Re: snort 3.1.21.0 fails with - can't find file_id.file_policy / enable_signature / enable_type

“file_policy” was moved out from “file_id”, please use snort --help-config to find out the details.

From: Snort-users <[email protected]> on behalf of Amish via Snort-users <[email protected]>
Date: Monday, January 31, 2022 at 5:58 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] snort 3.1.21.0 fails with - can't find file_id.file_policy / enable_signature / enable_type
Hello,

I just upgraded from snort 3.1.17.0 to 3.1.21.0

At the same time I also upgraded from daq 3.0.5 to 3.0.6 (both are more
or less same except year change from 2021 to 2022)

I run snort with this command via systemd

/usr/bin/snort -Q -c /etc/snort/snort.lua -l /var/log/snort --tweaks local

I have following rules in local.lua (gets called with --tweaks local)

file_id =
{
     enable_type = true,
     enable_signature = true,
     file_rules = file_magic,
     file_policy =
     {
         { use = { verdict = 'log', enable_file_type = true,
enable_file_signature = true } }
     }
}

It worked fine in 3.1.17.0 but in 3.1.21.0 it gives following error.

Jan 30 08:48:49 amish snort[491]: ERROR: /etc/snort/snort.lua: can't
find file_id.file_policy
Jan 30 08:48:49 amish snort[491]: ERROR: /etc/snort/snort.lua: can't
find file_id.enable_signature
Jan 30 08:48:49 amish snort[491]: ERROR: /etc/snort/snort.lua: can't
find file_id.enable_type

What changed between 3.1.17.0 and 3.1.21.0? If I comment the file_id
lines, then snort starts running again.

How do I resolve this? I can not figure out anything from above ERRORs.

Thanks in advance,

Amish.

PS: I also noticed that on snort.org the latest version is 3.1.20.0 but
on github latest release is 3.1.21.0

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette