snort3 / snort3 Goto Github PK

Snort++

License: Other

CMake 0.98% C++ 95.16% Shell 0.29% Lua 0.51% C 2.23% Lex 0.82%

snort3's Introduction

Snort++

Snort 3 is the next generation Snort IPS (Intrusion Prevention System). This file will show you what Snort++ has to offer and guide you through the steps from download to demo. If you are unfamiliar with Snort you should take a look at the Snort documentation first. We will cover the following topics:

Overview
Dependencies
Download
Build Snort
Run Snort
Documentation
Squeal

OVERVIEW

This version of Snort++ includes new features as well as all Snort 2.X features and bug fixes for the base version of Snort except as indicated below:

Project = Snort++
Binary = snort
Version = 3.0.0 (Build 250) from 2.9.11

Here are some key features of Snort++:

Support multiple packet processing threads
Use a shared configuration and attribute table
Use a simple, scriptable configuration
Make key components pluggable
Autodetect services for portless configuration
Support sticky buffers in rules
Autogenerate reference documentation
Provide better cross platform support
Facilitate component testing
Use a shared network map

Additional features on the roadmap include:

Support pipelining of packet processing
Support hardware offload and data plane integration
Support proxy mode
Windows support

DEPENDENCIES

If you already build Snort, you may have everything you need. If not, grab the latest:

cmake to build from source
daq from https://github.com/snort3/libdaq for packet IO
dnet from https://github.com/dugsong/libdnet.git for network utility functions
flex >= 2.6.0 from https://github.com/westes/flex for JavaScript syntax parser
g++ >= 5 or other C++14 compiler
hwloc from https://www.open-mpi.org/projects/hwloc/ for CPU affinity management
LuaJIT from http://luajit.org for configuration and scripting
OpenSSL from https://www.openssl.org/source/ for SHA and MD5 file signatures, the protected_content rule option, and SSL service detection
pcap from http://www.tcpdump.org for tcpdump style logging
pcre from http://www.pcre.org for regular expression pattern matching
pkgconfig from https://www.freedesktop.org/wiki/Software/pkg-config/ to locate build dependencies
zlib from http://www.zlib.net for decompression

Additional packages provide optional features. Check the manual for more.

DOWNLOAD

There is a source tarball available in the Downloads section on snort.org:

snort-3.0.0-a3.tar.gz

You can also get the code with:

git clone https://github.com/snort3/snort3.git

There are separate extras packages for cmake that provide additional features and demonstrate how to build plugins. The source for extras is in snort3_extra.git repo.

BUILD SNORT

Follow these steps:

Set up source directory:

If you are using a github clone:
```
cd snort3/
```
Otherwise, do this:
```
tar zxf snort-tarball
cd snort-3.0.0*
```

Setup install path:
```
export my_path=/path/to/snorty
```
Compile and install:

To build with cmake and make, run configure_cmake.sh. It will automatically create and populate a new subdirectory named 'build'.
```
./configure_cmake.sh --prefix=$my_path
cd build
make -j $(nproc) install
```

Note:

If you can do src/snort -V you built successfully.
If you are familiar with cmake, you can run cmake/ccmake instead of configure_cmake.sh.
cmake --help will list any available generators, such as Xcode. Feel free to use one, however help with those will be provided separately.

RUN SNORT

Here are some examples. If you are using Talos rules and/or configs, you should first set any needed variables at the top of snort.lua and snort_defaults.lua.

Snort++ provides lots of help from the command line, including:

$my_path/bin/snort --help
$my_path/bin/snort --help-module suppress
$my_path/bin/snort --help-config | grep thread

Examine and dump a pcap. In the following, replace a.pcap with your favorite:
```
$my_path/bin/snort -r a.pcap
$my_path/bin/snort -L dump -d -e -q -r a.pcap
```

Verify a config, with or w/o rules:

$my_path/bin/snort -c $my_path/etc/snort/snort.lua
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules

Run IDS mode. In the following, replace pcaps/ with a path to a directory with one or more *.pcap files:

$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
    -r a.pcap -A alert_test -n 100000

Let's suppress 1:2123. We could edit the conf or just do this:

$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
    -r a.pcap -A alert_test -n 100000 --lua "suppress = { { gid = 1, sid = 2123 } }"

Go whole hog on a directory with multiple packet threads:

$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
    --pcap-filter \*.pcap --pcap-dir pcaps/ -A alert_fast --max-packet-threads 8

Additional examples are given in doc/usage.txt.

DOCUMENTATION

Take a look at the manual, parts of which are generated by the code so it stays up to date:

$my_path/share/doc/snort/snort_manual.pdf
$my_path/share/doc/snort/snort_manual.html
$my_path/share/doc/snort/snort_manual/index.html

It does not yet have much on the how and why, but it does have all the currently available configuration, etc. Some key changes to rules:

you must use comma separated content sub options like this: content:"foo", nocase;
buffer selectors must appear before the content and remain in effect until changed
pcre buffer selectors were deleted
check the manual for more on Snort++ vs Snort
check the manual reference section to understand how parameters are defined, etc.

It also covers new features not demonstrated here:

snort2lua, a tool to convert Snort 2.X conf and rules to the new form
a new HTTP inspector
a binder, for mapping configuration to traffic
a wizard for port-independent configuration
improved rule parsing - arbitrary whitespace, C style comments, #begin/#end comments
local and remote command line shell

SQUEAL

o")~

We hope you are as excited about Snort++ as we are. Let us know what you think on the snort-users list. In the meantime, we'll keep our snout to the grindstone.

snort3's People

Contributors

Stargazers

Watchers

Forkers

vanquishsecurity techjournalist-zz voidexception securityigi 3cto leeclemens thurday baiyunping333 richardcao 8ackl0 chinaunixer connlan cumirror jncornett jqk6 odin1314 renzhexigua jlegendary shiham101 drptbl erskineroberts wkitty42 zhaoxx063 yangguang001 gavares dwdm yogeshjangir s4mick fnzv gregtampa tarzand daodaoliang xubingyue pirater delkyd shinsec iwillcodeu orio33 bogdan-pr sheltowt cspl-team btyouth qzm1218 hanlimo zengfan jango2015 subharthi ubuntuevangelist bailehang sfears tzubal 00312049 rh1nox seem-sky sverneka fatinishrak neonecosystem lengxu soediro zane-a-karl chris1201 yangwang92 freedai abukauser f2006116 hawtswys fanwj2010 rbaindourov webtradenow cl007 jakop345 prestonw zerolugithub 317369225 jviiret vanshikamadan kunschikov stmmcu seth1002 xuansen cbhimavarapu-datalicious brucelinco lorock b1nch3f schrc3b6 ydeng19 lxq2537664558 julieeen owenjsr williams-lu l7dpi micheal-o sanduo1314 rbshadow liumorgan jonlylinux sabicalija guangbinw ta-ical kiet-cheung

snort3's Issues

module 'snort_config' not found:

Hello,
in /usr/local/snort/etc/snort/snort.lua is

export LUA_PATH=/usr/local/snort/include/snort/lua/?.lua\;\;
export SNORT_LUA_PATH=/usr/local/snort/etc/snort/

I am using csh shell on FreeBSD
would be helpful put in the configuration file samples for a few kind of shells
so I have put the environment variable via:

#setenv LUA_PATH "/usr/local/snort/include/snort/lua/?.lua\;\;"
#setenv SNORT_LUA_PATH /usr/local/snort/etc/snort
#env |grep LUA
SNORT_LUA_PATH=/usr/local/snort/etc/snort
LUA_PATH=/usr/local/snort/include/snort/lua/?.lua\;\;

but still Snort have some problem:

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -i bridge0
o")~   Snort++ 3.0.0-248
--------------------------------------------------
Loading /usr/local/snort/etc/snort/snort.lua:
FATAL: can't init /usr/local/snort/etc/snort/snort.lua: /usr/local/snort/etc/snort/snort.lua:39: module 'snort_config' not found:
        no field package.preload['snort_config']
        no file '/usr/local/snort/include/snort/lua/snort_config.lua\'
        no file '\'
        no file './snort_config.so'
        no file '/usr/local/lib/lua/5.1/snort_config.so'
        no file '/usr/local/lib/lua/5.1/loadall.so'
Fatal Error, Quitting..

lua plugin not found during make install

Doing make install on snort-3.0.0-a4-191-auto.tar.gz results in error that lua_plugin_defs.h can't be found.

Ubuntu 14.04.4

Output during failure of make install

Making install in lua
make[2]: Entering directory `/home/user/snort_src/snort-3.0.0-a4/src/lua'
make[3]: Entering directory `/home/user/snort_src/snort-3.0.0-a4/src/lua'
make[3]: Nothing to be done for `install-exec-am'.
 /bin/mkdir -p '/opt/snort/include/snort/lua'
 /usr/bin/install -c -m 644 lua.h lua_ref.h lua_iface.h lua_table.h lua_arg.h lua_stack.h lua_util.h '/opt/snort/include/snort/lua'
make[3]: Leaving directory `/home/user/snort_src/snort-3.0.0-a4/src/lua'
make[2]: Leaving directory `/home/user/snort_src/snort-3.0.0-a4/src/lua'
Making install in ips_options
make[2]: Entering directory `/home/user/snort_src/snort-3.0.0-a4/src/ips_options'
make[3]: Entering directory `/home/user/snort_src/snort-3.0.0-a4/src/ips_options'
  CXX      ips_luajit.o
ips_luajit.cc:28:38: fatal error: managers/lua_plugin_defs.h: No such file or directory
 #include "managers/lua_plugin_defs.h"
                                      ^
compilation terminated.
make[3]: *** [ips_luajit.o] Error 1
make[3]: Leaving directory `/home/user/snort_src/snort-3.0.0-a4/src/ips_options'
make[2]: *** [install-recursive] Error 1
make[2]: Leaving directory `/home/user/snort_src/snort-3.0.0-a4/src/ips_options'
make[1]: *** [install-recursive] Error 1
make[1]: Leaving directory `/home/user/snort_src/snort-3.0.0-a4/src'
make: *** [install-recursive] Error 1

Where to report bugs

Hi,

I have been testing snort3 and have managed to find program crashes in read pcap mode. Where do I report them?

Thanks!
Bhargava

daq statistics is not reported by perf_monitor

I am testing 3.0.0-a4 (Build 239), found daq statistics was not reported by perf_monitor.How can I solve this problem?
perf_monitor seems working well because stream_ip statistics was reported.
daq statistics was reported by snort after killing the snort process.

Snort Version
,,_ -> Snort++ <-
o" )~ Version 3.0.0-a4 (Build 239) from 2.9.8-383
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2017 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 2.2.2
Using libpcap version 1.5.3
Using LuaJIT version 2.0.4
Using PCRE version 8.32 2012-11-30
Using ZLIB version 1.2.7
Using LZMA version 5.1.2alpha
Using OpenSSL 1.0.1e-fips 17 Nov 2016
perf_monitor config
perf_monitor = { cpu = true, flow = true, flow_ip = true, modules = { {name = 'daq', pegs = [[ pcaps received dropped ]]}, {name = 'stream_ip', pegs = [[ sessions drops discards ]]}, {name = 'stream_tcp', pegs = [[ sessions discards ]]} } }
perf_monitor output
#timestamp,daq.pcaps,daq.received,daq.dropped,stream_ip.sessions,stream_ip.drops,stream_ip.discards,stream_tcp.sessions,stream_tcp.discards
1516705766,0,0,0,1653,0,0,112388,52882
1516705826,0,0,0,1621,0,0,105354,45910

pid file not readable.

Hello...
I compiled Snort3 on FreeBsd 11.2. Rc initi script has been not created so I try to adapt init script from Snort2 with necessary changes of course.

#!/bin/sh
        # $FreeBSD$

        # PROVIDE: snort
        # REQUIRE: DAEMON
        # BEFORE: LOGIN
        # KEYWORD: shutdown

        . /etc/rc.subr

        name="snort"
        rcvar=snort_enable
        extra_commands=reload

        command="/usr/local/snort/bin/snort"

        load_rc_config $name

        [ -z "$snort_enable" ]    && snort_enable="NO"
        [ -z "$snort_conf" ]      && snort_conf="/usr/local/snort/etc/snort/snort.lua"
        [ -z "$snort_flags" ]     && snort_flags="-D -q"

        [ -n "$snort_interface" ] && snort_flags="$snort_flags -i $snort_interface" \
                                  && pidfile="/var/run/snort_${snort_interface}.pid"
        [ -n "$snort_conf" ]      && snort_flags="$snort_flags -c $snort_conf"
        [ -n "$snort_expression" ] && snort_flags="$snort_flags $snort_expression"

        if [ -n "$snort_rules" ]; then
          _1=$1
          if [ $# -gt 1 ]; then shift; snort_rules=$*; fi
          snort_conf=""
          snort_flags=""
          rc=0
          for i in ${snort_rules}; do
                eval _conf=\$snort_${i}_conf
                eval _flags=\$snort_${i}_flags
                [ -z "$_flags" ] && _flags="-D -q"
                eval _intf=\$snort_${i}_interface
                eval _expr=\$snort_${i}_expression
                if [ -n "$_intf" ] ;then
                    _conf="$_conf -i $_intf"
                   eval pidfile="/var/run/snort_$_intf.pid"
                fi
                command_args="$_flags -c $_conf $_expr"
                run_rc_command "$_1"
                if [ $? -ne 0 ]; then rc=1; fi
                unset _pidcmd _rc_restart_done
           done
           exit $rc
        else
           run_rc_command "$1"
        fi

then I try launch the snort via the rc script:

# /usr/local/etc/rc.d/snort start
/usr/local/etc/rc.d/snort: DEBUG: pid file (/var/run/snort_bridge0.pid): not readable.
/usr/local/etc/rc.d/snort: DEBUG: checkyesno: snort_enable is set to YES.
Starting snort.
/usr/local/etc/rc.d/snort: DEBUG: run_rc_command: doit:  limits -C daemon /usr/local/snort/bin/snort -D -q -i bridge0 -c /usr/local/snort/etc/snort/snort.lua

Snort runs, but doesn't create pid file

# ps -aux | grep snort
root       1475  2.0  5.5 451120 105580  -  Rs   17:42    13:31.28 /usr/local/snort/bin/snort -D -q -i bridge0 -c /usr/local/snort/etc/snort/snort.lua  
root       3407  0.0  0.0    408    324  1  R+   08:44     0:00.00 grep snort  

# /usr/local/etc/rc.d/snort status
/usr/local/etc/rc.d/snort: DEBUG: pid file (/var/run/snort_bridge0.pid): not readable.
/usr/local/etc/rc.d/snort: DEBUG: checkyesno: snort_enable is set to YES.
snort is not running.

Miss I something in the init script?
Thank You

Segmentation fault on dce_rpc inspector

Snort 3 Beta faults with below. Snort does not fault when dce_rpc inspector/binder is disabled.

[New Thread 0x7ffff2802700 (LWP 14180)]
-- [3] ./pcaps/fuzz-2010-06-26-12232.pcap
++ [3] ./pcaps/fuzz-2010-06-27-1544.pcap
[Thread 0x7ffff2001700 (LWP 14178) exited]
[New Thread 0x7ffff2001700 (LWP 14181)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff3003700 (LWP 14176)]
0x000000000075e8a8 in DCE2_CoSetRopts (sd=0x38760b78, cot=0x38760bd8, co_hdr=0x3db1a010, p=0x7fffede20c40) at /root/sources/snort3/src/service_inspectors/dce_rpc/dce_co.cc:298
298	    endianness->hdr_byte_order = DceRpcCoByteOrder(co_hdr);
#0  0x000000000075e8a8 in DCE2_CoSetRopts (sd=0x38760b78, cot=0x38760bd8, co_hdr=0x3db1a010, p=0x7fffede20c40) at /root/sources/snort3/src/service_inspectors/dce_rpc/dce_co.cc:298
#1  0x0000000000760720 in DCE2_CoRequest (sd=0x38760b78, cot=0x38760bd8, co_hdr=0x3db1a010, frag_ptr=0x3db1a028 "\001", frag_len=132) at /root/sources/snort3/src/service_inspectors/dce_rpc/dce_co.cc:1529
#2  0x0000000000760e24 in DCE2_CoDecode (sd=0x38760b78, cot=0x38760bd8, frag_ptr=0x3db1a020 "\204", frag_len=140) at /root/sources/snort3/src/service_inspectors/dce_rpc/dce_co.cc:1816
#3  0x000000000076199e in DCE2_CoProcess (sd=0x38760b78, cot=0x38760bd8, data_ptr=0x3db1a0ac "\005", data_len=156) at /root/sources/snort3/src/service_inspectors/dce_rpc/dce_co.cc:2301
#4  0x0000000000775124 in Dce2Tcp::eval (this=0x5cf66d0, p=0x7fffede20b50) at /root/sources/snort3/src/service_inspectors/dce_rpc/dce_tcp.cc:170
#5  0x00000000005d9e4a in snort::InspectorManager::full_inspection (p=0x7fffede20b50) at /root/sources/snort3/src/managers/inspector_manager.cc:944
#6  0x00000000005da08a in snort::InspectorManager::execute (p=0x7fffede20b50) at /root/sources/snort3/src/managers/inspector_manager.cc:1006
#7  0x000000000052f497 in snort::DetectionEngine::inspect (p=0x7fffede20b50) at /root/sources/snort3/src/detection/detection_engine.cc:403
#8  0x00000000005c75b2 in snort::Snort::inspect (p=0x7fffede20b50) at /root/sources/snort3/src/main/snort.cc:868
#9  0x00000000006594cd in TcpReassembler::_flush_to_seq (this=0x135c458 <TcpReassemblerFactory::create(StreamPolicy)::bsd>, trs=..., bytes=312, p=0x7fffede20c40, pkt_flags=128) at /root/sources/snort3/src/stream/tcp/tcp_reassembler.cc:563
#10 0x00000000006597f4 in TcpReassembler::flush_to_seq (this=0x135c458 <TcpReassemblerFactory::create(StreamPolicy)::bsd>, trs=..., bytes=312, p=0x7fffede20c40, pkt_flags=128) at /root/sources/snort3/src/stream/tcp/tcp_reassembler.cc:623
#11 0x0000000000659d13 in TcpReassembler::flush_stream (this=0x135c458 <TcpReassemblerFactory::create(StreamPolicy)::bsd>, trs=..., p=0x7fffede20c40, dir=128, final_flush=true) at /root/sources/snort3/src/stream/tcp/tcp_reassembler.cc:742
#12 0x0000000000659d92 in TcpReassembler::final_flush (this=0x135c458 <TcpReassemblerFactory::create(StreamPolicy)::bsd>, trs=..., p=0x7fffede20c40, dir=128) at /root/sources/snort3/src/stream/tcp/tcp_reassembler.cc:754
#13 0x000000000065a08d in TcpReassembler::flush_queued_segments (this=0x135c458 <TcpReassemblerFactory::create(StreamPolicy)::bsd>, trs=..., flow=0x256c33b8, clear=true, p=0x7fffede20c40) at /root/sources/snort3/src/stream/tcp/tcp_reassembler.cc:808
#14 0x000000000065fc95 in TcpReassemblerPolicy::flush_queued_segments (this=0x7fffec7745d8, flow=0x256c33b8, clear=true, p=0x0) at /root/sources/snort3/src/stream/tcp/tcp_reassemblers.h:56
#15 0x000000000065cedc in TcpSession::clear_session (this=0x7fffec774310, free_flow_data=true, flush_segments=true, restart=false, p=0x0) at /root/sources/snort3/src/stream/tcp/tcp_session.cc:157
#16 0x000000000064f3fc in TcpStreamSession::cleanup (this=0x7fffec774310, p=0x0) at /root/sources/snort3/src/stream/libtcp/tcp_stream_session.cc:414
#17 0x000000000055ca07 in snort::Flow::reset (this=0x256c33b8, do_cleanup=true) at /root/sources/snort3/src/flow/flow.cc:138
#18 0x000000000055dd68 in FlowCache::release (this=0x38b37e90, flow=0x256c33b8, reason=IDLE, do_cleanup=true) at /root/sources/snort3/src/flow/flow_cache.cc:152
#19 0x000000000055e2ba in FlowCache::timeout (this=0x38b37e90, num_flows=1, thetime=1268520507) at /root/sources/snort3/src/flow/flow_cache.cc:318
#20 0x000000000055e9b7 in FlowControl::timeout_flows (this=0x7fffeed6d690, cur_time=1268520507) at /root/sources/snort3/src/flow/flow_control.cc:148
#21 0x0000000000643b1e in snort::Stream::timeout_flows (cur_time=1268520507) at /root/sources/snort3/src/stream/stream.cc:367
#22 0x00000000005c7b05 in snort::Snort::packet_callback (pkthdr=0x7ffff2fcc5e0, pkt=0x3dee3800 "\377\377\377\377\377\377") at /root/sources/snort3/src/main/snort.cc:1015
#23 0x000000000079f231 in pcap_process_loop (user=user@entry=0x7fffec1bb4a0 "", pkth=pkth@entry=0x7ffff2fcc690, data=0x3dee3800 "\377\377\377\377\377\377") at daq_pcap.c:376
#24 0x00007ffff759b0d1 in pcap_offline_read (p=0x3c6962c0, cnt=-1, callback=0x79f1a0 <pcap_process_loop>, user=0x7fffec1bb4a0 "") at ./savefile.c:506
#25 0x000000000079f35b in pcap_daq_acquire (handle=0x7fffec1bb4a0, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<optimized out>) at daq_pcap.c:394
#26 0x00000000005fdcd9 in snort::SFDAQInstance::acquire (this=0x969d2a0, max=0, callback=0x5c791c <snort::Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*)>) at /root/sources/snort3/src/packet_io/sfdaq.cc:570
#27 0x00000000005b157a in Analyzer::analyze (this=0x5e62370) at /root/sources/snort3/src/main/analyzer.cc:161
#28 0x00000000005b136e in Analyzer::operator() (this=0x5e62370, ps=0xcf02610, run_num=413) at /root/sources/snort3/src/main/analyzer.cc:99
#29 0x000000000052954e in std::__invoke<Analyzer<Swapper*, unsigned short> > (__f=...) at /usr/include/c++/4.8.2/functional:234
#30 0x00000000005294ed in std::reference_wrapper<Analyzer>::operator()<Swapper*, unsigned short>(Swapper*&&, unsigned short&&) const (this=0x35287670) at /usr/include/c++/4.8.2/functional:467
#31 0x0000000000529451 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (this=0x35287660) at /usr/include/c++/4.8.2/functional:1732
#32 0x0000000000529309 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)>::operator()() (this=0x35287660) at /usr/include/c++/4.8.2/functional:1720
#33 0x00000000005292a2 in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)> >::_M_run() (this=0x35287648) at /usr/include/c++/4.8.2/thread:115
#34 0x00007ffff528b070 in ?? () from /lib64/libstdc++.so.6
#35 0x00007ffff6b42e25 in start_thread () from /lib64/libpthread.so.0
#36 0x00007ffff49efbad in clone () from /lib64/libc.so.6

Unable to find libsfbpf.so.0 if libdaq is not in the default path

Configure parameters:

../configure_cmake.sh --with-hyperscan-libraries=/root/project/gerrit/hyperscan/ --with-hyperscan-includes=/root/project/gerrit/hyperscan/src --prefix=/root/project/snort_srcs/staging/ --with-daq-includes=/root/project/snort_srcs/staging/include --with-daq-libraries=/root/project/snort_srcs/staging/lib/

~ ls libsfbpf*
/root/project/snort_srcs/staging/lib/libsfbpf.a
/root/project/snort_srcs/staging/lib/libsfbpf.so.0
/root/project/snort_srcs/staging/lib/libsfbpf.so
/root/project/snort_srcs/staging/lib/libsfbpf.so.0.0.1
/root/project/snort_srcs/staging/lib/libsfbpf.la

[ 97%] Documents: building commands.txt with
cd /root/project/snort_srcs/snort3/objdir/build/doc && ../../../doc/scripts/generate_help.sh /root/project/snort_srcs/snort3/objdir/build/src/snort commands.txt
/root/project/snort_srcs/snort3/objdir/build/src/snort: error while loading shared libraries: libsfbpf.so.0: cannot open shared object file: No such file or directory
doc/CMakeFiles/all_built_sources.dir/build.make:80: recipe for target 'doc/commands.txt' failed
make[2]: *** [doc/commands.txt] Error 127
make[2]: *** Deleting file 'doc/commands.txt'
make[2]: Leaving directory '/root/project/snort_srcs/snort3/objdir/build'
CMakeFiles/Makefile2:6000: recipe for target 'doc/CMakeFiles/all_built_sources.dir/all' failed
make[1]: *** [doc/CMakeFiles/all_built_sources.dir/all] Error 2
make[1]: Leaving directory '/root/project/snort_srcs/snort3/objdir/build'
Makefile:151: recipe for target 'all' failed
make: *** [all] Error 2

Snort Crashes

Hi,

Snort crashed after 9 minutes later. Very frequent crashes occur in traffic of 1 gbit and above

snort inline ips with bridge and nfq

Hello..
i am trying to used snort inline(IPS) mode with bridge(br0) between eth0 and eth1 with nfq and iptables.

But is is not working as IPS mode . it is only working as IDS mode.

so can u help me to using bridge how i can run in IPS with nfq
already did below settings

changed snort config in HOME ADDRESS
change inline mode and NFQ
iptable installl and FORWARD On NFQ

Thanks

Snort rule match fails when setting detection cursor

I have two rules, the only difference between them being that I set the detection cursor to http_uri in rule b:

alert tcp any any -> any 8080 ( msg:"test rule a"; flow:to_server,established; content:"attack",fast_pattern,nocase; sid:10000001; rev:1; )
alert tcp any any -> any 8080 ( msg:"test rule b"; flow:to_server,established; http_uri; content:"attack",fast_pattern,nocase; sid:10000002; rev:1; )

I expect both rules to match a request like this:

curl http://192.168.1.134:8080/attack

However, I only get a single alert (alert_fast format):

04/12-05:56:46.760940 [**] [1:10000001:1] "test rule a" [**] [Priority: 0] {TCP} 192.168.1.192:37664 -> 192.168.1.134:8080

Is this a bug, is my rule syntax broken, or is there something else going on here?

I am using 3.0.0-252, but the same thing happens with 3.0.0-251. Both built like this:

-------------------------------------------------------
snort version 3.0.0

Install options:
    prefix:     /usr/local
    includes:   /usr/local/include/snort
    plugins:    /usr/local/lib64/snort

Compiler options:
    CC:             /usr/bin/cc
    CXX:            /usr/bin/c++
    CFLAGS:            -fvisibility=hidden   -DNDEBUG -g -ggdb   
    CXXFLAGS:          -fvisibility=hidden   -DNDEBUG -g -ggdb   
    EXE_LDFLAGS:        
    MODULE_LDFLAGS:     

Feature options:
    Flatbuffers:    ON
    Hyperscan:      ON
    ICONV:          ON
    LZMA:           ON
    RPC DB:         TIRPC
    SafeC:          ON
    TCMalloc:       OFF
    UUID:           ON
-------------------------------------------------------

~10kpps/200kb flow on a strong x86 UCS

--------------------------------------------------
module profile (all, depth 255, sorted by total_time)
#                      module layer    checks   time(us)  avg/check  %/caller  %/total
=                      ====== =====    ======   ========  =========  ========  =======
 1                       nbar     1  20038569 1547848619         77     77.67    77.67
 2                     detect     1  21513061  254274062         11     12.76    12.76
  1                      mpse     2  20553195  226242569         11     88.98    11.35
  2            rebuilt_packet     2   1480345   85018190         57     33.44     4.27
  3                 rule_eval     2    388994    1262055          3      0.50     0.06
   1           rule_tree_eval     3    388994    1225399          3     97.10     0.06
   2                 rtn_eval     3     12705       1854          0      0.15     0.00
 3                 stream_tcp     1  13772418  114960452          8      5.77     5.77
 4                     decode     1  21889147   30689750          1      1.54     1.54
 5                      appid     1  20064613   21948186          1      1.10     1.10
 6                     stream     1  20064613   15639294          0      0.78     0.78
 7                 stream_udp     1   6161209   12539375          2      0.63     0.63
 8                     wizard     1   6325084   11723558          1      0.59     0.59
 9               http_inspect     1   2234098   11257254          5      0.56     0.56
 10                 port_scan     1  20685033   11256212          0      0.56     0.56
 11                    eventq     1  25145567    4940710          0      0.25     0.25
 12                normalizer     1  20064545    4611448          0      0.23     0.23
 13              perf_monitor     1  22184860    4253430          0      0.21     0.21
 14                    binder     1    355148    1852117          5      0.09     0.09
 15              dce_smb_main     1    163030     967648          5      0.05     0.05
  1           dce_smb_session     2    162520      12376          0      1.28     0.00
   1      dce_smb_new_session     3      2040       2604          1     21.04     0.00
  2            dce_smb_detect     2    162520       7480          0      0.77     0.00
  3           dce_smb_request     2      8670       1697          0      0.18     0.00
  4         dce_smb_negotiate     2      1564        721          0      0.07     0.00
  5               dce_smb_fid     2      3706        327          0      0.03     0.00
  6               dce_smb_tid     2      1428        105          0      0.01     0.00
  7               dce_smb_uid     2       884         71          0      0.01     0.00
 16              dce_tcp_main     1     66224     600452          9      0.03     0.03
  1           dce_tcp_session     2     66156       6937          0      1.16     0.00
   1      dce_tcp_new_session     3      3170       2279          0     32.85     0.00
  2            dce_tcp_detect     2     66156       3508          0      0.58     0.00
  3        dce_tcp_co_context     2     64150       3453          0      0.58     0.00
 17                       sip     1     57293     573831         10      0.03     0.03
 18              back_orifice     1   5324197     379004          0      0.02     0.02
 19                   content     1    529632     310350          0      0.02     0.02
 20                       ssl     1    553109     251325          0      0.01     0.01
 21                       dns     1    146496     112625          0      0.01     0.01
 22                      pcre     1     59024      45529          0      0.00     0.00
 23                      flow     1    346714      30177          0      0.00     0.00
 24            http_stat_code     1     87050      14291          0      0.00     0.00
 25                 stream_ip     1      4726      12555          2      0.00     0.00
  1                      frag     2       136       2438         17     19.43     0.00
   1              frag_insert     3        68         87          1      3.58     0.00
 26                    telnet     1     83946       9263          0      0.00     0.00
 27                 arp_spoof     1     19482       8643          0      0.00     0.00
 28              http_raw_uri     1     22260       5711          0      0.00     0.00
 29                 bufferlen     1     22260       3972          0      0.00     0.00
 30                       pop     1       374       1681          4      0.00     0.00
 31                     dsize     1      9648       1474          0      0.00     0.00
 32                 file_data     1     16152       1460          0      0.00     0.00
 33                  http_uri     1      6403       1269          0      0.00     0.00
 34                  pkt_data     1      7097        699          0      0.00     0.00
 35               http_method     1      1112        369          0      0.00     0.00
 36                 byte_test     1      1020        362          0      0.00     0.00
 37                  flowbits     1      1360        283          0      0.00     0.00
 38                 byte_jump     1       578        155          0      0.00     0.00
 39              byte_extract     1       204         54          0      0.00     0.00
 40               http_header     1       170         53          0      0.00     0.00
 41          http_client_body     1        34          9          0      0.00     0.00
--                      total    --  21889079 1992818706         91        --       --
--------------------------------------------------
memory profile (all, depth 255, sorted by total_used)
#                  module layer allocs   used (kb) avg/allocation  %/caller  %/total
=                  ====== ===== ======   ========= ==============  ========  =======
 1           http_inspect     16197471 11717343.71         1936.0     68.98    68.98
 2             stream_tcp     112117487  4108767.90          347.2     24.19    24.19
 3                  appid     13892547   491214.19          129.2      2.89     2.89
 4                 wizard     110421254   286126.56           28.1      1.68     1.68
 5                 stream     1 652615   202417.21          317.6      1.19     1.19
 6                 detect     1 249046    65067.07          267.5      0.38     0.38
  1        rebuilt_packet     2  95590     7278.59           78.0     11.19     0.04
 7              port_scan     1 225924    51185.91          232.0      0.30     0.30
 8                   nbar     1 327130    20445.62           64.0      0.12     0.12
 9           dce_smb_main     1 325448    15263.34           48.0      0.09     0.09
  1       dce_smb_request     2    204       17.00           85.3      0.11     0.00
  2           dce_smb_uid     2     68        4.78           72.0      0.03     0.00
 10                   sip     1 243354    12588.12           53.0      0.07     0.07
 11          dce_tcp_main     1 158584     7560.55           48.8      0.04     0.04
 12                binder     1 111662     5288.56           48.5      0.03     0.03
 13                   pop     1    340     2303.23         6936.8      0.01     0.01
 14                   ssl     1  26249     1640.56           64.0      0.01     0.01
 15                  pcre     1  59024     1383.38           24.0      0.01     0.01
 16              flowbits     1    340       11.29           34.0      0.00     0.00
--                  total    --35019566 16987457.23          496.7        --       --
--------------------------------------------------

one rule

alert tcp any any -> any any ( msg:"to_client"; flow:to_client,established; content:"******"; appids:"http,p2p"; classtype:misc-activity; sid:44591; rev:1; )

configuration

latency =
{
    packet = { max_time = 10500 },
    rule = { max_time = 20000 },
}

-- use these to capture perf data for analysis and tuning
--profiler = { }
-- perf_monitor = { modules = {}, base = true,cpu = true,flow = true, flow_ip = true, packets = 10000, seconds = 60,summary =true, output = console }

Traffic, some enterprise traffic mix

Is it expected? ?

can't running snort, error libluajit

$firewall/bin/snort --help
/usr/local/src/snort/bin/snort: error while loading shared libraries: libluajit-5.1.so.2: cannot open shared object file: No such file or directory

Compile error with DAQ 2.0.4

error: ‘DAQ_QueryFlow_t’ has not been declared

The new version of DAQ delete the DAQ_QueryFlow_t struct

snort failed to verdict reset with small file.

Snort-3.0.0-a4-213.
When I set reset for EICAR.COM, I can download that file and I didn't see signature_lookup got triggered. The file is very small and just 69 bytes. reset avast_free_antivirus_setup_online.ext works fine.

file_id =
{
    enable_type = true,
    enable_signature = true,
    file_rules = file_magic,
    enable_capture = true,
    type_depth = 104857600,
    signature_depth = 104857600,
    capture_max_size = 104857600,
    trace_type = true,
    trace_signature = true,
    file_policy =
    {
        -- http://10.50.8.202/pkgs/virus/avast_free_antivirus_setup_online.exe
        { when = {sha256 = "7ea883d91f36d26166751e05d734571a561312fbd078068787ad3efac2bcb0e6"}, use = {verdict = 'reset' } },
        -- http://10.50.8.202/pkgs/virus/EICAR.COM
        { when = {sha256 = "131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267"}, use = {verdict = 'reset' } }
    },
}

plugin that listens to flow events

Is there any c++ plugin (for reference) that listens to flow create and close events ?

Update documentation to reflect s/-K/-L/

The documentation and README still show usage of the -K command line option. This should be updated to use -L instead.

See: Getting Started -> Run -> Examine and dump a pcap in the Snort manual

Snort failed to verdict reset when I use wget retry

It works perfectly when I used
'wget http://10.50.8.202/pkgs/UTM/virus/avast_free_antivirus_setup_online.exe'

But when I used
'wget --tries=5 --timeout=1 http://10.50.8.202/pkgs/UTM/virus/avast_free_antivirus_setup_online.exe' I can finish the download.

I traced the code a little bit and set_file_id never got triggered. So it never can 'Found resume file'.

snort-3.0.0-a4-213 config:

    file_id = {
        enable_type = true,
        enable_signature = true,
        file_rules = file_magic,
        enable_capture = true,
        type_depth = 104857600,
        signature_depth = 104857600,
        capture_max_size = 104857600,
        trace_type = true,
        trace_signature = true,
        file_policy =
        {
            { when = {sha256 = "7ea883d91f36d26166751e05d734571a561312fbd078068787ad3efac2bcb0e6"}, use = {verdict = 'reset'  } }
        }
    }

wget output:

--2016-10-27 17:04:06--  http://10.50.8.202/pkgs/UTM/virus/avast_free_antivirus_setup_online.exe
Connecting to 10.50.8.202:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5006864 (4.8M) [application/octet-stream]
Saving to: “avast_free_antivirus_setup_online.exe”

99% [==================================================================================================================================================================================================> ] 5,006,096   2.30M/s   in 2.1s

2016-10-27 17:04:08 (2.30 MB/s) - Read error at byte 5006096/5006864 (Connection timed out). Retrying.

--2016-10-27 17:04:09--  (try: 2)  http://10.50.8.202/pkgs/UTM/virus/avast_free_antivirus_setup_online.exe
Connecting to 10.50.8.202:80... connected.
HTTP request sent, awaiting response... 206 Partial Content
Length: 5006864 (4.8M), 768 remaining [application/octet-stream]
Saving to: “avast_free_antivirus_setup_online.exe”

100%[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++>] 5,006,864   --.-K/s   in 0s

2016-10-27 17:04:09 (106 MB/s) - “avast_free_antivirus_setup_online.exe” saved [5006864/5006864]

errors when starting snort3 (fresh today's git) with nfq and -z (to increase number of packet processing threads)

Command to start snort:

/opt/snort/bin/snort -c /opt/snort/etc/snort/snort.lua -R /opt/snort/rules/snort3-community.rules -l /var/itcsoc/snort --daq nfq --daq-dir /usr/local/lib64/daq -A alert_fast --plugin-path /opt/snort/extra -Q -z 4

and error:
nfq DAQ configured to inline.
Commencing packet processing
++ [0]
++ [1]
++ [2]
++ [3]
Can't initialize DAQ nfq (-1) - nfq_daq_initialize: nf queue creation failed

Can't initialize DAQ nfq (-1) - nfq_daq_initialize: nf queue creation failed

-- [1]
-- [2]
Can't initialize DAQ nfq (-1) - nfq_daq_initialize: nf queue creation failed

-- [3]

/opt/snort/bin/snort --daq-list
Available DAQ modules:
pcap(v4): readback live multi unpriv
nfq(v7): live inline multi
ipfw(v3): live inline multi unpriv
dump(v4): readback live inline multi unpriv
afpacket(v6): live inline multi unpriv

service_tftp.lua:151: attempt to call global 'checkPattern' (a nil )

error building snort3

Did below steps on a ubuntu 14.04 LTS and getting below errors

- git clone 

- cd snort3

- autoreconf -isvf

- ./configure

- make

Error

make[3]: Entering directory `/home/sashank/snort3/src/packet_io'
  CXX      active.o
  CXX      sfdaq.o
sfdaq.cc: In member function ‘int SFDAQInstance::add_expected(const Packet*, const SfIp*, uint16_t, const SfIp*, uint16_t, IpProtocol, unsigned int, unsigned int)’:
sfdaq.cc:551:5: error: ‘DAQ_Data_Channel_Params_t’ was not declared in this scope
     DAQ_Data_Channel_Params_t daq_params;
     ^
sfdaq.cc:554:12: error: ‘DAQ_DP_key_t’ has no member named ‘src_af’
     dp_key.src_af = cliIP->get_family();
            ^
sfdaq.cc:561:12: error: ‘DAQ_DP_key_t’ has no member named ‘dst_af’
     dp_key.dst_af = srvIP->get_family();
            ^
sfdaq.cc:586:13: error: ‘daq_params’ was not declared in this scope
     memset(&daq_params, 0, sizeof(daq_params));
             ^
make[3]: *** [sfdaq.o] Error 1
make[3]: Leaving directory `/home/sashank/snort3/src/packet_io'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/home/sashank/snort3/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/sashank/snort3'
make: *** [all] Error 2

any help greatly appreciated !

Global buffer overflow due to incorrect protocol id in codec_data

Hi,

There's a potential global buffer overflow when handling a packet that I have called global_buffer_overflow.pcap that corrupts the value of codec_data.next_prot_id to -1 in turn resulting in a buffer overread at
208 mapped_prot = CodecManager::s_proto_map[to_utype(codec_data.next_prot_id)];

in packet_manager.cc:208

Here's the full stack trace:

#0  0x00007ffff576e428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff577002a in __GI_abort () at abort.c:89
#2  0x000000000052f2a9 in __sanitizer::Abort() ()
#3  0x000000000051c109 in __asan::AsanDie() ()
#4  0x0000000000523162 in __sanitizer::Die() ()
#5  0x000000000051b086 in __asan_report_error ()
#6  0x000000000051c4b3 in __asan_report_load1 ()
#7  0x00000000009dec10 in PacketManager::decode (p=0x610000017f40, pkthdr=0x7fffef7d5a20, pkt=0x631000258800 "\377\355\001\001\001\001\0
01", cooked=false) at packet_manager.cc:208
#8  0x000000000059c0c8 in Snort::process_packet (p=0x610000017f40, pkthdr=0x7fffef7d5a20, pkt=0x631000258800 "\377\355\001\001\001\001\0
01", is_frag=false) at snort.cc:772
#9  0x000000000059c856 in Snort::packet_callback (pkthdr=0x7fffef7d5a20, pkt=0x631000258800 "\377\355\001\001\001\001\001") at snort.cc:
883
#10 0x0000000000a15edd in pcap_process_loop (user=0x61500002fb00 "", pkth=<optimized out>, data=<optimized out>) at daq_pcap.c:370
#11 0x00007ffff6c40ac4 in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#12 0x0000000000a1594d in pcap_daq_acquire (handle=0x61500002fb00, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<opti
mized out>) at daq_pcap.c:388
#13 0x00000000009ad262 in SFDAQInstance::acquire (this=0x60e000006f60, max=0, callback=0x59c632 <Snort::packet_callback(void*, _daq_pkth
dr const*, unsigned char const*)>) at sfdaq.cc:487
#14 0x000000000058b56e in Analyzer::analyze (this=0x61200000b740) at analyzer.cc:160
#15 0x000000000058b0a6 in Analyzer::operator() (this=0x61200000b740, ps=0x603000013ab0) at analyzer.cc:98
#16 0x000000000054d312 in std::__invoke<Analyzer, Swapper*>(Analyzer&, Swapper*&&) (__f=...) at /usr/include/c++/5/functional:201
#17 0x000000000054d287 in std::reference_wrapper<Analyzer>::operator()<Swapper*>(Swapper*&&) const (this=0x606000010d30) at /usr/include
/c++/5/functional:428
#18 0x000000000054d249 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0x606000010d28) at /usr/include/c++/5/functional:1531
#19 0x000000000054d10e in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::operator()() (this=0x606000010d28) at /usr/inc
lude/c++/5/functional:1520
#20 0x000000000054d09e in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)> >::_M_run() (this=0x60600001
0d10) at /usr/include/c++/5/thread:115
#21 0x00007ffff62f6c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#22 0x00007ffff5d1f6ba in start_thread (arg=0x7fffef8aa700) at pthread_create.c:333
#23 0x00007ffff583f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
(gdb) p codec_data
$4 = {next_prot_id = -1, lyr_len = 14, invalid_bytes = 0, proto_bits = 512, codec_flags = 0, ip_layer_cnt = 0 '\000', ip6_extension_count = 0 '\000', curr_ip6_extension = 0 '\000', ip6_csum_proto = IpProtocol::IP}

Segmentation fault at vlan.h

Snort 3 Beta faults with error "Unable to find a Codec with data link type 113". In Snort 2, this solved with the option "--enable-non-ether-decoders". However, Snort 3 does not appear to have this option.

[Thread 0x7ffff2001700 (LWP 16068) exited]
-- [2] ./pcaps/fuzz-2014-04-11-8332.pcap
++ [2] ./pcaps/fuzz-2014-04-20-7766.pcap
[New Thread 0x7ffff2001700 (LWP 16076)]
ERROR: Unable to find a Codec with data link type 113

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff3003700 (LWP 16075)]
0x000000000055ba7a in snort::vlan::VlanTagHdr::vid (this=0x0) at /root/sources/snort3/src/protocols/vlan.h:41
41	    { return ntohs(vth_pri_cfi_vlan) & 0x0FFF; }
#0  0x000000000055ba7a in snort::vlan::VlanTagHdr::vid (this=0x0) at /root/sources/snort3/src/protocols/vlan.h:41
#1  0x000000000055ea67 in FlowControl::set_key (this=0x7fffef2950f0, key=0x7ffff2fcc3c0, p=0x7fffef5281f0) at /root/sources/snort3/src/flow/flow_control.cc:177
#2  0x000000000055f418 in FlowControl::process (this=0x7fffef2950f0, type=TCP, p=0x7fffef5281f0) at /root/sources/snort3/src/flow/flow_control.cc:365
#3  0x0000000000645b51 in StreamBase::eval (this=0x205c910, p=0x7fffef5281f0) at /root/sources/snort3/src/stream/base/stream_base.cc:244
#4  0x00000000005d9c8f in execute (p=0x7fffef5281f0, prep=0x5e4b570, num=1) at /root/sources/snort3/src/managers/inspector_manager.cc:912
#5  0x00000000005d9ea0 in snort::InspectorManager::execute (p=0x7fffef5281f0) at /root/sources/snort3/src/managers/inspector_manager.cc:963
#6  0x000000000052f497 in snort::DetectionEngine::inspect (p=0x7fffef5281f0) at /root/sources/snort3/src/detection/detection_engine.cc:403
#7  0x00000000005c76d9 in snort::Snort::process_packet (p=0x7fffef5281f0, pkthdr=0x7ffff2fcc5e0, pkt=0x2a05e01c "", is_frag=false) at /root/sources/snort3/src/main/snort.cc:892
#8  0x00000000005c7a3e in snort::Snort::packet_callback (pkthdr=0x7ffff2fcc5e0, pkt=0x2a05e01c "") at /root/sources/snort3/src/main/snort.cc:996
#9  0x000000000079f231 in pcap_process_loop (user=user@entry=0x1e4be00 "", pkth=pkth@entry=0x7ffff2fcc690, data=0x2a05e01c "") at daq_pcap.c:376
#10 0x00007ffff759b0d1 in pcap_offline_read (p=0x2a1a62c0, cnt=-1, callback=0x79f1a0 <pcap_process_loop>, user=0x1e4be00 "") at ./savefile.c:506
#11 0x000000000079f35b in pcap_daq_acquire (handle=0x1e4be00, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<optimized out>) at daq_pcap.c:394
#12 0x00000000005fdcd9 in snort::SFDAQInstance::acquire (this=0x2a16ca30, max=0, callback=0x5c791c <snort::Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*)>) at /root/sources/snort3/src/packet_io/sfdaq.cc:570
#13 0x00000000005b157a in Analyzer::analyze (this=0x5e4a130) at /root/sources/snort3/src/main/analyzer.cc:161
#14 0x00000000005b136e in Analyzer::operator() (this=0x5e4a130, ps=0xcb5b1b0, run_num=1429) at /root/sources/snort3/src/main/analyzer.cc:99
#15 0x000000000052954e in std::__invoke<Analyzer<Swapper*, unsigned short> > (__f=...) at /usr/include/c++/4.8.2/functional:234
#16 0x00000000005294ed in std::reference_wrapper<Analyzer>::operator()<Swapper*, unsigned short>(Swapper*&&, unsigned short&&) const (this=0x7fffec112950) at /usr/include/c++/4.8.2/functional:467
#17 0x0000000000529451 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (this=0x7fffec112940) at /usr/include/c++/4.8.2/functional:1732
#18 0x0000000000529309 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)>::operator()() (this=0x7fffec112940) at /usr/include/c++/4.8.2/functional:1720
#19 0x00000000005292a2 in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)> >::_M_run() (this=0x7fffec112928) at /usr/include/c++/4.8.2/thread:115
#20 0x00007ffff528b070 in ?? () from /lib64/libstdc++.so.6
#21 0x00007ffff6b42e25 in start_thread () from /lib64/libpthread.so.0
#22 0x00007ffff49efbad in clone () from /lib64/libc.so.6

compilation conflict with libiconv

Hello...
I am trying build Snort3 on FreeBSD(11.2) and step make -j 8 install finish with error:

/root/sources/snort3/src/utils/util_utf.cc:359: undefined reference to `libiconv_open'
/root/sources/snort3/src/utils/util_utf.cc:364: undefined reference to `libiconv'
/root/sources/snort3/src/utils/util_utf.cc:367: undefined reference to `libiconv_close'
/root/sources/snort3/src/utils/util_utf.cc:374: undefined reference to `libiconv_close'
c++: error: linker command failed with exit code 1 (use -v to see invocation)
--- src/snort ---
*** [src/snort] Error code 1
make[2]: stopped in /root/sources/snort3/build
1 error
make[2]: stopped in /root/sources/snort3/build
--- src/CMakeFiles/snort.dir/all ---
*** [src/CMakeFiles/snort.dir/all] Error code 2
make[1]: stopped in /root/sources/snort3/build
1 error
make[1]: stopped in /root/sources/snort3/build
*** [all] Error code 2
make: stopped in /root/sources/snort3/build
1 error
make: stopped in /root/sources/snort3/build

when I uninstalled the libiconv, so the compilation of Snort finish successfully.
Will be the libiconv needed for Snort?

Daemon mode doesn't create pidfile

Seems to be, that Snort3 has hard-defined path and name of the pidfile.

when I launch Snort with switch '-D' (daemon):
#/usr/local/snort/bin/snort -D -i bridge0 -c /usr/local/snort/etc/snort/snort.lua
the pid file is not created / I can not find the file
when I launch with switch '--create-pidfile'
#/usr/local/snort/bin/snort --create-pidfile -i bridge0 -c /usr/local/snort/etc/snort/snort.lua
returns:
Writing PID "4133" to file "./snort.pid"

Why daemon doesn't create pidfile?
How can I define name of the pidfile and also path to the file?

Snort3 compiled from GIT on FreeBSD 11.2

Rule File Format Request

Anyway you can make the rules files and config files in a JSON or yaml format??? This way it will follow a standard and will be easier to parse rules and configs.

Using mSplit Parse Config File

Hi.
I write a test case for mSplit function, And
When parsing string by mSplit, it will not work right.
The test case core codes:
const char *str = "\a:\b:\c:\d";
const char *sep_chars = "abcd:";
const int max_toks = 0,
int num_toks = 0;
const char meta_char = '\';
char ** strTable = mSplit(str, sep_chars, max_toks, &num_toks, meta_char);
for (int i = 0; i < num_toks; i)
printf("%s\n", strTable[i]);

Ouput:
a
\
\
\
Expect:
a
b
c
d
Reason:
if cur_tok >= 1, the function works not good.
Because when do the second or more split, mSplit will exec this code.
line: 236-251
/* Move past initial separator characters and whitespace */
for (i = 0; i < strlen(str); i++)
{
for (j = 0; j < strlen(sep_chars); j++)
{
if ((str[i] == sep_chars[j]) ||
isspace((int)str[i]))
{
break;
}
}

			/* Not a separator character or whitespace */
			if (j == strlen(sep_chars))
				break;
		}
		
		And then, i++
		line: 190
		for (i = 0; i < strlen(str); i++)
		
		mSplit ignored the 'escaped' character's function, 
		And treat the 'escaped' character as a normal character.

Fix:
Modify line: 330:
[-] tok_start = i;
[+] tok_start = i--;

Heap buffer overread while parsing ipv6 packet

Hi,

There's a heap buffer overread in Codec::CheckIPV6HopOptions while parsing an IPV6 packet. Here's the stack trace:

Starting program: /home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort -r ipv6.pcap
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffef8aa700 (LWP 47544)]
=================================================================
==47384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100003bffe at pc 0x00000093c7ad bp 0x7fffef7d55a0 sp 0x7fffef7d5590
READ of size 1 at 0x61100003bffe thread T1
    #0 0x93c7ac in Codec::CheckIPV6HopOptions(RawData const&, CodecData&) /home/fuzz/code/snort3/src/framework/codec.cc:131
    #1 0x5b6315 in decode /home/fuzz/code/snort3/src/codecs/ip/cd_hop_opts.cc:86
    #2 0x9de83f in PacketManager::decode(Packet*, _daq_pkthdr const*, unsigned char const*, bool) /home/fuzz/code/snort3/src/protocols/packet_manager.cc:153
    #3 0x59c0c7 in Snort::process_packet(Packet*, _daq_pkthdr const*, unsigned char const*, bool) /home/fuzz/code/snort3/src/main/snort.cc:772
    #4 0x59c855 in Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*) /home/fuzz/code/snort3/src/main/snort.cc:883
    #5 0xa15edc in pcap_process_loop /home/fuzz/code/daq-2.2.1/os-daq-modules/daq_pcap.c:370
    #6 0x7ffff6c40ac3  (/usr/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1eac3)
    #7 0xa1594c in pcap_daq_acquire /home/fuzz/code/daq-2.2.1/os-daq-modules/daq_pcap.c:388
    #8 0x9ad261 in SFDAQInstance::acquire(int, DAQ_Verdict (*)(void*, _daq_pkthdr const*, unsigned char const*)) /home/fuzz/code/snort3/src/packet_io/sfdaq.cc:487
    #9 0x58b56d in Analyzer::analyze() /home/fuzz/code/snort3/src/main/analyzer.cc:160
    #10 0x58b0a5 in Analyzer::operator()(Swapper*) /home/fuzz/code/snort3/src/main/analyzer.cc:98
    #11 0x54d311 in std::enable_if<((!std::is_member_pointer<Analyzer>::value)&&(!std::is_function<Analyzer>::value))&&(!std::is_function<std::remove_pointer<Analyzer>::type>::value), std::result_of<Analyzer& (Swapper*&&)>::type>::type std::__invoke<Analyzer, Swapper*>(Analyzer&, Swapper*&&) (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x54d311)
    #12 0x54d286 in std::result_of<Analyzer& (Swapper*&&)>::type std::reference_wrapper<Analyzer>::operator()<Swapper*>(Swapper*&&) const (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x54d286)
    #13 0x54d248 in void std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::_M_invoke<0ul>(std::_Index_tuple<0ul>) (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x54d248)
    #14 0x54d10d in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::operator()() (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x54d10d)
    #15 0x54d09d in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)> >::_M_run() (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x54d09d)
    #16 0x7ffff62f6c7f  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8c7f)
    #17 0x7ffff5d1f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #18 0x7ffff583f82c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10682c)

0x61100003bffe is located 0 bytes to the right of 254-byte region [0x61100003bf00,0x61100003bffe)
allocated by thread T1 here:
    #0 0x513fa2 in __interceptor_malloc (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x513fa2)
    #1 0x7ffff6c4152e  (/usr/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1f52e)

Thread T1 created by T0 here:
    #0 0x4b1b33 in __interceptor_pthread_create (/home/fuzz/code/snort3/.orthrus/binaries/asan-dbg/bin/snort+0x4b1b33)
    #1 0x7ffff62f6dc2 in std::thread::_M_start_thread(std::shared_ptr<std::thread::_Impl_base>, void (*)()) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8dc2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/code/snort3/src/framework/codec.cc:131 Codec::CheckIPV6HopOptions(RawData const&, CodecData&)
Shadow bytes around the buggy address:
  0x0c227ffff7a0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c227ffff7b0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227ffff7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227ffff7d0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227ffff7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227ffff7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[06]
  0x0c227ffff800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227ffff810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227ffff820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227ffff830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227ffff840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==47384==ABORTING
--------------------------------------------------
o")~   Snort++ 3.0.0-a4-231
--------------------------------------------------
--------------------------------------------------
pcap DAQ configured to read-file.
Commencing packet processing
++ [0] ipv6.pcap

Thread 2 "snort" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffef8aa700 (LWP 47544)]
0x00007ffff576e428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
#0  0x00007ffff576e428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff577002a in __GI_abort () at abort.c:89
#2  0x000000000052f2a9 in __sanitizer::Abort() ()
#3  0x000000000051c109 in __asan::AsanDie() ()
#4  0x0000000000523162 in __sanitizer::Die() ()
#5  0x000000000051b086 in __asan_report_error ()
#6  0x000000000051c4b3 in __asan_report_load1 ()
#7  0x000000000093c7ad in Codec::CheckIPV6HopOptions (this=0x602000005410, raw=..., codec=...) at codec.cc:131
#8  0x00000000005b6316 in (anonymous namespace)::Ipv6HopOptsCodec::decode (this=0x602000005410, raw=..., codec=...) at cd_hop_opts.cc:86
#9  0x00000000009de840 in PacketManager::decode (p=0x610000017f40, pkthdr=0x7fffef7d5a20, pkt=0x61100003bf00 "", cooked=false) at packet_manager.cc:153
#10 0x000000000059c0c8 in Snort::process_packet (p=0x610000017f40, pkthdr=0x7fffef7d5a20, pkt=0x61100003bf00 "", is_frag=false) at snort.cc:772
#11 0x000000000059c856 in Snort::packet_callback (pkthdr=0x7fffef7d5a20, pkt=0x61100003bf00 "") at snort.cc:883
#12 0x0000000000a15edd in pcap_process_loop (user=0x61500002fb00 "", pkth=<optimized out>, data=<optimized out>) at daq_pcap.c:370
#13 0x00007ffff6c40ac4 in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#14 0x0000000000a1594d in pcap_daq_acquire (handle=0x61500002fb00, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<optimized out>) at daq_pcap.c:388
#15 0x00000000009ad262 in SFDAQInstance::acquire (this=0x60e000006f60, max=0, callback=0x59c632 <Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*)>) at sfdaq.cc:487
#16 0x000000000058b56e in Analyzer::analyze (this=0x61200000b740) at analyzer.cc:160
#17 0x000000000058b0a6 in Analyzer::operator() (this=0x61200000b740, ps=0x603000013bd0) at analyzer.cc:98
#18 0x000000000054d312 in std::__invoke<Analyzer, Swapper*>(Analyzer&, Swapper*&&) (__f=...) at /usr/include/c++/5/functional:201
#19 0x000000000054d287 in std::reference_wrapper<Analyzer>::operator()<Swapper*>(Swapper*&&) const (this=0x606000010d30) at /usr/include/c++/5/functional:428
#20 0x000000000054d249 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0x606000010d28) at /usr/include/c++/5/functional:1531
#21 0x000000000054d10e in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::operator()() (this=0x606000010d28) at /usr/include/c++/5/functional:1520
#22 0x000000000054d09e in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)> >::_M_run() (this=0x606000010d10) at /usr/include/c++/5/thread:115
#23 0x00007ffff62f6c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#24 0x00007ffff5d1f6ba in start_thread (arg=0x7fffef8aa700) at pthread_create.c:333
#25 0x00007ffff583f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

snort3_community.rules - Fatal Error, Quitting

Hello,
Could You please clarify, how to prepare the config to use community.rules ?
when I uncommented parameter include = 'snort3_community.rules' Snort return error:

Loading /usr/local/snort/etc/snort/snort.lua:
FATAL: can't load /usr/local/snort/etc/snort/snort.lua: /usr/local/snort/etc/snort/snort.lua:209: '}' expected (to close '{' at line 197) near 'rules'
Fatal Error, Quitting..

part of my configuration where are the records about the community.rules

ips =
{
	mode = tap,

	-- use this to enable decoder and inspector alerts
	enable_builtin_rules = true,

	-- use include for rules files; be sure to set your path
	-- note that rules files can include other rules files

-- THIS PARAMETER IS FROM DEFAULT INSTALLATION - FOR WHAT IS IT?
	-- include = 'snort3_community.rules'

	-- The following include syntax is only valid for BUILD_243 (13-FEB-2018) and later
	-- RULE_PATH is typically set in snort_defaults.lua
    rules = [[

-- THIS PARAMETER HAS BEEN ADD MANUALLY BY ME 
	include $RULE_PATH/snort3-community.rules

        include $RULE_PATH/snort3-app-detect.rules
        include $RULE_PATH/snort3-browser-chrome.rules
        include $RULE_PATH/snort3-browser-firefox.rules
        include $RULE_PATH/snort3-browser-ie.rules
        include $RULE_PATH/snort3-browser-other.rules
        include $RULE_PATH/snort3-browser-plugins.rules

Thank You

Segmentation Fault on FreeBSD 11

Snort 3.0 Alpha 4 compiles but produces a Segmentation Fault when trying to run. Here is the truss output:

70018: mmap(0x0,32768,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34373668864 (0x800d49000)
70018: issetugid()                               = 0 (0x0)
70018: lstat("/etc",{ mode=drwxr-xr-x ,inode=22,size=107,blksize=7168 }) = 0 (0x0)
70018: lstat("/etc/libmap.conf",{ mode=-rw-r--r-- ,inode=13727,size=109,blksize=4096 }) = 0 (0x0)
70018: openat(AT_FDCWD,"/etc/libmap.conf",O_RDONLY|O_CLOEXEC,00) = 3 (0x3)
70018: fstat(3,{ mode=-rw-r--r-- ,inode=13727,size=109,blksize=4096 }) = 0 (0x0)
70018: mmap(0x0,109,PROT_READ,MAP_PRIVATE,3,0x0) = 34373701632 (0x800d51000)
70018: close(3)                                  = 0 (0x0)
70018: lstat("/usr",{ mode=drwxr-xr-x ,inode=26,size=15,blksize=4096 }) = 0 (0x0)
70018: lstat("/usr/local",{ mode=drwxr-xr-x ,inode=217,size=11,blksize=4096 }) = 0 (0x0)
70018: lstat("/usr/local/etc",{ mode=drwxr-xr-x ,inode=98327,size=7,blksize=131072 }) = 0 (0x0)
70018: lstat("/usr/local/etc/libmap.d",0x7fffffffc6b8) ERR#2 'No such file or directory'
70018: munmap(0x800d51000,109)                   = 0 (0x0)
70018: openat(AT_FDCWD,"/var/run/ld-elf.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3)
70018: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0-\0\0\0\0"...,128) = 128 (0x80)
70018: fstat(3,{ mode=-r--r--r-- ,inode=99504,size=173,blksize=4096 }) = 0 (0x0)
70018: lseek(3,0x80,SEEK_SET)                    = 128 (0x80)
70018: read(3,"/lib:/usr/lib:/usr/lib/compat:/u"...,45) = 45 (0x2d)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libpcre.so.1",F_OK)          ERR#2 'No such file or directory'
70018: access("/usr/lib/libpcre.so.1",F_OK)      ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libpcre.so.1",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libpcre.so.1",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libpcre.so.1",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98624,size=503168,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2600960,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34375770112 (0x800f4a000)
70018: mmap(0x800f4a000,503808,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34375770112 (0x800f4a000)
70018: mmap(0x8011c4000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x7a000) = 34378366976 (0x8011c4000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libcrypto.so.8",F_OK)        = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libcrypto.so.8",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=153,size=2517704,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,4624384,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE|MAP_ALIGNED_SUPER,-1,0x0) = 34378612736 (0x801200000)
70018: mmap(0x801200000,2351104,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34378612736 (0x801200000)
70018: mmap(0x80163d000,172032,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x23d000) = 34383056896 (0x80163d000)
70018: mmap(0x801667000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34383228928 (0x801667000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libluajit-5.1.so.2",F_OK)    ERR#2 'No such file or directory'
70018: access("/usr/lib/libluajit-5.1.so.2",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libluajit-5.1.so.2",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libluajit-5.1.so.2",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libluajit-5.1.so.2",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98833,size=525344,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2621440,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34383237120 (0x801669000)
70018: mmap(0x801669000,516096,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34383237120 (0x801669000)
70018: mmap(0x8018e7000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x7e000) = 34385850368 (0x8018e7000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libhwloc.so.5",F_OK)         ERR#2 'No such file or directory'
70018: access("/usr/lib/libhwloc.so.5",F_OK)     ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libhwloc.so.5",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libhwloc.so.5",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libhwloc.so.5",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98971,size=194288,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2289664,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34385858560 (0x8018e9000)
70018: mmap(0x8018e9000,188416,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34385858560 (0x8018e9000)
70018: mmap(0x801b17000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x2e000) = 34388144128 (0x801b17000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libdnet.so.1",F_OK)          ERR#2 'No such file or directory'
70018: access("/usr/lib/libdnet.so.1",F_OK)      ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libdnet.so.1",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libdnet.so.1",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libdnet.so.1",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98427,size=73766,blksize=74240 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2162688,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34388148224 (0x801b18000)
70018: mmap(0x801b18000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34388148224 (0x801b18000)
70018: mmap(0x801d26000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xe000) = 34390302720 (0x801d26000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libpcap.so.1",F_OK)          ERR#2 'No such file or directory'
70018: access("/usr/lib/libpcap.so.1",F_OK)      ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libpcap.so.1",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libpcap.so.1",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libpcap.so.1",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r-xr-xr-x ,inode=98469,size=311656,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2408448,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34390310912 (0x801d28000)
70018: mmap(0x801d28000,303104,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34390310912 (0x801d28000)
70018: mmap(0x801f72000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x4a000) = 34392711168 (0x801f72000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libsfbpf.so.0",F_OK)         ERR#2 'No such file or directory'
70018: access("/usr/lib/libsfbpf.so.0",F_OK)     ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libsfbpf.so.0",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libsfbpf.so.0",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libsfbpf.so.0",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98554,size=244712,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2342912,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34392719360 (0x801f74000)
70018: mmap(0x801f74000,241664,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34392719360 (0x801f74000)
70018: mmap(0x8021ae000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x3a000) = 34395054080 (0x8021ae000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libz.so.6",F_OK)             = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libz.so.6",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=142,size=102024,blksize=102400 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2199552,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34395062272 (0x8021b0000)
70018: mmap(0x8021b0000,98304,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34395062272 (0x8021b0000)
70018: mmap(0x8023c8000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x18000) = 34397257728 (0x8023c8000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/liblzma.so.5",F_OK)          ERR#2 'No such file or directory'
70018: access("/usr/lib/liblzma.so.5",F_OK)      = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/lib/liblzma.so.5",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=2984,size=168728,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2265088,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34397261824 (0x8023c9000)
70018: mmap(0x8023c9000,163840,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34397261824 (0x8023c9000)
70018: mmap(0x8025f1000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x28000) = 34399522816 (0x8025f1000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libc++.so.1",F_OK)           ERR#2 'No such file or directory'
70018: access("/usr/lib/libc++.so.1",F_OK)       = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/lib/libc++.so.1",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=2595,size=805824,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2912256,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34399526912 (0x8025f2000)
70018: mmap(0x8025f2000,782336,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34399526912 (0x8025f2000)
70018: mmap(0x8028b0000,28672,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xbe000) = 34402402304 (0x8028b0000)
70018: mmap(0x8028b7000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34402430976 (0x8028b7000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libcxxrt.so.1",F_OK)         = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libcxxrt.so.1",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=138,size=106232,blksize=106496 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2220032,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34402439168 (0x8028b9000)
70018: mmap(0x8028b9000,102400,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34402439168 (0x8028b9000)
70018: mmap(0x802ad1000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x18000) = 34404634624 (0x802ad1000)
70018: mmap(0x802ad3000,16384,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34404642816 (0x802ad3000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libm.so.5",F_OK)             = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libm.so.5",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=170,size=192576,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2273280,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34404659200 (0x802ad7000)
70018: mmap(0x802ad7000,172032,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34404659200 (0x802ad7000)
70018: mmap(0x802d01000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x2a000) = 34406928384 (0x802d01000)
70018: mmap(0x0,36864,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34373705728 (0x800d52000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libgcc_s.so.1",F_OK)         = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libgcc_s.so.1",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=169,size=58752,blksize=58880 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2154496,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34406932480 (0x802d02000)
70018: mmap(0x802d02000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34406932480 (0x802d02000)
70018: mmap(0x802f0f000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xd000) = 34409082880 (0x802f0f000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libthr.so.3",F_OK)           = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libthr.so.3",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=143,size=120728,blksize=120832 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2260992,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34409086976 (0x802f10000)
70018: mmap(0x802f10000,110592,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34409086976 (0x802f10000)
70018: mmap(0x80312b000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x1b000) = 34411294720 (0x80312b000)
70018: mmap(0x80312c000,49152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34411298816 (0x80312c000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libc.so.7",F_OK)             = 0 (0x0)
70018: openat(AT_FDCWD,"/lib/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-r--r--r-- ,inode=171,size=1761320,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,3899392,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34411347968 (0x803138000)
70018: mmap(0x803138000,1646592,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34411347968 (0x803138000)
70018: mmap(0x8034ca000,49152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x192000) = 34415091712 (0x8034ca000)
70018: mmap(0x8034d6000,106496,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34415140864 (0x8034d6000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libpciaccess.so.0",F_OK)     ERR#2 'No such file or directory'
70018: access("/usr/lib/libpciaccess.so.0",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libpciaccess.so.0",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libpciaccess.so.0",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libpciaccess.so.0",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98862,size=27840,blksize=28160 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,2125824,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34415247360 (0x8034f0000)
70018: mmap(0x8034f0000,24576,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34415247360 (0x8034f0000)
70018: mmap(0x8036f6000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x6000) = 34417369088 (0x8036f6000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: access("/lib/libxml2.so.2",F_OK)          ERR#2 'No such file or directory'
70018: access("/usr/lib/libxml2.so.2",F_OK)      ERR#2 'No such file or directory'
70018: access("/usr/lib/compat/libxml2.so.2",F_OK) ERR#2 'No such file or directory'
70018: access("/usr/local/lib/libxml2.so.2",F_OK) = 0 (0x0)
70018: openat(AT_FDCWD,"/usr/local/lib/libxml2.so.2",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
70018: fstat(3,{ mode=-rwxr-xr-x ,inode=98924,size=1655200,blksize=131072 }) = 0 (0x0)
70018: mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34373701632 (0x800d51000)
70018: mmap(0x0,3756032,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34417373184 (0x8036f7000)
70018: mmap(0x8036f7000,1609728,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34417373184 (0x8036f7000)
70018: mmap(0x803a80000,45056,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x189000) = 34421080064 (0x803a80000)
70018: mmap(0x803a8b000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34421125120 (0x803a8b000)
70018: munmap(0x800d51000,4096)                  = 0 (0x0)
70018: close(3)                                  = 0 (0x0)
70018: munmap(0x800d57000,16384)                 = 0 (0x0)
70018: mmap(0x0,69632,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34373726208 (0x800d57000)
70018: munmap(0x800d62000,24576)                 = 0 (0x0)
70018: mmap(0x0,102400,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34373771264 (0x800d62000)
70018: munmap(0x800d76000,20480)                 = 0 (0x0)
70018: mmap(0x0,561152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34373853184 (0x800d76000)
70018: sysarch(AMD64_SET_FSBASE,0x7fffffffe078)  = 0 (0x0)
70018: sigprocmask(SIG_BLOCK,{ SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: readlink("/etc/malloc.conf",0x7fffffffd770,1024) ERR#2 'No such file or directory'
70018: issetugid()                               = 0 (0x0)
70018: __sysctl(0x7fffffffd610,0x2,0x7fffffffd660,0x7fffffffd658,0x803299c93,0xd) = 0 (0x0)
70018: __sysctl(0x7fffffffd660,0x2,0x7fffffffd724,0x7fffffffd718,0x0,0x0) = 0 (0x0)
70018: mmap(0x0,2097152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34421129216 (0x803a8c000)
70018: munmap(0x803a8c000,2097152)               = 0 (0x0)
70018: mmap(0x0,4190208,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34421129216 (0x803a8c000)
70018: munmap(0x803a8c000,1523712)               = 0 (0x0)
70018: munmap(0x803e00000,569344)                = 0 (0x0)
70018: sigprocmask(SIG_BLOCK,{ SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: __sysctl(0x7fffffffdbc0,0x2,0x803137648,0x7fffffffdbc8,0x0,0x0) = 0 (0x0)
70018: getrlimit(RLIMIT_STACK,{ cur=536870912,max=536870912 }) = 0 (0x0)
70018: __sysctl(0x7fffffffdab0,0x2,0x7fffffffdb00,0x7fffffffdaf8,0x802f27408,0xd) = 0 (0x0)
70018: __sysctl(0x7fffffffdb00,0x3,0x803136c70,0x7fffffffdbc8,0x0,0x0) = 0 (0x0)
70018: mmap(0x0,2097152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34424750080 (0x803e00000)
70018: thr_self(0x803e18000)                     = 0 (0x0)
70018: mmap(0x7fffdfffe000,4096,PROT_NONE,MAP_ANON,-1,0x0) = 140736951476224 (0x7fffdfffe000)
70018: rtprio_thread(0x0,0x19717,0x7fffffffdb88) = 0 (0x0)
70018: sysarch(AMD64_SET_FSBASE,0x7fffffffdb88)  = 0 (0x0)
70018: sigaction(SIGTHR,{ 0x802f1dee0 SA_SIGINFO ss_t },0x0) = 0 (0x0)
70018: sigprocmask(SIG_UNBLOCK,{ },0x0)          = 0 (0x0)
70018: _umtx_op(0x7fffffffdb90,UMTX_OP_WAKE,0x1,0x0,0x0) = 0 (0x0)
70018: mprotect(0x0,0,PROT_NONE)                 = 0 (0x0)
70018: getpid()                                  = 70018 (0x11182)
70018: getpid()                                  = 70018 (0x11182)
70018: sigprocmask(SIG_BLOCK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: getcontext(0x7fffffffd7d0)                = 0 (0x0)
70018: fstat(1,{ mode=crw--w---- ,inode=285,size=0,blksize=4096 }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGTERM,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGINT,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGQUIT,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGUSR1,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGUSR2,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGHUP,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL 0x0 ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGURG,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGPIPE,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGABRT,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGSEGV,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ }) = 0 (0x0)
70018: sigaction(SIGBUS,{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t },{ SIG_DFL SA_RESTART ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ },0x0)          = 0 (0x0)
70018: __sysctl(0x7fffffffe478,0x2,0x7fffffffe480,0x7fffffffe488,0x0,0x0) = 0 (0x0)
70018: __sysctl(0x7fffffffded8,0x2,0x7fffffffdf30,0x7fffffffded0,0x0,0x0) = 0 (0x0)
70018: __sysctl(0x7fffffffded8,0x2,0x7fffffffe030,0x7fffffffded0,0x0,0x0) = 0 (0x0)
70018: __sysctl(0x7fffffffded8,0x2,0x7fffffffe330,0x7fffffffded0,0x0,0x0) = 0 (0x0)
70018: cpuset_getid(0x2,0x2,0xffffffffffffffff,0x7fffffffe40c) = 0 (0x0)
70018: cpuset_setid(0x2,0xffffffffffffffff,0x0)  ERR#3 'No such process'
70018: cpuset_getaffinity(0x3,0x1,0xffffffffffffffff,0x20,0x7fffffffe2a0) = 0 (0x0)
70018: cpuset_setaffinity(0x3,0x1,0xffffffffffffffff,0x20,0x7fffffffe2a0) = 0 (0x0)
70018: SIGNAL 11 (SIGSEGV)
70018: sigprocmask(SIG_SETMASK,{ SIGSEGV },0x0)  = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2 },{ SIGSEGV }) = 0 (0x0)
70018: sigaction(SIGSEGV,{ SIG_DFL SA_RESTART ss_t },{ 0x802f1dd90 SA_RESTART|SA_SIGINFO ss_t }) = 0 (0x0)
70018: sigprocmask(SIG_SETMASK,{ SIGSEGV },0x0)  = 0 (0x0)
70018: thr_self(0x7fffffffd990)                  = 0 (0x0)
70018: thr_kill(104215,SIGSEGV)                  = 0 (0x0)
70018: sigreturn(0x7fffffffd9e0)                 = 0 (0x0)
70018: SIGNAL 11 (SIGSEGV)
70018: process killed, signal = 11

Segmentation fault when appid is configured

Snort 3 Beta faults when appid is configured.

snort_default.lua

APPID_PATH = '/usr/local/snort/appid'

snort.lua

appid =
{
    app_detector_dir = APPID_PATH,
    log_stats = true
}

appid version: 8373 or

# cat odp/version.conf 
VERSION=303

-- [2] ./pcaps/fuzz-2006-07-06-20811.pcap
++ [2] ./pcaps/fuzz-2006-07-09-13403.pcap
[Thread 0x7ffff2802700 (LWP 21563) exited]
[New Thread 0x7ffff2802700 (LWP 21567)]
#0  0x00007ffff647c1b0 in ?? () from /usr/local/lib/libluajit-5.1.so.2
#1  0x00007ffff647d861 in lua_rawgeti () from /usr/local/lib/libluajit-5.1.so.2
#2  0x00007ffff64b4e79 in luaL_unref () from /usr/local/lib/libluajit-5.1.so.2
#3  0x00000000006b26fe in free_detector_flow (userdata=0xcef81f0) at /root/sources/snort3/src/network_inspectors/appid/lua_detector_flow_api.cc:235
#4  0x0000000000673681 in snort::sflist_static_free_all (s=0x7ffff2ff0948, nfree=0x6b26bb <free_detector_flow(void*)>) at /root/sources/snort3/src/utils/sflsq.cc:294
#5  0x00000000006b3258 in LuaDetectorManager::~LuaDetectorManager (this=0x7fffef38d350, __in_chrg=<optimized out>) at /root/sources/snort3/src/network_inspectors/appid/lua_detector_module.cc:193
#6  0x00000000006b338b in LuaDetectorManager::terminate () at /root/sources/snort3/src/network_inspectors/appid/lua_detector_module.cc:219
#7  0x000000000069e7b3 in AppIdInspector::tterm (this=0x1ee1aa0) at /root/sources/snort3/src/network_inspectors/appid/appid_inspector.cc:172
#8  0x00000000005d9304 in snort::InspectorManager::thread_stop () at /root/sources/snort3/src/managers/inspector_manager.cc:664
#9  0x00000000005c742b in snort::Snort::thread_term () at /root/sources/snort3/src/main/snort.cc:824
#10 0x00000000005b1373 in Analyzer::operator() (this=0x15b63210, ps=0xfb0f480, run_num=7) at /root/sources/snort3/src/main/analyzer.cc:101
#11 0x000000000052954e in std::__invoke<Analyzer<Swapper*, unsigned short> > (__f=...) at /usr/include/c++/4.8.2/functional:234
#12 0x00000000005294ed in std::reference_wrapper<Analyzer>::operator()<Swapper*, unsigned short>(Swapper*&&, unsigned short&&) const (this=0x105544d0) at /usr/include/c++/4.8.2/functional:467
#13 0x0000000000529451 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (this=0x105544c0) at /usr/include/c++/4.8.2/functional:1732
#14 0x0000000000529309 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)>::operator()() (this=0x105544c0) at /usr/include/c++/4.8.2/functional:1720
#15 0x00000000005292a2 in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*, unsigned short)> >::_M_run() (this=0x105544a8) at /usr/include/c++/4.8.2/thread:115
#16 0x00007ffff528b070 in ?? () from /lib64/libstdc++.so.6
#17 0x00007ffff6b42e25 in start_thread () from /lib64/libpthread.so.0
#18 0x00007ffff49efbad in clone () from /lib64/libc.so.6

Null pointer dereference while parsing icmp6 packet

Hi,

Similar to #23, here's the stack trace:

Thread 2 "snort" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff1f37700 (LWP 6549)]
0x00000000004e9285 in (anonymous namespace)::Icmp6Codec::decode (this=0xcfd050, raw=..., codec=..., snort=...) at cd_icmp6.cc:138
138                 COPY4(ph6.sip, snort.ip_api.get_src()->get_ip6_ptr());
(gdb) bt
#0  0x00000000004e9285 in (anonymous namespace)::Icmp6Codec::decode (this=0xcfd050, raw=..., codec=..., snort=...) at cd_icmp6.cc:138
#1  0x000000000075b5c5 in PacketManager::decode (p=0x7fffec012100, pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "", cooked=false) at packet_manager.cc:153
#2  0x00000000004cfc81 in Snort::process_packet (p=0x7fffec012100, pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "", is_frag=false) at snort.cc:772
#3  0x00000000004d0091 in Snort::packet_callback (pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "") at snort.cc:883
#4  0x000000000077ea2d in pcap_process_loop (user=0x7fffec000a20 "", pkth=<optimized out>, data=<optimized out>) at daq_pcap.c:370
#5  0x00007ffff6c40ac4 in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#6  0x000000000077e49d in pcap_daq_acquire (handle=0x7fffec000a20, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<optimized out>) at daq_pcap.c:388
#7  0x000000000073e3b9 in SFDAQInstance::acquire (this=0x7fffec000980, max=0, callback=0x4cff56 <Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*)>) at sfdaq.cc:487
#8  0x00000000004bffa4 in Analyzer::analyze (this=0xcff030) at analyzer.cc:160
#9  0x00000000004bfd21 in Analyzer::operator() (this=0xcff030, ps=0xcff1d0) at analyzer.cc:98
#10 0x000000000048c323 in std::__invoke<Analyzer, Swapper*>(Analyzer&, Swapper*&&) (__f=...) at /usr/include/c++/5/functional:201
#11 0x000000000048c292 in std::reference_wrapper<Analyzer>::operator()<Swapper*>(Swapper*&&) const (this=0xcff240) at /usr/include/c++/5/functional:428
#12 0x000000000048c231 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0xcff238) at /usr/include/c++/5/functional:1531
#13 0x000000000048c04a in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::operator()() (this=0xcff238) at /usr/include/c++/5/functional:1520
#14 0x000000000048bf81 in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)> >::_M_run() (this=0xcff220) at /usr/include/c++/5/thread:115
#15 0x00007ffff62f6c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#16 0x00007ffff5b096ba in start_thread (arg=0x7ffff1f37700) at pthread_create.c:333
#17 0x00007ffff583f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
(gdb) p snort.ip_api.
A syntax error in expression, near `'.
(gdb) p snort.ip_api
$1 = {src = {{ip8 = '\000' <repeats 15 times>, ip16 = {0, 0, 0, 0, 0, 0, 0, 0}, ip32 = {0, 0, 0, 0}}, family = 0}, dst = {{ip8 = '\000' <repeats 15 times>, ip16 = {0, 0, 0, 0, 0, 0, 0, 0}, ip32 = {0, 0, 0, 0}}, family = 0}, iph = 0x0, type = ip::IpApi::IAT_NONE}
(gdb) p snort.ip_api.get_src()
$2 = (const SfIp *) 0x0

Missing building configure setup

The command ./configure throws error of Cannot find install-sh, install.sh, or shtool in ac-aux.
The issue can be solved by running

libtoolize --force
aclocal
autoheader
automake --force-missing --add-missing
autoconf
./configure

I am wondering can we include this in README or a automake script to run before ./configure?
Reference: https://askubuntu.com/questions/27677/cannot-find-install-sh-install-sh-or-shtool-in-ac-aux

Segmentation fault while processing udp packet

Similar to #23 but instead of a null deref, I see a deref of 0x8. The stack trace:

Commencing packet processing
++ [0] udp.pcap
[New Thread 0x7ffff1f37700 (LWP 90344)]

Thread 2 "snort" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff1f37700 (LWP 90344)]
0x00000000004ee848 in (anonymous namespace)::UdpCodec::decode (this=0xcfe2a0, raw=..., codec=..., snort=...) at cd_udp.cc:262
262                     COPY4(ph6.sip, ip6h->ip6_src.u6_addr32);
#0  0x00000000004ee848 in (anonymous namespace)::UdpCodec::decode (this=0xcfe2a0, raw=..., codec=..., snort=...) at cd_udp.cc:262
#1  0x000000000075b5c5 in PacketManager::decode (p=0x7fffec011f00, pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "", cooked=false) at packet_manager.cc:153
#2  0x00000000004cfc81 in Snort::process_packet (p=0x7fffec011f00, pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "", is_frag=false) at snort.cc:772
#3  0x00000000004d0091 in Snort::packet_callback (pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "") at snort.cc:883
#4  0x000000000077ea2d in pcap_process_loop (user=0x7fffec000a20 "", pkth=<optimized out>, data=<optimized out>) at daq_pcap.c:370
#5  0x00007ffff6c40ac4 in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#6  0x000000000077e49d in pcap_daq_acquire (handle=0x7fffec000a20, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<optimized out>) at daq_pcap.c:388
#7  0x000000000073e3b9 in SFDAQInstance::acquire (this=0x7fffec000980, max=0, callback=0x4cff56 <Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*)>) at sfdaq.cc:487
#8  0x00000000004bffa4 in Analyzer::analyze (this=0xcff030) at analyzer.cc:160
#9  0x00000000004bfd21 in Analyzer::operator() (this=0xcff030, ps=0xcff1d0) at analyzer.cc:98
#10 0x000000000048c323 in std::__invoke<Analyzer, Swapper*>(Analyzer&, Swapper*&&) (__f=...) at /usr/include/c++/5/functional:201
#11 0x000000000048c292 in std::reference_wrapper<Analyzer>::operator()<Swapper*>(Swapper*&&) const (this=0xcff240) at /usr/include/c++/5/functional:428
#12 0x000000000048c231 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0xcff238) at /usr/include/c++/5/functional:1531
#13 0x000000000048c04a in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::operator()() (this=0xcff238) at /usr/include/c++/5/functional:1520
#14 0x000000000048bf81 in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)> >::_M_run() (this=0xcff220) at /usr/include/c++/5/thread:115
#15 0x00007ffff62f6c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#16 0x00007ffff5b096ba in start_thread (arg=0x7ffff1f37700) at pthread_create.c:333
#17 0x00007ffff583f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
(gdb) p ip6h->ip6_src
Cannot access memory at address 0x8

incomplete figures in snort_manual.pdf

page 5 and 6

Null dereference while parsing a tcp packet

Hi,

I'd like to report a null deference in cd_tcp.cc while parsing a tcp packet. Here's the active crash trace:

0x00000000004e2aa4 in (anonymous namespace)::TcpCodec::decode (this=0xcfe1b0, raw=..., codec=..., snort=...) at cd_tcp.cc:193
193                 COPY4(ph6.sip, ip6h->get_src()->u6_addr32);
(gdb) bt
#0  0x00000000004e2aa4 in (anonymous namespace)::TcpCodec::decode (this=0xcfe1b0, raw=..., codec=..., snort=...) at cd_tcp.cc:193
#1  0x000000000075b5c5 in PacketManager::decode (p=0x7fffec011f00, pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "", cooked=false) at packet_manager.cc:153
#2  0x00000000004cfc81 in Snort::process_packet (p=0x7fffec011f00, pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "", is_frag=false) at snort.cc:772
#3  0x00000000004d0091 in Snort::packet_callback (pkthdr=0x7ffff1e62a80, pkt=0x7fffec0020e0 "") at snort.cc:883
#4  0x000000000077ea2d in pcap_process_loop (user=0x7fffec000a20 "", pkth=<optimized out>, data=<optimized out>) at daq_pcap.c:370
#5  0x00007ffff6c40ac4 in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#6  0x000000000077e49d in pcap_daq_acquire (handle=0x7fffec000a20, cnt=0, callback=<optimized out>, metaback=<optimized out>, user=<optimized out>) at daq_pcap.c:388
#7  0x000000000073e3b9 in SFDAQInstance::acquire (this=0x7fffec000980, max=0, callback=0x4cff56 <Snort::packet_callback(void*, _daq_pkthdr const*, unsigned char const*)>) at sfdaq.cc:487
#8  0x00000000004bffa4 in Analyzer::analyze (this=0xcff030) at analyzer.cc:160
#9  0x00000000004bfd21 in Analyzer::operator() (this=0xcff030, ps=0xcff1d0) at analyzer.cc:98
#10 0x000000000048c323 in std::__invoke<Analyzer, Swapper*>(Analyzer&, Swapper*&&) (__f=...) at /usr/include/c++/5/functional:201
#11 0x000000000048c292 in std::reference_wrapper<Analyzer>::operator()<Swapper*>(Swapper*&&) const (this=0xcff240) at /usr/include/c++/5/functional:428
#12 0x000000000048c231 in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0xcff238) at /usr/include/c++/5/functional:1531
#13 0x000000000048c04a in std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)>::operator()() (this=0xcff238) at /usr/include/c++/5/functional:1520
#14 0x000000000048bf81 in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<Analyzer> (Swapper*)> >::_M_run() (this=0xcff220) at /usr/include/c++/5/thread:115
#15 0x00007ffff62f6c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#16 0x00007ffff5b096ba in start_thread (arg=0x7ffff1f37700) at pthread_create.c:333
#17 0x00007ffff583f82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Input triggering the null deref will be sent to [email protected]. Fix is similar to issue #22.

Time change

Hello,
at this Sunday was time change at Europe(winter time). Overturned 1 hour back.
Now I am watching log and Snort still use old time:
# date
Mon Oct 29 08:27:04 CET 2018
in same moment:
10/29-09:26:51.356881 [] [112:1:1] "(arp_spoof) unicast ARP request" [] [Priority: 3] {ARP} -

is somehow possible set Snort so that the time will be synchronized with system time?

sctp.h not found

Easy to fix..just copy from the libdnet git repo from include/dnet to /usr/local/include/dnet/. But still..thought you'd wanna know.

In file included from /home/me/build/snort++/snort3/src/utils/dnet_header.h:44:0,
                 from /home/me/build/snort++/snort3/src/framework/parameter.cc:33:
/usr/local/include/dnet.h:22:23: fatal error: dnet/sctp.h: No such file or directory
compilation terminated.
[  6%] Building CXX object src/framework/CMakeFiles/framework.dir/mpse.cc.o
src/framework/CMakeFiles/framework.dir/build.make:182: recipe for target 'src/framework/CMakeFiles/framework.dir/parameter.cc.o' failed
make[2]: *** [src/framework/CMakeFiles/framework.dir/parameter.cc.o] Error 1
make[2]: *** Waiting for unfinished jobs....
In file included from /home/me/build/snort++/snort3/src/utils/dnet_header.h:44:0,
                 from /home/me/build/snort++/snort3/src/packet_io/active.cc:31:
/usr/local/include/dnet.h:22:23: fatal error: dnet/sctp.h: No such file or directory
compilation terminated.
src/packet_io/CMakeFiles/packet_io.dir/build.make:62: recipe for target 'src/packet_io/CMakeFiles/packet_io.dir/active.cc.o' failed
make[2]: *** [src/packet_io/CMakeFiles/packet_io.dir/active.cc.o] Error 1
CMakeFiles/Makefile2:1616: recipe for target 'src/packet_io/CMakeFiles/packet_io.dir/all' failed
make[1]: *** [src/packet_io/CMakeFiles/packet_io.dir/all] Error 2

error: invalid use of incomplete type ‘X509 {aka struct x509_st}’

Receiving these errors:

Making all in appid
make[4]: Entering directory '/root/tools/snort3/src/network_inspectors/appid'
make[5]: Entering directory '/root/tools/snort3/src/network_inspectors/appid'
  CXX      service_plugins/service_ssl.o
service_plugins/service_ssl.cc: In function ‘bool parse_certificates(ServiceSSLData*)’:
service_plugins/service_ssl.cc:496:38: error: invalid use of incomplete type ‘X509 {aka struct x509_st}’
             char* start = strstr(cert->name, COMMON_NAME_STR);
                                      ^~
In file included from /usr/include/openssl/x509.h:20:0,
                 from service_plugins/service_ssl.cc:28:
/usr/include/openssl/ossl_typ.h:119:16: note: forward declaration of ‘X509 {aka struct x509_st}’
 typedef struct x509_st X509;
                ^~~~~~~
service_plugins/service_ssl.cc:513:32: error: invalid use of incomplete type ‘X509 {aka struct x509_st}’
             start = strstr(cert->name, ORG_NAME_STR);
                                ^~
In file included from /usr/include/openssl/x509.h:20:0,
                 from service_plugins/service_ssl.cc:28:
/usr/include/openssl/ossl_typ.h:119:16: note: forward declaration of ‘X509 {aka struct x509_st}’
 typedef struct x509_st X509;
                ^~~~~~~
make[5]: *** [Makefile:1017: service_plugins/service_ssl.o] Error 1
make[5]: Leaving directory '/root/tools/snort3/src/network_inspectors/appid'
make[4]: *** [Makefile:1053: all-recursive] Error 1
make[4]: Leaving directory '/root/tools/snort3/src/network_inspectors/appid'
make[3]: *** [Makefile:518: all-recursive] Error 1
make[3]: Leaving directory '/root/tools/snort3/src/network_inspectors'
make[2]: *** [Makefile:694: all-recursive] Error 1
make[2]: Leaving directory '/root/tools/snort3/src'
make[1]: *** [Makefile:520: all-recursive] Error 1
make[1]: Leaving directory '/root/tools/snort3'
make: *** [Makefile:429: all] Error 2

From the following build log:

https://gist.github.com/cclements/0a49bc5cc1258a93bc67f85e36e67d22

install snort3-a4 with openssl1.1.0-pre6-dev

I reinstalled the ubuntu and that works.

When I try to install snort3-a4. I have installed many dependences includes the openssl. But I found that when I input "make -j 8". The shell showed me below.

service_plugins/service_ssl.cc: In function ‘int parse_certificates(ServiceSSLData*)’:
service_plugins/service_ssl.cc:514:32: error: invalid use of incomplete type ‘X509 {aka struct x509_st}’
             start = strstr(cert->name, COMMON_NAME_STR);
                                ^
In file included from /usr/local/include/openssl/buffer.h:13:0,
                 from /usr/local/include/openssl/x509.h:22,
                 from service_plugins/service_ssl.cc:28:
/usr/local/include/openssl/ossl_typ.h:118:16: note: forward declaration of ‘X509 {aka struct x509_st}’
 typedef struct x509_st X509;
                ^
service_plugins/service_ssl.cc:530:32: error: invalid use of incomplete type ‘X509 {aka struct x509_st}’
             start = strstr(cert->name, ORG_NAME_STR);
                                ^
In file included from /usr/local/include/openssl/buffer.h:13:0,
                 from /usr/local/include/openssl/x509.h:22,
                 from service_plugins/service_ssl.cc:28:
/usr/local/include/openssl/ossl_typ.h:118:16: note: forward declaration of ‘X509 {aka struct x509_st}’
 typedef struct x509_st X509;

That must be somethings wrong happened. I don't know how to fix it.
I also tried to search the problem in Google. Someone said that's because the program do not support the latest api of Openssl.

Unhandled array out of bounds exception in "appid peg counts"

When all appids number is greater than SF_APPID_MAX(40000), the output of openappid will like following.

--------------------------------------------------
Appid dynamic stats:
http: flows: 1, clients: 0, users: 0, payloads 0, misc: 0, incompatible: 0, failed: 0
baidu: flows: 0, clients: 0, users: 0, payloads 1, misc: 0, incompatible: 0, failed: 0
app7171: flows: 9, clients: 0, users: 0, payloads 0, misc: 0, incompatible: 94099791939216, failed: 3209
app7172: flows: 94099792608848, clients: 2828, users: 1065353216, payloads 3209, misc: 0, incompatible: 0, failed: 94099791459536
app7173: flows: 337, clients: 94099792606672, users: 211, payloads 1065353216, misc: 337, incompatible: 0, failed: 0
app7174: flows: 94099792049968, clients: 709, users: 94099792605216, payloads 445, misc: 1065353216, incompatible: 709, failed: 0
...
--------------------------------------------------

http and baidu are the correct output, but others are not.

I find that the output is printed by function AppIdPegCounts::print() in appid_peg_counts.cc. The very codes are as follows.

for (unsigned i = 0; i < app_num; i++)
{
    AppIdDynamicPeg* pegs = &appid_dynamic_sum[i];
    if (pegs->all_zeros())
        continue;

    std::string app_name = AppIdPegCounts::appid_detectors_info[i];
    snort::LogMessage("%s: ", app_name.c_str());
    pegs->print();
}

These codes will case out of bounds exception when variable i is bigger than the length of appid_dynamic_sum.

build error

When I tried to build snort++ on my 16.04 Ubuntu today I encountered an issue.

me@escher:~/Workspace/snort3/build$ make -j $(nproc) install
[ 0%] Building CXX object src/codecs/CMakeFiles/codecs.dir/codec_api.cc.o
[ 0%] Building CXX object src/codecs/root/CMakeFiles/root_codecs.dir/cd_eth.cc.o
[ 0%] Building CXX object src/connectors/tcp_connector/CMakeFiles/tcp_connector.dir/tcp_connector.cc.o
[ 0%] Building CXX object src/actions/CMakeFiles/ips_actions.dir/actions.cc.o
[ 0%] Building CXX object src/codecs/CMakeFiles/codecs.dir/codec_module.cc.o
[ 0%] Building CXX object src/actions/CMakeFiles/ips_actions.dir/ips_actions.cc.o
[ 0%] Building CXX object src/actions/CMakeFiles/ips_actions.dir/act_replace.cc.o
[ 0%] Built target codecs
[ 0%] Building CXX object src/connectors/tcp_connector/CMakeFiles/tcp_connector.dir/tcp_connector_module.cc.o
[ 0%] Building CXX object src/codecs/root/CMakeFiles/root_codecs.dir/cd_raw.cc.o
[ 0%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_arp.cc.o
[ 0%] Built target root_codecs
[ 0%] Building CXX object src/codecs/ip/CMakeFiles/ip_codecs.dir/cd_ipv4.cc.o
[ 0%] Built target tcp_connector
[ 0%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_default.cc.o
[ 0%] Building CXX object src/actions/CMakeFiles/ips_actions.dir/act_react.cc.o
[ 1%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_gtp.cc.o
[ 1%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_erspan2.cc.o
/home/me/Workspace/snort3/src/codecs/ip/cd_ipv4.cc: In member function ‘virtual bool {anonymous}::Ipv4Codec::decode(const snort::RawData&, snort::CodecData&, DecodeData&)’:
/home/me/Workspace/snort3/src/codecs/ip/cd_ipv4.cc:223:28: error: ‘DAQ_PKT_FLAG_REAL_ADDRESSES’ was not declared in this scope
if ((raw.pkth->flags & DAQ_PKT_FLAG_REAL_ADDRESSES) and codec.ip_layer_cnt == 1)
^
/home/me/Workspace/snort3/src/codecs/ip/cd_ipv4.cc:227:33: error: ‘const struct _daq_pkthdr’ has no member named ‘real_sIP’
real_src.set(&raw.pkth->real_sIP,
^
/home/me/Workspace/snort3/src/codecs/ip/cd_ipv4.cc:228:33: error: ‘DAQ_PKT_FLAG_REAL_SIP_V6’ was not declared in this scope
((raw.pkth->flags & DAQ_PKT_FLAG_REAL_SIP_V6) ? AF_INET6 : AF_INET));
^
/home/me/Workspace/snort3/src/codecs/ip/cd_ipv4.cc:229:33: error: ‘const struct _daq_pkthdr’ has no member named ‘real_dIP’
real_dst.set(&raw.pkth->real_dIP,
^
/home/me/Workspace/snort3/src/codecs/ip/cd_ipv4.cc:230:33: error: ‘DAQ_PKT_FLAG_REAL_DIP_V6’ was not declared in this scope
((raw.pkth->flags & DAQ_PKT_FLAG_REAL_DIP_V6) ? AF_INET6 : AF_INET));
^
src/codecs/ip/CMakeFiles/ip_codecs.dir/build.make:62: recipe for target 'src/codecs/ip/CMakeFiles/ip_codecs.dir/cd_ipv4.cc.o' failed
make[2]: *** [src/codecs/ip/CMakeFiles/ip_codecs.dir/cd_ipv4.cc.o] Error 1
CMakeFiles/Makefile2:598: recipe for target 'src/codecs/ip/CMakeFiles/ip_codecs.dir/all' failed
make[1]: *** [src/codecs/ip/CMakeFiles/ip_codecs.dir/all] Error 2
make[1]: *** Waiting for unfinished jobs....
[ 1%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_erspan3.cc.o
[ 1%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_ciscometadata.cc.o
[ 1%] Building CXX object src/actions/CMakeFiles/ips_actions.dir/act_reject.cc.o
[ 1%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_fabricpath.cc.o
[ 1%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_icmp4_ip.cc.o
[ 1%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_mpls.cc.o
[ 1%] Built target ips_actions
[ 1%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_ppp_encap.cc.o
[ 2%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_pppoe.cc.o
[ 2%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_trans_bridge.cc.o
[ 2%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_icmp6_ip.cc.o
[ 2%] Building CXX object src/codecs/link/CMakeFiles/link_codecs.dir/cd_vlan.cc.o
[ 2%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_llc.cc.o
[ 2%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_teredo.cc.o
[ 2%] Building CXX object src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_user.cc.o
In file included from /home/me/Workspace/snort3/src/codecs/misc/cd_user.cc:28:0:
/home/me/Workspace/snort3/src/packet_io/sfdaq.h:68:51: error: ‘DAQ_QueryFlow_t’ has not been declared
SO_PUBLIC int query_flow(const DAQ_PktHdr_t*, DAQ_QueryFlow_t*);
^
/home/me/Workspace/snort3/src/codecs/misc/cd_user.cc: In member function ‘virtual bool UserCodec::decode(const snort::RawData&, snort::CodecData&, DecodeData&)’:
/home/me/Workspace/snort3/src/codecs/misc/cd_user.cc:101:5: error: ‘DAQ_QueryFlow_t’ was not declared in this scope
DAQ_QueryFlow_t query { DAQ_USR_QUERY_PCI, 0, nullptr };
^
/home/me/Workspace/snort3/src/codecs/misc/cd_user.cc:103:61: error: ‘query’ was not declared in this scope
if ( SFDAQ::get_local_instance()->query_flow(raw.pkth, &query) != DAQ_SUCCESS or
^
/home/me/Workspace/snort3/src/codecs/misc/cd_user.cc:109:46: error: ‘query’ was not declared in this scope
const DAQ_UsrHdr_t* pci = (DAQ_UsrHdr_t*)query.value;
^
src/codecs/misc/CMakeFiles/misc_codecs.dir/build.make:206: recipe for target 'src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_user.cc.o' failed
make[2]: *** [src/codecs/misc/CMakeFiles/misc_codecs.dir/cd_user.cc.o] Error 1
make[2]: *** Waiting for unfinished jobs....
[ 2%] Built target link_codecs
CMakeFiles/Makefile2:653: recipe for target 'src/codecs/misc/CMakeFiles/misc_codecs.dir/all' failed
make[1]: *** [src/codecs/misc/CMakeFiles/misc_codecs.dir/all] Error 2
Makefile:149: recipe for target 'all' failed
make: *** [all] Error 2

I followed the steps you provided in the README but it failed, did i do something wrong ?

Barnyard2 and snort++ get errors

Hi,

I am trying to use Barnyard2 to insert in a database the information from the unified2 log file but I get the following error :
WARNING database [Database()]: Called with Event[0x0] Event Type [0] (P)acket [0x36996f0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x0] Event Type [0] (P)acket [0x9a58830], information has not been outputed.
WARNING database [Database()]: Called with Event[0x0] Event Type [0] (P)acket [0x36996f0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x0] Event Type [0] (P)acket [0x9a58830], information has not been outputed.

I tried with snort 2.x and it works perfectly.
I did not change the barnyard2 configuration, but I upgrade the snort version to snort++
And now barnyard does not work.

I think there is an issue with snort++ and how the unified2 log file is written but I dont know how to get more information to debug my issue.

Is someone already get this error?

THank you

inspector data_log file_log did not working

inspector data_log file_log did not working.How can I fix it?
extra plugins have been installed and run snort with data_log using --plugin-path /data/snort/lib/snort_extra
inspector appids seems working well because alert occurs when testing appids using rule "alert http (msg:"http"; sid:1000000001;)".
data.log and file.log have been created in the expected location.

Snort Version
,,_ -> Snort++ <-
o" )~ Version 3.0.0-a4 (Build 239) from 2.9.8-383
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2017 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 2.2.2
Using libpcap version 1.5.3
Using LuaJIT version 2.0.4
Using PCRE version 8.32 2012-11-30
Using ZLIB version 1.2.7
Using LZMA version 5.1.2alpha
Using OpenSSL 1.0.1e-fips 17 Nov 2016
snort config
data_log = { key = 'http_raw_uri' }
file_log = { log_pkt_time = true, log_sys_time = false }
base Statistics
file type stats (files)
Type Download Upload
RIFF( 24) 5 0
GIF( 62) 1 0
GIF( 63) 32 0
PNG( 69) 42 0
JPEG( 70) 43 0
JPEG(157) 55 0
Total 178 0
http_inspect
flows: 172
scans: 2219
reassembles: 6985
inspections: 1926
requests: 316
responses: 313
get_requests: 316
chunked: 51
uri_normalizations: 24
uri_coding: 10

cmake configure fails detection of libsafec /report of SafeC feature option; uses incorrect var SAFEC_ENABLED

with source from snort3/git

	cd snort3
	git log | head
		commit a8a93c26ae70fa5abca8daf547e41b229ad033fe
		Author: Michael Altizer (mialtize) <[email protected]>
		Date:   Thu Jan 31 15:11:09 2019 -0500

		    Merge pull request #1483 in SNORT/snort3 from ~BBANTWAL/snort3:batching to master

		    Squashed commit of the following:

		    commit ecb607e1f70f760b545101a4dfa687f184aa2c36
		    Author: Jonathan McDowell <[email protected]>

and prereq safec libs built/installed

	cd safeclib
	git log | head
		commit 8f68fa3021a30f4bae081d6a158e5b8514579b10
		Author: Reini Urban <[email protected]>
		Date:   Sun Dec 30 11:16:50 2018 +0100

		    Release v30122018 3.4.0

		    See ChangeLog

		commit 7f1bfd5839dffbb801cd471ec99e79d6fb1d2c87
		Author: Reini Urban <[email protected]>

	find /usr/local/lib64 /usr/local/include -type f | grep safec
		/usr/local/lib64/libsafec-3.4.la
		/usr/local/lib64/libsafec-3.4.so.3.0.4
		/usr/local/lib64/pkgconfig/safec-3.4.pc
		/usr/local/include/libsafec/safe_lib_errno.h
		/usr/local/include/libsafec/safe_lib.h
		/usr/local/include/libsafec/safe_config.h
		/usr/local/include/libsafec/safe_str_lib.h
		/usr/local/include/libsafec/safe_mem_lib.h
		/usr/local/include/libsafec/safe_types.h
		/usr/local/include/libsafec/safe_compile.h

	pkg-config --libs --cflags safec-3.4
		-I/usr/local/include/safec-3.4 -I/usr/local/lib64/safec-3.4/include -L/usr/local/lib64 -lsafec-3.4

configuring snort3

	mkdir build
	cd    build
	cmake ..  \
	 -DENABLE_SAFEC=1 \
	 -DSAFEC_INCLUDE_DIR=/usr/local/include/libsafec \
	 -DSAFEC_LIBRARIES=/usr/local/lib64/libsafec-3.4.so \
	 ...

fails to find/use safec,

	Feature options:
	    Flatbuffers:    OFF
	    Hyperscan:      ON
	    ICONV:          ON
	    LZMA:           ON
	    RPC DB:         Built-in
	    SafeC:          OFF    <==================
	    TCMalloc:       OFF
	    UUID:           ON

Noting,

	grep SAFE CMakeCache.txt
!!!		ENABLE_SAFEC:BOOL=1
		SAFEC_INCLUDE_DIR:PATH=/usr/local/include/libsafec
		SAFEC_LIBRARIES:FILEPATH=/usr/local/lib64/libsafec-3.4.so

is inconsistent with CMakeLists.txt

	...
	if (HAVE_SAFEC AND SAFEC_ENABLED)
	    message("\
	    SafeC:          ON")
	else ()
	    message("\
	    SafeC:          OFF")
	endif ()
	...

SAFEC_ENABLED appears nowhere else in Snort3 source

also, in

	configure_cmake.sh (sh)  
        --disable-safec)
            append_cache_entry ENABLE_SAFEC             BOOL false
            ;;
        --enable-safec)
            append_cache_entry ENABLE_SAFEC             BOOL true

editing

	CMakeLists.txt
-		if (HAVE_SAFEC AND SAFEC_ENABLED)
+		if (HAVE_SAFEC AND ENABLE_SAFEC)

then re-

	cmake .. \
	...

		Feature options:
		    Flatbuffers:    OFF
		    Hyperscan:      ON
		    ICONV:          ON
		    LZMA:           ON
		    RPC DB:         Built-in
		    SafeC:          ON      <===========
		    TCMalloc:       OFF
		    UUID:           ON

What I'm not yet clear on is this just a Feature Option report bug? Or if it goes deeper ...

Snort++ 3.0.0-245 - Systemd failure due to LUA library dependency

When trying to configure system for Snort, service does not start and exits with following error:

no file '/usr/lib64/lua/5.1/snort_config.so'
no file '/usr/local/lib/lua/5.1/loadall.so'

Snort starts and operates just fine from the command line. Below is output from snort -V
[root@snort ~]# /usr/local/snort/bin/snort -V

,,_ -> Snort++ <-
o" )~ Version 3.0.0 (Build 245) from 2.9.11
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2018 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 2.2.2
Using LuaJIT version 2.0.4
Using OpenSSL 1.0.2k-fips 26 Jan 2017
Using libpcap version 1.5.3
Using PCRE version 8.32 2012-11-30
Using ZLIB version 1.2.7
Using FlatBuffers 1.8.0
Using Hyperscan version 4.7.0 2018-06-04
Using LZMA version 5.2.2

Snort logging to file

Hey,
I am running snort3 on CentOS 7 and wanted to log the messages to a normal file. I tried several things and I only see it on stdout or with syslog. My last try was this one:
snort -c /etc/snort/config/snort.lua -i eth0 -l /var/log/snort -A alert_csv -D

Does anyone have the same issues? Or a solution for me?

snort2lua rule converter

This is a very minor issue but i noticed that that the snort2lua tool does not convert empty lines corretly.

Example:
$my_path/bin/snort2lua -c snort3-protocol-icmp.rules -r test.rules
diff snort3-protocol-icmp.rules test.rules

20d19
< 
169d167
<

snort++ using file magic for capture file from http traffic

hi,
i build snort++ on my ubuntu server, but there is no clarification about the snort.lua configuration
how i can use the file magic features ? and how can i specify the output format and path ?
and in snort 2.9.x we can set output path for each rules using ruletype option but there is no option for that in snort++
also i use snort2lua to convert my snort.conf to snort.lua and he does't take all option in .conf file like output format and ruletype
where i can get full snort.lua file ?

Reload via HUP fails and finally Segmentation fault

I'm trying to test snort++, It's version 3.0.0-243
I'm testing react action, but this is also happens with reject action.
IPS inline mode, NFQ dac, snort starts correctly, loads rules and sending react messages to clients as expected, but after sending -HUP to snort process it's reloading incorrectly, it doesn't load react {} and reject {} sections from config, so all react and reject rules are throwing errors, and any traffic, matching this rules leads to process crash with "Segmentation fault"

rules:

react tcp any any -> any any ( flow:to_server; msg:"test uri"; http_uri: path; content:"123"; sid:1; )
reject tcp any any -> any 80 (msg:"test2"; http_uri; content:"/test";sid:2;)

first startup:

# /opt/snort3/bin/snort -c /etc/snort3/snort.lua --create-pidfile --warn-all --plugin-path=/opt/snort3/lib/snort_extra -v -z 1 -Lalert_full -Q -Anone
...
Loading /etc/snort3/snort.lua:
        binder
        stream_tcp
        normalizer
        search_engine
        reject
        react
        ips
        latency
        http_inspect
        stream_ip
        active
        daq
        stream
        alert_full
Finished /etc/snort3/snort.lua.
Loading rules:
Loading main.conf.rules:
Loading /etc/snort3/rules/test.rules:
Finished /etc/snort3/rules/test.rules.
Finished main.conf.rules.
Finished rules.

right after -HUP:

** caught reload-config signal
.. reloading configuration
Loading /etc/snort3/snort.lua:
        binder
        stream_tcp
        normalizer
        search_engine
        ips
        latency
        http_inspect
        stream_ip
        active
        daq
        stream
Finished /etc/snort3/snort.lua.
Loading rules:
Loading main.conf.rules:
Loading /etc/snort3/rules/test.rules:
ERROR: /etc/snort3/rules/test.rules:4 unconfigured rule action 'react'
ERROR: /etc/snort3/rules/test.rules:7 unconfigured rule action 'reject'
Finished /etc/snort3/rules/test.rules.
Finished main.conf.rules.
Finished rules.

as you can see for some reasons it's not loading reject, react and alert_full after HUP, but this is the same config and rules.

and finally Segmentation fault in case of matching traffic.

also
react = { msg = true }
isn't working, it's always sending default message, but this is another story.

Shell for config Snort

I am creating a script to facilitate the configuration of Snort if someone wants to help.
https://github.com/M3nin0/Snort-Config

I'm not very good with shell then not to call errors

Thanks =D

snort3 / snort3 Goto Github PK

snort3's Introduction

Snort++

OVERVIEW

DEPENDENCIES

DOWNLOAD

BUILD SNORT

RUN SNORT

DOCUMENTATION

SQUEAL

snort3's People

Contributors

Stargazers

Watchers

Forkers

snort3's Issues

one rule

configuration

I reinstalled the ubuntu and that works.

Recommend Projects

Recommend Topics

Recommend Org