From: Russ Combs Date: Wed, 10 Sep 2014 21:52:54 +0000 (-0400) Subject: added default bindings; updated snort.lua X-Git-Tag: 3.0.0-233~1414^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=adbf0d4d921bf249bfa4fb101b836487432cafef;p=thirdparty%2Fsnort3.git added default bindings; updated snort.lua --- diff --git a/ChangeLog b/ChangeLog index 6bd3b05f7..9b82ea6d3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,8 @@ 119 -- updated binder -- fixed packet direction +-- added default service bindings when wizard is configured but binder is not +-- updated snort.lua 118 -- fixed bind action diff --git a/lua/snort.lua b/lua/snort.lua index 6d3a18613..a25b6a1b9 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -1,6 +1,5 @@ --------------------------------------------------------------------------- --- This file contains a sample snort configuration. You should follow --- the steps to create your own custom configuration. +-- Snort++ prototype configuration -- -- let install_dir be a variable indicating where you installed Snort++. -- then do: @@ -9,7 +8,7 @@ -- export SNORT_LUA_PATH=$install_dir/conf/ --------------------------------------------------------------------------- -require('snort_config') +require('snort_config') -- for loading -- useful constants K = 1024 @@ -17,7 +16,7 @@ M = K * K G = M * K --------------------------------------------------------------------------- --- Step #1: Set paths, ports, and nets: +-- Set paths, ports, and nets: -- -- variables with 'PATH' in the name are vars -- variables with 'PORT' in the name are portvars @@ -29,8 +28,6 @@ G = M * K -- paths --------------------------------------------------------------------------- -- Path to your rules files (this can be a relative path) --- Note for Windows users: You are advised to make this an absolute path, --- such as: c:\snort\rules RULE_PATH = '../rules' BUILTIN_RULE_PATH = '../preproc_rules' @@ -129,39 +126,19 @@ GTP_PORTS = ' 2123 2152 3386' RPC_PORTS = ' 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779' --- Configure ports to ignore ---[[ -ignore_ports = -{ - tcp = ' 21 6667:6671 1356' - udp = ' 1:17 53' -} ---]] - -tcp_client_ports = SSH_PORTS .. FTP_PORTS .. MAIL_PORTS .. RPC_PORTS .. -[[ - 23 25 42 53 79 109 113 119 135 136 137 139 161 445 513 514 587 593 691 - 1433 1521 1741 3306 6070 6665 6666 6667 6668 6669 7000 8181 -]] -tcp_server_ports = '' -tcp_both_ports = HTTP_PORTS .. -[[ - 443 465 563 636 989 992 993 994 995 7907 7802 7801 7900 7901 7902 7903 - 7904 7905 7906 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 - 7919 7920 -]] - --------------------------------------------------------------------------- --- Step #2: configure builtin features +-- configure builtin features --------------------------------------------------------------------------- +cd_udp = { gtp_ports = GTP_PORTS } + -- Configure active response for non inline operation. active = { - device = 'eth0', - attempts = 2, - --max_active_responses = 2, - --min_response_seconds = 5 + --device = 'eth0', + attempts = 0, + max_responses = 1, + min_interval = 1 } -- Configure DAQ related options for inline operation. @@ -184,34 +161,34 @@ detection = pcre_match_limit_recursion = limit } +log_limit = 4 + -- Configure the detection engine search_engine = { - search_method = 'ac_full_q', - --search_method = 'lowmem_q', + search_method = 'ac_bnfa_q', split_any_any = true, - search_optimize = true, - max_pattern_len = 20 + max_queue_events = 4 * log_limit } -- Configure the event queue. event_queue = { - max_queue = 8, - log = 5, - order_events = 'content_length' + max_queue = 16, + log = 16, + order_events = 'priority' } -- Per packet and rule latency enforcement ppm = { -- Per Packet latency configuration - max_pkt_time = 250, + max_pkt_time = 0, fastpath_expensive_packets = true, pkt_log = 'log', -- Per Rule latency configuration - max_rule_time = 200, + max_rule_time = 0, threshold = 3, suspend_expensive_rules = true, suspend_timeout = 20, @@ -221,23 +198,14 @@ ppm = -- Configure Perf Profiling for debugging profile = { - rules = - { - count = 10, - sort = 'avg_ticks', - file = { append = true } - }, - preprocs = - { - count = 10, - sort = 'avg_ticks', - file = { append = true } - } + rules = { count = 0, sort = 'avg_ticks' }, + modules = { count = 0, sort = 'avg_ticks' } } --------------------------------------------------------------------------- --- Step #3: Configure inspectors +-- configure inspectors --------------------------------------------------------------------------- + normalize = { ip4 = @@ -256,20 +224,8 @@ normalize = icmp6 = true } ---defrag_global = { max_frags = 65536 } - -defrag_engine = -{ - policy = 'windows', - detect_anomalies = true, - overlap_limit = 10, - min_frag_length = 100, - timeout = 180 -} - arp_spoof = { - unicast = true, hosts = { { ip = '192.168.40.1', mac = 'f0:0f:00:f0:0f:00' }, @@ -279,10 +235,7 @@ arp_spoof = back_orifice = { } -rpc_decode = -{ - ports = RPC_PORTS -} +rpc_decode = { } port_scan_global = { memcap = 10000000 } @@ -320,70 +273,51 @@ perf_monitor = } --------------------------------------------------------------------------- --- HTTP normalization and anomaly detection. +-- http normalization and anomaly detection --------------------------------------------------------------------------- -http_global = -{ - unicode_map = - { - map_file = '/etc/unicode.map', - code_page = 1252 - }, - compress_depth = 65535, - decompress_depth = 65535 -} - default_http_methods = [[ - GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY + GIT GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA ]] +http_inspect = +{ + --unicode_map = + --{ + -- map_file = '/etc/unicode.map', + -- code_page = 1252 + --}, + compress_depth = 65535, + decompress_depth = 65535 +} + http_server = { - unicode_map = - { - map_file = '/etc/unicode.map', - code_page = 1252 - }, http_methods = default_http_methods, chunk_length = 500000, server_flow_depth = 0, client_flow_depth = 0, + post_depth = 0, +} + +hi_x = +{ + http_methods = default_http_methods, + chunk_length = 500000, + server_flow_depth = 1460, + client_flow_depth = 1460, post_depth = 65495, - oversize_dir_length = 500, - max_header_length = 750, - max_headers = 100, - max_spaces = 200, - small_chunk_length = { size = 10, count = 5 }, - ports = HTTP_PORTS, - non_rfc_chars = '0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07', - enable_cookies = true, - extended_response_inspection = true, - inspect_gzip = true, - normalize_utf = true, - unlimited_decompress = true, - normalize_javascript = true, - apache_whitespace = false, - ascii = false, - bare_byte = false, - directory = false, - double_decode = false, - iis_backslash = false, - iis_delimiter = false, - iis_unicode = false, - multi_slash = false, - utf_8 = false, - u_encode = true, - webroot = false -} - ---------------------------------------------------------------------------- --- FTP / Telnet normalization and anomaly detection. +} + +--nhttp_inspect = { } + +--------------------------------------------------------------------------- +-- ftp / telnet normalization and anomaly detection --------------------------------------------------------------------------- telnet = @@ -392,14 +326,6 @@ telnet = check_encrypted = true, ayt_attack_thresh = 20, normalize = true, - ports = '23', - detect_anomalies = true -} - -ftp_global = -{ - encrypted_traffic = false, - check_encrypted = true, } ftp_default_commands = @@ -423,7 +349,6 @@ ftp_format_commands = ftp_server = { - ports = FTP_PORTS, def_max_param_len = 100, encrypted_traffic = false, @@ -436,31 +361,48 @@ ftp_server = ftp_cmds = ftp_default_commands, chk_str_fmt = ftp_format_commands, - alt_max_param = - { - { length = 0, - commands = [[ ABOR CCC CDUP ESTA FEAT LPSV - NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD ]] }, - - { length = 200, - commands = 'ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD' }, - - { length = 256, commands = 'CWD RNTO' }, - { length = 400, commands = 'PORT' }, - { length = 512, commands = 'SIZE' }, - }, - cmd_validity = { - { command = 'ALLO', format = '< int [ char R int ] >' }, + { command = 'ABOR', length = 0 }, + { command = 'CCC', length = 0 }, + { command = 'CDUP', length = 0 }, + { command = 'ESTA', length = 0 }, + { command = 'FEAT', length = 0 }, + { command = 'LPSV', length = 0 }, + { command = 'NOOP', length = 0 }, + { command = 'PASV', length = 0 }, + { command = 'PWD', length = 0 }, + { command = 'QUIT', length = 0 }, + { command = 'REIN', length = 0 }, + { command = 'SYST', length = 0 }, + { command = 'XCUP', length = 0 }, + { command = 'XPWD', length = 0 }, + + { command = 'APPE', length = 200 }, + { command = 'CMD', length = 200 }, + { command = 'HELP', length = 200 }, + { command = 'NLST', length = 200 }, + { command = 'RETR', length = 200 }, + { command = 'RNFR', length = 200 }, + { command = 'STOR', length = 200 }, + { command = 'STOU', length = 200 }, + { command = 'XMKD', length = 200 }, + + { command = 'CWD', length = 256 }, + { command = 'RNTO', length = 256 }, + { command = 'SIZE', length = 512 }, + + { command = 'ALLO', length = 200, format = '< int [ char R int ] >' }, + { command = 'PORT', length = 400, format = '< host_port >' }, + { command = 'EPSV', format = '< [ { char 12 | char A char L char L } ] >' }, { command = 'MACB', format = '< string >' }, { command = 'MDTM', format = '< [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string >' }, { command = 'MODE', format = '< char ASBCZ >' }, - { command = 'PORT', format = '< host_port >' }, { command = 'PROT', format = '< char CSEP >' }, { command = 'STRU', format = '< char FRPO [ string ] >' }, - { command = 'TYPE', format = '< { char AE [ char NTC ] | char I | char L [ number ] } >' } + { command = 'TYPE', + format = '< { char AE [ char NTC ] | char I | char L [ number ] } >' } }, } @@ -471,118 +413,110 @@ ftp_client = ignore_telnet_erase_cmds = true, telnet_cmds = true, ---[[ bounce_to = { { address = '192.168.1.1', port = 12345 }, { address = '192.168.144.120', port = 50010, last_port = 50020 } } ---]] } +ftp_data = { } + --------------------------------------------------------------------------- --- the following inspector configs are just prototypes --- they are nominally validated but they are not actually loaded ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- --- Target-Based stateful inspection/stream reassembly. +-- stream reassembly and anomaly detection --------------------------------------------------------------------------- -stream_global = +stream = { - tcp_memcap = 123456789, - show_rebuilt_packets = false, - prune_log_max = 0, - paf_max = 16384, - - tcp_cache = { max_sessions = 256 * K, idle_timeout = 60 }, - udp_cache = { max_sessions = 128 * K, pruning_timeout = 30 }, - ip_cache = { max_sessions = 64 * K }, - icmp_cache = { max_sessions = 32 * K }, + ip_cache = { max_sessions = 64000 }, + icmp_cache = { max_sessions = 0 }, + tcp_cache = { max_sessions = 256000, idle_timeout = 60 }, + udp_cache = { max_sessions = 128000, pruning_timeout = 30 }, +} - active_response = - { - max_responses = 0, - min_interval = 1 - } +stream_ip = +{ + session_timeout = 980, + policy = 'windows', + max_overlaps = 10, + max_frags = 8191, + min_frag_length = 100 +} + +stream_icmp = +{ + session_timeout = 180, } stream_tcp = { policy = 'windows', + paf_max = 16384, session_timeout = 180, - require_3whs = 180, - flush_factor = 0, + --require_3whs = -1, + show_rebuilt_packets = false, + flush_factor = 0, overlap_limit = 10, - queue_limit = - { - max_bytes = 3, - max_segments = 1300, - }, - small_segments = - { - count = 10, - maximum_size = 128, - ignore_ports = '1 2 3' - }, - footprint = 0, - reassemble_async = false, - ignore_any_rules = false, - - client_ports = tcp_client_ports, - server_ports = tcp_server_ports, - both_ports = tcp_both_ports, -} - -stream_udp = -{ - session_timeout = 180, + reassemble_async = true, ignore_any_rules = false, } -stream_icmp = +tcp_x = { + policy = 'linux', + paf_max = 16384, session_timeout = 180, } -stream_ip = +stream_udp = { session_timeout = 180, + ignore_any_rules = false, } --------------------------------------------------------------------------- --- Step #4: Configure loggers +-- loggers --------------------------------------------------------------------------- -- alerts + packets +--[[ unified2 = { file = 'u2.log', - limit = 128, - units = 'M', + limit = 128 * M, nostamp = true, mpls_event_types = true, vlan_event_types = true } +--]] -- text --alert_syslog = { mode = 'LOG_AUTH LOG_ALERT' } alert_fast = { } -alert_full = { } ---alert_test = { file = 'alert.tsv', session = false, msg = true } +--alert_full = { } +--alert_test = { file = 'alert.tsv' } --alert_csv = { file = 'alert.csv' } +-- to use -A lualert, this must be configured +lualert = { args = "foo = 'bar'" } + -- pcap -log_tcpdump = { file = 'snort++.pcap' } +--log_tcpdump = { file = 'snort++.pcap' } --------------------------------------------------------------------------- --- Step #6: Customize your rule set --- --- NOTE: All categories are enabled in this conf file +-- actions +--------------------------------------------------------------------------- + +--react = { } +reject = { reset = 'both', control = 'network' } +rewrite = { } + +--------------------------------------------------------------------------- +-- ips rules and filters --------------------------------------------------------------------------- dir = os.getenv('SNORT_LUA_PATH') @@ -594,24 +528,8 @@ end dofile(dir .. 'classification.lua') dofile(dir .. 'reference.lua') ---[[ -event_filter = -{ - { gid = 1, sid = 2, type = 'both', count = 1, seconds = 5 }, - { gid = 1, sid = 1, type = 'both', count = 1, seconds = 5 } -} ---]] --- -suppress = -{ - { gid = 116, sid = 408 }, - { gid = 116, sid = 412 }, - { gid = 116, sid = 414 }, -} - default_rules = [[ -#output unified2: filename snort.alert, limit 128, nostamp # snort-classic comments, includes, and rules with $VARIABLES # (rules files support the same syntax) @@ -622,17 +540,30 @@ default_rules = # text rules #include $RULE_PATH/local.rules -#include $RULE_PATH/app-detect.rules -#include $RULE_PATH/attack-responses.rules -#include $RULE_PATH/backdoor.rules # so rules -#include $PLUGIN_RULE_PATH/bad-traffic.rules -#include $PLUGIN_RULE_PATH/chat.rules #include $PLUGIN_RULE_PATH/dos.rules -alert tcp any any -> any 80 ( sid:1; msg:"1"; content:"HTTP"; ) -alert tcp any 80 -> any any ( sid:2; msg:"2"; content:"HTTP"; ) +# no metadata:service: +#alert http ( sid:1; msg:"1"; content:"HTTP"; ) +#alert http any -> 1.2.3.4 ( sid:2; msg:"2"; content:"HTTP"; ) +#alert http any any -> 1.2.3.4 80 ( sid:3; msg:"3"; content:"HTTP"; ) + +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST User-Agent known malicious user agent - SAH Agent"; flow:to_server,established; content:"User-Agent|3A| SAH Agent"; metadata: policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; classtype:misc-activity; sid:5808; rev:9;) + +#alert tcp any any -> any 80 ( msg:"Sample rule for Snort++"; http_uri; content:"attack"; sid:1; ) +#alert tcp any 80 -> any any ( msg:"Sample rule for Snort++"; http_header:Transfer-Encoding; content:"chunk"; sid:2; ) +#alert tcp any 80 -> any any ( msg:"Sample rule for Snort++"; http_header; content:"chunk"; sid:3; ) +#alert tcp any any -> any any ( msg:"Sample rule for Snort++"; content:"trigger"; sid:2; ) + +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;) + +alert tcp any any -> any 80 ( http_method; content:"GIT"; gid:1; sid:1000051) +#alert tcp any any -> any 80 ( sid:1; msg:"found!"; content:"GET", nocase; content:"bck"; ) +#alert tcp any any -> any 80 ( sid:2; msg:"found!"; http_method; content:"GET"; ) +#alert tcp any any -> any 80 ( sid:3; msg:"found!"; content:"GET"; find:"pat=' HTTP/1%.%d'" ; ) +#alert tcp any any -> any any ( gid:123; sid:2; msg:"(stream_ip) Teardrop attack"; ) +#rewrite tcp any any -> any 80 ( sid:9; msg:"found!"; content:"GET"; replace:"GIT"; ) ]] network = @@ -643,59 +574,155 @@ network = -- put classic rules and includes in the include file and/or rules string ips = { - --include = '../active.rules', + --include = '../test.rules', + include = 'rules/active.rules', --rules = default_rules, - enable_builtin_rules = true + --enable_builtin_rules = true } --- prototype bindings: --- nets and ports move out of inspector configurations --- only need to specify non-default bindings --- match = id | ((vlans | networks) [protocol [ports]]) --- config = type [name [direction]] --- type = module | 'file' --- name = type (default) | instance | filename --- action = block | allow | inspect (default) --- direction = from client | from server | any (default) | none - -bindings = +--[[ +event_filter = { - { - match = { id = 5 }, - config = { type = 'bo', name = 'bo2' } - }, + { gid = 1, sid = 2, type = 'both', count = 1, seconds = 5 }, + { gid = 1, sid = 1, type = 'both', count = 1, seconds = 5 } +} +--]] - { - match = { id = 4 }, - config = { type = 'file', name = '4.lua' } - }, +suppress = +{ + { gid = 116, sid = 408 }, + { gid = 116, sid = 412 }, + { gid = 116, sid = 414 }, +} - { - match = { vlans = '123' }, - config = { type = 'detect', name = '123.detect' } - }, +--------------------------------------------------------------------------- +-- net map attributes (replaces attribte table) +--------------------------------------------------------------------------- +hosts = +{ { - match = { networks = '1.2.3.0/24', protocol = 'tcp' }, - config = { type = 'stream_tcp', name = 'last', direction = 'any' } + ip = '1.2.3.4', + frag_policy = 'linux', + tcp_policy = 'linux', + services = + { + { name = 'ftp', proto = 'tcp', port = 21 }, + { name = 'smtp', proto = 'tcp', port = 25 }, + { name = 'http', proto = 'tcp', port = 80 } + } }, - { - match = { networks = '1.2.3.4', protocol = 'tcp', ports = '80 8080' }, - config = { type = 'http_inspect' }, - action = 'inspect' - }, + ip = '2.4.6.8', + frag_policy = 'windows', + tcp_policy = 'windows', + services = + { + { name = 'netbios', proto = 'tcp', port = 137 }, + { name = 'imap', proto = 'tcp', port = 143 }, + } + } +} +--------------------------------------------------------------------------- +-- prototype wizard +--------------------------------------------------------------------------- + +http_methods = { 'GIT', 'GET', 'POST', 'HEAD' } -- build from default_http_methods +ftp_commands = { 'USER' } -- add others +sip_methods = { 'INVITE', 'NOTIFY' } -- add others +isakmp_hex = { '?????????????????|01|', '?????????????????|10|' } + +telnet_commands = +{ + '|FF F0|', '|FF F1|', '|FF F2|', '|FF F3|', + '|FF F4|', '|FF F5|', '|FF F6|', '|FF F7|', + '|FF F8|', '|FF F9|', '|FF FA|', '|FF FB|', + '|FF FC|', '|FF FD|', '|FF FE|', '|FF FF|' +} + +wizard = +{ + spells = { - match = { networks = '1.2.3.4', protocol = 'tcp', ports = '88 8088' }, - config = { type = 'http', name = 'iis' }, - }, + { service = 'ftp', proto = 'tcp', client_first = false, + to_server = ftp_commands, to_client = { '220*FTP' } }, + + { service = 'http', proto = 'tcp', client_first = true, + to_server = http_methods, to_client = { 'HTTP/' } }, + + { service = 'imap', proto = 'tcp', client_first = false, + to_server = { 'LOGIN', 'AUTHENTICATE', 'STARTTLS' }, + to_client = { '**OK', '**BYE' } }, + { service = 'pop3', proto = 'tcp', client_first = false, + to_server = { 'USER', 'APOP' }, + to_client = { '+OK', '-ERR' } }, + + { service = 'sip', proto = 'tcp', client_first = true, + to_server = sip_methods, to_client = { 'SIP/' } }, + + { service = 'smtp', proto = 'tcp', client_first = false, + to_server = { 'HELO', 'EHLO' }, + to_client = { '220*SMTP', '220*MAIL' } }, + + { service = 'ssh', proto = 'tcp', client_first = true, + to_server = { '*SSH' }, to_client = { '*SSH' } } + }, + hexes = { - match = { networks = '192.168.1.0/24', protocol = 'udp', ports = '53' }, - action = 'block' + { service = 'dcerpc', proto = 'tcp', client_first = true, + to_server = { '|05 00|' }, to_client = { '|05 00|' } }, + + { service = 'dnp3', proto = 'tcp', client_first = true, + to_server = { '|05 64|' }, to_client = { '|05 64|' } }, + + { service = 'isakmp', proto = 'udp', client_first = true, + to_server = isakmp_hex, to_client = isakmp_hex }, +--[[ + { service = 'modbus', proto = 'tcp', client_first = true, + to_server = { '??|0 0|' } }, + + { service = 'rpc', proto = 'tcp', client_first = true, + to_server = { '????|0 0 0 0 0 0 0 1|' }, + to_client = { '????|0 0 0 0 0 0 0 1|' } }, +--]] + { service = 'smb', proto = 'tcp', client_first = true, + to_server = { '|FF|SMB' }, to_client = { '|FF|SMB' } }, + + { service = 'smb', proto = 'udp', client_first = true, + to_server = { '|FF|SMB' }, to_client = { '|FF|SMB' } }, + + { service = 'ssl', proto = 'tcp', client_first = true, + to_server = { '|16 03|' }, to_client = { '|16 03|' } }, + + { service = 'telnet', proto = 'tcp', client_first = true, + to_server = telnet_commands, to_client = telnet_commands }, } } - --- lowmem_q = { var = "test" } +--------------------------------------------------------------------------- +-- prototype bindings: +-- +-- only need to specify non-default bindings +-- when: policy_id, vlans, nets, proto, ports, service +-- use: action | file | type,name | service +-- when: roles, days, times are tbd +-- +-- binder is disabled by default (xbinder is unknown, not loaded) +-- service inspectors will be bound automatically if wizard is configured +-- if binder is configured, there are no defaults added +--------------------------------------------------------------------------- + +xbinder = +{ + { when = { proto = 'tcp', ports = 'any' }, use = { type = 'wizard' } }, + { when = { proto = 'udp', ports = 'any' }, use = { type = 'wizard' } }, + + { when = { service = 'ftp-data' }, use = { type = 'ftp_data' } }, + { when = { service = 'ftp' }, use = { type = 'ftp_server' } }, + { when = { service = 'http' }, use = { type = 'http_server' } }, + { when = { service = 'sunrpc' }, use = { type = 'rpc_decode' } }, + { when = { service = 'telnet' }, use = { type = 'telnet' } }, +} + diff --git a/src/flow/flow.cc b/src/flow/flow.cc index 886c50a42..87f846925 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -239,127 +239,52 @@ void Flow::set_direction(Packet* p) if(ip_api->is_ip4()) { - uint8_t proto = p->ip_api.proto(); - if (sfip_fast_eq4(ip_api->get_src(), &client_ip)) { - if (proto == IPPROTO_TCP) - { - if (p->sp == client_port) - { - p->packet_flags |= PKT_FROM_CLIENT; - } - else - { - p->packet_flags |= PKT_FROM_SERVER; - } - } - else if (proto == IPPROTO_UDP && p->udph ) - { - if (p->sp == client_port) - { - p->packet_flags |= PKT_FROM_CLIENT; - } - else - { - p->packet_flags |= PKT_FROM_SERVER; - } - } - else - { + if ( !(p->proto_bits & (PROTO_BIT__TCP | PROTO_BIT__UDP)) ) + p->packet_flags |= PKT_FROM_CLIENT; + + else if (p->sp == client_port) p->packet_flags |= PKT_FROM_CLIENT; - } + + else + p->packet_flags |= PKT_FROM_SERVER; } else if (sfip_fast_eq4(ip_api->get_dst(), &client_ip)) { - if (proto == IPPROTO_TCP) - { - if (p->dp == client_port) - { - p->packet_flags |= PKT_FROM_SERVER; - } - else - { - p->packet_flags |= PKT_FROM_CLIENT; - } - } - else if (proto == IPPROTO_UDP && p->udph ) - { - if (p->dp == client_port) - { - p->packet_flags |= PKT_FROM_SERVER; - } - else - { - p->packet_flags |= PKT_FROM_CLIENT; - } - } - else - { + if ( !(p->proto_bits & (PROTO_BIT__TCP | PROTO_BIT__UDP)) ) + p->packet_flags |= PKT_FROM_SERVER; + + else if (p->dp == client_port) p->packet_flags |= PKT_FROM_SERVER; - } } + + else + p->packet_flags |= PKT_FROM_CLIENT; + } } else /* IS_IP6(p) */ { - uint16_t proto = ip_api->proto(); - if (sfip_fast_eq6(ip_api->get_src(), &client_ip)) { - if (proto == IPPROTO_TCP) - { - if (p->sp == client_port) - { - p->packet_flags |= PKT_FROM_CLIENT; - } - else - { - p->packet_flags |= PKT_FROM_SERVER; - } - } - else if (proto == IPPROTO_UDP && p->udph ) - { - if (p->sp == client_port) - { - p->packet_flags |= PKT_FROM_CLIENT; - } - else - { - p->packet_flags |= PKT_FROM_SERVER; - } - } - else - { + if ( !(p->proto_bits & (PROTO_BIT__TCP | PROTO_BIT__UDP)) ) + p->packet_flags |= PKT_FROM_CLIENT; + + else if (p->sp == client_port) p->packet_flags |= PKT_FROM_CLIENT; - } + + else + p->packet_flags |= PKT_FROM_SERVER; } else if (sfip_fast_eq6(ip_api->get_dst(), &client_ip)) { - if (proto == IPPROTO_TCP) - { - if (p->dp == client_port) - { - p->packet_flags |= PKT_FROM_SERVER; - } - else - { - p->packet_flags |= PKT_FROM_CLIENT; - } - } - else if (proto == IPPROTO_UDP && p->udph ) - { - if (p->dp == client_port) - { - p->packet_flags |= PKT_FROM_SERVER; - } - else - { - p->packet_flags |= PKT_FROM_CLIENT; - } - } - else - { + if ( !(p->proto_bits & (PROTO_BIT__TCP | PROTO_BIT__UDP)) ) + p->packet_flags |= PKT_FROM_SERVER; + + else if (p->dp == client_port) p->packet_flags |= PKT_FROM_SERVER; - } + + else + p->packet_flags |= PKT_FROM_CLIENT; } } } diff --git a/src/main/snort.cc b/src/main/snort.cc index 886eaff01..e62f40b18 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -351,7 +351,7 @@ static void SnortInit(int argc, char **argv) if (ScAlertBeforePass()) { - OrderRuleLists(snort_conf, "activation dynamic drop sdrop reject alert pass log"); + OrderRuleLists(snort_conf, "drop sdrop reject alert pass log"); } if ( !InspectorManager::configure(snort_conf) ) FatalError("can't initialize inspectors\n"); diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index 3bb38d0c7..3d5d62d9c 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -35,9 +35,14 @@ #include "snort.h" #include "log/messages.h" #include "target_based/sftarget_protocol_reference.h" +#include "binder/bind_module.h" using namespace std; +// FIXIT-L should be using IT_* instead or at least define once +static const char* bind_id = "binder"; +static const char* wiz_id = "wizard"; + //------------------------------------------------------------------------- // list stuff //------------------------------------------------------------------------- @@ -469,10 +474,40 @@ void InspectorManager::instantiate( } } +// create default binding for wizard and configured services +static void instantiate_binder(SnortConfig* sc, FrameworkPolicy* fp) +{ + BinderModule* m = (BinderModule*)ModuleManager::get_module(bind_id); + bool tcp = false, udp = false; + + for ( unsigned i = 0; i < fp->service.num; i++ ) + { + const InspectApi& api = fp->service.vec[i]->pp_class.api; + + const char* s = api.service; + const char* t = api.base.name; + m->add(s, t); + + tcp = tcp || (api.proto_bits & PROTO_BIT__TCP); + udp = udp || (api.proto_bits & PROTO_BIT__UDP); + } + if ( tcp ) + m->add(PROTO_BIT__TCP, wiz_id); + +// if ( udp ) + m->add(PROTO_BIT__UDP, wiz_id); + + const InspectApi* api = get_plugin(bind_id); + InspectorManager::instantiate(api, nullptr, sc); + fp->binder = get_instance(fp, bind_id)->handler; +} + bool InspectorManager::configure(SnortConfig *sc) { sort(s_handlers.begin(), s_handlers.end(), PHGlobal::comp); + // FIXIT-H do we need more than one framework policy? + // if so, must vectorize(), etc. multiple times FrameworkPolicy* fp = sc->policy_map->inspection_policy[0]->framework_policy; bool ok = true; @@ -482,6 +517,9 @@ bool InspectorManager::configure(SnortConfig *sc) sort(fp->ilist.begin(), fp->ilist.end(), PHInstance::comp); fp->vectorize(); + if ( fp->service.num && !fp->binder && get_wizard() ) + instantiate_binder(sc, fp); + return ok; } diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc index 7addfb1a6..bf9624fcd 100644 --- a/src/network_inspectors/binder/bind_module.cc +++ b/src/network_inspectors/binder/bind_module.cc @@ -187,6 +187,22 @@ bool BinderModule::end(const char* fqn, int idx, SnortConfig*) return true; } +void BinderModule::add(const char* svc, const char* type) +{ + Binding* b = new Binding; + b->when.svc = svc; + b->use.type = type; + bindings.push_back(b); +} + +void BinderModule::add(unsigned proto, const char* type) +{ + Binding* b = new Binding; + b->when.protos = proto; + b->use.type = type; + bindings.push_back(b); +} + vector BinderModule::get_data() { return bindings; // move semantics diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h index a745f8f4c..17f452aff 100644 --- a/src/network_inspectors/binder/bind_module.h +++ b/src/network_inspectors/binder/bind_module.h @@ -50,6 +50,9 @@ public: bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); + void add(const char* service, const char* type); + void add(unsigned proto, const char* type); + const char** get_pegs() const; PegCount* get_counts() const; ProfileStats* get_profile() const; diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc index 0052a6396..3ca88bc63 100644 --- a/src/stream/base/stream_base.cc +++ b/src/stream/base/stream_base.cc @@ -209,6 +209,7 @@ void StreamBase::eval(Packet *p) MODULE_PROFILE_START(s5PerfStats); + // FIXIT-H need new packet_type (may need to use it elsewhere too) switch ( p->ip_api.proto() ) { case IPPROTO_TCP: