Re: Servers section of lua configuration problem
Yehor Velykozhon via Snort-users <[email protected]> Mon, 3 Feb 2025 11:08:13 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <AS2PR05MB101044CC99E4EB816F384A091BCF52@AS2PR05MB10104.eurprd05.prod.outlook.com> |
--===============1294415868218066596==
Content-Language: en-GB
Content-Type: multipart/alternative;
boundary="_000_AS2PR05MB101044CC99E4EB816F384A091BCF52AS2PR05MB10104eu_"
--_000_AS2PR05MB101044CC99E4EB816F384A091BCF52AS2PR05MB10104eu_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Hello,
To make sure that variable is visible in scope of IPS rule, you need to def=
ine it as a part of ips.variables.nets table.
So, based on your output, the easiest way - manually move those definitions=
from table =93servers=94 to =93nets=94 section, so it will look like follo=
wing. There is another example (of how you can define those =93servers=94 v=
ariables) located in snort_defaults.lua =96 check how =93default_variables=
=94 is defined.
ips =3D {
variables =3D {
nets =3D {
HOME_NET =3D HOME_NET,
EXTERNAL_NET =3D '!$HOME_NET',
HTTP_SERVERS =3D HOME_NET,
SQL_SERVERS =3D HOME_NET,
SMTP_SERVERS =3D HOME_NET,
SIP_SERVERS =3D HOME_NET,
},
ports =3D {
HTTP_PORTS =3D HTTP_PORTS,
SIP_PORTS =3D SIP_PORTS,
FILE_DATA_PORTS =3D FILE_DATA_PORTS,
FTP_PORTS =3D FTP_PORTS,
ORACLE_PORTS =3D ORACLE_PORTS,
SSH_PORTS =3D SSH_PORTS,
}
}
}
Side note: you can play around with Lua code to implement a function that w=
ill insert table into another table, so you can use table =93servers=94 fur=
ther.
Thanks, Yehor.
From: Snort-users <[email protected]> on behalf of Jacko =
B via Snort-users <[email protected]>
Date: Tuesday, 21 January 2025 at 17:09
To: Snort users <[email protected]>
Subject: [Snort-users] Servers section of lua configuration problem
CAUTION: This email originated from outside the organization. Do not click =
links or open attachments unless you recognize the sender and know the cont=
ent is safe.
Hello everyone, I am using Snort 3 version 3.6.0.0, and this is the bottom =
portion of my Lua config. I have HOME_NET set to my IP address, and that po=
rtion passes, but then I get these error messages:
ERROR: snort3-sql.rules:106 undefined variable in the string: $HTTP_SERVERS=
.
ERROR: snort3-sql.rules:32 Undefined variable in the string: $SQL_SERVERS.
ERROR: snort3-server-webapp.rules:4457 undefined variable in the string: $S=
MTP_SERVERS.
ERROR: snort3-protocol-voip.rules:89 undefined variable in the string: $SIP=
_SERVERS.
I initially had the servers portion nested and then made it top-level, but =
the errors still persist. Any help would be greatly appreciated. Thank you!
Here=92s the relevant part of my configuration:
---------------------------------------------------------------------------
-- default whitelist
---------------------------------------------------------------------------
default_whitelist =3D
[[
ftp_command_specs default_ftp_server smtp_default_alt_max_command_lines
default_smtp http_methods sip_requests telnet_commands default_wizard
default_references default_classifications gtp_v0_msg gtp_v1_msg gtp_v2=
_msg
gtp_v0_info gtp_v1_info gtp_v2_info default_gtp tcp_low_ports
tcp_low_decoy tcp_low_sweep tcp_low_dist tcp_med_ports
tcp_med_decoy tcp_med_sweep tcp_med_dist tcp_hi_ports tcp_hi_decoy
tcp_hi_sweep tcp_hi_dist udp_low_ports udp_low_decoy udp_low_sweep
udp_low_dist udp_med_ports udp_med_decoy udp_med_sweep udp_med_dist
udp_hi_ports udp_hi_decoy udp_hi_sweep udp_hi_dist ip_low_proto
ip_low_decoy ip_low_sweep ip_low_dist ip_med_proto ip_med_decoy
ip_med_sweep ip_med_dist ip_hi_proto ip_hi_decoy ip_hi_sweep
ip_hi_dist icmp_low_sweep icmp_med_sweep icmp_hi_sweep
default_hi_port_scan default_med_port_scan default_low_port_scan
default_variables netflow_versions default_js_norm_ident_ignore
default_js_norm_prop_ignore default_js_norm
]]
snort_whitelist_append(default_whitelist)
ips =3D {
rules =3D [[
include /usr/local/etc/snort/rules/includes.rules
]],
variables =3D {
nets =3D {
HOME_NET =3D HOME_NET,
EXTERNAL_NET =3D '!$HOME_NET',
},
ports =3D {
HTTP_PORTS =3D HTTP_PORTS,
SIP_PORTS =3D SIP_PORTS,
FILE_DATA_PORTS =3D FILE_DATA_PORTS,
FTP_PORTS =3D FTP_PORTS,
ORACLE_PORTS =3D ORACLE_PORTS,
SSH_PORTS =3D SSH_PORTS,
}
}
}
servers =3D {
HTTP_SERVERS =3D 'HOME_NET',
SQL_SERVERS =3D 'HOME_NET',
SMTP_SERVERS =3D 'HOME_NET',
SIP_SERVERS =3D 'HOME_NET',
}
alert_syslog =3D { }
--_000_AS2PR05MB101044CC99E4EB816F384A091BCF52AS2PR05MB10104eu_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of=
fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0cm;
font-size:9.0pt;
font-family:Menlo;
color:black;}
p.p2, li.p2, div.p2
{mso-style-name:p2;
margin:0cm;
font-size:9.0pt;
font-family:Menlo;
color:black;}
span.s1
{mso-style-name:s1;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang=3D"en-UA" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-=
family:"Calibri",sans-serif;mso-fareast-language:EN-US">Hello,<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-=
family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-=
family:"Calibri",sans-serif;mso-fareast-language:EN-US">To make s=
ure that variable is visible in scope of IPS rule, you need to define it as=
a part of ips.variables.nets table.<o:p></o:p></span></p>
<p class=3D"p1"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-family:=
"Calibri",sans-serif;mso-fareast-language:EN-US">So, based on you=
r output, the easiest way - manually move those definitions from table =93s=
ervers=94 to =93nets=94 section, so it will look like following.
There is another example (of how you can define those =93servers=94 variab=
les) located in snort_defaults.lua =96 check how =93default_variables=94 is=
defined.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-=
family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs=
p;</o:p></span></p>
<p class=3D"p1"><span class=3D"s1">ips =3D {</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> </span>=
<span class=3D"s1">variables =3D {</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">nets =3D {</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">HOME_NET =3D HOME_NET,</span=
><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">EXTERNAL_NET =3D '!$HOME_NET=
',</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">HTTP_SERVERS =3D HOME_NET,</=
span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">SQL_SERVERS =3D HOME_NET,</s=
pan><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">SMTP_SERVERS =3D HOME_NET,</=
span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">SIP_SERVERS =3D HOME_NET,</s=
pan><o:p></o:p></p>
<p class=3D"p2"><o:p> </o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">},</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">ports =3D {</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">HTTP_PORTS =3D HTTP_PORTS,</=
span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">SIP_PORTS =3D SIP_PORTS,</sp=
an><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">FILE_DATA_PORTS =3D FILE_DAT=
A_PORTS,</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">FTP_PORTS =3D FTP_PORTS,</sp=
an><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">ORACLE_PORTS =3D ORACLE_PORT=
S,</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">SSH_PORTS =3D SSH_PORTS,</sp=
an><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> =
</span><span class=3D"s1">}</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"apple-converted-space"> </span>=
<span class=3D"s1">}</span><o:p></o:p></p>
<p class=3D"p1"><span class=3D"s1">}</span><span class=3D"s1"><span lang=3D=
"EN-US"><o:p></o:p></span></span></p>
<p class=3D"p1"><span class=3D"s1"><span lang=3D"EN-US"><o:p> </o:p></=
span></span></p>
<p class=3D"p1"><span class=3D"s1"><span lang=3D"EN-US"><o:p> </o:p></=
span></span></p>
<p class=3D"p1"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-family:=
"Calibri",sans-serif;mso-fareast-language:EN-US">Side note: you c=
an play around with Lua code to implement a function that will insert table=
into another table, so you can use table =93servers=94
further.<o:p></o:p></span></p>
<p class=3D"p1"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-family:=
"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p=
></span></p>
<p class=3D"p1"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-family:=
"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p=
></span></p>
<p class=3D"p1"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-family:=
"Calibri",sans-serif;mso-fareast-language:EN-US">Thanks, Yehor.<o=
:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca=
libri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span>=
</p>
<div id=3D"mail-editor-reference-message-container">
<div>
<div>
<div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b><span style=3D"col=
or:black">From:
</span></b><span style=3D"color:black">Snort-users <snort-users-bounces@=
lists.snort.org> on behalf of Jacko B via Snort-users <snort-users@li=
sts.snort.org><br>
<b>Date: </b>Tuesday, 21 January 2025 at 17:09<br>
<b>To: </b>Snort users <[email protected]><br>
<b>Subject: </b>[Snort-users] Servers section of lua configuration problem<=
o:p></o:p></span></p>
</div>
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" align=3D"left">
<tbody>
<tr>
<td style=3D"background:#BBA555;padding:5.25pt 5.5pt 5.25pt 1.5pt"></td>
<td width=3D"100%" style=3D"width:100.0%;background:#FFE599;padding:5.25pt =
3.75pt 5.25pt 11.25pt">
<div>
<p style=3D"mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-w=
rap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizon=
tal:column;mso-height-rule:exactly">
<b><span style=3D"font-size:11.0pt;font-family:"Arial",sans-serif=
;color:#212121">CAUTION:</span></b><span style=3D"font-size:11.0pt;font-fam=
ily:"Arial",sans-serif;color:#212121"> This email originated from=
outside the organization. Do not click links or open attachments
unless you recognize the sender and know the content is safe. </span><o:p>=
</o:p></p>
</div>
</td>
</tr>
</tbody>
</table>
<div>
<div>
<div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">Hello everyone, I am using Snort 3 vers=
ion 3.6.0.0, and this is the bottom portion of my Lua config. I have HOME_N=
ET set to my IP address, and that portion passes,
but then I get these error messages:<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">ERROR: snort3-sql.rules:106 undefined v=
ariable in the string: $HTTP_SERVERS.<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">ERROR: snort3-sql.rules:32 Undefined va=
riable in the string: $SQL_SERVERS.<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">ERROR: snort3-server-webapp.rules:4457 =
undefined variable in the string: $SMTP_SERVERS.<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">ERROR: snort3-protocol-voip.rules:89 un=
defined variable in the string: $SIP_SERVERS.<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">I initially had the servers portion nes=
ted and then made it top-level, but the errors still persist. Any help woul=
d be greatly appreciated. Thank you!<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">Here=92s the relevant part of my config=
uration:<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">---------------------------------------=
------------------------------------<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">-- default whitelist<o:p></o:p></span><=
/p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">---------------------------------------=
------------------------------------<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">default_whitelist =3D<o:p></o:p></span>=
</p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">[[<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> ftp_command_specs default=
_ftp_server smtp_default_alt_max_command_lines<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> default_smtp http_methods=
sip_requests telnet_commands default_wizard<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> default_references defaul=
t_classifications gtp_v0_msg gtp_v1_msg gtp_v2_msg<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> gtp_v0_info gtp_v1_info g=
tp_v2_info default_gtp tcp_low_ports<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> tcp_low_decoy tcp_low_swe=
ep tcp_low_dist tcp_med_ports<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> tcp_med_decoy tcp_med_swe=
ep tcp_med_dist tcp_hi_ports tcp_hi_decoy<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> tcp_hi_sweep tcp_hi_dist =
udp_low_ports udp_low_decoy udp_low_sweep<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> udp_low_dist udp_med_port=
s udp_med_decoy udp_med_sweep udp_med_dist<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> udp_hi_ports udp_hi_decoy=
udp_hi_sweep udp_hi_dist ip_low_proto<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> ip_low_decoy ip_low_sweep=
ip_low_dist ip_med_proto ip_med_decoy<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> ip_med_sweep ip_med_dist =
ip_hi_proto ip_hi_decoy ip_hi_sweep<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> ip_hi_dist icmp_low_sweep=
icmp_med_sweep icmp_hi_sweep<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> default_hi_port_scan defa=
ult_med_port_scan default_low_port_scan<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> default_variables netflow=
_versions default_js_norm_ident_ignore<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> default_js_norm_prop_igno=
re default_js_norm<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">]]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">snort_whitelist_append(default_whitelis=
t)<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">ips =3D {<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> rules =3D [[<o:p></o:p></=
span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">include /usr/local/etc/snort/rules/incl=
udes.rules<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> ]],<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> variables =3D {<o:p></o:p=
></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> nets =3D {<=
o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; HOME_NET =3D HOME_NET,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; EXTERNAL_NET =3D '!$HOME_NET',<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> },<o:p></o:=
p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> ports =3D {=
<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; HTTP_PORTS =3D HTTP_PORTS,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; SIP_PORTS =3D SIP_PORTS,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; FILE_DATA_PORTS =3D FILE_DATA_PORTS,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; FTP_PORTS =3D FTP_PORTS,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; ORACLE_PORTS =3D ORACLE_PORTS,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> &nbs=
p; SSH_PORTS =3D SSH_PORTS,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> }<o:p></o:p=
></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> }<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">}<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">servers =3D {<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> HTTP_SERVERS =3D 'HOME_NE=
T',<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> SQL_SERVERS =3D 'HOME_NET=
',<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> SMTP_SERVERS =3D 'HOME_NE=
T',<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"> SIP_SERVERS =3D 'HOME_NET=
',<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">}<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">alert_syslog =3D { }<o:p></o:p></span><=
/p>
</div>
</div>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
--_000_AS2PR05MB101044CC99E4EB816F384A091BCF52AS2PR05MB10104eu_--
--===============1294415868218066596==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
--===============1294415868218066596==--