From: Josh Date: Mon, 20 Oct 2014 17:38:27 +0000 (-0500) Subject: fixing Snort2Lua csv output X-Git-Tag: 3.0.0-233~1344^2~3^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a464ad34a3d09874aba08b187bb6cc7c9fdf7e99;p=thirdparty%2Fsnort3.git fixing Snort2Lua csv output --- diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc index de8fa1bff..ec49afab8 100644 --- a/src/loggers/alert_csv.cc +++ b/src/loggers/alert_csv.cc @@ -65,7 +65,7 @@ using namespace std; "src_addr | dst_addr | src_port | dst_port | " \ "eth_src | eth_dst | eth_type | eth_len | " \ "ttl | tos | id | ip_len | dgm_len | " \ - "icmp_type | icmp_code | icmp_id | icmp_seq" \ + "icmp_type | icmp_code | icmp_id | icmp_seq | " \ "tcp_flags | tcp_seq | tcp_ack | tcp_len | tcp_win | " \ "udp_len" diff --git a/src/parser/keywords.h b/src/parser/keywords.h index 548cbe673..3d5f7edf4 100644 --- a/src/parser/keywords.h +++ b/src/parser/keywords.h @@ -48,4 +48,3 @@ #define CHECKSUM_MODE_OPT__NO_ICMP "noicmp" #endif - diff --git a/src/stream/tcp/ips_stream_reassemble.cc b/src/stream/tcp/ips_stream_reassemble.cc index 75d2b8518..d493abe26 100644 --- a/src/stream/tcp/ips_stream_reassemble.cc +++ b/src/stream/tcp/ips_stream_reassemble.cc @@ -157,10 +157,10 @@ int ReassembleOption::eval(Cursor&, Packet* pkt) static const Parameter s_params[] = { - { "*action", Parameter::PT_ENUM, "disable|enable", nullptr, + { "action", Parameter::PT_ENUM, "disable|enable", nullptr, "stop or start stream reassembly" }, - { "*direction", Parameter::PT_ENUM, "client|server|both", nullptr, + { "direction", Parameter::PT_ENUM, "client|server|both", nullptr, "action applies to the given direction(s)" }, { "noalert", Parameter::PT_IMPLIED, nullptr, nullptr, @@ -197,10 +197,10 @@ bool ReassembleModule::begin(const char*, int, SnortConfig*) bool ReassembleModule::set(const char*, Value& v, SnortConfig*) { - if ( v.is("*action") ) + if ( v.is("action") ) srod.enable = v.get_long(); - else if ( v.is("*direction") ) + else if ( v.is("direction") ) srod.enable = v.get_long() + 1; else if ( v.is("noalert") ) diff --git a/src/stream/tcp/ips_stream_size.cc b/src/stream/tcp/ips_stream_size.cc index 395798a65..c746ded0f 100644 --- a/src/stream/tcp/ips_stream_size.cc +++ b/src/stream/tcp/ips_stream_size.cc @@ -220,13 +220,13 @@ int SizeOption::eval(Cursor&, Packet* pkt) static const Parameter s_params[] = { - { "*direction", Parameter::PT_ENUM, "either|client|server|both", nullptr, + { "direction", Parameter::PT_ENUM, "either|client|server|both", nullptr, "compare applies to the given direction(s)" }, - { "*operator", Parameter::PT_ENUM, "= | != | < | > | <= | >=", nullptr, + { "operator", Parameter::PT_ENUM, "= | != | < | > | <= | >=", nullptr, "how to compare" }, - { "*size", Parameter::PT_INT, nullptr, nullptr, + { "size", Parameter::PT_INT, nullptr, nullptr, "size for comparison" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } diff --git a/tools/snort2lua/config_states/config_checksums.cc b/tools/snort2lua/config_states/config_checksums.cc index e39e801d5..422c2722d 100644 --- a/tools/snort2lua/config_states/config_checksums.cc +++ b/tools/snort2lua/config_states/config_checksums.cc @@ -53,18 +53,14 @@ public: if (snort_option == nullptr || lua_table == nullptr) return false; - table_api.open_table(*lua_table); if(lua_option == nullptr) - { lua_option = snort_option; - } else if (snort_option->compare(*lua_option)) - { table_api.add_diff_option_comment(*snort_option, *lua_option); - } + while (stream >> val) retval = table_api.add_list(*lua_option, val) && retval; diff --git a/tools/snort2lua/output_states/out_csv.cc b/tools/snort2lua/output_states/out_csv.cc index ceaa2cd7a..55f9fc31d 100644 --- a/tools/snort2lua/output_states/out_csv.cc +++ b/tools/snort2lua/output_states/out_csv.cc @@ -61,7 +61,6 @@ bool AlertCsv::convert(std::istringstream& data_stream) if (!(data_stream >> keyword)) return retval; - // parsing the format list. std::istringstream format(keyword); while (std::getline(format, val, ',')) @@ -80,12 +79,6 @@ bool AlertCsv::convert(std::istringstream& data_stream) else if (!val.compare("proto")) tmpval = table_api.add_list("csv", "proto"); - else if (!val.compare("dst")) - tmpval = table_api.add_list("csv", "dst"); - - else if (!val.compare("src")) - tmpval = table_api.add_list("csv", "src"); - else if (!val.compare("ttl")) tmpval = table_api.add_list("csv", "ttl"); @@ -95,15 +88,30 @@ bool AlertCsv::convert(std::istringstream& data_stream) else if (!val.compare("tos")) tmpval = table_api.add_list("csv", "tos"); + else if (!val.compare("trheader")) + tmpval = table_api.add_deleted_comment("trheader"); + + else if (!val.compare("dst")) + { + table_api.add_diff_option_comment("dst", "dst_addr"); + tmpval = table_api.add_list("csv", "dst_addr"); + } + + else if (!val.compare("src")) + { + table_api.add_diff_option_comment("src", "src_addr"); + tmpval = table_api.add_list("csv", "src_addr"); + } + else if (!val.compare("sig_generator")) { table_api.add_diff_option_comment("sig_generator", "gid"); tmpval = table_api.add_list("csv", "gid"); } - else if (!val.compare("sid_id")) + else if (!val.compare("sig_id")) { - table_api.add_diff_option_comment("sid_id", "sid"); + table_api.add_diff_option_comment("sig_id", "sid"); tmpval = table_api.add_list("csv", "sid"); } @@ -143,6 +151,13 @@ bool AlertCsv::convert(std::istringstream& data_stream) tmpval = table_api.add_list("csv", "eth_len"); } + else if (!val.compare("ethtype")) + { + table_api.add_diff_option_comment("ethtype", "eth_type"); + tmpval = table_api.add_list("csv", "eth_type"); + } + + else if (!val.compare("tcpflags")) { table_api.add_diff_option_comment("tcpflags", "tcp_flags"); @@ -209,6 +224,12 @@ bool AlertCsv::convert(std::istringstream& data_stream) tmpval = table_api.add_list("csv", "icmp_seq"); } + else if (!val.compare("udplength")) + { + table_api.add_diff_option_comment("udplength", "udp_len"); + tmpval = table_api.add_list("csv", "udp_len"); + } + else { tmpval = false; diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt index ae3b0ac53..6cab9f186 100644 --- a/tools/snort2lua/rule_states/CMakeLists.txt +++ b/tools/snort2lua/rule_states/CMakeLists.txt @@ -9,6 +9,7 @@ add_library( rule_states rule_pcre.cc rule_react.cc rule_resp.cc + rule_stream_reassemble.cc rule_tag.cc rule_threshold.cc rule_unchanged.cc diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am index 0a578340e..da30f5b15 100644 --- a/tools/snort2lua/rule_states/Makefile.am +++ b/tools/snort2lua/rule_states/Makefile.am @@ -13,6 +13,7 @@ rule_metadata.cc \ rule_pcre.cc \ rule_react.cc \ rule_resp.cc \ +rule_stream_reassemble.cc \ rule_tag.cc \ rule_threshold.cc \ rule_unchanged.cc \ diff --git a/tools/snort2lua/rule_states/rule_tag.cc b/tools/snort2lua/rule_states/rule_tag.cc index 04397de46..38ea05b4e 100644 --- a/tools/snort2lua/rule_states/rule_tag.cc +++ b/tools/snort2lua/rule_states/rule_tag.cc @@ -116,7 +116,6 @@ bool Tag::convert(std::istringstream& data_stream) else rule_api.bad_rule(data_stream, "tag: " + value + " - unknown metric"); } - cnt = !cnt; } diff --git a/tools/snort2lua/rule_states/rule_threshold.cc b/tools/snort2lua/rule_states/rule_threshold.cc index 0836494cd..64470ec6f 100644 --- a/tools/snort2lua/rule_states/rule_threshold.cc +++ b/tools/snort2lua/rule_states/rule_threshold.cc @@ -136,6 +136,9 @@ bool Threshold::convert(std::istringstream& data_stream) tmp_pos = data_stream.tellg(); } + if (!found_gid) + table_api.add_option("gid", 1); + table_api.close_table(); table_api.close_table(); diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc index c246c1138..3bfabb6f6 100644 --- a/tools/snort2lua/rule_states/rule_unchanged.cc +++ b/tools/snort2lua/rule_states/rule_unchanged.cc @@ -415,19 +415,6 @@ static const ConvertMap rule_sameip = const ConvertMap* sameip_map = &rule_sameip; -/************************************ - ****** STREAM_RESSAMBLE ********** - ************************************/ - -static const std::string stream_reassemble = "stream_reassemble"; -static const ConvertMap rule_stream_reassemble = -{ - stream_reassemble, - unchanged_rule_ctor<&stream_reassemble>, -}; - -const ConvertMap* stream_reassemble_map = &rule_stream_reassemble; - /************************************ ********* STREAM_SIZE ************ ************************************/ diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in index d9224c0ad..15f256b8f 100644 --- a/tools/snort2lua/tests/snort.conf.in +++ b/tools/snort2lua/tests/snort.conf.in @@ -931,7 +931,7 @@ output alert_unixsock: output alert_csv: output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv1.dlt output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv2.dlt default -output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv3.dlt timestamp,sig_generator,sid_id,sig_rev,msg,proto,src,srcport,dst,dstport,ethsrc,ethdst,ethlen,tcpflags,tcpseq,tcpack,tcplen,tcpwindow,ttl,tos,id,dgmlen,iplen,icmptype,icmpcode,icmpid,icmpseq 63 +output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv3.dlt timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,ethsrc,ethdst,ethlen,tcpflags,tcpseq,tcpack,tcplen,tcpwindow,ttl,tos,id,dgmlen,iplen,icmptype,icmpcode,icmpid,icmpseq,ethtype,udplength 63 output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv4.dlt default,icmptype,icmpcode,icmpid 64K output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv5.dlt default,icmptype,icmpcode,icmpid 65M output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv6.dlt default,icmptype,icmpcode,icmpid 66G @@ -1289,4 +1289,8 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"INDICATOR-COMPROMISE alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER NeoSploit Malvertising - URI Requested"; flow:to_server,established; urilen:>62; content:"GET /?"; fast_pattern:only; pcre:"/\/\?[0-9a-f]{60,66}[\;\d]*$/U"; metadata:policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:23058; rev:2;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Redkit exploit kit landing page"; flow:to_server,established; urilen:18<>21; content:".html?h="; fast_pattern:only; http_uri; pcre:"/\/[a-z]{4}\.html\?h\=\d{6,7}$/Ui"; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:cve,2012-0188; reference:cve,2012-0507; reference:cve,2012-1723; reference:cve,2012-4681; reference:cve,2013-0422; reference:cve,2013-2423; reference:url,blog.malwarebytes.org/intelligence/2013/04/redkit-exploit-kit-does-the-splits/; classtype:trojan-activity; sid:26345; rev:3;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,norm; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26814; rev:1;) -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,raw; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26814; rev:1;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,raw; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26815; rev:1;) + +alert tcp any any -> any any ( sid:26816; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:disable,both,fastpath; ) +alert tcp any any -> any any ( sid:26817; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:enable,client,fastpath,noalert; ) +alert tcp any any -> any any ( sid:26818; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:enable,server,fastpath,noalert; )