Merge pull request #2675 in SNORT/snort3 from ~DERAMADA/snort3:revert_reputation...

Squashed commit of the following:

commit e9c62d807056426a8702607b7c10bed407f624da
Author: Deepak Ramadass <deramada@cisco.com>
Date:   Thu Dec 17 10:26:37 2020 -0500

    reputation: retain backward compatibility

    This reverts commit 29c66e6d5d11a680633b1d8ac6f00b8c1c8e98d2.

diff --git a/src/network_inspectors/reputation/reputation_module.cc b/src/network_inspectors/reputation/reputation_module.cc
index 44a3e4a3da6b5028f376c819ecc44da496c7ac8f..ba0693d276cfa7e643a6146626908a0f9ba3bfb8 100644 (file)
--- a/src/network_inspectors/reputation/reputation_module.cc
+++ b/src/network_inspectors/reputation/reputation_module.cc
@@ -54,6 +54,9 @@ static const Parameter s_params[] =
     { "blocklist", Parameter::PT_STRING, nullptr, nullptr,
       "blocklist file name with IP lists" },
 
+    { "blacklist", Parameter::PT_STRING, nullptr, nullptr,
+      "blacklist file name with IP lists" },
+
     { "list_dir", Parameter::PT_STRING, nullptr, nullptr,
       "directory for IP lists and manifest file" },
 
@@ -63,18 +66,24 @@ static const Parameter s_params[] =
     { "nested_ip", Parameter::PT_ENUM, "inner|outer|all", "inner",
       "IP to use when there is IP encapsulation" },
 
-    { "priority", Parameter::PT_ENUM, "blocklist|allowlist", "allowlist",
+    { "priority", Parameter::PT_ENUM, "blocklist|allowlist|blacklist|whitelist", "allowlist",
       "defines priority when there is a decision conflict during run-time" },
 
     { "scan_local", Parameter::PT_BOOL, nullptr, "false",
       "inspect local address defined in RFC 1918" },
 
-    { "allow", Parameter::PT_ENUM, "do_not_block|trust", "do_not_block",
+    { "allow", Parameter::PT_ENUM, "do_not_block|trust|unblack", "do_not_block",
       "specify the meaning of allowlist" },
 
+    { "white", Parameter::PT_ENUM, "do_not_block|trust|unblack", "do_not_block",
+      "specify the meaning of whitelist" },
+
     { "allowlist", Parameter::PT_STRING, nullptr, nullptr,
       "allowlist file name with IP lists" },
 
+    { "whitelist", Parameter::PT_STRING, nullptr, nullptr,
+      "whitelist file name with IP lists" },
+
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
 
@@ -120,7 +129,7 @@ ProfileStats* ReputationModule::get_profile() const
 
 bool ReputationModule::set(const char*, Value& v, SnortConfig*)
 {
-    if ( v.is("blocklist") )
+    if ( v.is("blocklist") or v.is("blacklist") )
         conf->blocklist_path = v.get_string();
 
     else if ( v.is("list_dir") )
@@ -133,15 +142,34 @@ bool ReputationModule::set(const char*, Value& v, SnortConfig*)
         conf->nested_ip = (NestedIP)v.get_uint8();
 
     else if ( v.is("priority") )
-        conf->priority = (IPdecision)(v.get_uint8() + 1);
+    {
+        int priority = v.get_uint8() + 1;
+
+        if (priority == 3) // blacklist
+            priority = 1;
+
+        else if (priority == 4) // whitelist
+           priority = 2;
+
+        conf->priority = (IPdecision)(priority);
+
+    }
 
     else if ( v.is("scan_local") )
         conf->scanlocal = v.get_bool();
 
-    else if ( v.is("allow") )
-        conf->allow_action = (AllowAction)v.get_uint8();
+    else if ( v.is("allow") or v.is("white") )
+    {
+        int action = v.get_uint8();
+
+        if ( action == 2 ) // unblack
+            action = 0;
+
+        conf->allow_action = (AllowAction)action;
+
+    }
 
-    else if ( v.is("allowlist") )
+    else if ( v.is("allowlist") or v.is("whitelist") )
         conf->allowlist_path = v.get_string();
 
     else

diff --git a/src/network_inspectors/reputation/reputation_parse.cc b/src/network_inspectors/reputation/reputation_parse.cc
index 683fcc96dd52f433059b60a785387b2c884897b3..952b3fa2393f70a0a679a8c33bfee47301440c55 100644 (file)
--- a/src/network_inspectors/reputation/reputation_parse.cc
+++ b/src/network_inspectors/reputation/reputation_parse.cc
@@ -57,7 +57,7 @@ static char block_info[] = "blocklist";
 static char allow_info[] = "allowlist";
 static char monitor_info[] = "monitorlist";
 
-#define TRUST_TYPE_KEYWORD       "trust"
+#define ALLOW_TYPE_KEYWORD       "allow"
 #define BLOCK_TYPE_KEYWORD       "block"
 #define MONITOR_TYPE_KEYWORD     "monitor"
 
@@ -786,10 +786,10 @@ static int get_file_type(char* type_name)
 
     type_name = ignore_start_space(type_name);
 
-    if (strncasecmp(type_name, TRUST_TYPE_KEYWORD, strlen(TRUST_TYPE_KEYWORD)) == 0)
+    if (strncasecmp(type_name, ALLOW_TYPE_KEYWORD, strlen(ALLOW_TYPE_KEYWORD)) == 0)
     {
         type = ALLOW_LIST;
-        type_name += strlen(TRUST_TYPE_KEYWORD);
+        type_name += strlen(ALLOW_TYPE_KEYWORD);
     }
     else if (strncasecmp(type_name, BLOCK_TYPE_KEYWORD, strlen(BLOCK_TYPE_KEYWORD)) == 0)
     {
@@ -869,7 +869,7 @@ static bool process_line_in_manifest(ListFile* list_item, const char* manifest,
             {
                 ErrorMessage(" %s(%d) => Unknown action specified (%s)."
                     " Please specify a value: %s | %s | %s.\n", manifest, line_number, token,
-                    TRUST_TYPE_KEYWORD, BLOCK_TYPE_KEYWORD, MONITOR_TYPE_KEYWORD);
+                    ALLOW_TYPE_KEYWORD, BLOCK_TYPE_KEYWORD, MONITOR_TYPE_KEYWORD);
                 return false;
             }
             break;