snort: disabled rules are not applied until next rule download

[filippocarletti]

After disabling a rule, it continues to alert.

Steps to reproduce

• Disable a rule
• Trigger an alert for the disabled rule
• Or check if the rule is in /var/ns-snort/rules/snort.rules

Expected behavior

No alert

Actual behavior

The rule is still in enabled

Components

NethSecurity 8-24.10.0-ns.1.5.0 r28427-6df0e3d02a
snort3 - 3.6.2.0-r1

See also

root@firewall:~# uci show snort | grep disabled
snort.snort.ns_disabled_rules='1,54577,SERVER-OTHER Microsoft Windows DNS server remote integer overflow attempt'
root@firewall:~# grep 54577 /var/ns-snort/rules/snort.rules 
block tcp $EXTERNAL_NET 53 -> $HOME_NET any ( msg:"SERVER-OTHER Microsoft Windows DNS server remote integer overflow attempt"; flow:to_client,established; content:"|FF|",depth 1; byte_test:1,=,0,4,bitmask 0x78; content:"|00 18|",depth 40,offset 22; metadata:policy balanced-ips drop,policy max-detect-ips drop,policy security-ips drop; service:dns; reference:cve,2020-1350; reference:url,portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-1350; classtype:attempted-user; sid:54577; rev:4; )
root@firewall:~# ls -l /etc/config/snort 
-rw-------    1 root     root           791 Apr  9 12:17 /etc/config/snort
root@firewall:~# ls -l /var/ns-snort/rules/snort.rules 
-rw-r--r--    1 root     root      10576428 Apr  9 09:48 /var/ns-snort/rules/snort.rules

[filippocarletti]

Workaround: /usr/bin/ns-snort-rules --download --restart
Can't we adjust rules without downloading them again?

[Tbaile]

QA Image: 24.10.0-ns.1.5.1-6-gb3f3e7e7
Check issue does not reproduce
Also, check testing mode following the new README.