From: rcombs Date: Tue, 18 Nov 2014 12:24:22 +0000 (-0500) Subject: normalizer ip4.base and tcp.base defaults X-Git-Tag: 3.0.0-233~1206 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=23639b1dfd7d1818860da14177cf7fa50aacab48;p=thirdparty%2Fsnort3.git normalizer ip4.base and tcp.base defaults --- diff --git a/ChangeLog b/ChangeLog index ee8b6841b..8dcc256a1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,7 @@ -- fixed stream_reassemble.direction -- initial integration of hosts into binder -- don't log redecode events (from shutdown rebuilds) +-- changed normalizer ip4.base and tcp.base to default to true 127 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug diff --git a/src/network_inspectors/normalize/norm_module.cc b/src/network_inspectors/normalize/norm_module.cc index 65f017d6c..0d4568f79 100644 --- a/src/network_inspectors/normalize/norm_module.cc +++ b/src/network_inspectors/normalize/norm_module.cc @@ -84,7 +84,7 @@ static bool allow_codes(NormalizerConfig* config, const char* s) static const Parameter norm_ip4_params[] = { - { "base", Parameter::PT_BOOL, nullptr, "false", + { "base", Parameter::PT_BOOL, nullptr, "true", "clear options" }, { "df", Parameter::PT_BOOL, nullptr, "false", @@ -104,7 +104,7 @@ static const Parameter norm_ip4_params[] = static const Parameter norm_tcp_params[] = { - { "base", Parameter::PT_BOOL, nullptr, "false", + { "base", Parameter::PT_BOOL, nullptr, "true", "clear reserved bits and option padding and fix urgent pointer / flags issues" }, { "ips", Parameter::PT_BOOL, nullptr, "false", @@ -169,7 +169,7 @@ ProfileStats* NormalizeModule::get_profile() const bool NormalizeModule::set_ip4(const char*, Value& v, SnortConfig*) { if ( v.is("base") ) - Norm_Set(&config, NORM_IP4, v.get_bool()); + Norm_Set(&config, NORM_IP4_BASE, v.get_bool()); else if ( v.is("df") ) Norm_Set(&config, NORM_IP4_DF, v.get_bool()); @@ -192,7 +192,7 @@ bool NormalizeModule::set_ip4(const char*, Value& v, SnortConfig*) bool NormalizeModule::set_tcp(const char*, Value& v, SnortConfig*) { if ( v.is("base") ) - Norm_Set(&config, NORM_TCP, v.get_bool()); + Norm_Set(&config, NORM_TCP_BASE, v.get_bool()); else if ( v.is("urp") ) Norm_Set(&config, NORM_TCP_URP, v.get_bool()); @@ -238,7 +238,7 @@ bool NormalizeModule::set(const char* fqn, Value& v, SnortConfig* sc) return set_tcp(fqn, v, sc); else if ( v.is("ip6") ) - Norm_Set(&config, NORM_IP6, v.get_bool()); + Norm_Set(&config, NORM_IP6_BASE, v.get_bool()); else if ( v.is("icmp4") ) Norm_Set(&config, NORM_ICMP4, v.get_bool()); @@ -253,6 +253,17 @@ bool NormalizeModule::set(const char* fqn, Value& v, SnortConfig* sc) } bool NormalizeModule::begin(const char* fqn, int, SnortConfig*) +{ + if ( !strcmp(fqn, "normalizer.ip4") ) + Norm_Set(&config, NORM_IP4_BASE, true); + + else if ( !strcmp(fqn, "normalizer.tcp") ) + Norm_Set(&config, NORM_TCP_BASE, true); + + return true; +} + +bool NormalizeModule::end(const char* fqn, int, SnortConfig*) { if ( !strcmp(fqn, NORM_NAME) ) { @@ -260,23 +271,18 @@ bool NormalizeModule::begin(const char* fqn, int, SnortConfig*) if ( (policy->new_ttl > 1) && (policy->new_ttl >= policy->min_ttl) ) { - if ( Norm_IsEnabled(&config, NORM_IP4) ) + if ( Norm_IsEnabled(&config, NORM_IP4_BASE) ) Norm_Enable(&config, NORM_IP4_TTL); } if ( (policy->new_ttl > 1) && (policy->new_ttl >= policy->min_ttl) ) { - if ( Norm_IsEnabled(&config, NORM_IP6) ) + if ( Norm_IsEnabled(&config, NORM_IP6_BASE) ) Norm_Enable(&config, NORM_IP6_TTL); } } return true; } -bool NormalizeModule::end(const char*, int, SnortConfig*) -{ - return true; -} - void NormalizeModule::sum_stats() { Norm_SumStats(); } diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 11f16cd88..ca3c988de 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -55,25 +55,24 @@ static inline void LogFlag ( static void Print_IP4 (SnortConfig*, const NormalizerConfig* nc) { - LogFlag("ip4", nc, NORM_IP4); + if ( !Norm_IsEnabled(nc, (NormFlags)NORM_IP4_ANY) ) + return; - if ( Norm_IsEnabled(nc, NORM_IP4) ) - { - //LogFlag("ip4.id", nc, NORM_IP4_ID); - LogFlag("ip4.df", nc, NORM_IP4_DF); - LogFlag("ip4.rf", nc, NORM_IP4_RF); - LogFlag("ip4.tos", nc, NORM_IP4_TOS); - LogFlag("ip4.trim", nc, NORM_IP4_TRIM); + LogFlag("ip4.base", nc, NORM_IP4_BASE); + //LogFlag("ip4.id", nc, NORM_IP4_ID); + LogFlag("ip4.df", nc, NORM_IP4_DF); + LogFlag("ip4.rf", nc, NORM_IP4_RF); + LogFlag("ip4.tos", nc, NORM_IP4_TOS); + LogFlag("ip4.trim", nc, NORM_IP4_TRIM); - if ( Norm_IsEnabled(nc, NORM_IP4_TTL) ) - { - NetworkPolicy* policy = get_network_policy(); - LogMessage("%12s: %s (min=%d, new=%d)\n", "ip4.ttl", ON, - policy->min_ttl, policy->new_ttl); - } - else - LogConf("ip4.ttl", OFF); + if ( Norm_IsEnabled(nc, NORM_IP4_TTL) ) + { + NetworkPolicy* policy = get_network_policy(); + LogMessage("%12s: %s (min=%d, new=%d)\n", "ip4.ttl", ON, + policy->min_ttl, policy->new_ttl); } + else + LogConf("ip4.ttl", OFF); } static void Print_ICMP4 (const NormalizerConfig* nc) @@ -83,18 +82,16 @@ static void Print_ICMP4 (const NormalizerConfig* nc) static void Print_IP6 (SnortConfig*, const NormalizerConfig* nc) { - LogFlag("ip6", nc, NORM_IP6); + if ( !Norm_IsEnabled(nc, (NormFlags)NORM_IP6_ANY) ) + return; - if ( Norm_IsEnabled(nc, NORM_IP6) ) + LogFlag("ip6.base", nc, NORM_IP6_BASE); + + if ( Norm_IsEnabled(nc, NORM_IP6_TTL) ) { - if ( Norm_IsEnabled(nc, NORM_IP6_TTL) ) - { - NetworkPolicy* policy = get_network_policy(); - LogMessage("%12s: %s (min=%d, new=%d)\n", "ip6.hops", - ON, policy->min_ttl, policy->new_ttl); - } - else - LogConf("ip6.hops", OFF); + NetworkPolicy* policy = get_network_policy(); + LogMessage("%12s: %s (min=%d, new=%d)\n", "ip6.hops", + ON, policy->min_ttl, policy->new_ttl); } } @@ -105,51 +102,50 @@ static void Print_ICMP6 (const NormalizerConfig* nc) static void Print_TCP (const NormalizerConfig* nc) { - LogFlag("tcp", nc, NORM_TCP); + if ( !Norm_IsEnabled(nc, (NormFlags)NORM_TCP_ANY) ) + return; - if ( Norm_IsEnabled(nc, NORM_TCP) ) - { - const char* s; + LogFlag("tcp.base", nc, NORM_TCP_BASE); + const char* s; - if ( Norm_IsEnabled(nc, NORM_TCP_ECN_PKT) ) - s = "packet"; - else if ( Norm_IsEnabled(nc, NORM_TCP_ECN_STR) ) - s = "stream"; - else - s = OFF; + if ( Norm_IsEnabled(nc, NORM_TCP_ECN_PKT) ) + s = "packet"; + else if ( Norm_IsEnabled(nc, NORM_TCP_ECN_STR) ) + s = "stream"; + else + s = OFF; - LogConf("tcp.ecn", s); - LogFlag("tcp.urp", nc, NORM_TCP_URP); + LogConf("tcp.ecn", s); + LogFlag("tcp.urp", nc, NORM_TCP_URP); - if ( Norm_IsEnabled(nc, NORM_TCP_OPT) ) + if ( Norm_IsEnabled(nc, NORM_TCP_OPT) ) + { + char buf[1024] = ""; + char* p = buf; + int opt; + size_t min; + + p += snprintf(p, buf+sizeof(buf)-p, "%s", "(allow "); + min = strlen(buf); + + // TBD translate options to keywords allowed by parser + for ( opt = 2; opt < 256; opt++ ) { - char buf[1024] = ""; - char* p = buf; - int opt; - size_t min; - - p += snprintf(p, buf+sizeof(buf)-p, "%s", "(allow "); - min = strlen(buf); - - // TBD translate options to keywords allowed by parser - for ( opt = 2; opt < 256; opt++ ) - { - const char* fmt = (strlen(buf) > min) ? ",%d" : "%d"; - if ( Norm_TcpIsOptional(nc, opt) ) - p += snprintf(p, buf+sizeof(buf)-p, fmt, opt); - } - if ( strlen(buf) > min ) - { - snprintf(p, buf+sizeof(buf)-p, "%c", ')'); - buf[sizeof(buf)-1] = '\0'; - } - LogMessage("%12s: %s %s\n", "tcp.opt", ON, buf); + const char* fmt = (strlen(buf) > min) ? ",%d" : "%d"; + if ( Norm_TcpIsOptional(nc, opt) ) + p += snprintf(p, buf+sizeof(buf)-p, fmt, opt); } - else - LogConf("tcp.opt", OFF); - - LogFlag("tcp.ips", nc, NORM_TCP_IPS); + if ( strlen(buf) > min ) + { + snprintf(p, buf+sizeof(buf)-p, "%c", ')'); + buf[sizeof(buf)-1] = '\0'; + } + LogMessage("%12s: %s %s\n", "tcp.opt", ON, buf); } + else + LogConf("tcp.opt", OFF); + + LogFlag("tcp.ips", nc, NORM_TCP_IPS); } //------------------------------------------------------------------------- diff --git a/src/network_inspectors/normalize/normalize.h b/src/network_inspectors/normalize/normalize.h index ea5f0297d..ff3369830 100644 --- a/src/network_inspectors/normalize/normalize.h +++ b/src/network_inspectors/normalize/normalize.h @@ -29,34 +29,35 @@ typedef enum { - NORM_IP4 = 0x00000001, // core ip4 norms + NORM_IP4_BASE = 0x00000001, // core ip4 norms //NORM_IP4_ID = 0x00000002, // tbd: encrypt ip id NORM_IP4_DF = 0x00000004, // clear df NORM_IP4_RF = 0x00000008, // clear rf NORM_IP4_TTL = 0x00000010, // ensure min ttl - NORM_ICMP4 = 0x00000020, // core icmp4 norms - NORM_IP6 = 0x00000040, // core ip6 norms - NORM_IP6_TTL = 0x00000080, // ensure min hop limit - NORM_ICMP6 = 0x00000100, // core icmp6 norms - NORM_TCP = 0x00000200, // core tcp norms - NORM_TCP_ECN_PKT = 0x00000400, // clear ece and cwr - NORM_TCP_ECN_STR = 0x00000800, // clear if not negotiated (stream) - NORM_TCP_URP = 0x00001000, // trim urp to dsize - NORM_TCP_OPT = 0x00002000, // nop over non-essential options - NORM_TCP_IPS = 0x00004000, // enable stream normalization/pre-ack flushing - NORM_IP4_TOS = 0x00008000, // clear tos/diff-serv - NORM_IP4_TRIM = 0x00010000, // enforce min frame - NORM_TCP_TRIM = 0x00020000, // enforce min frame - NORM_ALL = 0x0003FFFF // all normalizations on + NORM_IP4_TOS = 0x00000020, // clear tos/diff-serv + NORM_IP4_TRIM = 0x00000040, // enforce min frame + + NORM_IP6_BASE = 0x00000100, // core ip6 norms + NORM_IP6_TTL = 0x00000200, // ensure min hop limit + NORM_ICMP4 = 0x00000400, // core icmp4 norms + NORM_ICMP6 = 0x00000800, // core icmp6 norms + + NORM_TCP_BASE = 0x00001000, // core tcp norms + NORM_TCP_ECN_PKT = 0x00002000, // clear ece and cwr + NORM_TCP_ECN_STR = 0x00004000, // clear if not negotiated (stream) + NORM_TCP_URP = 0x00008000, // trim urp to dsize + NORM_TCP_OPT = 0x00010000, // nop over non-essential options + NORM_TCP_IPS = 0x00020000, // enable stream normalization/pre-ack flushing + NORM_TCP_TRIM = 0x00040000, // enforce min frame + + NORM_ALL = 0x000FFFFF // all normalizations on } NormFlags; bool Normalize_IsEnabled(NormFlags); -#define NORM_IP4_ANY (NORM_IP4|NORM_IP4_DF|NORM_IP4_RF|NORM_IP4_TTL) -#define NORM_IP6_ANY (NORM_IP6|NORM_IP6_TTL) -#define NORM_TCP_ANY \ - (NORM_TCP|NORM_TCP_ECN_PKT|NORM_TCP_ECN_STR|NORM_TCP_URP| \ - NORM_TCP_OPT|NORM_TCP_IPS|NORM_IP4_TOS|NORM_IP4_TRIM|NORM_TCP_TRIM) +#define NORM_IP4_ANY (0xFF) +#define NORM_IP6_ANY (NORM_IP6_BASE|NORM_IP6_TTL) +#define NORM_TCP_ANY (0xFF000) #endif diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index eb3149491..b3d8c29b8 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -5081,7 +5081,7 @@ static int ProcessTcp( "bad sequence number, bailing\n");); Discard(); eventcode |= EVENT_BAD_RST; - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); LogTcpEvents(eventcode); MODULE_PROFILE_END(s5TcpStatePerfStats); return retcode; @@ -5188,7 +5188,7 @@ static int ProcessTcp( "bad sequence number, bailing\n");); Discard(); eventcode |= EVENT_BAD_RST; - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); LogTcpEvents(eventcode); MODULE_PROFILE_END(s5TcpStatePerfStats); return retcode | ts_action; @@ -5251,7 +5251,7 @@ static int ProcessTcp( { int action; if ( !SEQ_EQ(tdb->seq, talker->isn) && - NormalDropPacketIf(p, NORM_TCP) ) + NormalDropPacketIf(p, NORM_TCP_BASE) ) action = ACTION_BAD_PKT; else if ( talker->s_mgr.state >= TCP_STATE_ESTABLISHED ) @@ -5279,7 +5279,7 @@ static int ProcessTcp( /* got a window too large, alert! */ eventcode |= EVENT_WINDOW_TOO_LARGE; Discard(); - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); LogTcpEvents(eventcode); MODULE_PROFILE_END(s5TcpStatePerfStats); return retcode | ACTION_BAD_PKT; @@ -5295,7 +5295,7 @@ static int ProcessTcp( eventcode |= EVENT_WINDOW_SLAM; Discard(); - if ( NormalDropPacketIf(p, NORM_TCP) ) + if ( NormalDropPacketIf(p, NORM_TCP_BASE) ) { LogTcpEvents(eventcode); MODULE_PROFILE_END(s5TcpStatePerfStats); @@ -5376,7 +5376,7 @@ static int ProcessTcp( eventcode |= EVENT_WINDOW_SLAM; Discard(); - if ( NormalDropPacketIf(p, NORM_TCP) ) + if ( NormalDropPacketIf(p, NORM_TCP_BASE) ) { LogTcpEvents(eventcode); MODULE_PROFILE_END(s5TcpStatePerfStats); @@ -5424,7 +5424,7 @@ static int ProcessTcp( { eventcode |= EVENT_BAD_ACK; LogTcpEvents(eventcode); - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); MODULE_PROFILE_END(s5TcpStatePerfStats); return retcode | ACTION_BAD_PKT; } @@ -5473,7 +5473,7 @@ static int ProcessTcp( //EventDataOnClosed(talker->config); eventcode |= EVENT_DATA_ON_CLOSED; retcode |= ACTION_BAD_PKT; - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); } else if (TCP_STATE_CLOSED == talker->s_mgr.state) { @@ -5493,7 +5493,7 @@ static int ProcessTcp( eventcode |= EVENT_DATA_ON_CLOSED; } retcode |= ACTION_BAD_PKT; - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); } else { @@ -5538,7 +5538,7 @@ static int ProcessTcp( else { eventcode |= EVENT_DATA_WITHOUT_FLAGS; - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); } } } @@ -5623,7 +5623,7 @@ static int ProcessTcp( "FIN beyond previous, ignoring\n");); eventcode |= EVENT_BAD_FIN; LogTcpEvents(eventcode); - NormalDropPacketIf(p, NORM_TCP); + NormalDropPacketIf(p, NORM_TCP_BASE); MODULE_PROFILE_END(s5TcpStatePerfStats); return retcode | ACTION_BAD_PKT; }