Merge pull request #1333 in SNORT/snort3 from reevaluate_flow_reputation to master

Squashed commit of the following:

commit 3ace3ed94c1046f1bb7c29730c6478a971567ce4
Author: Masud Hasan <mashasan@cisco.com>
Date:   Wed Aug 15 12:12:03 2018 -0400

    reputation: Reevaluate current flows upon reload

diff --git a/src/network_inspectors/reputation/reputation_inspect.cc b/src/network_inspectors/reputation/reputation_inspect.cc
index c0dc555f197461aec9b9831e065e98b4a7b42d9d..5a80035b4bd7986d5d3ceed5ca7188e5f1dac71b 100644 (file)
--- a/src/network_inspectors/reputation/reputation_inspect.cc
+++ b/src/network_inspectors/reputation/reputation_inspect.cc
@@ -24,16 +24,19 @@
 #endif
 
 #include "reputation_inspect.h"
-#include "reputation_parse.h"
 
 #include "detection/detect.h"
 #include "detection/detection_engine.h"
 #include "events/event_queue.h"
 #include "log/messages.h"
+#include "network_inspectors/packet_tracer/packet_tracer.h"
 #include "packet_io/active.h"
 #include "profiler/profiler.h"
 
 #include "reputation_module.h"
+#include "reputation_parse.h"
+
+#define VERDICT_REASON_REPUTATION 19
 
 using namespace snort;
 
@@ -73,49 +76,6 @@ static void snort_reputation(ReputationConfig* GlobalConf, Packet* p);
 
 unsigned ReputationFlowData::inspector_id = 0;
 
-static ReputationData* set_new_reputation_data(Flow* flow)
-{
-    ReputationFlowData* fd = new ReputationFlowData;
-    flow->set_flow_data(fd);
-    return &fd->session;
-}
-
-static ReputationData* get_session_data(Flow* flow)
-{
-    ReputationFlowData* fd = (ReputationFlowData*)flow->get_flow_data(
-        ReputationFlowData::inspector_id);
-
-    return fd ? &fd->session : nullptr;
-}
-
-static bool is_reputation_disabled(Flow* flow)
-{
-    ReputationData* data;
-
-    if (!flow)
-        return false;
-
-    data = get_session_data(flow);
-
-    if (!data)
-        set_new_reputation_data(flow);
-
-    return data ? data->disabled : false;
-}
-
-static void disable_reputation(Flow* flow)
-{
-    ReputationData* data;
-
-    if (!flow)
-        return;
-
-    data = get_session_data(flow);
-
-    if (data)
-        data->disabled = true;
-}
-
 static void print_iplist_stats(ReputationConfig* config)
 {
     /*Print out the summary*/
@@ -320,6 +280,11 @@ static void snort_reputation(ReputationConfig* config, Packet* p)
         DetectionEngine::disable_all(p);
         Active::block_session(p, true);
         reputationstats.blacklisted++;
+        if (PacketTracer::is_active())
+        {
+            PacketTracer::set_reason(VERDICT_REASON_REPUTATION);
+            PacketTracer::log("Reputation: packet blacklisted, drop\n");
+        }
     }
     else if (MONITORED == decision)
     {
@@ -336,6 +301,14 @@ static void snort_reputation(ReputationConfig* config, Packet* p)
     }
 }
 
+static unsigned create_reputation_id()
+{
+    static unsigned reputation_id_tracker = 0;
+    if (++reputation_id_tracker == 0)
+        ++reputation_id_tracker;
+    return reputation_id_tracker;
+}
+
 //-------------------------------------------------------------------------
 // class stuff
 //-------------------------------------------------------------------------
@@ -350,6 +323,8 @@ public:
 
 private:
     ReputationConfig config;
+    unsigned reputation_id;
+    bool is_reputation_disabled(Flow* flow);
 };
 
 Reputation::Reputation(ReputationConfig* pc)
@@ -370,6 +345,27 @@ Reputation::Reputation(ReputationConfig* pc)
 
     ip_list_init(conf->num_entries + 1, conf);
     reputationstats.memory_allocated = sfrt_flat_usage(conf->ip_list);
+    reputation_id = create_reputation_id();
+}
+
+bool Reputation::is_reputation_disabled(Flow* flow)
+{
+    if (!flow)
+        return false;
+
+    ReputationFlowData* fd = (ReputationFlowData*)flow->get_flow_data(
+        ReputationFlowData::inspector_id);
+
+    if (!fd)
+    {
+        fd = new ReputationFlowData;
+        flow->set_flow_data(fd);
+    }
+    else if (fd->checked_reputation_id == reputation_id) // reputation previously checked
+        return true;
+
+    fd->checked_reputation_id = reputation_id; // disable future reputation checking
+    return false;
 }
 
 void Reputation::show(SnortConfig*)
@@ -387,7 +383,6 @@ void Reputation::eval(Packet* p)
     if (!p->is_rebuilt() && !is_reputation_disabled(p->flow))
     {
         snort_reputation(&config, p);
-        disable_reputation(p->flow);
         ++reputationstats.packets;
     }
 }
@@ -405,6 +400,7 @@ static void mod_dtor(Module* m)
 static void reputation_init()
 {
     ReputationFlowData::init();
+    PacketTracer::register_verdict_reason(VERDICT_REASON_REPUTATION, PacketTracer::PRIORITY_LOW);
 }
 
 static Inspector* reputation_ctor(Module* m)

diff --git a/src/network_inspectors/reputation/reputation_inspect.h b/src/network_inspectors/reputation/reputation_inspect.h
index 2300ae0fa74c450870256eb4f0c3a0ef9aad007c..410add11422b2fdd6e1367126b285343bb752eeb 100644 (file)
--- a/src/network_inspectors/reputation/reputation_inspect.h
+++ b/src/network_inspectors/reputation/reputation_inspect.h
@@ -21,26 +21,16 @@
 
 #include "flow/flow.h"
 
-// Per-session data block containing current state
-// of the Reputation preprocessor for the session.
-
-struct ReputationData
-{
-    bool disabled = false;
-};
-
 class ReputationFlowData : public snort::FlowData
 {
 public:
     ReputationFlowData() : snort::FlowData(inspector_id){}
 
-
     static void init()
     { inspector_id = snort::FlowData::create_flow_data_id(); }
 
-public:
     static unsigned inspector_id;
-    ReputationData session;
+    unsigned checked_reputation_id = 0;
 };
 
 #endif

diff --git a/src/network_inspectors/reputation/reputation_parse.cc b/src/network_inspectors/reputation/reputation_parse.cc
index e18de36da4339c59af8114ac0cc949c8fb8c0b41..a49fa7186f922e72ce6410f5a524d5cb09eceb3a 100644 (file)
--- a/src/network_inspectors/reputation/reputation_parse.cc
+++ b/src/network_inspectors/reputation/reputation_parse.cc
@@ -824,7 +824,7 @@ static bool process_line_in_manifest(ListFile* list_item, const char* manifest,
 {
     char* token;
     int token_index = 0;
-    char* next_ptr = (char*)line;
+    char* next_ptr = const_cast<char*>(line);
     bool has_zone = false;
 
     list_item->zones.clear();
@@ -847,16 +847,16 @@ static bool process_line_in_manifest(ListFile* list_item, const char* manifest,
             if ( *end_str )
             {
                 ErrorMessage("%s(%d) => Bad value (%s) specified for listID. "
-                    "Please specify an integer between %u and %u.\n",
-                    manifest, line_number, token, 0, MAX_LIST_ID);
+                    "Please specify an integer between 0 and %u.\n",
+                    manifest, line_number, token, MAX_LIST_ID);
                 return false;
             }
 
             if ((list_id < 0)  || (list_id > MAX_LIST_ID) || (errno == ERANGE))
             {
                 ErrorMessage(" %s(%d) => Value specified (%s) is out of "
-                    "bounds.  Please specify an integer between %u and %u.\n",
-                    manifest, line_number, token, 0, MAX_LIST_ID);
+                    "bounds.  Please specify an integer between 0 and %u.\n",
+                    manifest, line_number, token, MAX_LIST_ID);
                 return false;
             }
             list_item->list_id = (uint32_t)list_id;
@@ -884,15 +884,15 @@ static bool process_line_in_manifest(ListFile* list_item, const char* manifest,
             if ( *end_str )
             {
                 ErrorMessage("%s(%d) => Bad value (%s) specified for zone. "
-                    "Please specify an integer between %u and %u.\n",
-                    manifest, line_number, token, 0, MAX_NUM_ZONES);
+                    "Please specify an integer between 0 and %u.\n",
+                    manifest, line_number, token, MAX_NUM_ZONES);
                 return false;
             }
             if ((zone_id < 0)  || (zone_id > MAX_NUM_ZONES ) || (errno == ERANGE))
             {
                 ErrorMessage(" %s(%d) => Value specified (%s) for zone is "
-                    "out of bounds. Please specify an integer between %u and %u.\n",
-                    manifest, line_number, token, 0, MAX_NUM_ZONES );
+                    "out of bounds. Please specify an integer between 0 and %u.\n",
+                    manifest, line_number, token, MAX_NUM_ZONES);
                 return false;
             }