Merge pull request #1532 in SNORT/snort3 from ~NIHDESAI/snort3:snort2lua_zones to...

Squashed commit of the following:

commit ab76f0b0b651553f40675e5d33511a968ec35a16
Author: Nihal Desai <nihdesai@cisco.com>
Date:   Fri Mar 1 07:22:06 2019 -0500

    snort2lua: combining multiple zone in one binder rule

diff --git a/src/framework/bits.h b/src/framework/bits.h
index b309eff5fd219e3b3ed8e7543816f49e9f447bc4..b9ba9645fb5193ab9bc638380f20ebf141b9f856 100644 (file)
--- a/src/framework/bits.h
+++ b/src/framework/bits.h
@@ -27,6 +27,7 @@
 typedef std::bitset<65536> PortBitSet;
 typedef std::bitset<4096> VlanBitSet;
 typedef std::bitset<256> ByteBitSet;
+typedef std::bitset<64> ZoneBitSet;
 
 #endif
 

diff --git a/src/framework/value.cc b/src/framework/value.cc
index 328dc3ea4d348c4094469ed9ad73bd6752e3b401..25b40b5dd22754c4c6e507191debe0e58a5d9617 100644 (file)
--- a/src/framework/value.cc
+++ b/src/framework/value.cc
@@ -114,6 +114,19 @@ void Value::get_bits(PortBitSet& list) const
     }
 }
 
+void Value::get_bits(ZoneBitSet& list) const
+{
+    list.reset();
+    std::size_t len = str.size();
+    assert(len == list.size());
+
+    for ( std::size_t n = 0; n < len; ++n )
+    {
+        if ( str[n] == '1' )
+            list.set(n);
+    }
+}
+
 void Value::get_bits(VlanBitSet& list) const
 {
     list.reset();

diff --git a/src/framework/value.h b/src/framework/value.h
index 68514e4cd43e6420e48797aec0b33423241081a8..6c7d3c0009d0bfab4b0858dc9c2a9b26fb58508b 100644 (file)
--- a/src/framework/value.h
+++ b/src/framework/value.h
@@ -140,6 +140,7 @@ public:
     void get_bits(PortBitSet&) const;
     void get_bits(VlanBitSet&) const;
     void get_bits(ByteBitSet&) const;
+    void get_bits(ZoneBitSet&) const;
 
     void lower()
     { std::transform(str.begin(), str.end(), str.begin(), ::tolower); }

diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc
index a3aa25b59b6261b4460eb12c113459cc4084835d..45c859115887aa2f3afaf010ecd1fb1ccd512860 100644 (file)
--- a/src/network_inspectors/binder/bind_module.cc
+++ b/src/network_inspectors/binder/bind_module.cc
@@ -89,10 +89,13 @@ static const Parameter binder_when_params[] =
     { "dst_ports", Parameter::PT_BIT_LIST, "65535", nullptr,
       "list of destination ports" },
 
-    { "src_zone", Parameter::PT_INT, "0:max31", nullptr,
+    { "zones", Parameter::PT_BIT_LIST, "63", nullptr,
+      "zones" },
+
+    { "src_zone", Parameter::PT_BIT_LIST, "63", nullptr,
       "source zone" },
 
-    { "dst_zone", Parameter::PT_INT, "0:max31", nullptr,
+    { "dst_zone", Parameter::PT_BIT_LIST, "63", nullptr,
       "destination zone" },
 
     { "role", Parameter::PT_ENUM, "client | server | any", "any",
@@ -230,11 +233,21 @@ bool BinderModule::set(const char* fqn, Value& v, SnortConfig*)
         work->when.split_ports = true;
     }
 
+    else if ( v.is("zones") )
+    {
+        v.get_bits(work->when.src_zones);
+        unsplit_zones = true;
+    }
     else if ( v.is("src_zone") )
-        work->when.src_zone = v.get_int32();
-
+    {
+        v.get_bits(work->when.src_zones);
+        work->when.split_zones = true;
+    }
     else if ( v.is("dst_zone") )
-        work->when.dst_zone = v.get_int32();
+    {
+        v.get_bits(work->when.dst_zones);
+        work->when.split_zones = true;
+    }
 
     else if ( v.is("role") )
         work->when.role = (BindWhen::Role)v.get_uint8();
@@ -281,6 +294,7 @@ bool BinderModule::begin(const char* fqn, int idx, SnortConfig*)
         work = new Binding;
         unsplit_nets = false;
         unsplit_ports = false;
+        unsplit_zones = false;
         use_name_count = 0;
         use_type_count = 0;
     }
@@ -297,6 +311,9 @@ static void split_nets_warning()
 static void split_ports_warning()
 { ParseWarning(WARN_CONF, "src_ports and dst_ports override ports"); }
 
+static void split_zones_warning()
+{ ParseWarning(WARN_CONF, "src_zones and dst_zones override zones"); }
+
 bool BinderModule::end(const char* fqn, int idx, SnortConfig* sc)
 {
     if ( idx && !strcmp(fqn, BIND_NAME) )
@@ -313,6 +330,9 @@ bool BinderModule::end(const char* fqn, int idx, SnortConfig* sc)
         if ( unsplit_ports && work->when.split_ports )
             split_ports_warning();
 
+        if ( unsplit_zones && work->when.split_zones )
+            split_zones_warning();
+
         if ( use_type_count > 1 || use_name_count > 1 )
             file_name_type_error();
 

diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h
index eaa198db88d155a6d4e6b1530b27d74812068ce9..ad9da623fda798ba89699525419ec52b2d65ff36 100644 (file)
--- a/src/network_inspectors/binder/bind_module.h
+++ b/src/network_inspectors/binder/bind_module.h
@@ -66,6 +66,7 @@ private:
     std::vector<Binding*> bindings;
     bool unsplit_nets;
     bool unsplit_ports;
+    bool unsplit_zones;
     unsigned use_name_count;
     unsigned use_type_count;
 

diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index a7968aeaea787e4b7e414cc7af565894c3877f76..df0e150dd83eedcf8d5671dc75ae4951fbcca9eb 100644 (file)
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -66,13 +66,14 @@ Binding::Binding()
     when.src_ports.set();
     when.dst_ports.set();
 
+    when.split_zones = false;
+    when.src_zones.set();
+    when.dst_zones.set();
+
     when.protos = PROTO_BIT__ANY_TYPE;
     when.vlans.set();
     when.ifaces.reset();
 
-    when.src_zone = DAQ_PKTHDR_UNKNOWN;
-    when.dst_zone = DAQ_PKTHDR_UNKNOWN;
-
     when.ips_id = 0;
     when.ips_id_user = 0;
     when.role = BindWhen::BR_EITHER;
@@ -310,16 +311,43 @@ inline Binding::DirResult Binding::check_split_port(
         { return when_val.test(traffic_val); });
 }
 
-inline Binding::DirResult Binding::check_zone(
-    const Packet* p, const Binding::DirResult dr) const
+inline bool Binding::check_zone(const Packet* p) const
 {
-    if ( !p )
+    if ( when.split_zones or !p )
+        return true;
+
+    if (p->pkth->egress_group == DAQ_PKTHDR_UNKNOWN or
+        p->pkth->ingress_group == DAQ_PKTHDR_UNKNOWN)
+        return true;
+
+    assert(((unsigned)p->pkth->ingress_group) < when.src_zones.size());
+    assert(((unsigned)p->pkth->egress_group) < when.dst_zones.size());
+
+    if (when.src_zones.test((unsigned)p->pkth->ingress_group) or
+        when.dst_zones.test((unsigned)p->pkth->egress_group))
+        return true;
+    return false;
+}
+
+inline Binding::DirResult Binding::check_split_zone(const Packet* p, const Binding::DirResult dr) const
+{
+    if ( !when.split_zones )
         return dr;
 
-    return directional_match(when.src_zone, when.dst_zone,
-        p->pkth->ingress_group, p->pkth->egress_group, dr,
-        [](int32_t when_val, int32_t zone)
-        { return when_val == DAQ_PKTHDR_UNKNOWN or when_val == zone; });
+    int src_zone;
+    int dst_zone;
+
+    if ( p )
+    {
+        src_zone = p->pkth->ingress_group;
+        dst_zone = p->pkth->egress_group;
+    }
+    else
+        return dr;
+
+    return directional_match(when.src_zones, when.dst_zones, src_zone, dst_zone, dr,
+        [](const ZoneBitSet& when_val, int traffic_val)
+        { return traffic_val == DAQ_PKTHDR_UNKNOWN ? true : when_val.test(traffic_val); });
 }
 
 bool Binding::check_all(const Flow* flow, Packet* p) const
@@ -353,11 +381,14 @@ bool Binding::check_all(const Flow* flow, Packet* p) const
     if ( dir == Binding::DR_NO_MATCH )
         return false;
 
+    dir = check_split_zone(p, dir);
+    if ( dir == Binding::DR_NO_MATCH )
+        return false;
+
     if ( !check_service(flow) )
         return false;
 
-    dir = check_zone(p, dir);
-    if ( dir == Binding::DR_NO_MATCH )
+    if ( !check_zone(p) )
         return false;
 
     return true;

diff --git a/src/network_inspectors/binder/binding.h b/src/network_inspectors/binder/binding.h
index 4f00ed7dbb4bc56c337a259d47769a2d2c26cb3e..8e31dc1f4c6a01246e4008eca1550aca25d595cb 100644 (file)
--- a/src/network_inspectors/binder/binding.h
+++ b/src/network_inspectors/binder/binding.h
@@ -54,8 +54,9 @@ struct BindWhen
     PortBitSet src_ports;
     PortBitSet dst_ports;
 
-    int32_t src_zone;
-    int32_t dst_zone;
+    bool split_zones;
+    ZoneBitSet src_zones;
+    ZoneBitSet dst_zones;
 };
 
 struct BindUse
@@ -112,8 +113,9 @@ struct Binding
     bool check_proto(const snort::Flow*) const;
     bool check_port(const snort::Flow*) const;
     DirResult check_split_port(const snort::Flow*, const snort::Packet*, const DirResult) const;
+    bool check_zone(const snort::Packet*) const;
+    DirResult check_split_zone(const snort::Packet*, const DirResult) const;
     bool check_service(const snort::Flow*) const;
-    DirResult check_zone(const snort::Packet*, const DirResult) const;
 };
 
 #endif

diff --git a/tools/snort2lua/helpers/util_binder.cc b/tools/snort2lua/helpers/util_binder.cc
index 8f4b4eee95a3cb8ff1c2665173e98342dd187048..796483520506a24bc752166f671defa0efad7f97 100644 (file)
--- a/tools/snort2lua/helpers/util_binder.cc
+++ b/tools/snort2lua/helpers/util_binder.cc
@@ -75,11 +75,14 @@ void Binder::add_to_configuration()
     for ( const auto& p : ports )
         table_api.add_list("ports", p);
 
-    if ( has_src_zone() )
-        table_api.add_option("src_zone", std::stoi(when_src_zone));
+    for ( const auto& p : when_src_zone )
+        table_api.add_list("src_zone", p);
 
-    if ( has_dst_zone() )
-        table_api.add_option("dst_zone", std::stoi(when_dst_zone));
+    for ( const auto& p : when_dst_zone )
+        table_api.add_list("dst_zone", p);
+
+    for ( const auto& p : zones )
+        table_api.add_list("zones", p);
 
     if ( has_proto() )
         table_api.add_option("proto", when_proto);
@@ -178,10 +181,13 @@ void Binder::add_when_port(const std::string& port)
 { ports.push_back(port); }
 
 void Binder::set_when_src_zone(const std::string& zone)
-{ when_src_zone = zone; }
+{ when_src_zone.push_back(zone); }
 
 void Binder::set_when_dst_zone(const std::string& zone)
-{ when_dst_zone = zone; }
+{ when_dst_zone.push_back(zone); }
+
+void Binder::add_when_zone(const std::string& zone)
+{ zones.push_back(zone); }
 
 void Binder::clear_ports()
 { ports.clear(); }
@@ -344,9 +350,12 @@ void print_binder_priorities()
             binders.back()->add_when_port("a");
 
         if ( i & (1 << 11) )
-            binders.back()->set_when_proto("a");
+            binders.back()->add_when_zone("a");
 
         if ( i & (1 << 12) )
+            binders.back()->set_when_proto("a");
+
+        if ( i & (1 << 13) )
             binders.back()->set_when_role("a");
     }
 

diff --git a/tools/snort2lua/helpers/util_binder.h b/tools/snort2lua/helpers/util_binder.h
index 63af34891e7a21f1ec6be01dba141b2875116d75..73263eb8b8bc00ffd05cc4efd1735330dbbff51d 100644 (file)
--- a/tools/snort2lua/helpers/util_binder.h
+++ b/tools/snort2lua/helpers/util_binder.h
@@ -65,6 +65,7 @@ public:
     void add_when_src_net(const std::string&);
     void add_when_dst_net(const std::string&);
     void add_when_port(const std::string&);
+    void add_when_zone(const std::string&);
     void add_when_src_port(const std::string&);
     void add_when_dst_port(const std::string&);
     void set_when_src_zone(const std::string&);
@@ -152,8 +153,9 @@ private:
     std::vector<std::string> ports;
     std::vector<std::string> src_ports;
     std::vector<std::string> dst_ports;
-    std::string when_src_zone;
-    std::string when_dst_zone;
+    std::vector<std::string> when_src_zone;
+    std::vector<std::string> when_dst_zone;
+    std::vector<std::string> zones; 
 
     std::string use_type;
     std::string use_name;