From: Russ Combs Date: Thu, 10 Apr 2014 17:41:16 +0000 (-0400) Subject: removed ftp / telnet stateless inspection X-Git-Tag: 3.0.0-233~1582 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=245e423d421cb2aac6e0459dd508f8a2b44de777;p=thirdparty%2Fsnort3.git removed ftp / telnet stateless inspection --- diff --git a/doc/differences.txt b/doc/differences.txt index 83f9fb46e..8b1651126 100644 --- a/doc/differences.txt +++ b/doc/differences.txt @@ -64,6 +64,7 @@ Snort++ differs from Snort in the following ways: * frag3 default policy is linux not bsd * lowmem* search methods are now in snort_examples * deleted unused http_inspect stateful mode +* deleted stateless inspection from ftp and telnet === Rules diff --git a/src/service_inspectors/ftp_telnet/ft_main.cc b/src/service_inspectors/ftp_telnet/ft_main.cc index c2b86bf11..7a014f579 100644 --- a/src/service_inspectors/ftp_telnet/ft_main.cc +++ b/src/service_inspectors/ftp_telnet/ft_main.cc @@ -90,7 +90,6 @@ static THREAD_LOCAL PreprocStats ftppDetectPerfStats; */ #define ENCRYPTED_TRAFFIC "encrypted_traffic" #define CHECK_ENCRYPTED "check_encrypted" -#define INSPECT_TYPE "inspection_type" #define INSPECT_TYPE_STATELESS "stateless" #define INSPECT_TYPE_STATEFUL "stateful" @@ -419,56 +418,6 @@ static int PrintConfOpt(FTPTELNET_CONF_OPT *ConfOpt, const char* Option) return FTPP_SUCCESS; } -/* - * Function: ProcessInspectType(FTPTELNET_CONF_OPT *ConfOpt, - * char *ErrorString, int ErrStrLen) - * - * Purpose: Process the type of inspection. - * This sets the type of inspection for FTPTelnet to do. - * - * Arguments: GlobalConf => pointer to the global configuration - * ErrorString => error string buffer - * ErrStrLen => the length of the error string buffer - * - * Returns: int => an error code integer (0 = success, - * >0 = non-fatal error, <0 = fatal error) - * - */ -static int ProcessInspectType(FTPTELNET_GLOBAL_CONF *GlobalConf, - char *ErrorString, int ErrStrLen) -{ - char *pcToken; - - pcToken = NextToken(CONF_SEPARATORS); - if(pcToken == NULL) - { - snprintf(ErrorString, ErrStrLen, - "No argument to token '%s'.", INSPECT_TYPE); - - return FTPP_FATAL_ERR; - } - - if(!strcmp(INSPECT_TYPE_STATEFUL, pcToken)) - { - GlobalConf->inspection_type = FTPP_UI_CONFIG_STATEFUL; - } - else if(!strcmp(INSPECT_TYPE_STATELESS, pcToken)) - { - GlobalConf->inspection_type = FTPP_UI_CONFIG_STATELESS; - } - else - { - snprintf(ErrorString, ErrStrLen, - "Invalid argument to token '%s'. Must be either " - "'%s' or '%s'.", INSPECT_TYPE, INSPECT_TYPE_STATEFUL, - INSPECT_TYPE_STATELESS); - - return FTPP_FATAL_ERR; - } - - return FTPP_SUCCESS; -} - /* * Function: ProcessFTPGlobalConf(FTPTELNET_GLOBAL_CONF *GlobalConf, * char *ErrorString, int ErrStrLen) @@ -481,8 +430,6 @@ static int ProcessInspectType(FTPTELNET_GLOBAL_CONF *GlobalConf, * non-fatal. * * The configuration options that are dealt with here are: - * - inspection_type - * Indicate whether to operate in stateful stateless mode * - encrypted_traffic * Detect and alert on encrypted sessions * - check_after_encrypted @@ -529,14 +476,6 @@ int ProcessFTPGlobalConf(FTPTELNET_GLOBAL_CONF *GlobalConf, return iRet; } } - else if(!strcmp(INSPECT_TYPE, pcToken)) - { - iRet = ProcessInspectType(GlobalConf, ErrorString, ErrStrLen); - if (iRet) - { - return iRet; - } - } else { snprintf(ErrorString, ErrStrLen, @@ -3066,9 +3005,6 @@ int PrintFTPGlobalConf(FTPTELNET_GLOBAL_CONF *GlobalConf) LogMessage("FTPTelnet Config:\n"); LogMessage(" GLOBAL CONFIG\n"); - LogMessage(" Inspection Type: %s\n", - GlobalConf->inspection_type == FTPP_UI_CONFIG_STATELESS ? - "stateless" : "stateful"); PrintConfOpt(&GlobalConf->encrypted, "Check for Encrypted Traffic"); LogMessage(" Continue to check encrypted data: %s\n", GlobalConf->check_encrypted_data ? "YES" : "NO"); @@ -3374,14 +3310,7 @@ int SnortTelnet(FTPTELNET_GLOBAL_CONF *GlobalConf, TELNET_SESSION *Telnetsession if (!Telnetsession) { - if (GlobalConf->inspection_type == FTPP_UI_CONFIG_STATEFUL) - { - return FTPP_NONFATAL_ERR; - } - else - { - return FTPP_INVALID_SESSION; - } + return FTPP_NONFATAL_ERR; } if (Telnetsession->encr_state && !GlobalConf->check_encrypted_data) diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.cc b/src/service_inspectors/ftp_telnet/ftpp_si.cc index 8f02a1a44..c325be08b 100644 --- a/src/service_inspectors/ftp_telnet/ftpp_si.cc +++ b/src/service_inspectors/ftp_telnet/ftpp_si.cc @@ -57,8 +57,6 @@ #include "stream5/stream_api.h" #include "ft_main.h" -static THREAD_LOCAL FTP_SESSION Staticsession; - unsigned FtpFlowData::flow_id = 0; unsigned TelnetFlowData::flow_id = 0; @@ -155,50 +153,6 @@ static int TelnetStatefulsessionInspection(Packet *p, return FTPP_NONFATAL_ERR; } -/* - * Function: TelnetStatelesssessionInspection(Packet *p, - * FTPTELNET_GLOBAL_CONF *GlobalConf, - * TELNET_SESSION **Telnetsession, - * FTPP_SI_INPUT *SiInput) - * - * Purpose: Initialize the session and server configurations for this - * packet/stream. It is important to note in stateless mode that - * we assume no knowledge of the state of a connection, other - * than the knowledge that we can glean from an individual packet. - * So in essence, each packet is it's own session and there - * is no knowledge retained from one packet to another. If you - * want to track a telnet session for real, use stateful mode. - * - * In this function, we set the session pointer (which includes - * the correct server configuration). The actual processing to - * find which IP is the server and which is the client, is done in - * the InitServerConf() function. - * - * Arguments: p => pointer to the packet/stream - * GlobalConf => pointer to the global configuration - * session => double pointer to the session structure - * SiInput => pointer to the session information - * - * Returns: int => return code indicating error or success - * - */ -static int TelnetStatelesssessionInspection( - Packet*, FTPTELNET_GLOBAL_CONF *GlobalConf, - TELNET_SESSION **session, FTPP_SI_INPUT *SiInput) -{ - static THREAD_LOCAL TELNET_SESSION TelnetStaticsession; - - TelnetResetsession(&TelnetStaticsession); - - SiInput->pproto = FTPP_SI_PROTO_TELNET; - TelnetStaticsession.telnet_conf = GlobalConf->telnet_config; - - *session = &TelnetStaticsession; - - return FTPP_SUCCESS; -} - - /* * Function: TelnetsessionInspection(Packet *p, * FTPTELNET_GLOBAL_CONF *GlobalConf, @@ -281,23 +235,10 @@ int TelnetsessionInspection(Packet *p, FTPTELNET_GLOBAL_CONF *GlobalConf, * Reassembly module (which includes the server configuration) or the * structure will be allocated and added to the stream pointer for the * rest of the session. - * - * In stateless mode, we just use a static variable that is contained in - * the function here. */ - if(GlobalConf->inspection_type == FTPP_UI_CONFIG_STATEFUL) - { - iRet = TelnetStatefulsessionInspection(p, GlobalConf, Telnetsession, SiInput); - if (iRet) - return iRet; - } - else - { - /* Assume stateless processing otherwise */ - iRet = TelnetStatelesssessionInspection(p, GlobalConf, Telnetsession, SiInput); - if (iRet) - return iRet; - } + iRet = TelnetStatefulsessionInspection(p, GlobalConf, Telnetsession, SiInput); + if (iRet) + return iRet; return FTPP_SUCCESS; } @@ -738,60 +679,6 @@ static int FTPStatefulsessionInspection(Packet *p, return FTPP_INVALID_PROTO; } -/* - * Function: FTPStatelesssessionInspection(Packet *p, - * FTPTELNET_GLOBAL_CONF *GlobalConf, - * FTP_SESSION **Ftpsession, - * FTPP_SI_INPUT *SiInput, int *piInspectMode) - * - * Purpose: Initialize the session and server configurations for this - * packet/stream. It is important to note in stateless mode that - * we assume no knowledge of the state of a connection, other than - * the knowledge that we can glean from an individual packet. So - * in essence, each packet is it's own session and there is no - * knowledge retained from one packet to another. If you want to - * track an FTP session for real, use stateful mode. - * - * In this function, we set the session pointer (which includes - * the correct server configuration). The actual processing to find - * which IP is the server and which is the client, is done in the - * InitServerConf() function. - * - * Arguments: p => pointer to the Packet/session - * GlobalConf => pointer to the global configuration - * session => double pointer to the session structure - * SiInput => pointer to the session information - * piInspectMode => pointer so the inspection mode can be set - * - * Returns: int => return code indicating error or success - * - */ -static int FTPStatelesssessionInspection(Packet *p, - FTPTELNET_GLOBAL_CONF *GlobalConf, - FTP_SESSION **Ftpsession, - FTPP_SI_INPUT *SiInput, int *piInspectMode) -{ - FTP_CLIENT_PROTO_CONF *ClientConf; - FTP_SERVER_PROTO_CONF *ServerConf; - int iRet; - - FTPResetsession(&Staticsession); - - iRet = FTPInitConf(p, GlobalConf, &ClientConf, &ServerConf, SiInput, piInspectMode); - if (iRet) - return iRet; - - Staticsession.ft_ssn.proto = FTPP_SI_PROTO_FTP; - Staticsession.client_conf = ClientConf; - Staticsession.server_conf = ServerConf; - - SiInput->pproto = FTPP_SI_PROTO_FTP; - *Ftpsession = &Staticsession; - - return FTPP_SUCCESS; -} - - /* * Function: FTPsessionInspection(Packet *p, * FTPTELNET_GLOBAL_CONF *GlobalConf, @@ -832,23 +719,10 @@ int FTPsessionInspection(Packet *p, FTPTELNET_GLOBAL_CONF *GlobalConf, * Reassembly module (which includes the server configuration) or the * structure will be allocated and added to the stream pointer for the * rest of the session. - * - * In stateless mode, we just use a static variable that is contained in - * the function here. */ - if(GlobalConf->inspection_type == FTPP_UI_CONFIG_STATEFUL) - { - iRet = FTPStatefulsessionInspection(p, GlobalConf, Ftpsession, SiInput, piInspectMode); - if (iRet) - return iRet; - } - else - { - /* Assume stateless processing otherwise */ - iRet = FTPStatelesssessionInspection(p, GlobalConf, Ftpsession, SiInput, piInspectMode); - if (iRet) - return iRet; - } + iRet = FTPStatefulsessionInspection(p, GlobalConf, Ftpsession, SiInput, piInspectMode); + if (iRet) + return iRet; return FTPP_SUCCESS; } diff --git a/src/service_inspectors/ftp_telnet/ftpp_ui_config.h b/src/service_inspectors/ftp_telnet/ftpp_ui_config.h index 30fe730fc..89511dd28 100644 --- a/src/service_inspectors/ftp_telnet/ftpp_ui_config.h +++ b/src/service_inspectors/ftp_telnet/ftpp_ui_config.h @@ -292,7 +292,6 @@ typedef struct s_TELNET_PROTO_CONF */ typedef struct s_FTPTELNET_GLOBAL_CONF { - int inspection_type; int check_encrypted_data; FTPTELNET_CONF_OPT encrypted; diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc index 8ba77c3ff..206404bbf 100644 --- a/src/service_inspectors/ftp_telnet/pp_ftp.cc +++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc @@ -1745,8 +1745,6 @@ int check_ftp(FTP_SESSION *ftpssn, Packet *p, int iMode) iRet = FTPP_ALERT; } - if (global_conf->inspection_type == - FTPP_UI_CONFIG_STATEFUL) { int newRet = do_stateful_checks(ftpssn, p, req, rsp_code); if (newRet != FTPP_SUCCESS)