datmanslo/ubuntu-snort3-dev repository overview

GitHub⁠

⁠Ubuntu Snort3 Development Environment

A Docker-based development environment for building and testing Snort 3 (Snort++) on Ubuntu 24.04 LTS. This container includes all necessary dependencies for compiling Snort 3, libDAQ, and running unit tests.

⁠Features

• Based on Ubuntu 24.04 LTS
• Pre-installed build dependencies for Snort 3 and libDAQ
• Support for unit testing with CppUTest
• Development tools (git, gdb, vim, nano)
• Non-root user (snorty) for secure development
• Clean, minimal image with removed apt cache

⁠Building the Image

⁠Basic Build

docker build -t ubuntu-snort3-dev .

⁠Custom Ubuntu Version

You can specify a different Ubuntu version using the build argument:

docker build --build-arg UBUNTU_VERSION=22.04 -t ubuntu-snort3-dev:22.04 .

⁠Build with Custom Tag

docker build -t myusername/snort3-dev:latest .

⁠Usage

⁠Running the Container

⁠Interactive Shell

Start an interactive bash session:

docker run -it --rm ubuntu-snort3-dev

⁠With Volume Mounting

Mount a local directory to persist your work:

docker run -it --rm -v $(pwd)/workspace:/home/snorty/workspace ubuntu-snort3-dev

On Windows (PowerShell):

docker run -it --rm -v ${PWD}/workspace:/home/snorty/workspace ubuntu-snort3-dev

On Windows (Command Prompt):

docker run -it --rm -v %cd%/workspace:/home/snorty/workspace ubuntu-snort3-dev

⁠With Network Capabilities

For packet capture and network analysis:

docker run -it --rm --cap-add=NET_ADMIN --cap-add=NET_RAW ubuntu-snort3-dev

⁠Named Container

Run with a custom name for easier management:

docker run -it --name snort3-dev ubuntu-snort3-dev

To reconnect to the same container:

docker start -ai snort3-dev

⁠Common Docker Commands

# List running containers
docker ps

# List all containers (including stopped)
docker ps -a

# Stop a running container
docker stop snort3-dev

# Remove a stopped container
docker rm snort3-dev

# Remove the image
docker rmi ubuntu-snort3-dev

⁠Building Snort 3 Inside the Container

Once inside the container, follow these steps to build Snort 3 with unit test support:

⁠Build libDAQ

cd $HOME
git clone https://github.com/snort3/libdaq.git
cd libdaq
./bootstrap
./configure
sudo make install
sudo ldconfig

⁠(Optional) Build LibML

cd $HOME
git clone https://github.com/snort3/libml.git
cd libml
./configure.sh --prefix=/usr/local
cd build
sudo make -j8 install
sudo ldconfig

⁠Build Snort 3

cd $HOME
git clone https://github.com/snort3/snort3.git
cd snort3
./configure_cmake.sh --prefix=$HOME/install/snort3 --enable-unit-tests --enable-jemalloc
cd build
make -j$(nproc) install
export PATH=$PATH:$HOME/install/snort3/bin

⁠Verify Installation

# Check Snort version
$HOME/install/snort3/bin/snort -V

# Run all unit tests
$HOME/install/snort3/bin/snort --catch-test all

⁠Installed Dependencies

The container includes the following key packages:

• Build Tools: gcc, g++, make, cmake, autoconf, automake, libtool
• Snort Dependencies: libpcap-dev, libpcre2-dev, libdumbnet-dev, zlib1g-dev
• Advanced Features: libhyperscan-dev, libluajit-5.1-dev, libhwloc-dev
• Testing: libcpputest-dev
• Debugging: gdb
• Editors: vim, nano
• Version Control: git

For a complete list, see the Dockerfile.

⁠Environment Variables

The following environment variables are set in the container:

• DEBIAN_FRONTEND=noninteractive - Prevents interactive prompts during apt operations
• TZ=UTC - Sets timezone to UTC
• LANG=C.UTF-8 - Sets language encoding
• LC_ALL=C.UTF-8 - Sets locale encoding

⁠User Information

• Default User: snorty
• Default Password: oink
• Home Directory: /home/snorty
• User ID: 1000 (default)

⁠Troubleshooting

⁠Permission Issues

If you encounter permission issues with mounted volumes:

# Run with user matching your host UID
docker run -it --rm --user $(id -u):$(id -g) -v $(pwd)/workspace:/home/snorty/workspace ubuntu-snort3-dev

⁠Network Packet Capture

For network packet capture functionality, ensure you run with appropriate capabilities:

docker run -it --rm --cap-add=NET_ADMIN --cap-add=NET_RAW --network=host ubuntu-snort3-dev

⁠Contributing

Feel free to submit issues and enhancement requests!

⁠License

This project is provided as-is for development purposes.