aboutsummaryrefslogtreecommitdiff
path: root/net/snort3
Commit message (Collapse)AuthorAge
* snort3: fix bug with unset variableEric Fahlgren2024-04-27
| | | | | | | | - Parameter not set in two places: /usr/bin/snort-mgr: eval: line 125: options: parameter not set Reported-by: @klingon888 Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: add patch and move to PCRE2Christian Marangi2024-04-27
| | | | | | | Add experimental patch and move package to PCRE2 as PCRE is EOL and won't receive any security updates anymore. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* snort3: use local tarballsRosen Penev2024-04-23
| | | | | | Avoids having a bad tarball name with just the version. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* snort3: update to 3.1.84.0John Audia2024-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Update to latest version 2. Remove redundant section in Makefile Changelog: https://github.com/snort3/snort3/releases/tag/3.1.84.0 ,,_ -*> Snort++ <*- o" )~ Version 3.1.84.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.14 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.13 30 Jan 2024 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3.1 Using Hyperscan version 5.4.2 2024-04-10 Using LZMA version 5.4.6 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: fix issue caused by ucode semantics changeEric Fahlgren2024-04-13
| | | | | | | | | | | A recent change in the ucode interpeter caused a failure when using the 'in' operator. https://github.com/jow-/ucode/commit/be767ae197babd656d4f5d9c2d5013e39ddbe656 Reported in a forum post by @graysky2. https://forum.openwrt.org/t/194218/28 Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: Fix compilation with GCC 13Hauke Mehrtens2024-03-24
| | | | | | This fixes a compile problem with GCC 13. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* snort3: update to 3.1.82.0John Audia2024-03-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/snort3/snort3/releases/tag/3.1.82.0 Removed patches/010-gcc13.patch ,,_ -*> Snort++ <*- o" )~ Version 3.1.82.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.14 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.13 30 Jan 2024 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3.1 Using Hyperscan version 5.4.2 2024-03-06 Using LZMA version 5.4.6 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: build against gperftools-runtimeJohn Audia2024-02-24
| | | | | | | | | | | | | | | | Should provide increases in snort3 performance thanks to thread- caching malloc provided by gperftools. Avg CPU usage is down. Another user reported higher throughput achieved with snort3 compiled with this on samba transfers on system with CPU-limited snort3 performance.[1] 1. https://forum.openwrt.org/t/some-help-with-a-makefile-gperftools/165656/22 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.81.0John Audia2024-02-24
| | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/snort3/snort3/releases/tag/3.1.81.0 ,,_ -*> Snort++ <*- o" )~ Version 3.1.81.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.14 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.13 30 Jan 2024 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3.1 Using Hyperscan version 5.4.2 2024-02-16 Using LZMA version 5.4.6 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: build against hyperscanJohn Audia2024-02-20
| | | | | | | | | | | | | | | Increases snort's IPS fast pattern matching by 2x (compared to the ac_full engine) and 3x (compared to ac_bfna). This is most noticeable for users of large rules sets and when doing deep flow inspection. For more see: https://blog.snort.org/2020/09/snort-3-hyperscan-.html Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: clean up ucode usageEric Fahlgren2024-02-14
| | | | | | | | - Add missing 'ucode' package dependency - Proto-ify the ConfigItem objects - Fix indentation and tab usage Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: improve script reliabilityEric Fahlgren2024-02-07
| | | | | | | - Enable missing variable checking by default - Explicitly check variables are defined in all 'rm' commands Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: finish up several incomplete capabilitiesEric Fahlgren2024-02-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reporting - Use json alert data for 10x speed improvement in report generation - Include both gid and sid, plus packet direction in report output - Add by-date incident filtering - Add verbose mode which displays actual rules triggered and their source - Attempt to look up host names from IPs in verbose mode - Clean up display of port number involved in incidents Rules - Complete downloader for subscription rules using oinkcode (only tested with snort.org's "free" tier subscription) - Auto-detect multiple rules files and include them in lua 'ips.rules' - Add '--backup' option to copy out current rules before installing new - Add '--persistent' option to 'snort-rules', storing in persistent location CLI interface - Completely rework command line option parsing in all user scripts - Allow options and commands to be in any order on command line - Add long-form names for all options ('--help' for '-h' and so on) - Detect errors properly in options, enhance help pages Bug fixes - Use 'mkdir -p' on all directory creation - Use proper tmp directory from 'snort.snort.temp_dir' everywhere Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: update to 3.1.78.0John Audia2024-01-19
| | | | | | | | | | | | | | | | | | | | | | | | | Upstream bump ,,_ -*> Snort++ <*- o" )~ Version 3.1.78.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.14 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.12 24 Oct 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3 Using Hyperscan version 5.4.2 2024-01-15 Using LZMA version 5.4.4 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: add missing action-override optionEric Fahlgren2024-01-02
| | | | | | | | | Allow use of rules as-defined, and don't override their actions. This is generally the best way to use the ruleset, and overriding their actions should only be undertaken when you fully understand how it affects their use. Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: compile with lzma supportJohn Audia2024-01-02
| | | | | | | | | | | | | | | | | | | | This PR adds the ability of snort to process rules that target swf and pdf files requiring lzma decompression to look for malicious payloads therein. This change only increases the size of the snort3 executable by a fraction of a KB and the added dependency of liblzma (based on currently offered 5.4.4-1) is only a 169 KB shared object. Based on CPU requirements of snort, x86 users likely represent the majority user-base and space their rootfs is not an issue as it may be for lower-powered SoCs. Size of snort3-3.1.76.0-2: 7354403 bytes Size of snort3-3.1.76.0-3: 7354435 bytes Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.77.0John Audia2023-12-23
| | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/snort3/snort3/releases/tag/3.1.77.0 ,,_ -*> Snort++ <*- o" )~ Version 3.1.77.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.13 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.12 24 Oct 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3 Using Hyperscan version 5.4.2 2023-12-20 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: add missing config include and general cleanupEric Fahlgren2023-12-16
| | | | | | | | | | | | | - Delete legacy configuration files homenet.lua and local.lua - Add snort config 'include' to allow user customizations in the lua - Enhance 'check' to test generated nftables file - Suppress inclusion of rules file when doing silent config check - Suppress warnings on configuration check unless '-v'erbose - Replace text logging with json logging to reduce footprint and make reports easier - Fix some typos in the snort.uc template - Fix up some error messages suggesting solutions Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: add myself as a co-maintainerJohn Audia2023-12-13
| | | | | | | | Michael invited me to co-maintain[1]. 1. https://github.com/openwrt/packages/pull/22830#issuecomment-1848997029 Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.76.0John Audia2023-12-08
| | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/snort3/snort3/releases/tag/3.1.76.0 ,,_ -*> Snort++ <*- o" )~ Version 3.1.76.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.13 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.12 24 Oct 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3 Using Hyperscan version 5.4.2 2023-12-03 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: complete reworkEric Fahlgren2023-12-03
| | | | | | | | | - Add many options to config file. - Move rules and generated snort.lua to /tmp. - Add script for downloading rules. - Add preliminary reporting capabilites. Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
* snort3: update to 3.1.75.0John Audia2023-12-01
| | | | | | | | | | | | | | | | | | | | | | | | Upstream bump ,,_ -*> Snort++ <*- o" )~ Version 3.1.75.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.13 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.12 24 Oct 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3 Using Hyperscan version 5.4.2 2023-11-20 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: fix compilation with gcc13Rosen Penev2023-11-18
| | | | | | Missing header. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* snort3: update to 3.1.74.0John Audia2023-11-09
| | | | | | | | | | | | | | | | | | | | | | | | Upstream bump ,,_ -*> Snort++ <*- o" )~ Version 3.1.74.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.13 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.12 24 Oct 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3 Using Hyperscan version 5.4.2 2023-11-08 Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.73.0John Audia2023-10-28
| | | | | | | | | | | | | | | | | | | | | | | | Upstream bump Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne ,,_ -*> Snort++ <*- o" )~ Version 3.1.73.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.12 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.11 19 Sep 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.3 Using Hyperscan version 5.4.2 2023-10-26 Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.71.0John Audia2023-09-27
| | | | | | | | | | | | | | | | | | | | | | Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne ,,_ -*> Snort++ <*- o" )~ Version 3.1.71.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.12 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.11 19 Sep 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.2.13 Using Hyperscan version 5.4.2 2023-09-23 Signed-off-by: John Audia <therealgraysky@proton.me>
* treewide: add HAS_LUAJIT_ARCH dependency to luajit userChristian Marangi2023-09-25
| | | | | | | Add HAS_LUAJIT_ARCH dependency to any user of luajit to fix circular dependency limitation. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* snort3: update to 3.1.70.0John Audia2023-09-14
| | | | | | | | | | | | | | | | | | | | | | Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne ,,_ -*> Snort++ <*- o" )~ Version 3.1.70.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.12 Using LuaJIT version 2.1.0-beta3 Using OpenSSL 3.0.10 1 Aug 2023 Using libpcap version 1.10.4 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.2.13 Using Hyperscan version 5.4.2 2023-09-07 Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.69.0John Audia2023-09-03
| | | | | | | | | | Upstream bump Build system: x86/64 Build-tested: x86/64/AMD Cezanne Run-tested: x86/64/AMD Cezanne Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.67.0John Audia2023-08-04
| | | | | | Upstream bump Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.66.0John Audia2023-07-22
| | | | | | | | | | Upstream bump Build system: x86/64 Build-tested: x86/64 Run-tested: x86/64 Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.65.0John Audia2023-07-10
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: x86_64/AMD 5800U Run-tested: x86_64/AMD 5800U Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.64.0John Audia2023-06-30
| | | | | | Upstream bump Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.63.0John Audia2023-06-05
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.62.0John Audia2023-05-23
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.61.0John Audia2023-05-08
| | | | | | | | | | | | | | Upstream bump Removed upstreamed patch: 900-fix_build_for_archs_contain_plus.patch[1] 1. https://github.com/snort3/snort3/commit/4de62ca9b9bfea4049ebe373a07076284b121bfe Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.60.0John Audia2023-04-24
| | | | | | Upstream bump Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.59.0John Audia2023-04-11
| | | | | | Upstream bump Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.58.0John Audia2023-03-30
| | | | | | Upstream bump Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.57.0John Audia2023-03-14
| | | | | | Upstream bump Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.56.0John Audia2023-03-12
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.53.0John Audia2023-01-28
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.52.0John Audia2023-01-21
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.51.0John Audia2023-01-21
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.50.0John Audia2022-12-22
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.49.0John Audia2022-12-22
| | | | | | | | | | Upstream bump Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: minor tweaks to local.luaJohn Audia2022-12-22
| | | | | | | | | * Use Boolean true for enable inline mode which is more intuitive that older '' * Add skeleton section for openappid since it has been merged[1] 1. https://github.com/openwrt/packages/commit/2d4e7d5fd343652d0852337184d56522ef5af83d Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: unified configs: local.lua and homenet.luaJohn Audia2022-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds /etc/snort/local.lua and /etc/snort/homenet.lua for user defined config options which is more simplistic than modifying upstream files directly. That can be tedious and decisive to maintain in sync with upstream changes. The init script has been adjusted accordingly. Acknowledgment to amish who maintains the Arch Linux snort-nfqueue package[1] for these ideas and initial code. Another modification is dropping the following args in the call to /usr/bin/snort by the init system as these options are provided in /etc/snort/local.lua: * --daq-dir /usr/lib/daq/ * -A "$alert_module" Instructions to configure snort3: 1. Edit /etc/snort/homenet.lua and redefine HOME_NET and EXTERNAL_NET, for example: HOME_NET = [[ 10.9.8.0/24 192.168.1.0/24 ]] EXTERNAL_NET = "!$HOME_NET" 2. Edit /etc/snort/local.lua to setup options unique to your use case of snort. The default ones I included should be sane for the role of IDS (alert only), but users may easily uncomment some options therein to use IPS (drop) mode. 3. Install or symlink rules to /etc/snort/rules/snort.rules and optionally edit /etc/snort/local.lua to define extra rules files if not using a unified 'snort.rules' References: 1. https://aur.archlinux.org/packages/snort-nfqueue Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.48.0-1John Audia2022-12-06
| | | | | | | | | | Had to add a patch to allow builds of targets containing '+' in their dir name Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
* snort3: update to 3.1.47.0-1John Audia2022-11-29
| | | | | | | | Build system: x86_64 Build-tested: bcm2711/RPi4B Run-tested: bcm2711/RPi4B Signed-off-by: John Audia <therealgraysky@proton.me>
Powered by cgit, Themed by Ted Yin.