normalizer ip4.base and tcp.base defaults

diff --git a/ChangeLog b/ChangeLog
index ee8b6841b6bad63d6ab13e545dfd69e484b839db..8dcc256a1e18b9e9dabf700d39b5b1ba34e87fed 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -37,6 +37,7 @@
 -- fixed stream_reassemble.direction
 -- initial integration of hosts into binder
 -- don't log redecode events (from shutdown rebuilds)
+-- changed normalizer ip4.base and tcp.base to default to true
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug

diff --git a/src/network_inspectors/normalize/norm_module.cc b/src/network_inspectors/normalize/norm_module.cc
index 65f017d6c0532b73211f22bc36dc0d185b83c3ba..0d4568f79b58a48d132bf8f16c1cdd487ce22b1d 100644 (file)
--- a/src/network_inspectors/normalize/norm_module.cc
+++ b/src/network_inspectors/normalize/norm_module.cc
@@ -84,7 +84,7 @@ static bool allow_codes(NormalizerConfig* config, const char* s)
 
 static const Parameter norm_ip4_params[] =
 {
-    { "base", Parameter::PT_BOOL, nullptr, "false",
+    { "base", Parameter::PT_BOOL, nullptr, "true",
       "clear options" },
 
     { "df", Parameter::PT_BOOL, nullptr, "false",
@@ -104,7 +104,7 @@ static const Parameter norm_ip4_params[] =
 
 static const Parameter norm_tcp_params[] =
 {
-    { "base", Parameter::PT_BOOL, nullptr, "false",
+    { "base", Parameter::PT_BOOL, nullptr, "true",
       "clear reserved bits and option padding and fix urgent pointer / flags issues" },
 
     { "ips", Parameter::PT_BOOL, nullptr, "false",
@@ -169,7 +169,7 @@ ProfileStats* NormalizeModule::get_profile() const
 bool NormalizeModule::set_ip4(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("base") )
-        Norm_Set(&config, NORM_IP4, v.get_bool());
+        Norm_Set(&config, NORM_IP4_BASE, v.get_bool());
 
     else if ( v.is("df") )
         Norm_Set(&config, NORM_IP4_DF, v.get_bool());
@@ -192,7 +192,7 @@ bool NormalizeModule::set_ip4(const char*, Value& v, SnortConfig*)
 bool NormalizeModule::set_tcp(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("base") )
-        Norm_Set(&config, NORM_TCP, v.get_bool());
+        Norm_Set(&config, NORM_TCP_BASE, v.get_bool());
 
     else if ( v.is("urp") )
         Norm_Set(&config, NORM_TCP_URP, v.get_bool());
@@ -238,7 +238,7 @@ bool NormalizeModule::set(const char* fqn, Value& v, SnortConfig* sc)
         return set_tcp(fqn, v, sc);
 
     else if ( v.is("ip6") )
-        Norm_Set(&config, NORM_IP6, v.get_bool());
+        Norm_Set(&config, NORM_IP6_BASE, v.get_bool());
 
     else if ( v.is("icmp4") )
         Norm_Set(&config, NORM_ICMP4, v.get_bool());
@@ -253,6 +253,17 @@ bool NormalizeModule::set(const char* fqn, Value& v, SnortConfig* sc)
 }
 
 bool NormalizeModule::begin(const char* fqn, int, SnortConfig*)
+{
+    if ( !strcmp(fqn, "normalizer.ip4") )
+        Norm_Set(&config, NORM_IP4_BASE, true);
+
+    else if ( !strcmp(fqn, "normalizer.tcp") )
+        Norm_Set(&config, NORM_TCP_BASE, true);
+
+    return true;
+}
+
+bool NormalizeModule::end(const char* fqn, int, SnortConfig*)
 {
     if ( !strcmp(fqn, NORM_NAME) )
     {
@@ -260,23 +271,18 @@ bool NormalizeModule::begin(const char* fqn, int, SnortConfig*)
 
         if ( (policy->new_ttl > 1) && (policy->new_ttl >= policy->min_ttl) )
         {
-            if ( Norm_IsEnabled(&config, NORM_IP4) )
+            if ( Norm_IsEnabled(&config, NORM_IP4_BASE) )
                 Norm_Enable(&config, NORM_IP4_TTL);
         }
         if ( (policy->new_ttl > 1) && (policy->new_ttl >= policy->min_ttl) )
         {
-            if ( Norm_IsEnabled(&config, NORM_IP6) )
+            if ( Norm_IsEnabled(&config, NORM_IP6_BASE) )
                 Norm_Enable(&config, NORM_IP6_TTL);
         }
     }
     return true;
 }
 
-bool NormalizeModule::end(const char*, int, SnortConfig*)
-{
-    return true;
-}
-
 void NormalizeModule::sum_stats()
 { Norm_SumStats(); }
 

diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index 11f16cd88d2a86b8e698b3364f9ae38a542b5d66..ca3c988de52cb33e2dcb32cbdafea4b43543b484 100644 (file)
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -55,25 +55,24 @@ static inline void LogFlag (
 
 static void Print_IP4 (SnortConfig*, const NormalizerConfig* nc)
 {
-    LogFlag("ip4", nc, NORM_IP4);
+    if ( !Norm_IsEnabled(nc, (NormFlags)NORM_IP4_ANY) )
+        return;
 
-    if ( Norm_IsEnabled(nc, NORM_IP4) )
-    {
-        //LogFlag("ip4.id", nc, NORM_IP4_ID);
-        LogFlag("ip4.df", nc, NORM_IP4_DF);
-        LogFlag("ip4.rf", nc, NORM_IP4_RF);
-        LogFlag("ip4.tos", nc, NORM_IP4_TOS);
-        LogFlag("ip4.trim", nc, NORM_IP4_TRIM);
+    LogFlag("ip4.base", nc, NORM_IP4_BASE);
+    //LogFlag("ip4.id", nc, NORM_IP4_ID);
+    LogFlag("ip4.df", nc, NORM_IP4_DF);
+    LogFlag("ip4.rf", nc, NORM_IP4_RF);
+    LogFlag("ip4.tos", nc, NORM_IP4_TOS);
+    LogFlag("ip4.trim", nc, NORM_IP4_TRIM);
 
-        if ( Norm_IsEnabled(nc, NORM_IP4_TTL) )
-        {
-            NetworkPolicy* policy = get_network_policy();
-            LogMessage("%12s: %s (min=%d, new=%d)\n", "ip4.ttl", ON, 
-                policy->min_ttl, policy->new_ttl);
-        }
-        else
-            LogConf("ip4.ttl", OFF);
+    if ( Norm_IsEnabled(nc, NORM_IP4_TTL) )
+    {
+        NetworkPolicy* policy = get_network_policy();
+        LogMessage("%12s: %s (min=%d, new=%d)\n", "ip4.ttl", ON, 
+            policy->min_ttl, policy->new_ttl);
     }
+    else
+        LogConf("ip4.ttl", OFF);
 }
 
 static void Print_ICMP4 (const NormalizerConfig* nc)
@@ -83,18 +82,16 @@ static void Print_ICMP4 (const NormalizerConfig* nc)
 
 static void Print_IP6 (SnortConfig*, const NormalizerConfig* nc)
 {
-    LogFlag("ip6", nc, NORM_IP6);
+    if ( !Norm_IsEnabled(nc, (NormFlags)NORM_IP6_ANY) )
+        return;
 
-    if ( Norm_IsEnabled(nc, NORM_IP6) )
+    LogFlag("ip6.base", nc, NORM_IP6_BASE);
+
+    if ( Norm_IsEnabled(nc, NORM_IP6_TTL) )
     {
-        if ( Norm_IsEnabled(nc, NORM_IP6_TTL) )
-        {
-            NetworkPolicy* policy = get_network_policy();
-            LogMessage("%12s: %s (min=%d, new=%d)\n", "ip6.hops",
-                ON, policy->min_ttl, policy->new_ttl);
-        }
-        else
-            LogConf("ip6.hops", OFF);
+        NetworkPolicy* policy = get_network_policy();
+        LogMessage("%12s: %s (min=%d, new=%d)\n", "ip6.hops",
+            ON, policy->min_ttl, policy->new_ttl);
     }
 }
 
@@ -105,51 +102,50 @@ static void Print_ICMP6 (const NormalizerConfig* nc)
 
 static void Print_TCP (const NormalizerConfig* nc)
 {
-    LogFlag("tcp", nc, NORM_TCP);
+    if ( !Norm_IsEnabled(nc, (NormFlags)NORM_TCP_ANY) )
+        return;
 
-    if ( Norm_IsEnabled(nc, NORM_TCP) )
-    {
-        const char* s;
+    LogFlag("tcp.base", nc, NORM_TCP_BASE);
+    const char* s;
 
-        if ( Norm_IsEnabled(nc, NORM_TCP_ECN_PKT) )
-            s = "packet";
-        else if ( Norm_IsEnabled(nc, NORM_TCP_ECN_STR) )
-            s = "stream";
-        else
-            s = OFF;
+    if ( Norm_IsEnabled(nc, NORM_TCP_ECN_PKT) )
+        s = "packet";
+    else if ( Norm_IsEnabled(nc, NORM_TCP_ECN_STR) )
+        s = "stream";
+    else
+        s = OFF;
 
-        LogConf("tcp.ecn", s);
-        LogFlag("tcp.urp", nc, NORM_TCP_URP);
+    LogConf("tcp.ecn", s);
+    LogFlag("tcp.urp", nc, NORM_TCP_URP);
 
-        if ( Norm_IsEnabled(nc, NORM_TCP_OPT) )
+    if ( Norm_IsEnabled(nc, NORM_TCP_OPT) )
+    {
+        char buf[1024] = "";
+        char* p = buf;
+        int opt;
+        size_t min;
+
+        p += snprintf(p, buf+sizeof(buf)-p, "%s", "(allow ");
+        min = strlen(buf);
+
+        // TBD translate options to keywords allowed by parser
+        for ( opt = 2; opt < 256; opt++ )
         {
-            char buf[1024] = "";
-            char* p = buf;
-            int opt;
-            size_t min;
-
-            p += snprintf(p, buf+sizeof(buf)-p, "%s", "(allow ");
-            min = strlen(buf);
-
-            // TBD translate options to keywords allowed by parser
-            for ( opt = 2; opt < 256; opt++ )
-            {
-                const char* fmt = (strlen(buf) > min) ? ",%d" : "%d";
-                if ( Norm_TcpIsOptional(nc, opt) )
-                    p += snprintf(p, buf+sizeof(buf)-p, fmt, opt);
-            }
-            if ( strlen(buf) > min )
-            {
-                snprintf(p, buf+sizeof(buf)-p, "%c", ')');
-                buf[sizeof(buf)-1] = '\0';
-            }
-            LogMessage("%12s: %s %s\n", "tcp.opt", ON, buf);
+            const char* fmt = (strlen(buf) > min) ? ",%d" : "%d";
+            if ( Norm_TcpIsOptional(nc, opt) )
+                p += snprintf(p, buf+sizeof(buf)-p, fmt, opt);
         }
-        else
-            LogConf("tcp.opt", OFF);
-
-        LogFlag("tcp.ips", nc, NORM_TCP_IPS);
+        if ( strlen(buf) > min )
+        {
+            snprintf(p, buf+sizeof(buf)-p, "%c", ')');
+            buf[sizeof(buf)-1] = '\0';
+        }
+        LogMessage("%12s: %s %s\n", "tcp.opt", ON, buf);
     }
+    else
+        LogConf("tcp.opt", OFF);
+
+    LogFlag("tcp.ips", nc, NORM_TCP_IPS);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/network_inspectors/normalize/normalize.h b/src/network_inspectors/normalize/normalize.h
index ea5f0297d7966d30c9c485f7ca2bf4f7eac9c41e..ff3369830c711da460854c7b86e76bd89fcd2ba7 100644 (file)
--- a/src/network_inspectors/normalize/normalize.h
+++ b/src/network_inspectors/normalize/normalize.h
@@ -29,34 +29,35 @@
 
 typedef enum
 {
-    NORM_IP4             = 0x00000001, // core ip4 norms
+    NORM_IP4_BASE        = 0x00000001, // core ip4 norms
   //NORM_IP4_ID          = 0x00000002, // tbd:  encrypt ip id
     NORM_IP4_DF          = 0x00000004, // clear df
     NORM_IP4_RF          = 0x00000008, // clear rf
     NORM_IP4_TTL         = 0x00000010, // ensure min ttl
-    NORM_ICMP4           = 0x00000020, // core icmp4 norms
-    NORM_IP6             = 0x00000040, // core ip6 norms
-    NORM_IP6_TTL         = 0x00000080, // ensure min hop limit
-    NORM_ICMP6           = 0x00000100, // core icmp6 norms
-    NORM_TCP             = 0x00000200, // core tcp norms
-    NORM_TCP_ECN_PKT     = 0x00000400, // clear ece and cwr
-    NORM_TCP_ECN_STR     = 0x00000800, // clear if not negotiated (stream)
-    NORM_TCP_URP         = 0x00001000, // trim urp to dsize
-    NORM_TCP_OPT         = 0x00002000, // nop over non-essential options
-    NORM_TCP_IPS         = 0x00004000, // enable stream normalization/pre-ack flushing
-    NORM_IP4_TOS         = 0x00008000, // clear tos/diff-serv
-    NORM_IP4_TRIM        = 0x00010000, // enforce min frame
-    NORM_TCP_TRIM        = 0x00020000, // enforce min frame
-    NORM_ALL             = 0x0003FFFF  // all normalizations on
+    NORM_IP4_TOS         = 0x00000020, // clear tos/diff-serv
+    NORM_IP4_TRIM        = 0x00000040, // enforce min frame
+
+    NORM_IP6_BASE        = 0x00000100, // core ip6 norms
+    NORM_IP6_TTL         = 0x00000200, // ensure min hop limit
+    NORM_ICMP4           = 0x00000400, // core icmp4 norms
+    NORM_ICMP6           = 0x00000800, // core icmp6 norms
+
+    NORM_TCP_BASE        = 0x00001000, // core tcp norms
+    NORM_TCP_ECN_PKT     = 0x00002000, // clear ece and cwr
+    NORM_TCP_ECN_STR     = 0x00004000, // clear if not negotiated (stream)
+    NORM_TCP_URP         = 0x00008000, // trim urp to dsize
+    NORM_TCP_OPT         = 0x00010000, // nop over non-essential options
+    NORM_TCP_IPS         = 0x00020000, // enable stream normalization/pre-ack flushing
+    NORM_TCP_TRIM        = 0x00040000, // enforce min frame
+
+    NORM_ALL             = 0x000FFFFF  // all normalizations on
 } NormFlags;
 
 bool Normalize_IsEnabled(NormFlags);
 
-#define NORM_IP4_ANY (NORM_IP4|NORM_IP4_DF|NORM_IP4_RF|NORM_IP4_TTL)
-#define NORM_IP6_ANY (NORM_IP6|NORM_IP6_TTL)
-#define NORM_TCP_ANY \
-    (NORM_TCP|NORM_TCP_ECN_PKT|NORM_TCP_ECN_STR|NORM_TCP_URP| \
-     NORM_TCP_OPT|NORM_TCP_IPS|NORM_IP4_TOS|NORM_IP4_TRIM|NORM_TCP_TRIM)
+#define NORM_IP4_ANY (0xFF)
+#define NORM_IP6_ANY (NORM_IP6_BASE|NORM_IP6_TTL)
+#define NORM_TCP_ANY (0xFF000)
 
 #endif
 

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index eb31494912835e7d0c7c5980ee8f3a43be0bbaeb..b3d8c29b8c6200e6bf30e1de55ae344b2b321548 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -5081,7 +5081,7 @@ static int ProcessTcp(
                         "bad sequence number, bailing\n"););
             Discard();
             eventcode |= EVENT_BAD_RST;
-            NormalDropPacketIf(p, NORM_TCP);
+            NormalDropPacketIf(p, NORM_TCP_BASE);
             LogTcpEvents(eventcode);
             MODULE_PROFILE_END(s5TcpStatePerfStats);
             return retcode;
@@ -5188,7 +5188,7 @@ static int ProcessTcp(
                     "bad sequence number, bailing\n"););
         Discard();
         eventcode |= EVENT_BAD_RST;
-        NormalDropPacketIf(p, NORM_TCP);
+        NormalDropPacketIf(p, NORM_TCP_BASE);
         LogTcpEvents(eventcode);
         MODULE_PROFILE_END(s5TcpStatePerfStats);
         return retcode | ts_action;
@@ -5251,7 +5251,7 @@ static int ProcessTcp(
     {
         int action;
         if ( !SEQ_EQ(tdb->seq, talker->isn) &&
-             NormalDropPacketIf(p, NORM_TCP) )
+             NormalDropPacketIf(p, NORM_TCP_BASE) )
             action = ACTION_BAD_PKT;
         else
         if ( talker->s_mgr.state >= TCP_STATE_ESTABLISHED )
@@ -5279,7 +5279,7 @@ static int ProcessTcp(
         /* got a window too large, alert! */
         eventcode |= EVENT_WINDOW_TOO_LARGE;
         Discard();
-        NormalDropPacketIf(p, NORM_TCP);
+        NormalDropPacketIf(p, NORM_TCP_BASE);
         LogTcpEvents(eventcode);
         MODULE_PROFILE_END(s5TcpStatePerfStats);
         return retcode | ACTION_BAD_PKT;
@@ -5295,7 +5295,7 @@ static int ProcessTcp(
         eventcode |= EVENT_WINDOW_SLAM;
         Discard();
 
-        if ( NormalDropPacketIf(p, NORM_TCP) )
+        if ( NormalDropPacketIf(p, NORM_TCP_BASE) )
         {
             LogTcpEvents(eventcode);
             MODULE_PROFILE_END(s5TcpStatePerfStats);
@@ -5376,7 +5376,7 @@ static int ProcessTcp(
                         eventcode |= EVENT_WINDOW_SLAM;
                         Discard();
 
-                        if ( NormalDropPacketIf(p, NORM_TCP) )
+                        if ( NormalDropPacketIf(p, NORM_TCP_BASE) )
                         {
                             LogTcpEvents(eventcode);
                             MODULE_PROFILE_END(s5TcpStatePerfStats);
@@ -5424,7 +5424,7 @@ static int ProcessTcp(
                 {
                     eventcode |= EVENT_BAD_ACK;
                     LogTcpEvents(eventcode);
-                    NormalDropPacketIf(p, NORM_TCP);
+                    NormalDropPacketIf(p, NORM_TCP_BASE);
                     MODULE_PROFILE_END(s5TcpStatePerfStats);
                     return retcode | ACTION_BAD_PKT;
                 }
@@ -5473,7 +5473,7 @@ static int ProcessTcp(
             //EventDataOnClosed(talker->config);
             eventcode |= EVENT_DATA_ON_CLOSED;
             retcode |= ACTION_BAD_PKT;
-            NormalDropPacketIf(p, NORM_TCP);
+            NormalDropPacketIf(p, NORM_TCP_BASE);
         }
         else if (TCP_STATE_CLOSED == talker->s_mgr.state)
         {
@@ -5493,7 +5493,7 @@ static int ProcessTcp(
                 eventcode |= EVENT_DATA_ON_CLOSED;
             }
             retcode |= ACTION_BAD_PKT;
-            NormalDropPacketIf(p, NORM_TCP);
+            NormalDropPacketIf(p, NORM_TCP_BASE);
         }
         else
         {
@@ -5538,7 +5538,7 @@ static int ProcessTcp(
             else
             {
                 eventcode |= EVENT_DATA_WITHOUT_FLAGS;
-                NormalDropPacketIf(p, NORM_TCP);
+                NormalDropPacketIf(p, NORM_TCP_BASE);
             }
         }
     }
@@ -5623,7 +5623,7 @@ static int ProcessTcp(
                         "FIN beyond previous, ignoring\n"););
                     eventcode |= EVENT_BAD_FIN;
                     LogTcpEvents(eventcode);
-                    NormalDropPacketIf(p, NORM_TCP);
+                    NormalDropPacketIf(p, NORM_TCP_BASE);
                     MODULE_PROFILE_END(s5TcpStatePerfStats);
                     return retcode | ACTION_BAD_PKT;
                 }