Merge pull request #1075 in SNORT/snort3 from misc_update to master

Squashed commit of the following:

commit f5ec7aa483757573d3f99486a3dbfce9ce39de4a
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Mon Nov 27 13:40:36 2017 -0500

    stream_ip: fix non-frag counting

commit b8712168a7f0bb744ecd46fcbf4b934b3798e770
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Mon Nov 27 08:50:41 2017 -0500

    ips options: error if lookup fails due to bad case, typos, etc.

    thanks to Noah Dietrich <noah_dietrich@86penny.org> for reporting the issue

commit 30ea59db4a0b0e50985e5740f8ff4f0be9dd06ae
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Mon Nov 27 08:14:59 2017 -0500

    alert_json: tcp_ack, tcp_seq, and tcp_win are (base 10) integers

commit ad40486ab8ddfa1584df015792624caeb14dbd63
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Sun Nov 26 08:04:47 2017 -0500

    stream: change tcp idle timeout to 3600 to match 2.X nominal timeout

commit 0436867d413467160d37597f196f8f661d62c885
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Fri Nov 24 16:18:53 2017 -0500

    port_scan: fix flow checks
    port_scan: add alert_all to make alerting on all events in window optional

diff --git a/extra/src/loggers/alert_json/alert_json.cc b/extra/src/loggers/alert_json/alert_json.cc
index 062d06d4eccbbf5c513216759b42f0150ac66897..c319d7d94c41b4e3ed2272b6809375ca38d252ba 100644 (file)
--- a/extra/src/loggers/alert_json/alert_json.cc
+++ b/extra/src/loggers/alert_json/alert_json.cc
@@ -481,7 +481,7 @@ static bool ff_tcp_ack(Args& a)
     if (a.pkt->ptrs.tcph )
     {
         print_label(a, "tcp_ack");
-        TextLog_Print(json_log, "0x%lX", (u_long)ntohl(a.pkt->ptrs.tcph->th_ack));
+        TextLog_Print(json_log, "%u", ntohl(a.pkt->ptrs.tcph->th_ack));
         return true;
     }
     return false;
@@ -517,7 +517,7 @@ static bool ff_tcp_seq(Args& a)
     if (a.pkt->ptrs.tcph )
     {
         print_label(a, "tcp_seq");
-        TextLog_Print(json_log, "0x%lX", (u_long)ntohl(a.pkt->ptrs.tcph->th_seq));
+        TextLog_Print(json_log, "%u", ntohl(a.pkt->ptrs.tcph->th_seq));
         return true;
     }
     return false;
@@ -528,7 +528,7 @@ static bool ff_tcp_win(Args& a)
     if (a.pkt->ptrs.tcph )
     {
         print_label(a, "tcp_win");
-        TextLog_Print(json_log, "0x%X", ntohs(a.pkt->ptrs.tcph->th_win));
+        TextLog_Print(json_log, "%u", ntohs(a.pkt->ptrs.tcph->th_win));
         return true;
     }
     return false;

diff --git a/src/managers/ips_manager.cc b/src/managers/ips_manager.cc
index 0bd50e7aa5371bae43aa5130c60678175dd755ac..257cec8f0449b79a0c88b7f7e4f6c89555eb2244 100644 (file)
--- a/src/managers/ips_manager.cc
+++ b/src/managers/ips_manager.cc
@@ -262,15 +262,22 @@ bool IpsManager::option_end(
     current_module = nullptr;
     current_params = nullptr;
 
-    if ( mod && !mod->end(key, 0, sc) )
+    Option* opt = get_opt(key);
+    assert(opt);
+
+    if ( !mod and opt->api->base.mod_ctor )
     {
-        ParseError("can't finalize %s", key);
+        ParseError("unknown option %s", key);
         current_keyword.clear();
         return false;
     }
 
-    Option* opt = get_opt(key);
-    assert(opt);
+    if ( mod and !mod->end(key, 0, sc) )
+    {
+        ParseError("can't finalize %s", key);
+        current_keyword.clear();
+        return false;
+    }
 
     IpsOption* ips = opt->api->ctor(mod, otn);
     type = opt->api->type;

diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index c301d28f0f4325e139333a128262a3439bc60edf..18c1ee563c1975223ffba9363d6a246b8eb5b806 100644 (file)
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -450,10 +450,7 @@ void PortScan::eval(Packet* p)
         return;
 
     ++spstats.total_packets;
-
-    PS_PKT ps_pkt;
-    memset(&ps_pkt, 0x00, sizeof(PS_PKT));
-    ps_pkt.pkt = p;
+    PS_PKT ps_pkt(p);
 
     ps_detect(&ps_pkt);
 

diff --git a/src/network_inspectors/port_scan/ps_detect.cc b/src/network_inspectors/port_scan/ps_detect.cc
index 9e162a7812a8f866d5673ad3061de6e3e17ca1be..aae1d933315963900c802fd51dd2ce58d45da891 100644 (file)
--- a/src/network_inspectors/port_scan/ps_detect.cc
+++ b/src/network_inspectors/port_scan/ps_detect.cc
@@ -41,6 +41,7 @@
 #include "stream/stream.h"
 #include "time/packet_time.h"
 #include "utils/cpp_macros.h"
+#include "utils/stats.h"
 
 #include "ps_inspect.h"
 
@@ -55,6 +56,13 @@ PADDING_GUARD_END
 
 static THREAD_LOCAL XHash* portscan_hash = nullptr;
 
+PS_PKT::PS_PKT(Packet* p)
+{
+    pkt = p;
+    scanner = scanned = nullptr;
+    proto = reverse_pkt = 0;
+}
+
 PortscanConfig::PortscanConfig()
 {
     memset(this, 0, sizeof(*this));
@@ -226,7 +234,7 @@ bool PortScan::ps_filter_ignore(PS_PKT* ps_pkt)
     {
         reverse_pkt = 1;
     }
-    else if (p->ptrs.udph && p->flow)
+    else if (p->ptrs.udph and p->flow )
     {
         if (Stream::get_packet_direction(p) & PKT_FROM_SERVER)
             reverse_pkt = 1;
@@ -575,11 +583,12 @@ void PortScan::ps_tracker_update_tcp(PS_PKT* ps_pkt, PS_TRACKER* scanner,
     **  picked up midstream, then we don't care about the MIDSTREAM flag.
     **  Otherwise, only consider streams not picked up midstream.
     */
-    if ( p->flow )
+    // FIXIT-H using SSNFLAG_COUNTED_INITIALIZE is a hack to get parity with 2.X
+    // this should be completely redone and port_scan should require stream_tcp
+    if ( p->flow and (p->flow->ssn_state.session_flags & SSNFLAG_COUNTED_INITIALIZE) )
+    {
         session_flags = p->flow->get_session_flags();
 
-    if ( session_flags & (SSNFLAG_SEEN_CLIENT|SSNFLAG_SEEN_SERVER) )
-    {
         if ((session_flags & SSNFLAG_SEEN_CLIENT) &&
             !(session_flags & SSNFLAG_SEEN_SERVER) &&
             (config->include_midstream || !(session_flags & SSNFLAG_MIDSTREAM)))
@@ -745,8 +754,8 @@ void PortScan::ps_tracker_update_ip(PS_PKT* ps_pkt, PS_TRACKER* scanner,
     }
 }
 
-void PortScan::ps_tracker_update_udp(PS_PKT* ps_pkt, PS_TRACKER* scanner,
-    PS_TRACKER* scanned)
+void PortScan::ps_tracker_update_udp(
+    PS_PKT* ps_pkt, PS_TRACKER* scanner, PS_TRACKER* scanned)
 {
     Packet* p = (Packet*)ps_pkt->pkt;
     unsigned win = config->udp_window;
@@ -1120,13 +1129,15 @@ bool PortScan::ps_tracker_alert(
 
     if ( scanner )
     {
-        scanner->proto.alerts = 0;
+        if ( config->alert_all )
+            scanner->proto.alerts = 0;
         scanner_proto = &scanner->proto;
     }
 
     if ( scanned )
     {
-        scanned->proto.alerts = 0;
+        if ( config->alert_all )
+            scanned->proto.alerts = 0;
         scanned_proto = &scanned->proto;
     }
 
@@ -1179,15 +1190,13 @@ int PortScan::ps_detect(PS_PKT* ps_pkt)
     PS_TRACKER* scanner = nullptr;
     PS_TRACKER* scanned = nullptr;
     int check_tcp_rst_other_dir = 1;
-    Packet* p;
 
-    if (!ps_pkt || !ps_pkt->pkt)
-        return -1;
+    assert(ps_pkt and ps_pkt->pkt);
 
     if (ps_filter_ignore(ps_pkt))
         return 0;
 
-    p = (Packet*)ps_pkt->pkt;
+    Packet* p = (Packet*)ps_pkt->pkt;
 
     do
     {
@@ -1202,7 +1211,7 @@ int PortScan::ps_detect(PS_PKT* ps_pkt)
 
         /* This is added to address the case of no
          * session and a RST packet going back from the Server. */
-        if ( p->ptrs.tcph && (p->ptrs.tcph->th_flags & TH_RST) && !p->flow )
+        if ( p->ptrs.tcph and (p->ptrs.tcph->th_flags & TH_RST) and !p->flow )
         {
             if (ps_pkt->reverse_pkt == 1)
                 check_tcp_rst_other_dir = 0;

diff --git a/src/network_inspectors/port_scan/ps_detect.h b/src/network_inspectors/port_scan/ps_detect.h
index 4f13069c0bac3686f274cb1ef1cb37684119f9ae..4356634cc80df601d802ab765e2a68054bcf421f 100644 (file)
--- a/src/network_inspectors/port_scan/ps_detect.h
+++ b/src/network_inspectors/port_scan/ps_detect.h
@@ -80,6 +80,7 @@ struct PortscanConfig
     int include_midstream;
     int print_tracker;
 
+    bool alert_all;
     bool logfile;
 
     unsigned tcp_window;
@@ -151,6 +152,8 @@ struct PS_PKT
 
     int proto;
     int reverse_pkt;
+
+    PS_PKT(Packet*);
 };
 
 void ps_cleanup();

diff --git a/src/network_inspectors/port_scan/ps_module.cc b/src/network_inspectors/port_scan/ps_module.cc
index cafca8348baf6128448d955a000b7940be325518..2090ac9137dfb3f236447e2a1f3a73635b4b4e9c 100644 (file)
--- a/src/network_inspectors/port_scan/ps_module.cc
+++ b/src/network_inspectors/port_scan/ps_module.cc
@@ -74,6 +74,9 @@ static const Parameter ps_params[] =
     { "ignore_scanned", Parameter::PT_STRING, nullptr, nullptr,
       "list of CIDRs with optional ports to ignore if the destination of scan alerts" },
 
+    { "alert_all", Parameter::PT_BOOL, nullptr, "false",
+      "alert on all events over threshold within window if true; else alert on first only" },
+
     { "include_midstream", Parameter::PT_BOOL, nullptr, "false",
       "list of CIDRs with optional ports" },
 
@@ -246,6 +249,9 @@ bool PortScanModule::set(const char* fqn, Value& v, SnortConfig*)
             u = PS_TYPE_ALL;
         config->detect_scan_type = u;
     }
+    else if ( v.is("alert_all") )
+        config->alert_all = v.get_bool();
+
     else if ( v.is("include_midstream") )
         config->include_midstream = v.get_bool();
 

diff --git a/src/stream/base/stream_module.cc b/src/stream/base/stream_module.cc
index dcd526b0abb063fe9dc8d7096d96422543ba687f..4d046ff8f37b3ea8301acd17e4449d34fc47b00c 100644 (file)
--- a/src/stream/base/stream_module.cc
+++ b/src/stream/base/stream_module.cc
@@ -45,12 +45,12 @@ static const Parameter name[] = \
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } \
 }
 
-CACHE_PARAMS(ip_params,    "16384",  "30", "180", "5");
-CACHE_PARAMS(icmp_params,  "65536",  "30", "180", "5");
-CACHE_PARAMS(tcp_params,  "262144",  "30", "180", "5");
-CACHE_PARAMS(udp_params,  "131072",  "30", "180", "5");
-CACHE_PARAMS(user_params,   "1024",  "30", "180", "5");
-CACHE_PARAMS(file_params,    "128",  "30", "180", "5");
+CACHE_PARAMS(ip_params,    "16384",  "30",  "180", "5");
+CACHE_PARAMS(icmp_params,  "65536",  "30",  "180", "5");
+CACHE_PARAMS(tcp_params,  "262144",  "30", "3600", "5");
+CACHE_PARAMS(udp_params,  "131072",  "30",  "180", "5");
+CACHE_PARAMS(user_params,   "1024",  "30",  "180", "5");
+CACHE_PARAMS(file_params,    "128",  "30",  "180", "5");
 
 #define CACHE_TABLE(cache, proto, params) \
     { cache, Parameter::PT_TABLE, params, nullptr, \

diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index a31c81d7d9b53e4389aa81f831e812b77f78b317..e68a7f59060603f3fa7973d0715df63320d0be97 100644 (file)
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -139,16 +139,18 @@ void IpSession::clear()
     IpHAManager::process_deletion(flow);
 }
 
-bool IpSession::setup(Packet*)
+bool IpSession::setup(Packet* p)
 {
-    DebugMessage(DEBUG_STREAM,
-        "Stream IP session created!\n");
+    DebugMessage(DEBUG_STREAM, "Stream IP session created!\n");
 
-    memset(&tracker, 0, sizeof(tracker));
     SESSION_STATS_ADD(ip_stats);
-    ip_stats.trackers_created++;
-    ip_stats.current_frags++;
+    memset(&tracker, 0, sizeof(tracker));
 
+    if ( p->ptrs.decode_flags & DECODE_FRAG )
+    {
+        ip_stats.trackers_created++;
+        ip_stats.current_frags++;
+    }
 #ifdef ENABLE_EXPECTED_IP
     if ( Stream::expected_flow(flow, p) )
     {

diff --git a/src/stream/tcp/tcp_tracker.cc b/src/stream/tcp/tcp_tracker.cc
index e8559ad8eab11ff00f6b687492a55293f4625f24..b43932bf7317e05ed95c712ba523cd1b234f4267 100644 (file)
--- a/src/stream/tcp/tcp_tracker.cc
+++ b/src/stream/tcp/tcp_tracker.cc
@@ -426,9 +426,6 @@ bool TcpTracker::update_on_3whs_ack(TcpSegmentDescriptor& tsd)
         update_tracker_ack_recv(tsd);
         flow->set_session_flags(SSNFLAG_ESTABLISHED);
         flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
-
-        /* Indicate this packet completes 3-way handshake */
-        tsd.get_pkt()->packet_flags |= PKT_STREAM_TWH;
         tcp_state = TcpStreamTracker::TCP_ESTABLISHED;
     }
     else