From: Russ Combs Date: Sun, 21 Sep 2014 12:39:08 +0000 (-0400) Subject: initial multiple policy binding X-Git-Tag: 3.0.0-233~1404^2~12^2~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=20c70073ead9ff021660034e954cdc5c5f38cbdd;p=thirdparty%2Fsnort3.git initial multiple policy binding --- diff --git a/ChangeLog b/ChangeLog index f4c2e4271..e4aa38991 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,7 @@ -- fixed valgrind issues -- refactored Shells to support multiple files/policies -- changed detect reset to accommodate buffer population before reassembly +-- initial multiple policy binding 119 -- updated binder diff --git a/src/main/policy.cc b/src/main/policy.cc index e1ca2dcef..1800044ae 100644 --- a/src/main/policy.cc +++ b/src/main/policy.cc @@ -97,10 +97,7 @@ IpsPolicy::~IpsPolicy() PolicyMap::PolicyMap() { - shells.push_back(new Shell); - inspection_policy.push_back(new InspectionPolicy); - ips_policy.push_back(new IpsPolicy); - network_policy.push_back(new NetworkPolicy); + add_shell(new Shell); set_inspection_policy(inspection_policy[0]); set_ips_policy(ips_policy[0]); @@ -127,3 +124,57 @@ PolicyMap::~PolicyMap() network_policy.clear(); } +unsigned PolicyMap::add_shell(Shell* sh) +{ + shells.push_back(sh); + inspection_policy.push_back(new InspectionPolicy); + ips_policy.push_back(new IpsPolicy); + network_policy.push_back(new NetworkPolicy); + return shells.size() - 1; +} + +//------------------------------------------------------------------------- +// policy nav +//------------------------------------------------------------------------- + +static THREAD_LOCAL NetworkPolicy* s_traffic_policy = nullptr; +static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr; +static THREAD_LOCAL IpsPolicy* s_detection_policy = nullptr; + +NetworkPolicy* get_network_policy() +{ return s_traffic_policy; } + +InspectionPolicy* get_inspection_policy() +{ return s_inspection_policy; } + +IpsPolicy* get_ips_policy() +{ return s_detection_policy; } + +void set_network_policy(NetworkPolicy* p) +{ s_traffic_policy = p; } + +void set_inspection_policy(InspectionPolicy* p) +{ s_inspection_policy = p; } + +void set_ips_policy(IpsPolicy* p) +{ s_detection_policy = p; } + +void set_policies(SnortConfig* sc, unsigned i) +{ + PolicyMap* pm = sc->policy_map; + + if ( i < pm->shells.size() ) + { + set_network_policy(pm->network_policy[i]); + set_inspection_policy(pm->inspection_policy[i]); + set_ips_policy(pm->ips_policy[i]); + } +} + +void set_default_policy() +{ + set_network_policy(snort_conf->policy_map->network_policy[0]); + set_ips_policy(snort_conf->policy_map->ips_policy[0]); + set_inspection_policy(snort_conf->policy_map->inspection_policy[0]); +} + diff --git a/src/main/policy.h b/src/main/policy.h index 8ce58d51f..dba484aeb 100644 --- a/src/main/policy.h +++ b/src/main/policy.h @@ -141,7 +141,7 @@ public: }; //------------------------------------------------------------------------- -// binding stuff - FIXIT-H tbd +// binding stuff //------------------------------------------------------------------------- class Shell; @@ -152,20 +152,7 @@ public: PolicyMap(); ~PolicyMap(); - InspectionPolicy* get_inspection_policy() - { return inspection_policy[0]; }; - - IpsPolicy* get_ips_policy() - { return ips_policy[0]; }; - - NetworkPolicy* get_network_policy() - { return network_policy[0]; }; - - unsigned add_shell(Shell* sh) - { - shells.push_back(sh); - return shells.size() - 1; - }; + unsigned add_shell(Shell*); Shell* get_shell(unsigned i = 0) { return i < shells.size() ? shells[i] : nullptr; }; @@ -177,5 +164,21 @@ public: // FIXTHIS-H make impl private std::vector network_policy; }; +//------------------------------------------------------------------------- +// navigator stuff +//------------------------------------------------------------------------- + +// FIXIT-L may be inlined at some point; on lockdown for now +NetworkPolicy* get_network_policy(); +InspectionPolicy* get_inspection_policy(); +IpsPolicy* get_ips_policy(); + +void set_network_policy(NetworkPolicy*); +void set_inspection_policy(InspectionPolicy*); +void set_ips_policy(IpsPolicy*); + +void set_policies(struct SnortConfig*, unsigned = 0); +void set_default_policy(); + #endif diff --git a/src/main/snort.cc b/src/main/snort.cc index 07b391497..cabc87c0c 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -131,34 +131,6 @@ static char** snort_argv = NULL; static void CleanExit(int); static void SnortCleanup(); -//------------------------------------------------------------------------- -// nascent policy management -//------------------------------------------------------------------------- -// FIXIT-H need stub binding rule to set these for runtime -// FIXIT-H need to set these on load too somehow - -static THREAD_LOCAL NetworkPolicy* s_traffic_policy = nullptr; -static THREAD_LOCAL InspectionPolicy* s_inspection_policy = nullptr; -static THREAD_LOCAL IpsPolicy* s_detection_policy = nullptr; - -NetworkPolicy* get_network_policy() -{ return s_traffic_policy; } - -InspectionPolicy* get_inspection_policy() -{ return s_inspection_policy; } - -IpsPolicy* get_ips_policy() -{ return s_detection_policy; } - -void set_network_policy(NetworkPolicy* p) -{ s_traffic_policy = p; } - -void set_inspection_policy(InspectionPolicy* p) -{ s_inspection_policy = p; } - -void set_ips_policy(IpsPolicy* p) -{ s_detection_policy = p; } - //------------------------------------------------------------------------- // utility //------------------------------------------------------------------------- @@ -300,7 +272,7 @@ static void init_policy(SnortConfig* sc) else pm = POLICY_MODE__PASSIVE; - sc->get_ips_policy()->policy_mode = pm; + get_ips_policy()->policy_mode = pm; } static void SnortInit(int argc, char **argv) @@ -718,27 +690,10 @@ void CapturePacket() } } -void set_default_policy() +static void set_policy(Packet* p) // FIXIT-H delete this? { - set_network_policy(snort_conf->policy_map->network_policy[0]); - set_ips_policy(snort_conf->policy_map->ips_policy[0]); - set_inspection_policy(snort_conf->policy_map->inspection_policy[0]); -} - -static void set_policy(Packet*) // FIX SSN implement based on bindings -{ - // for now need to just get stream_* inspectors and call appropriately -#if 0 - int vlanId = (p->vh) ? vlan::vth_vlan(p->vh) : -1; - const sfip_t *srcIp = p->ptrs.ip_api.get_src(); // returns nullptr if not set - const sfip_t *dstIp = p->ptrs.ip_api.get_dst(); - - //set policy id for this packet - setCurrentPolicy(snort_conf, sfGetApplicablePolicyId( - snort_conf->policy_config, vlanId, srcIp, dstIp)); -#else set_default_policy(); -#endif + p->user_policy_id = get_ips_policy()->user_policy_id; } void DecodeRebuiltPacket ( @@ -750,8 +705,7 @@ void DecodeRebuiltPacket ( p->flow = lws; - set_policy(p); // FIX SSN rebuilt should reuse original bindings - p->user_policy_id = get_ips_policy()->user_policy_id; + set_policy(p); // FIXIT-H rebuilt should reuse original bindings from flow SnortEventqPop(); } @@ -797,9 +751,7 @@ DAQ_Verdict ProcessPacket( p->proto_bits &= ~PROTO_BIT__IP; #endif - set_policy(p); - - p->user_policy_id = get_ips_policy()->user_policy_id; + set_policy(p); // FIXIT-H should not need this here /* just throw away the packet if we are configured to ignore this port */ if ( !(p->packet_flags & PKT_IGNORE) ) diff --git a/src/main/snort.h b/src/main/snort.h index 75f96ab4e..6a0889bbb 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -57,15 +57,6 @@ void snort_thread_term(); void snort_idle(); void snort_rotate(); -// FIXIT-L may be inlined at some point; on lockdown for now -NetworkPolicy* get_network_policy(); -InspectionPolicy* get_inspection_policy(); -IpsPolicy* get_ips_policy(); - -void set_network_policy(NetworkPolicy*); -void set_inspection_policy(InspectionPolicy*); -void set_ips_policy(IpsPolicy*); - void CapturePacket(); void DecodeRebuiltPacket (Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, Flow*); void DetectRebuiltPacket (Packet*); @@ -76,8 +67,6 @@ DAQ_Verdict ProcessPacket(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt); DAQ_Verdict fail_open(void*, const DAQ_PktHdr_t*, const uint8_t*); DAQ_Verdict packet_callback(void*, const DAQ_PktHdr_t*, const uint8_t*); -void set_default_policy(); - typedef void (*MainHook_f)(Packet*); void set_main_hook(MainHook_f); @@ -217,62 +206,62 @@ static inline int ScLogQuiet(void) static inline int ScIpChecksums(void) { - return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__IP; + return get_network_policy()->checksum_eval & CHECKSUM_FLAG__IP; } static inline int ScIpChecksumDrops(void) { - return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__IP; + return get_network_policy()->checksum_drop & CHECKSUM_FLAG__IP; } static inline int ScUdpChecksums(void) { - return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__UDP; + return get_network_policy()->checksum_eval & CHECKSUM_FLAG__UDP; } static inline int ScUdpChecksumDrops(void) { - return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__UDP; + return get_network_policy()->checksum_drop & CHECKSUM_FLAG__UDP; } static inline int ScTcpChecksums(void) { - return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__TCP; + return get_network_policy()->checksum_eval & CHECKSUM_FLAG__TCP; } static inline int ScTcpChecksumDrops(void) { - return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__TCP; + return get_network_policy()->checksum_drop & CHECKSUM_FLAG__TCP; } static inline int ScIcmpChecksums(void) { - return snort_conf->get_network_policy()->checksum_eval & CHECKSUM_FLAG__ICMP; + return get_network_policy()->checksum_eval & CHECKSUM_FLAG__ICMP; } static inline int ScIcmpChecksumDrops(void) { - return snort_conf->get_network_policy()->checksum_drop & CHECKSUM_FLAG__ICMP; + return get_network_policy()->checksum_drop & CHECKSUM_FLAG__ICMP; } static inline uint8_t ScMinTTL(void) { - return snort_conf->get_network_policy()->min_ttl; + return get_network_policy()->min_ttl; } static inline uint8_t ScNewTTL(void) { - return snort_conf->get_network_policy()->new_ttl; + return get_network_policy()->new_ttl; } static inline int ScInlineMode(void) { - return ((snort_conf->get_ips_policy()->policy_mode) == POLICY_MODE__INLINE ); + return ((get_ips_policy()->policy_mode) == POLICY_MODE__INLINE ); } static inline int ScInlineTestMode(void) { - return ((snort_conf->get_ips_policy()->policy_mode) == POLICY_MODE__INLINE_TEST ); + return ((get_ips_policy()->policy_mode) == POLICY_MODE__INLINE_TEST ); } //------------------------------------------------------------------------- diff --git a/src/main/snort_config.h b/src/main/snort_config.h index 5aeb058b8..d293253a9 100644 --- a/src/main/snort_config.h +++ b/src/main/snort_config.h @@ -282,13 +282,13 @@ struct SnortConfig #endif InspectionPolicy* get_inspection_policy() - { return policy_map->get_inspection_policy(); }; + { return policy_map->inspection_policy[0]; }; IpsPolicy* get_ips_policy() - { return policy_map->get_ips_policy(); }; + { return policy_map->ips_policy[0]; }; NetworkPolicy* get_network_policy() - { return policy_map->get_network_policy(); }; + { return policy_map->network_policy[0]; }; }; SnortConfig* SnortConfNew(void); diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index 808ffb11a..9088d8cf0 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -451,10 +451,8 @@ void InspectorManager::thread_term(SnortConfig* sc) void InspectorManager::instantiate( const InspectApi* api, Module*, SnortConfig* sc) { - // FIXIT-H only configures inspectors in base policy; must be - // revisited when bindings are implemented FrameworkConfig* fc = sc->framework_config; - FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy; + FrameworkPolicy* fp = get_inspection_policy()->framework_policy; // FIXIT-H should not need to lookup inspector etc // since given api and mod @@ -502,13 +500,8 @@ static void instantiate_binder(SnortConfig* sc, FrameworkPolicy* fp) fp->binder = get_instance(fp, bind_id)->handler; } -bool InspectorManager::configure(SnortConfig *sc) +static bool configure(SnortConfig* sc, FrameworkPolicy* fp) { - sort(s_handlers.begin(), s_handlers.end(), PHGlobal::comp); - - // FIXIT-H do we need more than one framework policy? - // if so, must vectorize(), etc. multiple times - FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy; bool ok = true; for ( auto* p : fp->ilist ) @@ -517,12 +510,23 @@ bool InspectorManager::configure(SnortConfig *sc) sort(fp->ilist.begin(), fp->ilist.end(), PHInstance::comp); fp->vectorize(); - if ( fp->service.num && !fp->binder && get_wizard() ) + if ( fp->service.num && !fp->binder && InspectorManager::get_wizard() ) instantiate_binder(sc, fp); return ok; } +bool InspectorManager::configure(SnortConfig *sc) +{ + sort(s_handlers.begin(), s_handlers.end(), PHGlobal::comp); + bool ok = true; + + for ( auto* p : sc->policy_map->inspection_policy ) + ok = ::configure(sc, p->framework_policy) && ok; + + return ok; +} + void InspectorManager::print_config(SnortConfig *sc) { InspectionPolicy* pi = get_inspection_policy(); diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc index 344bbcf7d..66b953771 100644 --- a/src/network_inspectors/binder/bind_module.cc +++ b/src/network_inspectors/binder/bind_module.cc @@ -214,7 +214,7 @@ void BinderModule::add(unsigned proto, const char* type) bindings.push_back(b); } -vector BinderModule::get_data() +vector& BinderModule::get_data() { return bindings; // move semantics } diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h index 17f452aff..9d6c34527 100644 --- a/src/network_inspectors/binder/bind_module.h +++ b/src/network_inspectors/binder/bind_module.h @@ -57,7 +57,7 @@ public: PegCount* get_counts() const; ProfileStats* get_profile() const; - std::vector get_data(); + std::vector& get_data(); private: Binding* work; std::vector bindings; diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index dfbdf8f8e..9e2121c08 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -172,7 +172,7 @@ static void set_session(Flow* flow) class Binder : public Inspector { public: - Binder(vector); + Binder(vector&); ~Binder(); void show(SnortConfig*) @@ -194,9 +194,9 @@ private: vector bindings; }; -Binder::Binder(vector v) +Binder::Binder(vector& v) { - bindings = v; + bindings = std::move(v); } Binder::~Binder() @@ -364,7 +364,7 @@ static void mod_dtor(Module* m) static Inspector* bind_ctor(Module* m) { BinderModule* mod = (BinderModule*)m; - vector pb = mod->get_data(); + vector& pb = mod->get_data(); return new Binder(pb); } diff --git a/src/parser/parser.cc b/src/parser/parser.cc index 3afd8f8a8..2f138cf0e 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -565,6 +565,15 @@ static void IntegrityCheckRules(SnortConfig *sc) //DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "OK\n");); } +static void parse_file(SnortConfig* sc, Shell* sh) +{ + const char* fname = sh->get_file(); + LogMessage("Loading %s:\n", fname); + push_parse_location(fname); + sh->configure(sc); + pop_parse_location(); +} + //------------------------------------------------------------------------- // public methods //------------------------------------------------------------------------- @@ -643,12 +652,10 @@ SnortConfig * ParseSnortConf(const SnortConfig* boot_conf) if ( !sh ) break; - fname = sh->get_file(); - LogMessage("Loading %s:\n", fname); - push_parse_location(fname); - sh->configure(sc); - pop_parse_location(); + set_policies(sc, i); + parse_file(sc, sh); } + set_policies(sc); return sc; } diff --git a/src/service_inspectors/ftp_telnet/ftp_module.cc b/src/service_inspectors/ftp_telnet/ftp_module.cc index da009941d..9bf26574a 100644 --- a/src/service_inspectors/ftp_telnet/ftp_module.cc +++ b/src/service_inspectors/ftp_telnet/ftp_module.cc @@ -227,43 +227,6 @@ FtpCmd::FtpCmd(std::string& key, std::string& fmt, int num) #define FTP_EVASIVE_TELNET_CMD_STR \ "(ftp) Evasive (incomplete) TELNET CMD on FTP Command Channel" -// FIXIT-H convert to Lua and use as module default settings -#if 0 -static const char* DEFAULT_FTP_CONF[] = -{ - "hardcoded_config " - "def_max_param_len 100 " - - // eg must appear in at least one *_cmds parameter - "ftp_cmds { USER PASS ACCT CWD CDUP SMNT QUIT REIN TYPE STRU" - " MODE RETR STOR STOU APPE ALLO REST RNFR RNTO ABOR" - " DELE RMD MKD PWD LIST NLST SITE SYST STAT HELP NOOP } " - "ftp_cmds { AUTH ADAT PROT PBSZ CONF ENC } " - "ftp_cmds { PORT PASV LPRT LPSV EPRT EPSV } " - "ftp_cmds { FEAT OPTS } " - "ftp_cmds { MDTM REST SIZE MLST MLSD } " - - "alt_max_param_len 0 { CDUP QUIT REIN PASV STOU ABOR PWD SYST NOOP } ", - - "cmd_validity MODE < char SBC > " - "cmd_validity STRU < char FRPO [ string ] > " - "cmd_validity ALLO < int [ char R int ] > " - "cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > " - "cmd_validity PORT < host_port > " - "cmd_validity LPRT < long_host_port > " - "cmd_validity EPRT < extd_host_port > " - "cmd_validity EPSV < [ { '1' | '2' | 'ALL' } ] > ", - - "data_chan_cmds { PORT PASV LPRT LPSV EPRT EPSV } " - "data_xfer_cmds { RETR STOR STOU APPE LIST NLST } " - "file_put_cmds { STOR STOU } " - "file_get_cmds { RETR } " - "login_cmds { USER PASS } " - "dir_cmds { CWD 250 CDUP 250 PWD 257 } " - "encr_cmds { AUTH } " -}; -#endif - //------------------------------------------------------------------------- static const Parameter ftp_server_validity_params[] =