Re: Snort 3 configuration on CentOS 8 : Why is RULE_PATH undefined?

Hey TianLing,

Variables used within the ips.rules string must be defined in ips.variables. In your case, adding something like this should work:

    ips.variables = { paths = { RULE_PATH = RULE_PATH } }

But note that this is actually already done in snort_defaults.lua so you could just do:

    ips.variables = default_variables

(or only set ips.mode and ips.rules instead of overwriting the whole table).

Any one of those three approaches should fix it.

Hope that helps.
Russ

________________________________
From: Snort-users <[email protected]> on behalf of Ling Tian via Snort-users <[email protected]>
Sent: Friday, February 3, 2023 12:41 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort 3 configuration on CentOS 8 : Why is RULE_PATH undefined?

Hello everyone!
I'm working to install snort 3.1.47 on CentOS 8.5 while following the "Snort 3.1.00 on CentOS 8 Stream" manual from Snort's official documentation.
I finished configuring snort along with this manual and I'm now trying to start Snort on my network interface using the following command.
/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -i enp37s0 -l /var/log/snort --plugin-path /usr/local/snort/extra -k none
However, the output this command generates mentions the error FATAL: ips.rules:2 undefined variable name: RULE_PATH while reading my snort.lua file.

The content of the ips array inside my snort.lua file is as follows:

ips =
{
    mode = tap,
     rules = [[
        include $RULE_PATH/snort3-app-detect.rules
        include $RULE_PATH/snort3-browser-chrome.rules
        include $RULE_PATH/snort3-browser-firefox.rules
         ...
        include $RULE_PATH/snort3-x11.rules
   ]]
}


The RULE_PATH variable is defined in the snort_defaults.lua file:

---------------------------------------------------------------------------
-- default paths
---------------------------------------------------------------------------
-- Path to your rules files (this can be a relative path)

RULE_PATH = '../../rules'
BUILTIN_RULE_PATH = '../../builtin_rules'
PLUGIN_RULE_PATH = '../../so_rules'

-- If you are using reputation preprocessor set these
PASS_LIST_PATH = '../../intel'
BLOCK_LIST_PATH = '../../intel'

I don't understand why it would be undefined, because snort_defaults.lua is imported at the beginning of the snort.lua file:

---------------------------------------------------------------------------
-- 2. configure defaults
---------------------------------------------------------------------------

-- HOME_NET and EXTERNAL_NET must be set now
-- setup the network addresses you are protecting
HOME_NET = [[ 192.168.1.0/24<http://192.168.1.0/24> ]]

-- set up the external network addresses.
-- (leave as "any" in most situations)
EXTERNAL_NET = 'any'

-- dofile(conf_dir .. '/snort_defaults.lua')
-- dofile(conf_dir .. '/file_magic.lua')

include 'snort_defaults.lua'
include 'file_magic.lua'

What could be making Snort think that my RULE_PATH variable is undefined?
I have googled to fix this issue, but I can't find the right solution.

Thanks you in advance for your answer,

Regards.

TianLing.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette