Pull request #3657: netflow: implement deferred trust, cleanup

Merge in SNORT/snort3 from ~MMATIRKO/snort3:nf_trust to master

Squashed commit of the following:

commit 8d15aa644c9a00f98c627dfde8815c2d8c5677f1
Author: Michael Matirko <mmatirko@cisco.com>
Date:   Mon Oct 31 15:48:26 2022 -0400

    netflow: implement deferred trust, cleanup

diff --git a/src/service_inspectors/netflow/CMakeLists.txt b/src/service_inspectors/netflow/CMakeLists.txt
index 850a4a6d324e39eef34b6cba44efc008abec99b1..97a9cb26fbdbfccdf32eba133c608d7382919366 100644 (file)
--- a/src/service_inspectors/netflow/CMakeLists.txt
+++ b/src/service_inspectors/netflow/CMakeLists.txt
@@ -4,6 +4,7 @@ set ( NETFLOW_INCLUDES
     netflow_headers.h
     netflow_module.h
     netflow_record.h
+    netflow.h
 )
 set ( FILE_LIST
     ${NETFLOW_INCLUDES}

diff --git a/src/service_inspectors/netflow/netflow.cc b/src/service_inspectors/netflow/netflow.cc
index 1268aaa1acb6dc72bde35de0b7dd8601db7bb8e5..6722e40f11a5c605493500e8ab87a89b370cf903 100644 (file)
--- a/src/service_inspectors/netflow/netflow.cc
+++ b/src/service_inspectors/netflow/netflow.cc
@@ -23,6 +23,8 @@
 #include "config.h"
 #endif
 
+#include "netflow.h"
+
 #include <fstream>
 #include <mutex>
 #include <sys/stat.h>
@@ -32,8 +34,6 @@
 #include "log/messages.h"
 #include "managers/module_manager.h"
 #include "main/reload_tuner.h"
-#include "profiler/profiler.h"
-#include "protocols/packet.h"
 #include "pub_sub/netflow_event.h"
 #include "src/utils/endian.h"
 #include "time/packet_time.h"
@@ -44,41 +44,6 @@
 
 using namespace snort;
 
-THREAD_LOCAL NetFlowStats netflow_stats;
-THREAD_LOCAL ProfileStats netflow_perf_stats;
-
-// Used to ensure we fully populate the record; can't rely on the actual values being zero
-struct RecordStatus
-{
-    bool src = false;
-    bool dst = false;
-    bool first = false;
-    bool last = false;
-    bool src_tos = false;
-    bool dst_tos = false;
-    bool bytes_sent = false;
-    bool packets_sent = false;
-};
-
-// -----------------------------------------------------------------------------
-// static variables
-// -----------------------------------------------------------------------------
-
-// temporary cache required to dump the output
-typedef std::pair<snort::SfIp, NetFlowSessionRecord> IpRecord;
-typedef std::vector<IpRecord> DumpCache;
-static DumpCache* dump_cache = nullptr;
-
-// compare struct to use with ip sort
-struct IpCompare
-{
-    bool operator()(const IpRecord& a, const IpRecord& b)
-    { return a.first.less_than(b.first); }
-};
-
-static std::unordered_map<int, int>* udp_srv_map = nullptr;
-static std::unordered_map<int, int>* tcp_srv_map = nullptr;
-
 // -----------------------------------------------------------------------------
 // static functions
 // -----------------------------------------------------------------------------
@@ -423,6 +388,9 @@ static bool version_9_record_update(const unsigned char* data, uint32_t unix_sec
 static bool decode_netflow_v9(const unsigned char* data, uint16_t size,
     const Packet* p, const NetFlowRules* p_rules)
 {
+    // Ensure this flow isn't implicitly trusted
+    p->flow->set_deferred_trust(NetFlowModule::module_id, true);
+
     NetFlow9Hdr header;
     const NetFlow9Hdr *pheader;
     const NetFlow9FlowSet *flowset;
@@ -643,6 +611,9 @@ static bool decode_netflow_v9(const unsigned char* data, uint16_t size,
 static bool decode_netflow_v5(const unsigned char* data, uint16_t size,
     const Packet* p, const NetFlowRules* p_rules)
 {
+    // Ensure this flow isn't implicitly trusted
+    p->flow->set_deferred_trust(NetFlowModule::module_id, true);
+
     NetFlow5Hdr header;
     const NetFlow5Hdr *pheader;
     const NetFlow5RecordHdr *precord;
@@ -799,6 +770,9 @@ public:
     void show(const snort::SnortConfig*) const override;
     void install_reload_handler(snort::SnortConfig*) override;
 
+    bool is_control_channel() const override
+    { return true; }
+
 private:
     const NetFlowConfig *config;
 
@@ -1091,6 +1065,11 @@ static Inspector* netflow_ctor(Module* m)
 static void netflow_dtor(Inspector* p)
 { delete p; }
 
+static void netflow_inspector_pinit()
+{
+    NetFlowModule::init();
+}
+
 static const InspectApi netflow_api =
 {
     {
@@ -1109,7 +1088,7 @@ static const InspectApi netflow_api =
     PROTO_BIT__UDP,
     nullptr,    // buffers
     "netflow",  // service
-    nullptr,
+    netflow_inspector_pinit,
     nullptr,    //pterm
     nullptr,    // pre-config tinit
     nullptr,    // pre-config tterm

diff --git a/src/service_inspectors/netflow/netflow.h b/src/service_inspectors/netflow/netflow.h
new file mode 100644 (file)
index 0000000..ba93dda
--- /dev/null
+++ b/src/service_inspectors/netflow/netflow.h
@@ -0,0 +1,65 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2022-2022 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// netflow.h author Michael Matirko <mmatirkoe@cisco.com>
+
+#ifndef NETFLOW_H
+#define NETFLOW_H
+
+#include <unordered_map>
+#include <vector>
+
+#include "flow/flow_data.h"
+#include "profiler/profiler.h"
+#include "protocols/packet.h"
+#include "utils/util.h"
+
+#include "netflow_cache.cc"
+#include "netflow_record.h"
+
+THREAD_LOCAL NetFlowStats netflow_stats;
+THREAD_LOCAL snort::ProfileStats netflow_perf_stats;
+
+// Used to ensure we fully populate the record; can't rely on the actual values being zero
+struct RecordStatus
+{
+    bool src = false;
+    bool dst = false;
+    bool first = false;
+    bool last = false;
+    bool src_tos = false;
+    bool dst_tos = false;
+    bool bytes_sent = false;
+    bool packets_sent = false;
+};
+
+// temporary cache required to dump the output
+typedef std::pair<snort::SfIp, NetFlowSessionRecord> IpRecord;
+typedef std::vector<IpRecord> DumpCache;
+static DumpCache* dump_cache = nullptr;
+
+struct IpCompare
+{
+    bool operator()(const IpRecord& a, const IpRecord& b)
+    { return a.first.less_than(b.first); }
+};
+
+static std::unordered_map<int, int>* udp_srv_map = nullptr;
+static std::unordered_map<int, int>* tcp_srv_map = nullptr;
+
+#endif

diff --git a/src/service_inspectors/netflow/netflow_module.cc b/src/service_inspectors/netflow/netflow_module.cc
index a73583cfec75957cdac7c544100f248c951e7f6d..785b5d148f2b36b31fb55f2eabe5b24dd69d0ec6 100644 (file)
--- a/src/service_inspectors/netflow/netflow_module.cc
+++ b/src/service_inspectors/netflow/netflow_module.cc
@@ -97,6 +97,8 @@ static const PegInfo netflow_pegs[] =
     { CountType::END, nullptr, nullptr},
 };
 
+unsigned NetFlowModule::module_id = 0;
+
 //-------------------------------------------------------------------------
 // netflow module
 //-------------------------------------------------------------------------

diff --git a/src/service_inspectors/netflow/netflow_module.h b/src/service_inspectors/netflow/netflow_module.h
index 2d90e3693a6b29deafd107a40282fff506a43f9f..3cadfc0f0f10145d2772013efd4e4ffa9e5face6 100644 (file)
--- a/src/service_inspectors/netflow/netflow_module.h
+++ b/src/service_inspectors/netflow/netflow_module.h
@@ -24,6 +24,7 @@
 
 #include <unordered_map>
 
+#include "flow/flow_data.h"
 #include "framework/module.h"
 #include "hash/lru_cache_local.h"
 #include "sfip/sf_cidr.h"
@@ -167,6 +168,10 @@ public:
     bool is_bindable() const override
     { return true; }
 
+    static unsigned module_id;
+    static void init()
+    { module_id = snort::FlowData::create_flow_data_id(); }
+
 private:
     NetFlowConfig* conf = nullptr;
     NetFlowRule rule_cfg = {};