}
--]]
-tcp_client_ports = SSH_PORTS .. FTP_PORTS .. MAIL_PORTS .. RPC_PORTS ..
-[[
- 23 25 42 53 79 109 113 119 135 136 137 139 161 445 513 514 587 593 691
- 1433 1521 1741 3306 6070 6665 6666 6667 6668 6669 7000 8181
-]]
-tcp_server_ports = ''
-tcp_both_ports = HTTP_PORTS ..
-[[
- 443 465 563 636 989 992 993 994 995 7907 7802 7801 7900 7901 7902 7903
- 7904 7905 7906 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918
- 7919 7920
-]]
-
---------------------------------------------------------------------------
-- Step #2: configure builtin features
---------------------------------------------------------------------------
stream =
{
- tcp_cache = { max_sessions = 256 * K, idle_timeout = 60 },
- udp_cache = { max_sessions = 128 * K, pruning_timeout = 30 },
- ip_cache = { max_sessions = 64 * K },
- icmp_cache = { max_sessions = 32 * K },
+ tcp_cache = { max_sessions = 256000, idle_timeout = 60 },
+ udp_cache = { max_sessions = 128000, pruning_timeout = 30 },
+ ip_cache = { max_sessions = 64000 },
+ icmp_cache = { max_sessions = 0 },
}
stream_tcp =
paf_max = 16384,
session_timeout = 180,
- require_3whs = 180,
- flush_factor = 0,
+ --require_3whs = -1,
+ flush_factor = 0,
overlap_limit = 10,
- queue_limit =
- {
- max_bytes = 3,
- max_segments = 1300,
- },
- small_segments =
- {
- count = 10,
- maximum_size = 128,
- ignore_ports = '1 2 3'
- },
-
footprint = 0,
- reassemble_async = false,
+ reassemble_async = true,
ignore_any_rules = false,
-
- client_ports = tcp_client_ports,
- server_ports = tcp_server_ports,
- both_ports = tcp_both_ports,
}
stream_udp =
stream_ip =
{
- session_timeout = 180,
+ session_timeout = 980,
policy = 'windows',
max_overlaps = 10,
max_frags = 8191,
#include $PLUGIN_RULE_PATH/chat.rules
#include $PLUGIN_RULE_PATH/dos.rules
-alert tcp any any -> any 80 ( sid:1; msg:"1"; content:"HTTP"; )
-alert tcp any 80 -> any any ( sid:2; msg:"2"; content:"HTTP"; )
+#alert tcp any any -> any 80 ( sid:1; msg:"1"; content:"HTTP"; )
+#alert tcp any 80 -> any any ( sid:2; msg:"2"; content:"HTTP"; )
+alert ( gid:129; sid:20; )
]]
network =
-- put classic rules and includes in the include file and/or rules string
ips =
{
- include = '../active.rules',
+ --include = '../active.rules',
--rules = default_rules,
- enable_builtin_rules = true
+ --enable_builtin_rules = true
}
-- prototype bindings:
-- use: action | file | type,name | policy_id [,service]
-- when: days, times are tbd
+targetX = { nets = HTTP_SERVERS, proto = 'tcp', ports = HTTP_PORTS }
+
bindings =
{
- -- define / load a policy only
+ -- product define / load a policy only to be selected by firewall
{
when = { policy_id = 'uuid' },
use = { file = 'uuid.lua' }
},
- -- open source policy based on vlan
+ -- classic open source policy based on vlan
{
when = { vlans = '123' },
use = { file = 'vlan.lua' }
},
- -- open source policy based on cidr
+ -- classic open source policy based on cidr
{
- when = { nets = '1.2.3.0/24' },
+ when = { nets = HOME_NET },
use = { file = 'net.lua' }
},
-- targeted inspector config
- {
- when = { nets = '2.3.4.0/24', proto = 'tcp', ports = '80', role = 'any' },
- use = { type = 'http_inspect', name = 'hi2' }
- },
+ { when = targetX, use = { type = 'stream_tcp', name = 'tcpX' } },
+ { when = targetX, use = { type = 'http_inspect', name = 'hiX' } },
+
-- auto service id override
{
when = { nets = '3.4.5.0/24', proto = 'tcp', ports = '80', role = 'any' },
#define STREAM5_STATE_CLOSED 0x0800
struct Packet;
-class Inspector;
typedef void (*StreamAppDataFree)(void*);
void FlowControl::process_tcp(Packet* p)
{
- if( !p->tcph || !tcp_cache )
+ if ( !tcp_cache )
return;
tcp_count += process(tcp_cache, p);
void FlowControl::process_udp(Packet* p)
{
- if( !p->udph || !udp_cache )
+ if ( !udp_cache )
return;
udp_count += process(udp_cache, p);
void FlowControl::process_icmp(Packet* p)
{
- if ( !p->icmph )
- return;
-
if ( icmp_cache )
icmp_count += process(icmp_cache, p);
void FlowControl::process_ip(Packet* p)
{
- if ( !p->iph || !ip_cache )
+ if ( !ip_cache )
return;
ip_count += process(ip_cache, p);
#include "binder.h"
#include "flow/flow.h"
+#include "framework/inspector.h"
#include "managers/inspector_manager.h"
-
-class Inspector;
+#include "protocols/packet.h"
// FIXIT these will move into bindings lookup structures
// these are for defaults but lookups will support default
-// and non-defaults
-static Inspector* tcp_hand;
-static Inspector* udp_hand;
-static Inspector* icmp_hand;
-static Inspector* ip_hand;
+// and non-defaults (and client and server may differ)
+static Inspector* pin_tcp = nullptr;
+static Inspector* pin_udp = nullptr;
+static Inspector* pin_icmp = nullptr;
+static Inspector* pin_ip = nullptr;
-void Binder::init()
+void Binder::set(Inspector* pin, unsigned proto)
{
- // FIXIT this is backwards; InspectorManager must call
- // binder to set the various default inspectors since
- // binder doesn't know what inspectors are available
- tcp_hand = InspectorManager::get_inspector("stream_tcp");
- udp_hand = InspectorManager::get_inspector("stream_udp");
- ip_hand = InspectorManager::get_inspector("stream_ip");
- icmp_hand = InspectorManager::get_inspector("stream_icmp");
-
- if ( !icmp_hand )
- icmp_hand = ip_hand;
+ switch ( proto )
+ {
+ case PROTO_BIT__TCP: pin_tcp = pin; break;
+ case PROTO_BIT__UDP: pin_udp = pin; break;
+ case PROTO_BIT__ICMP: pin_icmp = pin; break;
+ case PROTO_BIT__IP: pin_ip = pin; break;
+ }
+}
- // FIXIT need to instantiate if not set?
- assert(tcp_hand);
- assert(udp_hand);
- assert(ip_hand);
- assert(icmp_hand);
+void Binder::init()
+{
+ if ( !pin_icmp )
+ pin_icmp = pin_ip;
}
void Binder::init_flow(Flow* flow)
switch ( flow->protocol )
{
case IPPROTO_TCP:
- flow->set_client(tcp_hand);
- flow->set_server(tcp_hand);
+ flow->set_client(pin_tcp);
+ flow->set_server(pin_tcp);
break;
case IPPROTO_UDP:
- flow->set_client(udp_hand);
- flow->set_server(udp_hand);
+ flow->set_client(pin_udp);
+ flow->set_server(pin_udp);
break;
case IPPROTO_ICMP:
- flow->set_client(icmp_hand);
- flow->set_server(icmp_hand);
+ flow->set_client(pin_icmp);
+ flow->set_server(pin_icmp);
break;
case IPPROTO_IP:
- flow->set_client(ip_hand);
- flow->set_server(ip_hand);
+ flow->set_client(pin_ip);
+ flow->set_server(pin_ip);
break;
}
}
{
public:
static void init();
+ static void set(class Inspector*, unsigned proto);
static void init_flow(class Flow*);
};
#include <mutex>
#include "module_manager.h"
+#include "main/binder.h"
#include "framework/inspector.h"
#include "detection/detection_util.h"
#include "obfuscation.h"
for ( auto* p : ph_list )
{
if ( p->pp_class.api.ssn )
- continue;
+ Binder::set(p->handler, p->pp_class.api.proto_bits);
+
else if ( p->pp_class.api.type == IT_STREAM )
session.add(p);
+
else if ( p->pp_class.api.type < IT_STREAM )
network.add(p);
+
else if ( p->pp_class.api.type < IT_SERVICE )
generic.add(p);
+
else
service.add(p);
}
switch ( GET_IPH_PROTO(p) )
{
case IPPROTO_TCP:
- flow_con->process_tcp(p);
+ if ( p->tcph )
+ flow_con->process_tcp(p);
break;
case IPPROTO_UDP:
if ( p->frag_flag )
flow_con->process_ip(p);
- flow_con->process_udp(p);
+ if ( p->udph )
+ flow_con->process_udp(p);
break;
case IPPROTO_ICMP:
- flow_con->process_icmp(p);
+ if ( p->icmph )
+ flow_con->process_icmp(p);
break;
case IPPROTO_IP:
- flow_con->process_ip(p);
+ if ( p->iph )
+ flow_con->process_ip(p);
break;
}
static void mod_dtor(Module* m)
{ delete m; }
-#if 0
-static void tcp_stats()
-{
- // FIXIT add method to get exp cache?
- LogMessage(" Expected Flows\n");
- LogMessage(" Expected: %lu\n", exp_cache->get_expects());
- LogMessage(" Realized: %lu\n", exp_cache->get_realized());
- LogMessage(" Pruned: %lu\n", exp_cache->get_prunes());
- LogMessage(" Overflows: %lu\n", exp_cache->get_overflows());
-}
-#endif
-
static Inspector* tcp_ctor(Module* m)
{
StreamTcpModule* mod = (StreamTcpModule*)m;
void add_proto(const char* svc, bool c2s, bool s2c);
};
+// misc stuff
int Stream5VerifyTcpConfig(SnortConfig*, StreamTcpConfig *);
-void Stream5ResetTcp();
+void Stream5ResetTcpInstance(StreamTcpConfig*);
Session* get_tcp_session(Flow*);
-
-// misc stuff
-void Stream5ResetTcpInstance(StreamTcpConfig*);
+StreamTcpConfig* get_tcp_cfg(Inspector*);
void tcp_sinit();
void tcp_sterm();
void tcp_reset_stats();
void tcp_show(StreamTcpConfig*);
-StreamTcpConfig* get_tcp_cfg(Inspector*);
-
// Stream support
int Stream5FlushListener(Packet*, Flow*);
int Stream5FlushTalker(Packet*, Flow*);
#endif
/* G L O B A L S **************************************************/
-// FIXIT eliminate these globals
-static THREAD_LOCAL Packet *s5_pkt = NULL;
/* enum for policy names */
static const char *reassembly_policy_names[] = {
"Protocol-IPS"
};
-static THREAD_LOCAL int s5_tcp_cleanup = 0;
-
static const uint32_t g_static_points[RAND_FLUSH_POINTS] =
{
128, 217, 189, 130, 240, 221, 134, 129,
201, 142, 153, 187, 173, 199, 143, 201
};
+static THREAD_LOCAL Packet *s5_pkt = NULL;
+
/* F U N C T I O N S **********************************************/
static inline uint32_t GenerateFlushPoint(FlushPointList *flush_point_list)
{
}
#endif
-//-------------------------------------------------------------------------
-
-void Stream5ResetTcp()
-{
- s5_tcp_cleanup = 1;
- flow_con->purge_flows(IPPROTO_TCP);
- s5_tcp_cleanup = 0;
-}
-
//-------------------------------------------------------------------------
// TcpSession methods
//-------------------------------------------------------------------------
projects / thirdparty / snort3.git / commitdiff
