fixed bind action

diff --git a/ChangeLog b/ChangeLog
index 1d8366128486d532967518ed9b722cbe11056a7a..801217f9ad41af70fd8adba7c105789cdd50f800 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+118
+-- fixed bind action
+
 117
 -- added --stdin-rules
 -- added #begin / #end comments for rules

diff --git a/src/flow/flow.h b/src/flow/flow.h
index 8c01fda209503418e17d35a1d5724f2a196db5a1..028a6263f17d8649b9a416209332467510c7d0ec 100644 (file)
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -161,7 +161,10 @@ public:
 
     void set_ttl(Packet*, bool client);
 
-    bool was_blocked()
+    void block()
+    { s5_state.session_flags |= SSNFLAG_BLOCK; };
+
+    bool was_blocked() const
     { return (s5_state.session_flags & SSNFLAG_BLOCK) != 0; };
 
     void set_client(Inspector* ins)

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 89c2e232e44f0829749d05ff617d7baa1c6b956f..e69f5762f3b295c354f9ba5e2f2f62ed39ea9038 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -274,6 +274,7 @@ unsigned FlowControl::process(FlowCache* cache, Packet* p)
     switch ( flow->flow_state )
     {
     case 1: // block
+        // FIXIT-H this clears flow state!
         stream.drop_packet(p);
         break;
 

diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc
index 1edb13bb849df4206dbf059ae48b0e6fc4bf9bf5..a419498fc2137d61fae972268e89f2f585dbab03 100644 (file)
--- a/src/network_inspectors/binder/bind_module.cc
+++ b/src/network_inspectors/binder/bind_module.cc
@@ -30,7 +30,16 @@ using namespace std;
 #include "binder.h"
 #include "protocols/packet.h"
 
-THREAD_LOCAL SimpleStats bstats;
+THREAD_LOCAL BindStats bstats;
+
+static const char* bind_pegs[] =
+{
+    "packets",
+    "blocks",
+    "allows",
+    "inspects",
+    nullptr
+};
 
 //-------------------------------------------------------------------------
 // binder module
@@ -64,7 +73,7 @@ static const Parameter binder_when_params[] =
 
 static const Parameter binder_use_params[] =
 {
-    { "action", Parameter::PT_ENUM, "inspect | allow | block", "inspect",
+    { "action", Parameter::PT_ENUM, "block | allow | inspect", "inspect",
       "what to do with matching traffic" },
 
     { "file", Parameter::PT_STRING, nullptr, nullptr,
@@ -146,7 +155,7 @@ bool BinderModule::set(const char* fqn, Value& v, SnortConfig*)
 
     // use
     else if ( v.is("action") )
-        work->action = (BindAction)v.get_long();
+        work->action = (BindAction)(v.get_long() + 1);
 
     else if ( v.is("file") )
         work->file = v.get_string();
@@ -187,7 +196,7 @@ vector<Binding*> BinderModule::get_data()
 }
 
 const char** BinderModule::get_pegs() const
-{ return simple_pegs; }
+{ return bind_pegs; }
 
 PegCount* BinderModule::get_counts() const
 { return (PegCount*)&bstats; }

diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h
index 5425fff4e702a13b9961e2ad61b79d2dbca99f8f..82999a7ae2566faceeceb30abd8be96dcaf3e57d 100644 (file)
--- a/src/network_inspectors/binder/bind_module.h
+++ b/src/network_inspectors/binder/bind_module.h
@@ -27,7 +27,13 @@
 #include "framework/module.h"
 #include "main/thread.h"
 
-extern THREAD_LOCAL SimpleStats bstats;
+struct BindStats
+{
+    PegCount packets;
+    PegCount verdicts[3];
+};
+
+extern THREAD_LOCAL BindStats bstats;
 extern THREAD_LOCAL ProfileStats bindPerfStats;
 struct Binding;
 

diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index 8744f7802614a128d5ccb778c3e5dd006bf3819c..a38ac98dbf66ce3c9114a66063e8d58c4d026674 100644 (file)
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -108,7 +108,8 @@ public:
     { bindings.push_back(b); };
 
 private:
-    int check_rules(Flow*, Packet*);
+    Binding* get_binding(Flow*, Packet*);
+    BindAction apply(Flow*, Binding*);
     void init_flow(Flow*);
 
 private:
@@ -129,8 +130,12 @@ Binder::~Binder()
 void Binder::eval(Packet* p)
 {
     Flow* flow = p->flow;
-    flow->flow_state = check_rules(flow, p);
-    ++bstats.total_packets;
+
+    Binding* pb = get_binding(flow, p);
+    flow->flow_state = apply(flow, pb);
+
+    ++bstats.verdicts[flow->flow_state - 1];
+    ++bstats.packets;
 }
 
 // FIXIT-H implement inspector lookup from policy / bindings
@@ -182,7 +187,7 @@ int Binder::exec(int, void* pv)
 // FIXIT-H bind services - this is a temporary hack that just looks at ports,
 // need to examine all key fields for matching.  ultimately need a routing
 // table, scapegoat tree, etc.
-int Binder::check_rules(Flow* flow, Packet* p)
+Binding* Binder::get_binding(Flow* flow, Packet* p)
 {
     Binding* pb;
     unsigned i, sz = bindings.size();
@@ -201,12 +206,26 @@ int Binder::check_rules(Flow* flow, Packet* p)
         if ( pb->ports.test(port) )
             break;
     }
-        
+
+    // absent a specific rule, we must choose a course of action
+    // so we act as if binder wasn't configured at all
     if ( i == sz )
-        return BA_ALLOW;  // default action FIXIT-H make configurable
+        return nullptr;
+    
+    return pb;
+}
+    
+BindAction Binder::apply(Flow* flow, Binding* pb)
+{
+    if ( !pb )
+        return BA_ALLOW;
 
     if ( pb->action != BA_INSPECT )
+    {
+        if ( pb->action == BA_BLOCK )
+            stream.drop_traffic(flow, SSN_DIR_BOTH);
         return pb->action;
+    }
 
     init_flow(flow);
     Inspector* ins;

diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index 94178aad4daf68752402bcbf42e7a5ee8a5c8717..0e1fcb30c646968fb9abf6cab4d5e127b143526f 100644 (file)
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -273,8 +273,7 @@ uint32_t Stream::get_packet_direction(Packet *p)
     return (p->packet_flags & (PKT_FROM_SERVER|PKT_FROM_CLIENT));
 }
 
-void Stream::drop_traffic(
-    Packet*, Flow* flow, char dir)
+void Stream::drop_traffic(Flow* flow, char dir)
 {
     if (!flow)
         return;
@@ -305,7 +304,7 @@ void Stream::drop_packet(Packet *p)
     flow->session->clear();
 
     if (!(p->packet_flags & PKT_STATELESS))
-        drop_traffic(p, flow, SSN_DIR_BOTH);
+        drop_traffic(flow, SSN_DIR_BOTH);
 }
 
 uint32_t Stream::set_session_flags(Flow* flow, uint32_t flags)

diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h
index 57bfbc3d8711903aedf4cbb1434ecdfeeafa76b5..3c01be2bb56ab8169dc2dca2ddff8411dd7441f5 100644 (file)
--- a/src/stream/stream_api.h
+++ b/src/stream/stream_api.h
@@ -117,7 +117,7 @@ public:
 
     /* Drop traffic arriving on session.
      */
-    static void drop_traffic(Packet*, Flow*, char dir);
+    static void drop_traffic(Flow*, char dir);
 
     /* Drop retransmitted packet arriving on session.
      */