<div dir="ltr"><div dir="ltr">Someone tell me? I need your help.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org">oisf-users-request@lists.openinfosecfoundation.org</a>> 于2019年9月27日周五 下午1:45写道：<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send Oisf-users mailing list submissions to<br>
<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org" target="_blank">oisf-users-request@lists.openinfosecfoundation.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:oisf-users-owner@lists.openinfosecfoundation.org" target="_blank">oisf-users-owner@lists.openinfosecfoundation.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Oisf-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Rule updates (Jason Ish)<br>
2. Re: [EXT] Re: 4.1.5 Startup Error (jt)<br>
3. Re: [EXT] Re: 4.1.5 Startup Error (Cloherty, Sean E)<br>
4. Suricata Lua API (stack overflow) (Shell_Xu)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Thu, 26 Sep 2019 09:13:50 -0600<br>
From: Jason Ish <<a href="mailto:jason.ish@oisf.net" target="_blank">jason.ish@oisf.net</a>><br>
To: <a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br>
Subject: Re: [Oisf-users] Rule updates<br>
Message-ID: <<a href="mailto:d4c58f5c-b937-27ea-6a5a-b2c0e7d84953@oisf.net" target="_blank">d4c58f5c-b937-27ea-6a5a-b2c0e7d84953@oisf.net</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 2019-09-26 8:12 a.m., David Decker wrote:<br>
> All,<br>
> <br>
> I have a few off-line systems running in different location with limited<br>
> bandwidth and would like to keep them all on the same rule sets. <br>
> <br>
> If I have a "master" for lack of better terms with tuned rule sets and<br>
> newest rules, is it possible to just copy the /rules directory, or more<br>
> files required? <br>
> <br>
> Would this be possible instead of having to send out the ET rules, VRT<br>
> rules, custom rules to each for them to run suricata-update?<br>
<br>
Yes. Its just files so you are pretty flexible to do what you want.<br>
<br>
I've heard of use cases where suricata-update is used on one machine,<br>
and the resulting /var/lib/suricata/rules/suricata.rules is then pushed<br>
out to sensors with tools like Ansible, Salt, etc. Of course you could<br>
just use scp, or whatever. Just remember to SIGUSR2, or use suricatasc<br>
reload-rules to reload your rules after placing the new file in place.<br>
<br>
<br>
Jason<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 26 Sep 2019 11:39:54 -0400<br>
From: jt <<a href="mailto:jtfas90@gmail.com" target="_blank">jtfas90@gmail.com</a>><br>
To: "Cloherty, Sean E" <<a href="mailto:scloherty@mitre.org" target="_blank">scloherty@mitre.org</a>>, "<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>"<br>
<<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>>, "<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>"<br>
<<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
Subject: Re: [Oisf-users] [EXT] Re: 4.1.5 Startup Error<br>
Message-ID: <<a href="mailto:81e36d6ece895ce7981e03d68316d19f22b8bbec.camel@gmail.com" target="_blank">81e36d6ece895ce7981e03d68316d19f22b8bbec.camel@gmail.com</a>><br>
Content-Type: text/plain; charset="UTF-8"<br>
<br>
On Thu, 2019-09-26 at 14:26 +0000, Cloherty, Sean E wrote:<br>
> I was under the impression that the install included its own libhtp<br>
> package. <br>
> <br>
Are you installing from the 4.1.5 tarball? If so, you're right libhtp<br>
is bundled.<br>
<br>
> Is it possible that installing 4.1.5 after 5.0.0beta1 is causing<br>
> this?<br>
<br>
For what it's worth, we run 4.1.x and master branch/5.x side by side<br>
and haven't seen this. <br>
<br>
That being said depending on install paths and uninstall/install<br>
methods there are some odd things going on.<br>
<br>
JT<br>
> Thanks.<br>
> <br>
> -----Original Message-----<br>
> From: Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>><br>
> On Behalf Of Victor Julien<br>
> Sent: Thursday, September 26, 2019 9:43 AM<br>
> To: <a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br>
> Subject: [EXT] Re: [Oisf-users] 4.1.5 Startup Error<br>
> <br>
> On 26-09-19 15:24, Cloherty, Sean E wrote:<br>
> > Anybody else seeing this ? I get the following error following a<br>
> > new <br>
> > install of 4.1.5 – > undefined symbol: htp_config_set_lzma_memlimit<br>
> > <br>
> > <br>
> > <br>
> > I am running on CentOS 7 and here is my configuration statement -<br>
> > <br>
> > <br>
> > <br>
> > ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var <br>
> > --with-libhs-includes=/usr/local/include/hs/<br>
> > --with-libhs-libraries=/usr/local/lib/<br>
> > --with-liblzma-includes=/usr/include/ --enable-gccprotect <br>
> > --enable-gccprofile --enable-gccmarch-native --enable-profiling <br>
> > --enable-lua --enable-geoip --enable-rust --enable-unix-socket<br>
> > <br>
> > <br>
> > <br>
> > Any ideas ?<br>
> <br>
> Could you be having a outdated libhtp checkout in the suricata<br>
> directory?<br>
> <br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" rel="noreferrer" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" rel="noreferrer" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
> <br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 26 Sep 2019 20:59:33 +0000<br>
From: "Cloherty, Sean E" <<a href="mailto:scloherty@mitre.org" target="_blank">scloherty@mitre.org</a>><br>
To: jt <<a href="mailto:jtfas90@gmail.com" target="_blank">jtfas90@gmail.com</a>>, "<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>" <<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>>,<br>
"<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>"<br>
<<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
Subject: Re: [Oisf-users] [EXT] Re: 4.1.5 Startup Error<br>
Message-ID:<br>
<<a href="mailto:SN6PR0901MB2400D5F863633A624C57D592A8860@SN6PR0901MB2400.namprd09.prod.outlook.com" target="_blank">SN6PR0901MB2400D5F863633A624C57D592A8860@SN6PR0901MB2400.namprd09.prod.outlook.com</a>><br>
<br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I think I've fixed this now.<br>
<br>
I installed the latest libhtp package from the OISF github site, extracted a new copy of the suricata tarball files, recompiled, and now it is looking good. <br>
<br>
<br>
Sean<br>
-----Original Message-----<br>
From: jt <<a href="mailto:jtfas90@gmail.com" target="_blank">jtfas90@gmail.com</a>> <br>
Sent: Thursday, September 26, 2019 11:40 AM<br>
To: Cloherty, Sean E <<a href="mailto:scloherty@mitre.org" target="_blank">scloherty@mitre.org</a>>; <a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>; <a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br>
Subject: Re: [Oisf-users] [EXT] Re: 4.1.5 Startup Error<br>
<br>
On Thu, 2019-09-26 at 14:26 +0000, Cloherty, Sean E wrote:<br>
> I was under the impression that the install included its own libhtp <br>
> package.<br>
> <br>
Are you installing from the 4.1.5 tarball? If so, you're right libhtp is bundled.<br>
<br>
> Is it possible that installing 4.1.5 after 5.0.0beta1 is causing this?<br>
<br>
For what it's worth, we run 4.1.x and master branch/5.x side by side and haven't seen this. <br>
<br>
That being said depending on install paths and uninstall/install methods there are some odd things going on.<br>
<br>
JT<br>
> Thanks.<br>
> <br>
> -----Original Message-----<br>
> From: Oisf-users <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank">oisf-users-bounces@lists.openinfosecfoundation.org</a>><br>
> On Behalf Of Victor Julien<br>
> Sent: Thursday, September 26, 2019 9:43 AM<br>
> To: <a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a><br>
> Subject: [EXT] Re: [Oisf-users] 4.1.5 Startup Error<br>
> <br>
> On 26-09-19 15:24, Cloherty, Sean E wrote:<br>
> > Anybody else seeing this ? I get the following error following a <br>
> > new install of 4.1.5 – > undefined symbol: <br>
> > htp_config_set_lzma_memlimit<br>
> > <br>
> > <br>
> > <br>
> > I am running on CentOS 7 and here is my configuration statement -<br>
> > <br>
> > <br>
> > <br>
> > ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var <br>
> > --with-libhs-includes=/usr/local/include/hs/<br>
> > --with-libhs-libraries=/usr/local/lib/<br>
> > --with-liblzma-includes=/usr/include/ --enable-gccprotect <br>
> > --enable-gccprofile --enable-gccmarch-native --enable-profiling <br>
> > --enable-lua --enable-geoip --enable-rust --enable-unix-socket<br>
> > <br>
> > <br>
> > <br>
> > Any ideas ?<br>
> <br>
> Could you be having a outdated libhtp checkout in the suricata <br>
> directory?<br>
> <br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" rel="noreferrer" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" rel="noreferrer" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
> <br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Fri, 27 Sep 2019 13:44:54 +0800<br>
From: Shell_Xu <<a href="mailto:xuh881026@gmail.com" target="_blank">xuh881026@gmail.com</a>><br>
To: Open Information Security Foundation<br>
<<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank">oisf-users@lists.openinfosecfoundation.org</a>><br>
Subject: [Oisf-users] Suricata Lua API (stack overflow)<br>
Message-ID:<br>
<CAHY=<a href="mailto:VAom8Fqae%2BXb0A4oQGsCP3hUJCTL8X%2B_J9G1LJrcXg81DQ@mail.gmail.com" target="_blank">VAom8Fqae+Xb0A4oQGsCP3hUJCTL8X+_J9G1LJrcXg81DQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
HI, Suricata Team:<br>
<br>
I tried to use Lua scripts to audit all HTTP traffic, but after the<br>
script runs for about 30 seconds, the program automatically exits and<br>
outputs the following message: PANIC: unprotected error in call to Lua API<br>
(stack overflow).Since I don't want to log all HTTP headers, I didn't<br>
enable the dump-all-headers option.Lua scripts were used to implement my<br>
needs.But obviously, I have a problem now, can anyone help me?<br>
Is this problem caused by Lua scripts unable to withstand HTTP traffic?<br>
<br>
Traffic 1.5Gbpps<br>
CPU: 1 CPU 36 core<br>
Memory: 60G<br>
Suricata 5.0.0-rc1<br>
<br>
My lua script code is in the attachment, please correct me my mistake, any<br>
help makes sense to me.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190927/8c758759/attachment.html" rel="noreferrer" target="_blank">http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190927/8c758759/attachment.html</a>><br>
-------------- next part --------------<br>
A non-text attachment was scrubbed...<br>
Name: http_audit_demo.lua<br>
Type: application/octet-stream<br>
Size: 5692 bytes<br>
Desc: not available<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190927/8c758759/attachment.obj" rel="noreferrer" target="_blank">http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190927/8c758759/attachment.obj</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@lists.openinfosecfoundation.org" target="_blank">Oisf-users@lists.openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Oisf-users Digest, Vol 118, Issue 28<br>
*******************************************<br>
</blockquote></div></div>