From: Russ Combs Date: Mon, 5 May 2014 11:32:27 +0000 (-0400) Subject: tweaks for bindings X-Git-Tag: 3.0.0-233~1533 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=191146371c3d003e31aae81f4fb950005cb12e2f;p=thirdparty%2Fsnort3.git tweaks for bindings --- diff --git a/lua/snort.lua b/lua/snort.lua index b3145690d..16c9a4da9 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -474,10 +474,6 @@ ftp_client = --]] } ---------------------------------------------------------------------------- --- the following inspector configs are just prototypes --- they are nominally validated but they are not actually loaded ---------------------------------------------------------------------------- --------------------------------------------------------------------------- -- Target-Based stateful inspection/stream reassembly. --------------------------------------------------------------------------- @@ -605,7 +601,6 @@ suppress = default_rules = [[ -#output unified2: filename snort.alert, limit 128, nostamp # snort-classic comments, includes, and rules with $VARIABLES # (rules files support the same syntax) @@ -637,7 +632,7 @@ network = -- put classic rules and includes in the include file and/or rules string ips = { - include = '../active.rules', + --include = '../active.rules', --rules = default_rules, enable_builtin_rules = true } @@ -645,20 +640,46 @@ ips = -- prototype bindings: -- nets and ports move out of inspector configurations -- only need to specify non-default bindings +-- when: days, times, policy_id, vlans, nets, proto, ports, roles +-- use: type, name +-- use.type = action | service | | policy_id | nap | ips bindings = { + -- product policy lookup is done elsewhere + { + when = { policy_id = 'uuid' }, + use = { type = 'file', name = 'uuid.lua' } + }, + -- open source policy based on vlan + { + when = { vlans = '123' }, + use = { type = 'file', name = 'vlan.lua' } + }, + -- open source policy based on cidr { - when = - { - id = 'uuid', vlans = '123', nets = '1.2.3.0/24', - protos = 'tcp', ports = '80', role = 'any' - }, + when = { nets = '1.2.3.0/24' }, + use = { type = 'file', name = 'net.lua' } + }, + -- targeted inspector config + { + when = { nets = '2.3.4.0/24', proto = 'tcp', ports = '80', role = 'any' }, use = { type = 'http_inspect', name = 'hi2' } }, + -- auto service id override + { + when = { nets = '3.4.5.0/24', proto = 'tcp', ports = '80', role = 'any' }, + use = { type = 'service', name = 'http' } + }, + -- allow rule + { + when = { nets = '4.5.6.7', proto = 'udp', ports = '53' }, + use = { type = 'action', name = 'allow' } + }, + -- block rule { - when = { nets = '1.2.3.4', protos = 'tcp', ports = '80 8080' }, - action = 'block' + when = { nets = '5.6.7.8', proto = 'tcp', ports = '8' }, + use = { type = 'action', name = 'block' } }, } diff --git a/src/main/modules.cc b/src/main/modules.cc index 2cb735f0e..132f45f49 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -1300,10 +1300,10 @@ static const Parameter suppress_params[] = "rule signature ID" }, { "track", Parameter::PT_ENUM, "by_src | by_dst", nullptr, - "given ip must match source or destination address" }, + "suppress only matching source or destination addresses" }, { "ip", Parameter::PT_STRING, nullptr, nullptr, - "help" }, + "restrict suppression to these addresses according to track" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -1373,7 +1373,7 @@ static const Parameter event_filter_params[] = "1st count events | every count events | once after count events" }, { "track", Parameter::PT_ENUM, "by_src | by_dst", nullptr, - "given ip must match source or destination address" }, + "filter only matching source or destination addresses" }, { "count", Parameter::PT_INT, "0:", "0", "number of events in interval before tripping" }, @@ -1382,7 +1382,7 @@ static const Parameter event_filter_params[] = "count interval" }, { "ip", Parameter::PT_STRING, nullptr, nullptr, - "help" }, + "restrict filter to these addresses according to track" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -1460,7 +1460,7 @@ static const Parameter rate_filter_params[] = "rule signature ID" }, { "track", Parameter::PT_ENUM, "by_src | by_dst | by_rule", nullptr, - "given ip must match source or destination address" }, + "filter only matching source or destination addresses" }, { "count", Parameter::PT_INT, "0:", "0", "number of events in interval before tripping" }, @@ -1471,7 +1471,7 @@ static const Parameter rate_filter_params[] = { "new_action", Parameter::PT_SELECT, // FIXIT range based on available action plugins "alert | drop | log | pass | | reject | sdrop", "alert", - "help" }, + "restrict filter to these addresses according to track" }, { "timeout", Parameter::PT_INT, "0:", "1", "count interval" }, @@ -1634,12 +1634,6 @@ public: static const Parameter bindings_when_params[] = { - { "ingress_index", Parameter::PT_INT, "0:", "0", - "DAQ id where packet entered sensor" }, - - { "egress_index", Parameter::PT_INT, "0:", "0", - "DAQ id where packet exited sensor" }, - { "policy_id", Parameter::PT_STRING, nullptr, nullptr, "unique ID for selection of this config by external logic" }, @@ -1649,8 +1643,8 @@ static const Parameter bindings_when_params[] = { "nets", Parameter::PT_ADDR_LIST, nullptr, nullptr, "list of networks" }, - { "protos", Parameter::PT_SELECT, "ip | icmp | tcp | udp", nullptr, - "list of protocols" }, + { "proto", Parameter::PT_SELECT, "ip | icmp | tcp | udp", nullptr, + "protocol" }, { "ports", Parameter::PT_BIT_LIST, "65535", nullptr, "list of ports" }, @@ -1704,7 +1698,7 @@ bool BindingsModule::set(const char*, Value& v, SnortConfig*) if ( v.is("role") ) work->role = (BindRole)v.get_long(); - else if ( v.is("id") ) + else if ( v.is("policy_id") ) work->id = v.get_string(); else if ( v.is("vlans") ) @@ -1713,9 +1707,9 @@ bool BindingsModule::set(const char*, Value& v, SnortConfig*) else if ( v.is("nets") ) work->nets = v.get_string(); - else if ( v.is("protos") ) + else if ( v.is("proto") ) { - //v.get_bits(work->protos); FIXIT ? + //v.get_bits(work->proto); FIXIT ? } else if ( v.is("ports") ) v.get_bits(work->ports);