: all you need to do is reference
the folder containing all the .so rules for that platform with the
*--plugin-path* option, and include the rules from the stubs folder.  for
example:

/usr/local/bin/snort --plugin-path lightspd/modules/
3.1.15.0/ubuntu-x64/so_rules/ --rule-path lightspd/modules/stubs/ -c
/usr/local/etc/snort/snort.lua

(the above command works great for me with Snort 3.1.17.0 on Ubuntu x64)

I understand that the *--dump-dynamic-rules* option can be used to generate
the stub files from the .so rules, but it seems like that's not necessary
for the distros listed above since for the distros, these stubs are
included. This would only be needed if you were to compile the .so rules
from the .cc files located in the lightspd/modules/src folder (let me know
if this assumption is incorrect).

What is the process for compiling the .cc files in the lightspd/modules/src
folder into .so rules?  I tried running the makefile included in the src
directory, but it looks like it needs some of the files from the snort3
repo:

fatal error: main/snort_types.h: No such file or directory


Additionally: assuming I can compile these rules myself into .so files, are
the rules included different from the pre-compiled rules (meaning I would
need to use the --dump-dynamic-rules option with snort to generate the stub
files, rather than using the included stub files)?

Thank you
Noah

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette