Merge pull request #916 in SNORT/snort3 from conf_updates to master

Squashed commit of the following:

commit 647890ba3c1031f60fafa55ef606a8645466582d
Author: Russ Combs <rucombs@cisco.com>
Date:   Sun Jun 4 09:22:51 2017 -0400

    conf: refactor for clarity

commit a75b80cb43914841fd8821d4f3e4e3dad295d195
Author: Russ Combs <rucombs@cisco.com>
Date:   Sun Jun 4 08:49:56 2017 -0400

    conf: use updated external defaults, change internal defaults to enable file_id type and signature

commit 2ec586b505cf8f3e0f9999ecf5b4279c6f10935b
Author: Russ Combs <rucombs@cisco.com>
Date:   Sun Jun 4 08:47:34 2017 -0400

    conf: update defaults - remove old http cruft, add smtp defaults

diff --git a/lua/snort.lua b/lua/snort.lua
index 1ee8fc95cbd5d7402e822ae81b3dd1929ae4e757..f387b4378e138fb8f8a1de4c5b9c138ce87db984 100644 (file)
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -2,32 +2,32 @@
 -- Snort++ configuration
 ---------------------------------------------------------------------------
 
+-- 1. configure environment
+-- 2. configure dependencies
+-- 3. configure modules
+-- 4. configure rules
+
 ---------------------------------------------------------------------------
--- setup environment
+-- 1. configure environment
 ---------------------------------------------------------------------------
+
 -- given:
 -- export DIR=/install/path
 -- configure --prefix=$DIR
 -- make install
---
+
 -- then:
 -- export LUA_PATH=$DIR/include/snort/lua/?.lua\;\;
 -- export SNORT_LUA_PATH=$DIR/etc/snort
+
 ---------------------------------------------------------------------------
 
 ---------------------------------------------------------------------------
--- setup the basics
+-- 2. configure dependencies
 ---------------------------------------------------------------------------
 
 require('snort_config')  -- for loading
 
--- Setup the network addresses you are protecting
-HOME_NET = 'any'
-
--- Set up the external network addresses.
--- (leave as "any" in most situations)
-EXTERNAL_NET = 'any'
-
 conf_dir = os.getenv('SNORT_LUA_PATH')
 
 if ( not conf_dir ) then
@@ -38,7 +38,7 @@ dofile(conf_dir .. '/snort_defaults.lua')
 dofile(conf_dir .. '/file_magic.lua')
 
 ---------------------------------------------------------------------------
--- configure modules
+-- 3. configure modules
 ---------------------------------------------------------------------------
 --
 -- mod = { } uses internal defaults
@@ -48,10 +48,10 @@ dofile(conf_dir .. '/file_magic.lua')
 -- you can also use default_ftp_server and default_wizard
 ---------------------------------------------------------------------------
 
-
 -- uncomment normalizer if you are inline or not --pedantic
 --normalizer = { }
 
+-- uncomment these to analyze Snort performance
 --latency = { }
 --profiler = { }
 --perf_monitor = { }
@@ -69,10 +69,8 @@ arp_spoof = { }
 back_orifice = { }
 dnp3 = { }
 dns = { }
-gtp_inspect = default_gtp
 http_inspect = { }
 imap = { }
-smtp = { }
 pop = { }
 port_scan = { }
 reputation = { }
@@ -82,16 +80,36 @@ ssh = { }
 ssl = { }
 telnet = { }
 
+-- see snort_defaults.lua for default_*
+gtp_inspect = default_gtp
+smtp = default_smtp
+
 ftp_server = default_ftp_server
 ftp_client = { }
 ftp_data = { }
 
-file_id =
-{
-    enable_type = true,
-    enable_signature = true,
-    file_rules = file_magic,
-}
+-- see file_magic.lua for file id rules
+file_id = { file_rules = file_magic }
 
 wizard = default_wizard
 
+---------------------------------------------------------------------------
+-- 4. configure rules
+---------------------------------------------------------------------------
+
+-- setup the network addresses you are protecting
+HOME_NET = 'any'
+
+-- set up the external network addresses.
+-- (leave as "any" in most situations)
+EXTERNAL_NET = 'any'
+
+-- see snort_defaults.lua for other nets, ports, and servers
+-- and default references and classifications
+
+references = default_references
+classifications = default_classifications
+
+-- use snort -R $SNORT_LUA_PATH/sample.rules and/or set ips params
+ips = { }
+

diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index 23d3e2dd973aa738705cb1ee9fc55f529cc0738d..20224a7b4b869f6b52b41aaf628f15d965622398 100644 (file)
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -118,7 +118,7 @@ RPC_PORTS =
 -- default ftp server
 ---------------------------------------------------------------------------
 
-ftp_default_commands =
+ftp_default_cmds =
 [[
     ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP CEL CLNT CMD CONF CWD DELE ENC
     EPRT EPSV ESTA ESTP FEAT HELP LANG LIST LPRT LPSV MACB MAIL MDTM MIC
@@ -213,16 +213,8 @@ ftp_command_specs =
 
 default_ftp_server =
 {
-    def_max_param_len = 100,
-
-    encrypted_traffic = false,
-    check_encrypted = true,
-    print_cmds = false,
-    telnet_cmds = true,
-    ignore_telnet_erase_cmds = true,
-    ignore_data_chan = true,
-
-    ftp_cmds = ftp_default_commands,
+    -- params not specified here get internal defaults
+    ftp_cmds = ftp_default_cmds,
     data_chan_cmds = ftp_default_data_chan_cmds,
     data_xfer_cmds = ftp_default_data_xfer_cmds,
     file_put_cmds = ftp_default_file_put_cmds,
@@ -234,142 +226,45 @@ default_ftp_server =
 }
 
 ---------------------------------------------------------------------------
--- default http profiles
+-- default smtp configuration
 ---------------------------------------------------------------------------
 
-http_profile_default = 
-{
-    profile_type = 'default',
-    server_flow_depth = 300,
-    client_flow_depth = 300,
-    post_depth = -1,
-    chunk_length = 500000,
-    ascii = true,
-    multi_slash = true,
-    directory = true,
-    webroot = true,
-    double_decode = true,
-    u_encode = true,
-    bare_byte = true,
-    iis_unicode = true,
-    iis_backslash = true,
-    iis_delimiter = true,
-    apache_whitespace = true,
-    non_strict = true,
-    normalize_utf = true,
-    normalize_javascript = false,
-    max_header_length = 0,
-    max_headers = 0,
-    max_spaces = 200,
-    max_javascript_whitespaces = 200,
-    whitespace_chars ='0x9 0xb 0xc 0xd'
-}
+smtp_default_auth_cmds =
+[[
+    AUTH XAUTH X-EXPS
+]]
 
-http_profile_apache = 
-{
-    profile_type = 'apache',
-    server_flow_depth = 300,
-    client_flow_depth = 300,
-    post_depth = -1,
-    chunk_length = 500000,
-    ascii = true,
-    multi_slash = true,
-    directory = true,
-    webroot = true,
-    utf_8 = true,
-    apache_whitespace = true,
-    non_strict = true,
-    normalize_utf = true,
-    normalize_javascript = false,
-    max_header_length = 0,
-    max_headers = 0,
-    max_spaces = 200,
-    max_javascript_whitespaces = 200,
-    whitespace_chars ='0x9 0xb 0xc 0xd'
-}
+smtp_default_binary_data_cmds =
+[[
+    BDAT XEXCH50
+]]
 
-http_profile_iis = 
-{
-    profile_type = 'iis',
-    server_flow_depth = 300,
-    client_flow_depth = 300,
-    post_depth = -1,
-    chunk_length = 500000,
-    ascii = true,
-    multi_slash = true,
-    directory = true,
-    webroot = true,
-    double_decode = false,
-    u_encode = true,
-    bare_byte = true,
-    iis_unicode = true,
-    iis_backslash = true,
-    iis_delimiter = true,
-    apache_whitespace = true,
-    non_strict = true,
-    normalize_utf = true,
-    normalize_javascript = false,
-    max_header_length = 0,
-    max_headers = 0,
-    max_spaces = 200,
-    max_javascript_whitespaces = 200,
-    whitespace_chars ='0x9 0xb 0xc 0xd'
-}
+smtp_default_data_cmds =
+[[
+    DATA
+]]
 
-http_profile_iis_40 = 
-{
-    profile_type = 'iis_40',
-    server_flow_depth = 300,
-    client_flow_depth = 300,
-    post_depth = -1,
-    chunk_length = 500000,
-    ascii = true,
-    multi_slash = true,
-    directory = true,
-    webroot = true,
-    double_decode = true,
-    u_encode = true,
-    bare_byte = true,
-    iis_unicode = true,
-    iis_backslash = true,
-    iis_delimiter = true,
-    apache_whitespace = true,
-    non_strict = true,
-    normalize_utf = true,
-    normalize_javascript = false,
-    max_header_length = 0,
-    max_headers = 0,
-    max_spaces = 200,
-    max_javascript_whitespaces = 200,
-    whitespace_chars ='0x9 0xb 0xc 0xd'
-}
+smtp_default_normalize_cmds =
+[[
+    RCPT VRFY EXPN
+]]
+
+smtp_default_valid_cmds =
+[[
+    ATRN AUTH BDAT DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY EXPN HELO
+    HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SIZE SOML
+    STARTTLS TICK TIME TURN TURNME VERB VRFY X-EXPS X-LINK2STATE XADR XAUTH
+    XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR
+]]
 
-http_profile_iis_50 = 
+default_smtp =
 {
-    profile_type = 'iis_50',
-    server_flow_depth = 300,
-    client_flow_depth = 300,
-    post_depth = -1,
-    chunk_length = 500000,
-    ascii = true,
-    multi_slash = true,
-    directory = true,
-    webroot = true,
-    double_decode = true,
-    u_encode = true,
-    bare_byte = true,
-    iis_unicode = true,
-    iis_backslash = true,
-    iis_delimiter = true,
-    apache_whitespace = true,
-    non_strict = true,
-    normalize_utf = true,
-    normalize_javascript = false,
-    max_header_length = 0,
-    max_headers = 0,
-    max_spaces = 200,
-    max_javascript_whitespaces = 200,
-    whitespace_chars ='0x9 0xb 0xc 0xd'
+    -- params not specified here get internal defaults
+    auth_cmds = smtp_default_auth_cmds,
+    binary_data_cmds = smtp_default_binary_data_cmds,
+    data_cmds = smtp_default_data_cmds,
+    normalize_cmds = smtp_default_normalize_cmds,
+    valid_cmds = smtp_default_valid_cmds,
 }
 
 ---------------------------------------------------------------------------
@@ -389,7 +284,7 @@ http_methods =  -- build from default_http_methods
     'UNSUBSCRIBE', 'X_MS_ENUMATTS',
 }
 
-ftp_commands =  -- build from ftp_default_commands
+ftp_commands =  -- build from ftp_default_cmds
 {
     'ABOR', 'ACCT', 'ADAT', 'ALLO', 'APPE', 'AUTH', 'CCC', 'CDUP', 'CEL',
     'CLNT', 'CMD', 'CONF', 'CWD', 'DELE', 'ENC', 'EPRT', 'EPSV', 'ESTA',
@@ -483,7 +378,7 @@ default_wizard =
 -- default references
 ---------------------------------------------------------------------------
 
-references =
+default_references =
 {
     { name = 'bugtraq',   url = 'http://www.securityfocus.com/bid/' },
     { name = 'cve',       url = 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=' },
@@ -499,7 +394,7 @@ references =
 -- default classifications
 ---------------------------------------------------------------------------
 
-classifications =
+default_classifications =
 {
     { name = 'not-suspicious', priority = 3,
       text = 'Not Suspicious Traffic' },

diff --git a/src/file_api/file_module.cc b/src/file_api/file_module.cc
index da7dbc4c2b91def8c15e718d15fcfa6029c1e7fa..e843b626eed1b05dce4c3aefd9eabc0de1c97a65 100644 (file)
--- a/src/file_api/file_module.cc
+++ b/src/file_api/file_module.cc
@@ -144,10 +144,10 @@ static const Parameter file_id_params[] =
     { "max_files_cached", Parameter::PT_INT, "8:", "65536",
       "maximal number of files cached in memory" },
 
-    { "enable_type", Parameter::PT_BOOL, nullptr, "false",
+    { "enable_type", Parameter::PT_BOOL, nullptr, "true",
       "enable type ID" },
 
-    { "enable_signature", Parameter::PT_BOOL, nullptr, "false",
+    { "enable_signature", Parameter::PT_BOOL, nullptr, "true",
       "enable signature calculation" },
 
     { "enable_capture", Parameter::PT_BOOL, nullptr, "false",