Re: Error in registered TalosLightSPD ruleset released on 2026-03-24?

[Dheeraj Gupta via Snort-devel <snort-devel () lists snort org>]

Following up on this,

The new ruleset released on 2026-03-26 also causes the same error. Although
the reference in load_ips.lua has been removed, there is now a reference to
3.1.25.0 in

policies/common/ruledirs.conf.lua

With the latest ruleset, that line needs to be commented or the sensor will
not start.

Once again I am requesting the signature release admins to let us know if
there is something missing in the registered ruleset (The directory for
rules/3.1.25.0) which we need to manually account for or is this a bug at
Snort's end?

Thanks,
Dheeraj

On Thu, 26 Mar 2026 at 13:56, Dheeraj Gupta <dheeraj.gupta4 () gmail com>
wrote:

> Hi,
>
> We are using registered ruleset for Snort. After downloading the latest
> LightSPD ruleset released on 2026-03-24, our sensor failed to start up with
> an error
>
> ERROR: ips.rules:6 can't open ../../rules/3.1.25.0/includes.rules
> ERROR: ips.states:6 can't open ../../rules/
> 3.1.25.0/rulestates-security-ips.states
>
> Looking at the the file lightspd/policies/common/load_ips.lua in the
> release, there is a reference to 3.1.25 (which was not there in older
> release)
>
> if TALOS.functions.minsnortver_str("3.1.25.0-0") then
>    table.insert(ruleDirs, "../../rules/3.1.25.0")
> end
>
> while there is no 3.1.25.0 subdirectory in the rules/
>
> Commenting out the above 3 lines allows sensor to start. Is this a problem
> with only the registered ruleset?
>
> I initially posted this in snort-sigs list but cross-posting here as no
> response was received on that list
>
> Thanks,
> Dheeraj
_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!