From: Russ Combs <rucombs@cisco.com>
Date: Thu, 16 Oct 2014 15:48:54 +0000 (-0400)
Subject: basic random xor key for --rule-to-*
X-Git-Tag: 3.0.0-233~1373
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=26185d92a66a9231ff234e95392a72dc64eda2fd;p=thirdparty%2Fsnort3.git

basic random xor key for --rule-to-*
---

diff --git a/extra/src/so_rules/sid_18758.h b/extra/src/so_rules/sid_18758.h
deleted file mode 100644
index 00c9af8b2..000000000
--- a/extra/src/so_rules/sid_18758.h
+++ /dev/null
@@ -1,46 +0,0 @@
-const uint8_t rule_18758[] =
-{
-0x61, 0x6C, 0x65, 0x72, 0x74, 0x20, 0x74, 0x63, 0x70, 0x20, 0x24, 0x48, 
-0x4F, 0x4D, 0x45, 0x5F, 0x4E, 0x45, 0x54, 0x20, 0x61, 0x6E, 0x79, 0x20, 
-0x2D, 0x3E, 0x20, 0x24, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4E, 0x41, 0x4C, 
-0x5F, 0x4E, 0x45, 0x54, 0x20, 0x24, 0x48, 0x54, 0x54, 0x50, 0x5F, 0x50, 
-0x4F, 0x52, 0x54, 0x53, 0x0A, 0x28, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x6D, 
-0x73, 0x67, 0x3A, 0x22, 0x46, 0x49, 0x4C, 0x45, 0x2D, 0x49, 0x44, 0x45, 
-0x4E, 0x54, 0x49, 0x46, 0x59, 0x20, 0x4D, 0x69, 0x63, 0x72, 0x6F, 0x73, 
-0x6F, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73, 0x20, 
-0x56, 0x69, 0x73, 0x75, 0x61, 0x6C, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, 
-0x20, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x20, 0x66, 0x69, 0x6C, 0x65, 
-0x20, 0x64, 0x6F, 0x77, 0x6E, 0x6C, 0x6F, 0x61, 0x64, 0x20, 0x72, 0x65, 
-0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 
-0x6D, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x3A, 0x73, 0x65, 0x72, 
-0x76, 0x69, 0x63, 0x65, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3B, 0x0A, 0x20, 
-0x20, 0x20, 0x20, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6E, 0x63, 0x65, 
-0x3A, 0x75, 0x72, 0x6C, 0x2C, 0x65, 0x6E, 0x2E, 0x77, 0x69, 0x6B, 0x69, 
-0x70, 0x65, 0x64, 0x69, 0x61, 0x2E, 0x6F, 0x72, 0x67, 0x2F, 0x77, 0x69, 
-0x6B, 0x69, 0x2F, 0x56, 0x62, 0x73, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 
-0x63, 0x6C, 0x61, 0x73, 0x73, 0x74, 0x79, 0x70, 0x65, 0x3A, 0x6D, 0x69, 
-0x73, 0x63, 0x2D, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x3B, 
-0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x69, 0x64, 0x3A, 0x31, 0x38, 0x37, 
-0x35, 0x38, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x76, 0x3A, 
-0x38, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x6F, 0x69, 0x64, 0x3A, 
-0x33, 0x7C, 0x31, 0x38, 0x37, 0x35, 0x38, 0x3B, 0x0A, 0x23, 0x20, 0x65, 
-0x76, 0x65, 0x72, 0x79, 0x74, 0x68, 0x69, 0x6E, 0x67, 0x20, 0x61, 0x62, 
-0x6F, 0x76, 0x65, 0x20, 0x61, 0x70, 0x70, 0x65, 0x61, 0x72, 0x73, 0x20, 
-0x69, 0x6E, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, 0x23, 0x20, 0x74, 0x68, 
-0x65, 0x20, 0x66, 0x6F, 0x6C, 0x6C, 0x6F, 0x77, 0x69, 0x6E, 0x67, 0x20, 
-0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x6F, 0x70, 
-0x74, 0x69, 0x6F, 0x6E, 0x73, 0x20, 0x61, 0x72, 0x65, 0x20, 0x6E, 0x6F, 
-0x74, 0x20, 0x69, 0x6E, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, 0x20, 0x20, 
-0x20, 0x20, 0x66, 0x6C, 0x6F, 0x77, 0x3A, 0x74, 0x6F, 0x5F, 0x73, 0x65, 
-0x72, 0x76, 0x65, 0x72, 0x2C, 0x65, 0x73, 0x74, 0x61, 0x62, 0x6C, 0x69, 
-0x73, 0x68, 0x65, 0x64, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x68, 0x74, 
-0x74, 0x70, 0x5F, 0x75, 0x72, 0x69, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 
-0x63, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x3A, 0x22, 0x2E, 0x76, 0x62, 
-0x73, 0x22, 0x2C, 0x20, 0x6E, 0x6F, 0x63, 0x61, 0x73, 0x65, 0x3B, 0x0A, 
-0x20, 0x20, 0x20, 0x20, 0x70, 0x63, 0x72, 0x65, 0x3A, 0x22, 0x2F, 0x5C, 
-0x78, 0x32, 0x65, 0x76, 0x62, 0x73, 0x28, 0x5B, 0x5C, 0x3F, 0x5C, 0x78, 
-0x35, 0x63, 0x5C, 0x78, 0x32, 0x66, 0x5D, 0x7C, 0x24, 0x29, 0x2F, 0x73, 
-0x6D, 0x69, 0x22, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x6F, 0x3A, 
-0x65, 0x76, 0x61, 0x6C, 0x3B, 0x0A, 0x29, 0x0A, 
-};
-const unsigned rule_18758_len = 0;
diff --git a/extra/src/so_rules/sid_18758.txt b/extra/src/so_rules/sid_18758.txt
index 4487d0850..8daa4f343 100644
--- a/extra/src/so_rules/sid_18758.txt
+++ b/extra/src/so_rules/sid_18758.txt
@@ -8,7 +8,7 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
     rev:8;
     soid:3|18758;
 # everything above appears in stub
-# the following detection options are not in stub
+# the following detection options are not in protected stub
     flow:to_server,established;
     http_uri;
     content:".vbs", nocase;
diff --git a/src/managers/so_manager.cc b/src/managers/so_manager.cc
index eb4632fe1..3bfcbecb6 100644
--- a/src/managers/so_manager.cc
+++ b/src/managers/so_manager.cc
@@ -154,8 +154,13 @@ static void strvrt(const string& text, string& data)
 
     data.assign((char*)d, len);
 
-    // FIXIT-H choose random byte for xor
-    uint8_t key = 0xA5;
+    // generate xor key
+    // FIXIT-L there is no hard core crypto requirement here
+    // but rand() is known to be weak, especially in the lower bits
+    // nonetheless this seems to work as good as the basic
+    // C++ 11 default generator and uniform distribution
+    uint8_t key = (uint8_t)(rand() >> 16);
+    if ( !key ) key = 0xA5;
 
     for ( unsigned i = 0; i < len; i++ )
         data[i] ^= key;