Re: snort 3.1.21.0 fails with - can't find file_id.file_policy / enable_signature / enable_type

On 31/01/22 20:29, Steven Baigal (sbaigal) wrote:
>
> “file_policy” was moved out from “file_id”, please use snort 
> --help-config to find out the details.
>
Great. That did it. But I wonder if minor version change is supposed to 
have such breaking changes.

Here is new config directive that I changed to.

file_policy =
{
     enable_type = true,
     enable_signature = true,
     rules = { use = { verdict = 'log', enable_file_type = true, 
enable_file_signature = true } }
}

Regards.

Amish

> *From: *Snort-users <[email protected]> on behalf of 
> Amish via Snort-users <[email protected]>
> *Date: *Monday, January 31, 2022 at 5:58 AM
> *To: *[email protected] <[email protected]>
> *Subject: *[Snort-users] snort 3.1.21.0 fails with - can't find 
> file_id.file_policy / enable_signature / enable_type
>
> Hello,
>
> I just upgraded from snort 3.1.17.0 to 3.1.21.0
>
> At the same time I also upgraded from daq 3.0.5 to 3.0.6 (both are more
> or less same except year change from 2021 to 2022)
>
> I run snort with this command via systemd
>
> /usr/bin/snort -Q -c /etc/snort/snort.lua -l /var/log/snort --tweaks local
>
> I have following rules in local.lua (gets called with --tweaks local)
>
> file_id =
> {
>      enable_type = true,
>      enable_signature = true,
>      file_rules = file_magic,
>      file_policy =
>      {
>          { use = { verdict = 'log', enable_file_type = true,
> enable_file_signature = true } }
>      }
> }
>
> It worked fine in 3.1.17.0 but in 3.1.21.0 it gives following error.
>
> Jan 30 08:48:49 amish snort[491]: ERROR: /etc/snort/snort.lua: can't
> find file_id.file_policy
> Jan 30 08:48:49 amish snort[491]: ERROR: /etc/snort/snort.lua: can't
> find file_id.enable_signature
> Jan 30 08:48:49 amish snort[491]: ERROR: /etc/snort/snort.lua: can't
> find file_id.enable_type
>
> What changed between 3.1.17.0 and 3.1.21.0? If I comment the file_id
> lines, then snort starts running again.
>
> How do I resolve this? I can not figure out anything from above ERRORs.
>
> Thanks in advance,
>
> Amish.
>
> PS: I also noticed that on snort.org the latest version is 3.1.20.0 but
> on github latest release is 3.1.21.0
>
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
> [email protected]
>
> Please visit http://blog.snort.org to stay current on all the latest 
> Snort news!
>
> Please follow these rules: 
> https://snort.org/faq/what-is-the-mailing-list-etiquette
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette