Hi,
did anyone try (or is anyone trying) to have opkg package snort3 fully working on OpenWrt ?
I did install it via opkg, it apparently works fine if I let it run without it's full config, i.e. running it from command line directly from the bin exec (not init script), with most of its params but not the config file:
root@OpenWrt:/etc/snort/etc# /usr/bin/snort -v --daq-dir /usr/lib/daq/ -i br-lan -R /etc/snort/rules/local.rules -A alert_fast -s 65535 -k none -l /log/snort/ -T
--------------------------------------------------
o")~ Snort++ 3.0.0-247
--------------------------------------------------
Loading rules:
Loading /etc/snort/rules/local.rules:
Finished /etc/snort/rules/local.rules.
Finished rules.
--------------------------------------------------
rule counts
total rules loaded: 1
text rules: 1
option chains: 1
chain headers: 1
--------------------------------------------------
port rule counts
tcp udp icmp ip
any 0 0 1 0
total 0 0 1 0
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
where my custom local.rules file includes only the classic ICMP test rule. And if I let it really run, it works by detecting my test pings.
The problem arises when I feed it the default snort config (taken from the snort website along with the registered ruleset). That's needed since the opkg package doesn't include a default config to use.
Running it with the config file param, I get this:
Loading /etc/snort/etc/snort.lua:
FATAL: can't init /etc/snort/etc/snort.lua: /etc/snort/etc/snort.lua:30: attempt to call global 'include' (a nil value)
Fatal Error, Quitting..
where the culprit line states:
include 'snort_defaults.lua'
which is a file that does exist, next to the snort.lua config file. I've tried several attempts like forcing the path (no change), commenting the line (config is deemed incomplete), including its content in the snort.lua (no real change), etc. No success so far.
Anyone any hint ?
P.S. Just as a side note, snort 2.9 seems to run finely instead. It's just that most updated guides I've looked at (for my purposes of having a modern working dashboard somewhere) now refer to snort3 nowadays, and it actually deserve some attempts.