Servers section of lua configuration problem
Jacko B via Snort-users <[email protected]> Sun, 19 Jan 2025 18:48:57 -0600
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
--===============6396213975812787917==
Content-Type: multipart/alternative;
boundary="----=_Part_366201_1411632859.1737334137763"
------=_Part_366201_1411632859.1737334137763
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
=20
=20
Hello everyone, I am using Snort 3 version 3.6.0.0, and this i=
s the bottom portion of my Lua config. I have HOME_NET set to my IP address=
, and that portion passes, but then I get these error messages:ERROR: snort=
3-sql.rules:106 undefined variable in the string: $HTTP_SERVERS.ERROR: snor=
t3-sql.rules:32 Undefined variable in the string: $SQL_SERVERS.ERROR: snort=
3-server-webapp.rules:4457 undefined variable in the string: $SMTP_SERVERS.=
ERROR: snort3-protocol-voip.rules:89 undefined variable in the string: $SIP=
_SERVERS.I initially had the servers portion nested and then made it top-le=
vel, but the errors still persist. Any help would be greatly appreciated. T=
hank you!Here=E2=80=99s the relevant part of my configuration:-------------=
---------------------------------------------------------------- default wh=
itelist--------------------------------------------------------------------=
-------default_whitelist =3D[[=C2=A0 =C2=A0 ftp_command_specs default_ftp_s=
erver smtp_default_alt_max_command_lines=C2=A0 =C2=A0 default_smtp http_met=
hods sip_requests telnet_commands default_wizard=C2=A0 =C2=A0 default_refer=
ences default_classifications gtp_v0_msg gtp_v1_msg gtp_v2_msg=C2=A0 =C2=A0=
gtp_v0_info gtp_v1_info gtp_v2_info default_gtp tcp_low_ports=C2=A0 =C2=A0=
tcp_low_decoy tcp_low_sweep tcp_low_dist tcp_med_ports=C2=A0 =C2=A0 tcp_me=
d_decoy tcp_med_sweep tcp_med_dist tcp_hi_ports tcp_hi_decoy=C2=A0 =C2=A0 t=
cp_hi_sweep tcp_hi_dist udp_low_ports udp_low_decoy udp_low_sweep=C2=A0 =C2=
=A0 udp_low_dist udp_med_ports udp_med_decoy udp_med_sweep udp_med_dist=C2=
=A0 =C2=A0 udp_hi_ports udp_hi_decoy udp_hi_sweep udp_hi_dist ip_low_proto=
=C2=A0 =C2=A0 ip_low_decoy ip_low_sweep ip_low_dist ip_med_proto ip_med_dec=
oy=C2=A0 =C2=A0 ip_med_sweep ip_med_dist ip_hi_proto ip_hi_decoy ip_hi_swee=
p=C2=A0 =C2=A0 ip_hi_dist icmp_low_sweep icmp_med_sweep icmp_hi_sweep=C2=A0=
=C2=A0 default_hi_port_scan default_med_port_scan default_low_port_scan=C2=
=A0 =C2=A0 default_variables netflow_versions default_js_norm_ident_ignore=
=C2=A0 =C2=A0 default_js_norm_prop_ignore default_js_norm]]snort_whitelist_=
append(default_whitelist)ips =3D {=C2=A0 =C2=A0 rules =3D [[include /usr/lo=
cal/etc/snort/rules/includes.rules=C2=A0 =C2=A0 ]],=C2=A0 =C2=A0 variables =
=3D {=C2=A0 =C2=A0 =C2=A0 =C2=A0 nets =3D {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 HOME_NET =3D HOME_NET,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
EXTERNAL_NET =3D '!$HOME_NET',=C2=A0 =C2=A0 =C2=A0 =C2=A0 },=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 ports =3D {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HTTP_POR=
TS =3D HTTP_PORTS,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SIP_PORTS =3D S=
IP_PORTS,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 FILE_DATA_PORTS =3D FILE=
_DATA_PORTS,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 FTP_PORTS =3D FTP_POR=
TS,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ORACLE_PORTS =3D ORACLE_PORTS,=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SSH_PORTS =3D SSH_PORTS,=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 }=C2=A0 =C2=A0 }}servers =3D {=C2=A0 =C2=A0 HTTP_SERVE=
RS =3D 'HOME_NET',=C2=A0 =C2=A0 SQL_SERVERS =3D 'HOME_NET',=C2=A0 =C2=A0 SM=
TP_SERVERS =3D 'HOME_NET',=C2=A0 =C2=A0 SIP_SERVERS =3D 'HOME_NET',}alert_s=
yslog =3D { }=20
=20
=20
=20
=20
=20
=20
------=_Part_366201_1411632859.1737334137763
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>=
<meta content=3D"text/html;charset=3DUTF-8" http-equiv=3D"Content-Type"></h=
ead><body ><div style=3D'font-size:10pt;font-family:Verdana,Arial,Helvetica=
,sans-serif;color:#000000;'><div ><div><br></div> <div >Hello everyone, I a=
m using Snort 3 version 3.6.0.0, and this is the bottom portion of my Lua c=
onfig. I have HOME_NET set to my IP address, and that portion passes, but t=
hen I get these error messages:</div><div ><br></div><div >ERROR: snort3-sq=
l.rules:106 undefined variable in the string: $HTTP_SERVERS.</div><div >ERR=
OR: snort3-sql.rules:32 Undefined variable in the string: $SQL_SERVERS.</di=
v><div >ERROR: snort3-server-webapp.rules:4457 undefined variable in the st=
ring: $SMTP_SERVERS.</div><div >ERROR: snort3-protocol-voip.rules:89 undefi=
ned variable in the string: $SIP_SERVERS.</div><div ><br></div><div >I init=
ially had the servers portion nested and then made it top-level, but the er=
rors still persist. Any help would be greatly appreciated. Thank you!</div>=
<div ><br></div><div >Here=E2=80=99s the relevant part of my configuration:=
</div><div ><br></div><div >-----------------------------------------------=
----------------------------</div><div >-- default whitelist</div><div >---=
------------------------------------------------------------------------</d=
iv><div >default_whitelist =3D</div><div >[[</div><div > ftp_c=
ommand_specs default_ftp_server smtp_default_alt_max_command_lines</div><di=
v > default_smtp http_methods sip_requests telnet_commands def=
ault_wizard</div><div > default_references default_classificat=
ions gtp_v0_msg gtp_v1_msg gtp_v2_msg</div><div > gtp_v0_info =
gtp_v1_info gtp_v2_info default_gtp tcp_low_ports</div><div > =
tcp_low_decoy tcp_low_sweep tcp_low_dist tcp_med_ports</div><div > &n=
bsp; tcp_med_decoy tcp_med_sweep tcp_med_dist tcp_hi_ports tcp_hi_decoy</di=
v><div > tcp_hi_sweep tcp_hi_dist udp_low_ports udp_low_decoy =
udp_low_sweep</div><div > udp_low_dist udp_med_ports udp_med_d=
ecoy udp_med_sweep udp_med_dist</div><div > udp_hi_ports udp_h=
i_decoy udp_hi_sweep udp_hi_dist ip_low_proto</div><div > ip_l=
ow_decoy ip_low_sweep ip_low_dist ip_med_proto ip_med_decoy</div><div >&nbs=
p; ip_med_sweep ip_med_dist ip_hi_proto ip_hi_decoy ip_hi_sweep</div=
><div > ip_hi_dist icmp_low_sweep icmp_med_sweep icmp_hi_sweep=
</div><div > default_hi_port_scan default_med_port_scan defaul=
t_low_port_scan</div><div > default_variables netflow_versions=
default_js_norm_ident_ignore</div><div > default_js_norm_prop=
_ignore default_js_norm</div><div >]]</div><div ><br></div><div >snort_whit=
elist_append(default_whitelist)</div><div ><br></div><div >ips =3D {</div><=
div > rules =3D [[</div><div >include /usr/local/etc/snort/rul=
es/includes.rules</div><div > ]],</div><div ><br></div><div >&=
nbsp; variables =3D {</div><div > nets =
=3D {</div><div > HOME_NET =3D HOM=
E_NET,</div><div > EXTERNAL_NET =
=3D '!$HOME_NET',</div><div > },</div><div >&nbs=
p; ports =3D {</div><div > =
HTTP_PORTS =3D HTTP_PORTS,</div><div > &n=
bsp; SIP_PORTS =3D SIP_PORTS,</div><div > =
FILE_DATA_PORTS =3D FILE_DATA_PORTS,</div><div > =
; FTP_PORTS =3D FTP_PORTS,</div><div >&n=
bsp; ORACLE_PORTS =3D ORACLE_PORTS,</div=
><div > SSH_PORTS =3D SSH_PORTS,</=
div><div > }</div><div > }</div><di=
v >}</div><div ><br></div><div >servers =3D {</div><div > HTTP=
_SERVERS =3D 'HOME_NET',</div><div > SQL_SERVERS =3D 'HOME_NET=
',</div><div > SMTP_SERVERS =3D 'HOME_NET',</div><div > =
SIP_SERVERS =3D 'HOME_NET',</div><div >}</div><div ><br></div><div >=
alert_syslog =3D { }</div> </div> </div><br></=
body></html>
------=_Part_366201_1411632859.1737334137763--
--===============6396213975812787917==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
--===============6396213975812787917==--