tweaks for bindings

diff --git a/lua/snort.lua b/lua/snort.lua
index b3145690dbb801555b5f33a78979da37a8e3785e..16c9a4da9b37bd4990890bbc63fb0c31c77196c0 100644 (file)
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -474,10 +474,6 @@ ftp_client =
 --]]
 }
 
----------------------------------------------------------------------------
--- the following inspector configs are just prototypes
--- they are nominally validated but they are not actually loaded
----------------------------------------------------------------------------
 ---------------------------------------------------------------------------
 -- Target-Based stateful inspection/stream reassembly.
 ---------------------------------------------------------------------------
@@ -605,7 +601,6 @@ suppress =
 
 default_rules =
 [[
-#output unified2: filename snort.alert, limit 128, nostamp
 # snort-classic comments, includes, and rules with $VARIABLES
 # (rules files support the same syntax)
 
@@ -637,7 +632,7 @@ network =
 -- put classic rules and includes in the include file and/or rules string
 ips =
 {
-    include = '../active.rules',
+    --include = '../active.rules',
     --rules = default_rules,
     enable_builtin_rules = true
 }
@@ -645,20 +640,46 @@ ips =
 -- prototype bindings:
 -- nets and ports move out of inspector configurations
 -- only need to specify non-default bindings
+-- when: days, times, policy_id, vlans, nets, proto, ports, roles
+-- use: type, name
+-- use.type = action | service | <inspector> | policy_id | nap | ips
 
 bindings =
 {
+    -- product policy lookup is done elsewhere
+    {
+        when = { policy_id = 'uuid' },
+        use = { type = 'file', name = 'uuid.lua' }
+    },
+    -- open source policy based on vlan
+    {
+        when = { vlans = '123' },
+        use = { type = 'file', name = 'vlan.lua' }
+    },
+    -- open source policy based on cidr
     {
-        when =
-        {
-            id = 'uuid', vlans = '123', nets = '1.2.3.0/24',
-            protos = 'tcp', ports = '80', role = 'any'
-        },
+        when = { nets = '1.2.3.0/24' },
+        use = { type = 'file', name = 'net.lua' }
+    },
+    -- targeted inspector config
+    {
+        when = { nets = '2.3.4.0/24', proto = 'tcp', ports = '80', role = 'any' },
         use = { type = 'http_inspect', name = 'hi2' }
     },
+    -- auto service id override
+    {
+        when = { nets = '3.4.5.0/24', proto = 'tcp', ports = '80', role = 'any' },
+        use = { type = 'service', name = 'http' }
+    },
+    -- allow rule
+    {
+        when = { nets = '4.5.6.7', proto = 'udp', ports = '53' },
+        use = { type = 'action', name = 'allow' }
+    },
+    -- block rule
     {
-        when = { nets = '1.2.3.4', protos = 'tcp', ports = '80 8080' },
-        action = 'block'
+        when = { nets = '5.6.7.8', proto = 'tcp', ports = '8' },
+        use = { type = 'action', name = 'block' }
     },
 }
  

diff --git a/src/main/modules.cc b/src/main/modules.cc
index 2cb735f0e611a90d51b3402349e9af57085a3a2c..132f45f4935e352ddc65e0a3761572d203fda297 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -1300,10 +1300,10 @@ static const Parameter suppress_params[] =
       "rule signature ID" },
 
     { "track", Parameter::PT_ENUM, "by_src | by_dst", nullptr,
-      "given ip must match source or destination address" },
+      "suppress only matching source or destination addresses" },
 
     { "ip", Parameter::PT_STRING, nullptr, nullptr,
-      "help" },
+      "restrict suppression to these addresses according to track" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -1373,7 +1373,7 @@ static const Parameter event_filter_params[] =
       "1st count events | every count events | once after count events" },
 
     { "track", Parameter::PT_ENUM, "by_src | by_dst", nullptr,
-      "given ip must match source or destination address" },
+      "filter only matching source or destination addresses" },
 
     { "count", Parameter::PT_INT, "0:", "0",
       "number of events in interval before tripping" },
@@ -1382,7 +1382,7 @@ static const Parameter event_filter_params[] =
       "count interval" },
 
     { "ip", Parameter::PT_STRING, nullptr, nullptr,
-      "help" },
+      "restrict filter to these addresses according to track" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -1460,7 +1460,7 @@ static const Parameter rate_filter_params[] =
       "rule signature ID" },
 
     { "track", Parameter::PT_ENUM, "by_src | by_dst | by_rule", nullptr,
-      "given ip must match source or destination address" },
+      "filter only matching source or destination addresses" },
 
     { "count", Parameter::PT_INT, "0:", "0",
       "number of events in interval before tripping" },
@@ -1471,7 +1471,7 @@ static const Parameter rate_filter_params[] =
     { "new_action", Parameter::PT_SELECT,
       // FIXIT range based on available action plugins
       "alert | drop | log | pass | | reject | sdrop", "alert",
-      "help" },
+      "restrict filter to these addresses according to track" },
 
     { "timeout", Parameter::PT_INT, "0:", "1",
       "count interval" },
@@ -1634,12 +1634,6 @@ public:
 
 static const Parameter bindings_when_params[] =
 {
-    { "ingress_index", Parameter::PT_INT, "0:", "0",
-      "DAQ id where packet entered sensor" },
-
-    { "egress_index", Parameter::PT_INT, "0:", "0",
-      "DAQ id where packet exited sensor" },
-
     { "policy_id", Parameter::PT_STRING, nullptr, nullptr,
       "unique ID for selection of this config by external logic" },
 
@@ -1649,8 +1643,8 @@ static const Parameter bindings_when_params[] =
     { "nets", Parameter::PT_ADDR_LIST, nullptr, nullptr,
       "list of networks" },
 
-    { "protos", Parameter::PT_SELECT, "ip | icmp | tcp | udp", nullptr,
-      "list of protocols" },
+    { "proto", Parameter::PT_SELECT, "ip | icmp | tcp | udp", nullptr,
+      "protocol" },
 
     { "ports", Parameter::PT_BIT_LIST, "65535", nullptr,
       "list of ports" },
@@ -1704,7 +1698,7 @@ bool BindingsModule::set(const char*, Value& v, SnortConfig*)
     if ( v.is("role") )
         work->role = (BindRole)v.get_long();
 
-    else if ( v.is("id") )
+    else if ( v.is("policy_id") )
         work->id = v.get_string();
 
     else if ( v.is("vlans") )
@@ -1713,9 +1707,9 @@ bool BindingsModule::set(const char*, Value& v, SnortConfig*)
     else if ( v.is("nets") )
         work->nets = v.get_string();
 
-    else if ( v.is("protos") )
+    else if ( v.is("proto") )
     {
-        //v.get_bits(work->protos); FIXIT ?
+        //v.get_bits(work->proto); FIXIT ?
     }
     else if ( v.is("ports") )
         v.get_bits(work->ports);