Re: Network variables are not preserved when using LightSPD rules

Hi Oleksii,

That is a good idea!

The only downside is that to change HOME_NET would mean changing all
connected variables (like you have shown in your example). Also if new
FOO_SERVERS variable gets introduced, it won't be set correctly until I
change the stub and account for it.

What I had in mind is setting HOME_NET='x.x.x.x/y' at top of snort.lua file
and then when include('whatever-policy.lua') happens, the
`snort_variables.lua` preserves any variables that might already be defined
while setting others.

Thanks,
Dheeraj

On Thu, 26 Sept 2024 at 16:18, Oleksii Shumeiko -X (oshumeik - SOFTSERVE
INC at Cisco) <[email protected]> wrote:

> Hi,
>
> > over-ride them before the script is called
>
> You can override variables *after* the script is called.
> Just put the following lines at the end of the main config file
> (snort.lua):
>
> ips.variables.net.HOME_NET = 'x.x.x.x/z'
> ips.variables.net.DNS_SERVERS = 'y.y.y.y'
> ips.variables.net.EXTERNAL_NET = 'any'
> ips.variables.net.FTP_SERVERS = HOME_NET
> ips.variables.net.HTTP_SERVERS = HOME_NET
> ips.variables.net.SIP_SERVERS = HOME_NET
> ips.variables.net.SMTP_SERVERS = HOME_NET
> ips.variables.net.SQL_SERVERS = HOME_NET
> ips.variables.net.SSH_SERVERS = HOME_NET
> ips.variables.net.TELNET_SERVERS = HOME_NET
>
> Port variables can be overridden the same way:
> ips.variables.ports.NN = 12345
>
>
> Regards,
> Alexey
>
> On 26 Sep 2024, at 13:11, Dheeraj Gupta via Snort-users <
> [email protected]> wrote:
>
> over-ride them before the script is called
>
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette