Re: Network variables are not preserved when using LightSPD rules

I think, you can combine approaches.

Set Lua variables before the script (it should pick them up and configure default values for all related IPS variables), then override targeted variables after the script:

HOME_NET = 'x.x.x.x/z'
EXTERNAL_NET = 'any'

include(policy.lua)

ips.variables.net.DNS_SERVERS = 'y.y.y.y'
ips.variables.net.FOO_SERVERS = 'z.z.z.z' -- any new variable should be changed thoughtfully (not overridden automatically).


On 26 Sep 2024, at 14:06, Dheeraj Gupta <[email protected]> wrote:

Hi Oleksii,

That is a good idea!

The only downside is that to change HOME_NET would mean changing all connected variables (like you have shown in your example). Also if new FOO_SERVERS variable gets introduced, it won't be set correctly until I change the stub and account for it.

What I had in mind is setting HOME_NET='x.x.x.x/y' at top of snort.lua file and then when include('whatever-policy.lua') happens, the `snort_variables.lua` preserves any variables that might already be defined while setting others.

Thanks,
Dheeraj

On Thu, 26 Sept 2024 at 16:18, Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>> wrote:
Hi,

> over-ride them before the script is called

You can override variables after the script is called.
Just put the following lines at the end of the main config file (snort.lua):

ips.variables.net.HOME_NET = 'x.x.x.x/z'
ips.variables.net.DNS_SERVERS = 'y.y.y.y'
ips.variables.net.EXTERNAL_NET = 'any'
ips.variables.net.FTP_SERVERS = HOME_NET
ips.variables.net.HTTP_SERVERS = HOME_NET
ips.variables.net.SIP_SERVERS = HOME_NET
ips.variables.net.SMTP_SERVERS = HOME_NET
ips.variables.net.SQL_SERVERS = HOME_NET
ips.variables.net.SSH_SERVERS = HOME_NET
ips.variables.net.TELNET_SERVERS = HOME_NET

Port variables can be overridden the same way:
ips.variables.ports.NN = 12345


Regards,
Alexey

On 26 Sep 2024, at 13:11, Dheeraj Gupta via Snort-users <[email protected]<mailto:[email protected]>> wrote:

over-ride them before the script is called

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette