@efahl - Congratulations on getting your snort code merged. Can you summarize a quick upgrading guide/process for users of the old config?
I am still using this setup for my snort:
/etc/config/firewall
...
config include
option enabled '1'
option type 'script'
option path '/etc/snort/snort-table.sh'
option fw4_compatible '1'
/etc/snort/short-table.sh
#!/bin/sh
verbose=false
nft list tables | grep -q 'snort' && nft flush table inet snort
nft -f - <<TABLE
table inet snort {
chain IPS {
type filter hook postrouting priority 225; policy accept;
ct state invalid drop;
# Add here accept or drop rules to bypass snort or drop traffic that snort not should see
# Note that if nat is enabled, snort will only see the address of the outgoing device for outgoing traffic,
# for example for wan port the wan ip address or if you are using vpn the device address of the virtual #adapter
oifname "eth1" tcp flags ack ct state established counter accept
#"eth0" must be changed to the appropriate wan port on the target system. A vpn needs a second rule with the name of the virtual vpn wan port.
counter queue flags bypass to 4-11
}
}
TABLE
$verbose && nft list table inet snort
exit 0
/etc/init.d/snort
#!/bin/sh /etc/rc.common
START=99
STOP=10
USE_PROCD=1
PROG=/usr/bin/snort
validate_snort_section() {
uci_validate_section snort snort "${1}" \
'config_dir:string' \
'interface:string'
}
start_service() {
local config_file interface
validate_snort_section snort || {
echo "validation failed"
return 1
}
procd_open_instance
procd_set_param env SNORT_LUA_PATH="$config_dir"
procd_set_param command $PROG -q -c "${config_dir%/}/snort.lua" --tweaks local
procd_set_param file $CONFIGFILE
procd_set_param respawn
procd_close_instance
}
stop_service()
{
service_stop ${PROG}
}
service_triggers()
{
procd_add_reload_trigger "snort"
procd_add_validation validate_snort_section
}
/etc/snort/local.lua
snort = {
['-Q'] = true,
['--max-packet-threads'] = 8,
}
suppress = {
-- this kills stuff in lxc
{
gid = 1, sid = 650, track = 'by_dst', ip = '10.9.8.101'
},
}
network = {
checksum_eval = 'none',
}
daq = {
module_dirs = { '/usr/lib/daq' },
inputs = { '4', '5', '6', '7', '8', '9', '10', '11' },
snaplen = 65531,
modules = {
{
name = 'nfq',
mode = 'inline',
variables = {
'queue_maxlen=8192',
'fail_open',
'fanout_type=LB',
'device=eth1'
}
}
}
}
ips = {
mode = inline,
variables = default_variables,
action_override = 'drop',
include = RULE_PATH .. '/snort.rules',
--include = RULE_PATH .. '/test.rules',
}
output.logdir = '/mnt/data'
alert_fast = {
file = true,
packet = false,
}
file_policy = {
enable_type = true,
enable_signature = true,
rules = {
use = {
verdict = 'log', enable_file_type = true, enable_file_signature = true
}
}
}
search_engine = {
search_method = "hyperscan",
offload_search_method ="hyperscan",
detect_raw_tcp = true,
}
detection = {
hyperscan_literals = true,
pcre_to_regex = true,
}
) and dropped the PR.