From: Russ Combs Date: Mon, 6 Jul 2015 15:48:04 +0000 (-0400) Subject: build 160 - alpha 2 X-Git-Tag: 3.0.0-233~916 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3e1b6a92aa855bfcc442148ab7f2f0ff72ef3d3a;p=thirdparty%2Fsnort3.git build 160 - alpha 2 --- diff --git a/ChangeLog b/ChangeLog index 3b9cbb5db..bed38ba1e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,18 @@ +15/07/06 - build 160 - Alpha 2 + +-- fixed duplicate patterns in file_magic.lua +-- warn about rules with no fast pattern +-- warn if file rule has no file_data fp +-- run fast patterns according to packet type +-- update / expand shutdown output for detection +-- binder sets service from inspector if not set +-- allow abbreviated rule headers +-- fix cmake build on linux w/o asciidoc +-- add bugs list to manual +-- fix memory leaks +-- fix valgrind issues +-- fix xcode analyzer issues + 15/07/02 - build 159 -- added file processing to new_http_inspect diff --git a/doc/default_snort_manual.html b/doc/default_snort_manual.html index 031900f32..f5c6c28a1 100644 --- a/doc/default_snort_manual.html +++ b/doc/default_snort_manual.html @@ -781,7 +781,7 @@ asciidoc.install(2); 
 ,,_     -*> Snort++ <*-
-o"  )~   Version 3.0.0-a1 (Build 155) from 2.9.7-177
+o"  )~   Version 3.0.0-a1 (Build 160) from 2.9.7-177
  ''''    By Martin Roesch & The Snort Team
          http://snort.org/contact#team
          Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
@@ -1233,11 +1233,11 @@ one preprocessor supplies another with a function to call when certain data
 is available.  Snort has started to take this approach to pass some HTTP and
 SIP preprocessor data to app ID.  However, it remains a peripheral feature
 and still requires the production of data that may not be consumed.
-

The basic processing steps Snort takes are similar to Snort’s as seen in +

The basic processing steps Snort++ takes are similar to Snort’s as seen in the following diagram. The preprocess step employs specific inspector types instead of a generalized list, but the basic procedure includes stateless packet decoding, TCP stream reassembly, and service specific -analysis in both cases. (Snort provides hooks for arbitrary inspectors, +analysis in both cases. (Snort++ provides hooks for arbitrary inspectors, but they are not central to basic flow processing and are not shown.)

@@ -1260,8 +1260,8 @@ subscribed for (other in the above diagram). By adding data_log = { ke URI logger.

Inspection events coupled with pluggable inspectors provide a very flexible framework for implementing new features. And JIT buffer stuffers allow -Snort to work smarter, not harder. These capabilities will be leveraged -more and more as Snort development continues.

+Snort++ to work smarter, not harder. These capabilities will be leveraged +more and more as Snort++ development continues.

@@ -1898,6 +1898,127 @@ EXTERNAL_NET = '!' .. MY_SERVERS +
+

Bugs

+
+

Build

+
    +
  • +

    +configure bombs on OSX with g++ wrapper to clang because g version < 4.8 +(compare g\ -dumpversion and g++ --version) +

    +
    +
    +
    workaround:  export CXX=clang++
    +
    +
    • +
  • +

    +export CXX=clang++ to build with clang; coughs up these warnings: +

    +
    +
    +
    Wunused-but-set-variable is not understood by clang
+clang: warning: argument unused during compilation: '-pthread'
    +
    +
    • +
  • +

    +Cmake doc/ has a problem when SNORT_PLUGIN_PATH is set to get extras +included in the manual. +

    +
    • +
  • +

    +Making in doc/ may fail complaining something about xmllint. Just make +again and it will succeed. Appears to be an unknown dependency but it +works for me! +

    +
    • +
+
+
+

Config

+
    +
  • +

    +Parsing issue with IP lists. can’t parse rules with $EXTERNAL_NET +defined as below because or the space between ! and 10. +

    +
    +
    +
    HOME_NET = [[ 10.0.17.0/24 10.0.14.0/24 10.247.0.0/16 10.246.0.0/16 ]]
+EXTERNAL_NET = '! ' .. HOME_NET
    +
    +
    • +
  • +

    +Multiple versions of luajit scripts are not handled correctly. The +first loaded version will always be executed even though plugin manager +saves the correct version. +

    +
    • +
+
+
+

Rules

+
    +
  • +

    +metdata:service foo; metadata:service foo; won’t cause a duplicate service +warning as does metadata:service foo, service foo; +

    +
    • +
  • +

    +ip_proto doesn’t work properly with reassembled packets so it can’t be +used to restrict the protocol of service rules. +

    +
    • +
+
+
+

snort2lua

+
    +
  • +

    +uricontent:"foo"; content:"bar"; → http_uri; content:"foo"; content:"bar"; +(missing pkt_data) +

    +
    • +
  • +

    +stream_tcp ports and protocols both go into a single binder.when; this is +incorrect as the when fields are logically anded together (ie must all be +true). should create 2 separate bindings. +

    +
    • +
  • +

    +There is a bug in pps_stream_tcp.cc.. when stream_tcp: is +specified without any arguments, snort2lua doesn’t convert it +

    +
    • +
  • +

    +Loses the ip list delimiters [ ]; change to ( ) +

    +
    +
    +
    in snort.conf: var HOME_NET [A,B,C]
+in snort.lua: HOME_NET = [[A B C]]
    +
    +
    • +
  • +

    +Won’t convert packet rules (alert tcp etc.) to service rules (alert http +etc.). +

    +
    • +
+
+
@@ -1966,11 +2087,6 @@ int alerts.event_filter_memcap = 1048576: set available memory

  • -int alerts.flowbits_size = 1024: maximum number of allowed unique flowbits { 0:2048 } -

    -
    • -
  • -

    string alerts.order = pass drop alert log: change the order of rule action application

    • @@ -2257,6 +2373,51 @@ int detection.pcre_match_limit_recursion = 1500: limit pcre sta

  • +detection.slow searches: non-fast pattern rule evaluations +

    +
    • +
  • +

    +detection.raw searches: fast pattern searches in raw packet data +

    +
    • +
  • +

    +detection.cooked searches: fast pattern searches in cooked packet data +

    +
    • +
  • +

    +detection.pkt searches: fast pattern searches in packet data +

    +
    • +
  • +

    +detection.alt searches: alt fast pattern searches in packet data +

    +
    • +
  • +

    +detection.key searches: fast pattern searches in key buffer +

    +
    • +
  • +

    +detection.header searches: fast pattern searches in header buffer +

    +
    • +
  • +

    +detection.body searches: fast pattern searches in body buffer +

    +
    • +
  • +

    +detection.file searches: fast pattern searches in file buffer +

    +
    • +
  • +

    detection.alerts: alerts not including IP reputation

    • @@ -3005,7 +3166,7 @@ int search_engine.max_queue_events = 5: maximum number of match

  • -bool search_engine.inspect_stream_inserts = true: inspect reassembled payload - disabling is good for performance, bad for detection +bool search_engine.inspect_stream_inserts = false: inspect reassembled payload - disabling is good for performance, bad for detection

  • @@ -4872,7 +5033,7 @@ string binder[].when.service: override default configuration

  • -enum binder[].use.action = inspect: what to do with matching traffic { block | allow | inspect } +enum binder[].use.action = inspect: what to do with matching traffic { reset | block | allow | inspect }

  • @@ -4905,6 +5066,11 @@ string binder[].use.name: symbol name (defaults to type)

  • +binder.resets: reset bindings +

    +
    • +
  • +

    binder.blocks: block bindings

    • @@ -6246,7 +6412,7 @@ bool new_http_inspect.test_output = false: print out HTTP secti

  • -219:53 (new_http_inspect) Input apparently not HTTP +219:53 (new_http_inspect) Chunk length has excessive leading zeros

  • @@ -6284,6 +6450,31 @@ bool new_http_inspect.test_output = false: print out HTTP secti 219:60 (new_http_inspect) Format error in HTTP header

    • +
  • +

    +219:61 (new_http_inspect) Chunk header options present +

    +
    • +
  • +

    +219:62 (new_http_inspect) URI badly formatted +

    +
    • +
  • +

    +219:63 (new_http_inspect) URI bad port number +

    +
    • +
  • +

    +219:64 (new_http_inspect) HTTP chunk misformatted +

    +
    • +
  • +

    +219:65 (new_http_inspect) White space following chunk length +

    +
    • @@ -7116,375 +7307,708 @@ int port_scan_global.memcap = 1048576: maximum tracker memory {
    -

    smtp

    -

    What: smtp inspection

    +

    sip

    +

    What: sip inspection

    Type: inspector

    Configuration:

    • -string smtp.alt_max_command_line_len[].command: command string -

      -
      • -
    • -

      -int smtp.alt_max_command_line_len[].length = 0: specify non-default maximum for command { 0: } +bool sip.ignore_call_channel = false: enables the support for ignoring audio/video data channel

    • -string smtp.auth_cmds: commands that initiate an authentication exchange +int sip.max_call_id_len = 256: maximum call id field size { 0:65535 }

    • -string smtp.binary_data_cmds: commands that initiate sending of data and use a length value after the command +int sip.max_contact_len = 256: maximum contact field size { 0:65535 }

    • -int smtp.bitenc_decode_depth = 25: depth used to extract the non-encoded MIME attachments { -1:65535 } +int sip.max_content_len = 1024: maximum content length of the message body { 0:65535 }

    • -int smtp.b64_decode_depth = 25: depth used to decode the base64 encoded MIME attachments { -1:65535 } +int sip.max_dialogs = 4: maximum number of dialogs within one stream session { 1:4194303 }

    • -string smtp.data_cmds: commands that initiate sending of data with an end of data delimiter +int sip.max_from_len = 256: maximum from field size { 0:65535 }

    • -int smtp.email_hdrs_log_depth = 1464: depth for logging email headers { 0:20480 } +int sip.max_requestName_len = 20: maximum request name field size { 0:65535 }

    • -bool smtp.ignore_data = false: ignore data section of mail +int sip.max_sessions = 10000: maximum number of sessions that can be allocated { 1024:4194303 }

    • -bool smtp.ignore_tls_data = false: ignore TLS-encrypted data when processing rules +int sip.max_to_len = 256: maximum to field size { 0:65535 }

    • -string smtp.invalid_cmds: alert if this command is sent from client side +int sip.max_uri_len = 256: maximum request uri field size { 0:65535 }

    • -bool smtp.log_email_hdrs = false: log the SMTP email headers extracted from SMTP data +int sip.max_via_len = 1024: maximum via field size { 0:65535 }

    • -bool smtp.log_filename = false: log the MIME attachment filenames extracted from the Content-Disposition header within the MIME body +string sip.methods = invite cancel ack bye register options: list of methods to check in sip messages

      • +
    +

    Rules:

    +

    • -bool smtp.log_mailfrom = false: log the sender’s email address extracted from the MAIL FROM command +140:1 (sip) Maximum sessions reached

    • -bool smtp.log_rcptto = false: log the recipient’s email address extracted from the RCPT TO command +140:2 (sip) Empty request URI

    • -int smtp.max_command_line_len = 0: max Command Line Length { 0:65535 } +140:3 (sip) URI is too long

    • -int smtp.max_header_line_len = 0: max SMTP DATA header line { 0:65535 } +140:4 (sip) Empty call-Id

    • -int smtp.max_response_line_len = 0: max SMTP response line { 0:65535 } +140:5 (sip) Call-Id is too long

    • -enum smtp.normalize = none: turns on/off normalization { none | cmds | all } +140:6 (sip) CSeq number is too large or negative

    • -string smtp.normalize_cmds: list of commands to normalize +140:7 (sip) Request name in CSeq is too long

    • -int smtp.qp_decode_depth = 25: quoted-Printable decoding depth { -1:65535 } +140:8 (sip) Empty From header

    • -int smtp.uu_decode_depth = 25: unix-to-Unix decoding depth { -1:65535 } +140:9 (sip) From header is too long

    • -string smtp.valid_cmds: list of valid commands +140:10 (sip) Empty To header

    • -enum smtp.xlink2state = alert: enable/disable xlink2state alert { disable | alert | drop } +140:11 (sip) To header is too long

      • -
    -

    Rules:

    -

    • -124:1 (smtp) Attempted command buffer overflow +140:12 (sip) Empty Via header

    • -124:2 (smtp) Attempted data header buffer overflow +140:13 (sip) Via header is too long

    • -124:3 (smtp) Attempted response buffer overflow +140:14 (sip) Empty Contact

    • -124:4 (smtp) Attempted specific command buffer overflow +140:15 (sip) Contact is too long

    • -124:5 (smtp) Unknown command +140:16 (sip) Content length is too large or negative

    • -124:6 (smtp) Illegal command +140:17 (sip) Multiple SIP messages in a packet

    • -124:7 (smtp) Attempted header name buffer overflow +140:18 (sip) Content length mismatch

    • -124:8 (smtp) Attempted X-Link2State command buffer overflow +140:19 (sip) Request name is invalid

    • -124:10 (smtp) Base64 Decoding failed. +140:20 (sip) Invite replay attack

    • -124:11 (smtp) Quoted-Printable Decoding failed. +140:21 (sip) Illegal session information modification

    • -124:13 (smtp) Unix-to-Unix Decoding failed. +140:22 (sip) Response status code is not a 3 digit number

    • -124:14 (smtp) Cyrus SASL authentication attack. +140:23 (sip) Empty Content-type header

      • -
    -

    Peg counts:

    -

    • -smtp.packets: total packets +140:24 (sip) SIP version is invalid

      • -
    -
    -
    -

    ssh

    -

    What: ssh inspection

    -

    Type: inspector

    -

    Configuration:

    -

    • -int ssh.max_encrypted_packets = 25: ignore session after this many encrypted packets { 0:65535 } +140:25 (sip) Mismatch in METHOD of request and the CSEQ header

    • -int ssh.max_client_bytes = 19600: number of unanswered bytes before alerting on challenge-response overflow or CRC32 { 0:65535 } +140:26 (sip) Method is unknown

    • -int ssh.max_server_version_len = 80: limit before alerting on secure CRT server version string overflow { 0:255 } +140:27 (sip) Maximum dialogs within a session reached

    -

    Rules:

    +

    Peg counts:

    • -128:1 (ssh) Challenge-Response Overflow exploit +sip.sessions: total sessions

    • -128:2 (ssh) SSH1 CRC32 exploit +sip.events: events generated

    • -128:3 (ssh) Server version string overflow +sip.dialogs: total dialogs

    • -128:5 (ssh) Bad message direction +sip.ignored channels: total channels ignored

    • -128:6 (ssh) Payload size incorrect for the given payload +sip.ignored sessions: total sessions ignored

    • -128:7 (ssh) Failed to detect SSH version string +sip.requests: total requests

      • -
    -

    Peg counts:

    -

    • -ssh.packets: total packets +sip.responses: total responses

    -

    stream

    -

    What: common flow tracking

    +

    smtp

    +

    What: smtp inspection

    Type: inspector

    Configuration:

    • -int stream.icmp_cache.memcap = 0: maximum cache memory { 0: } +string smtp.alt_max_command_line_len[].command: command string

    • -int stream.icmp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +int smtp.alt_max_command_line_len[].length = 0: specify non-default maximum for command { 0: }

    • -int stream.icmp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +string smtp.auth_cmds: commands that initiate an authentication exchange

    • -int stream.icmp_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +string smtp.binary_data_cmds: commands that initiate sending of data and use a length value after the command

    • -int stream.ip_cache.memcap = 0: maximum cache memory { 0: } +int smtp.bitenc_decode_depth = 25: depth used to extract the non-encoded MIME attachments { -1:65535 }

    • -int stream.ip_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +int smtp.b64_decode_depth = 25: depth used to decode the base64 encoded MIME attachments { -1:65535 }

    • -int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +string smtp.data_cmds: commands that initiate sending of data with an end of data delimiter

    • -int stream.ip_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +int smtp.email_hdrs_log_depth = 1464: depth for logging email headers { 0:20480 }

    • -int stream.tcp_cache.memcap = 0: maximum cache memory { 0: } +bool smtp.ignore_data = false: ignore data section of mail

    • -int stream.tcp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +bool smtp.ignore_tls_data = false: ignore TLS-encrypted data when processing rules

    • -int stream.tcp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +string smtp.invalid_cmds: alert if this command is sent from client side

    • -int stream.tcp_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +bool smtp.log_email_hdrs = false: log the SMTP email headers extracted from SMTP data

    • -int stream.udp_cache.memcap = 0: maximum cache memory { 0: } +bool smtp.log_filename = false: log the MIME attachment filenames extracted from the Content-Disposition header within the MIME body

    • -int stream.udp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +bool smtp.log_mailfrom = false: log the sender’s email address extracted from the MAIL FROM command

    • -int stream.udp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +bool smtp.log_rcptto = false: log the recipient’s email address extracted from the RCPT TO command

    • -int stream.udp_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +int smtp.max_command_line_len = 0: max Command Line Length { 0:65535 }

      • -
    -

    Peg counts:

    -

    • -stream.ip flows: total ip sessions +int smtp.max_header_line_len = 0: max SMTP DATA header line { 0:65535 }

    • -stream.ip prunes: ip sessions pruned +int smtp.max_response_line_len = 0: max SMTP response line { 0:65535 }

    • -stream.icmp flows: total icmp sessions +enum smtp.normalize = none: turns on/off normalization { none | cmds | all }

    • -stream.icmp prunes: icmp sessions pruned +string smtp.normalize_cmds: list of commands to normalize +

      +
      • +
    • +

      +int smtp.qp_decode_depth = 25: quoted-Printable decoding depth { -1:65535 } +

      +
      • +
    • +

      +int smtp.uu_decode_depth = 25: unix-to-Unix decoding depth { -1:65535 } +

      +
      • +
    • +

      +string smtp.valid_cmds: list of valid commands +

      +
      • +
    • +

      +enum smtp.xlink2state = alert: enable/disable xlink2state alert { disable | alert | drop } +

      +
      • +
    +

    Rules:

    +
      +
    • +

      +124:1 (smtp) Attempted command buffer overflow +

      +
      • +
    • +

      +124:2 (smtp) Attempted data header buffer overflow +

      +
      • +
    • +

      +124:3 (smtp) Attempted response buffer overflow +

      +
      • +
    • +

      +124:4 (smtp) Attempted specific command buffer overflow +

      +
      • +
    • +

      +124:5 (smtp) Unknown command +

      +
      • +
    • +

      +124:6 (smtp) Illegal command +

      +
      • +
    • +

      +124:7 (smtp) Attempted header name buffer overflow +

      +
      • +
    • +

      +124:8 (smtp) Attempted X-Link2State command buffer overflow +

      +
      • +
    • +

      +124:10 (smtp) Base64 Decoding failed. +

      +
      • +
    • +

      +124:11 (smtp) Quoted-Printable Decoding failed. +

      +
      • +
    • +

      +124:13 (smtp) Unix-to-Unix Decoding failed. +

      +
      • +
    • +

      +124:14 (smtp) Cyrus SASL authentication attack. +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +smtp.packets: total packets +

      +
      • +
    +
    +
    +

    ssh

    +

    What: ssh inspection

    +

    Type: inspector

    +

    Configuration:

    +
      +
    • +

      +int ssh.max_encrypted_packets = 25: ignore session after this many encrypted packets { 0:65535 } +

      +
      • +
    • +

      +int ssh.max_client_bytes = 19600: number of unanswered bytes before alerting on challenge-response overflow or CRC32 { 0:65535 } +

      +
      • +
    • +

      +int ssh.max_server_version_len = 80: limit before alerting on secure CRT server version string overflow { 0:255 } +

      +
      • +
    +

    Rules:

    +
      +
    • +

      +128:1 (ssh) Challenge-Response Overflow exploit +

      +
      • +
    • +

      +128:2 (ssh) SSH1 CRC32 exploit +

      +
      • +
    • +

      +128:3 (ssh) Server version string overflow +

      +
      • +
    • +

      +128:5 (ssh) Bad message direction +

      +
      • +
    • +

      +128:6 (ssh) Payload size incorrect for the given payload +

      +
      • +
    • +

      +128:7 (ssh) Failed to detect SSH version string +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +ssh.packets: total packets +

      +
      • +
    +
    +
    +

    ssl

    +

    What: ssl inspection

    +

    Type: inspector

    +

    Configuration:

    +
      +
    • +

      +bool ssl.trust_servers = false: disables requirement that application (encrypted) data must be observed on both sides +

      +
      • +
    • +

      +int ssl.max_heartbeat_length = 0: maximum length of heartbeat record allowed { 0:65535 } +

      +
      • +
    +

    Rules:

    +
      +
    • +

      +137:1 (ssl) Invalid Client HELLO after Server HELLO Detected +

      +
      • +
    • +

      +137:2 (ssl) Invalid Server HELLO without Client HELLO Detected +

      +
      • +
    • +

      +137:3 (ssl) Heartbeat Read Overrun Attempt Detected +

      +
      • +
    • +

      +137:4 (ssl) Large Heartbeat Response Detected +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +ssl.packets: total packets +

      +
      • +
    +
    +
    +

    stream

    +

    What: common flow tracking

    +

    Type: inspector

    +

    Configuration:

    +
      +
    • +

      +int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 1: } +

      +
      • +
    • +

      +int stream.ip_cache.memcap = 23920640: maximum cache memory before pruning (0 is unlimited) { 0: } +

      +
      • +
    • +

      +int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

      +
      • +
    • +

      +int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

      +
      • +
    • +

      +int stream.icmp_cache.max_sessions = 32768: maximum simultaneous sessions tracked before pruning { 1: } +

      +
      • +
    • +

      +int stream.icmp_cache.memcap = 1048576: maximum cache memory before pruning (0 is unlimited) { 0: } +

      +
      • +
    • +

      +int stream.icmp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

      +
      • +
    • +

      +int stream.icmp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

      +
      • +
    • +

      +int stream.tcp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 1: } +

      +
      • +
    • +

      +int stream.tcp_cache.memcap = 268435456: maximum cache memory before pruning (0 is unlimited) { 0: } +

      +
      • +
    • +

      +int stream.tcp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

      +
      • +
    • +

      +int stream.tcp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

      +
      • +
    • +

      +int stream.udp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 1: } +

      +
      • +
    • +

      +int stream.udp_cache.memcap = 0: maximum cache memory before pruning (0 is unlimited) { 0: } +

      +
      • +
    • +

      +int stream.udp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

      +
      • +
    • +

      +int stream.udp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

      +
      • +
    • +

      +int stream.user_cache.max_sessions = 1024: maximum simultaneous sessions tracked before pruning { 1: } +

      +
      • +
    • +

      +int stream.user_cache.memcap = 1048576: maximum cache memory before pruning (0 is unlimited) { 0: } +

      +
      • +
    • +

      +int stream.user_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

      +
      • +
    • +

      +int stream.user_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

      +
      • +
    • +

      +int stream.file_cache.max_sessions = 128: maximum simultaneous sessions tracked before pruning { 1: } +

      +
      • +
    • +

      +int stream.file_cache.memcap = 0: maximum cache memory before pruning (0 is unlimited) { 0: } +

      +
      • +
    • +

      +int stream.file_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

      +
      • +
    • +

      +int stream.file_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +stream.ip flows: total ip sessions +

      +
      • +
    • +

      +stream.ip prunes: ip sessions pruned +

      +
      • +
    • +

      +stream.icmp flows: total icmp sessions +

      +
      • +
    • +

      +stream.icmp prunes: icmp sessions pruned

    • @@ -7805,11 +8329,6 @@ int stream_tcp.small_segments.maximum_size = 0: limit number of

    • -bit_list stream_tcp.small_segments.ignore_ports: limit number of small segments queued { 65535 } -

      -
      • -
    • -

      int stream_tcp.session_timeout = 30: session tracking timeout { 1:86400 }

      • @@ -9317,30 +9836,182 @@ implied sha512.relative = false: offset from cursor instead of int sid.~: signature id { 1: }

      -
    -
    -
    -

    so

    -

    What: rule option to call custom eval function

    -

    Type: ips_option

    -

    Configuration:

    -
      +
    +
    +
    +

    sip_body

    +

    What: rule option to set the detection cursor to the request body

    +

    Type: ips_option

    +
    +
    +

    sip_header

    +

    What: rule option to set the detection cursor to the SIP header buffer

    +

    Type: ips_option

    +
    +
    +

    sip_method

    +

    What: detection option for sip stat code

    +

    Type: ips_option

    +

    Configuration:

    +
      +
    • +

      +string sip_method.*method: sip method +

      +
      • +
    +
    +
    +

    sip_stat_code

    +

    What: detection option for sip stat code

    +

    Type: ips_option

    +

    Configuration:

    +
      +
    • +

      +int sip_stat_code.*code: stat code { 1:999 } +

      +
      • +
    +
    +
    +

    so

    +

    What: rule option to call custom eval function

    +

    Type: ips_option

    +

    Configuration:

    +
      +
    • +

      +string so.~func: name of eval function +

      +
      • +
    +
    +
    +

    soid

    +

    What: rule option to specify a shared object rule ID

    +

    Type: ips_option

    +

    Configuration:

    +
      +
    • +

      +string soid.~: SO rule ID has <gid>|<sid> format, like 3|12345 +

      +
      • +
    +
    +
    +

    ssl_state

    +

    What: detection option for ssl state

    +

    Type: ips_option

    +

    Configuration:

    +
      +
    • +

      +implied ssl_state.client_hello: check for client hello +

      +
      • +
    • +

      +implied ssl_state.server_hello: check for server hello +

      +
      • +
    • +

      +implied ssl_state.client_keyx: check for client keyx +

      +
      • +
    • +

      +implied ssl_state.server_keyx: check for server keyx +

      +
      • +
    • +

      +implied ssl_state.unknown: check for unknown record +

      +
      • +
    • +

      +implied ssl_state.!client_hello: check for records that are not client hello +

      +
      • +
    • +

      +implied ssl_state.!server_hello: check for records that are not server hello +

      +
      • +
    • +

      +implied ssl_state.!client_keyx: check for records that are not client keyx +

      +
      • +
    • +

      +implied ssl_state.!server_keyx: check for records that are not server keyx +

      +
      • +
    • +

      +implied ssl_state.!unknown: check for records that are not unknown +

      +
      • +
    +
    +
    +

    ssl_version

    +

    What: detection option for ssl version

    +

    Type: ips_option

    +

    Configuration:

    +
      +
    • +

      +implied ssl_version.sslv2: check for sslv2 +

      +
      • +
    • +

      +implied ssl_version.sslv3: check for sslv3 +

      +
      • +
    • +

      +implied ssl_version.tls1.0: check for tls1.0 +

      +
      • +
    • +

      +implied ssl_version.tls1.1: check for tls1.1 +

      +
      • +
    • +

      +implied ssl_version.tls1.2: check for tls1.2 +

      +
      • +
    • +

      +implied ssl_version.!sslv2: check for records that are not sslv2 +

      +
      • +
    • +

      +implied ssl_version.!sslv3: check for records that are not sslv3 +

      +
      • +
    • +

      +implied ssl_version.!tls1.0: check for records that are not tls1.0 +

      +

    • -string so.~func: name of eval function +implied ssl_version.!tls1.1: check for records that are not tls1.1

      • -
    -
    -
    -

    soid

    -

    What: rule option to specify a shared object rule ID

    -

    Type: ips_option

    -

    Configuration:

    -

    • -string soid.~: SO rule ID has <gid>|<sid> format, like 3|12345 +implied ssl_version.!tls1.2: check for records that are not tls1.2

    @@ -9663,6 +10334,11 @@ int log_hext.limit = 0: set limit (0 is unlimited) { 0: } enum log_hext.units = B: bytes | KB | MB | GB { B | K | M | G }

    +
  • +

    +int log_hext.width = 20: set line width (0 is unlimited) { 0: } +

    +
    • @@ -10798,7 +11474,7 @@ stream5_tcp: max_active_responses, min_response_seconds moved to
    -

    Rules

    +

    Rules

    • @@ -11059,14 +11735,14 @@ still under development.

    -

    Snort2Lua

    +

    Snort2Lua

    One of the major differences between Snort 2.9.X and Snort 3.0 is the configuration. Snort 2.9.X configuration files are written in Snort-specific syntax while Snort 3.0 configuration files are written in Lua. Snort2Lua is a program specifically designed to convert Snort 2.9.X configuration files into Lua files that Snort 3.0 can understand.

    -

    Snort2Lua reads your legacy Snort conf file(s) and generates Snort\++ Lua +

    Snort2Lua reads your legacy Snort conf file(s) and generates Snort++ Lua and rules files. When running this program, the only mandatory option is to provide Snort2Lua with a Snort configuration file. The default output file file is snort.lua, the default error file will be snort.rej, and the @@ -11115,7 +11791,7 @@ As expected, quiet mode produces a Snort++ configuration. All errors (aside from Fatal Snort2Lua errors), differences, and comments will omitted from the final output file. Default mode will print everything. That mean you will be able to see exactly what changes have occurred between Snort and -Snort\++ in addition to the new syntax, the original file’s comments, and +Snort++ in addition to the new syntax, the original file’s comments, and all errors that have occurred. Finally, differences mode will not actually output a valid Snort3.0 configuration. Instead, you can see the exact options from the input configuration that have changed.

    @@ -11495,9 +12171,9 @@ various other data and functions for their given roles.

    Modules

    -

    The Module is pervasive in Snort. It is how everything, including +

    The Module is pervasive in Snort+. It is how everything, including plugins, are configured. It also provides access to builtin rules. And as -the glue that binds functionality to Snort, the capabilities of a Module +the glue that binds functionality to Snort+, the capabilities of a Module are expected to grow to include statistics support, etc.

    Module configuration is handled by a list of Parameters. Most parameters can be validated by the framework, which means for example that conversion @@ -11976,6 +12652,15 @@ Declare functions as override if they are intended to override a parent signature.

    +
  • +

    +Use bool functions instead of int unless there is truly a need for + multiple error returns. The C-style use of zero for success and -1 for + error is less readable and often leads to messy code that either ignores + the various errors anyway or needlessly and ineffectively tries to do + something aobut them. +

    +
    • @@ -12429,12 +13114,12 @@ export SNORT_LUA_PATH=$my_path/etc/snort

    Dump the packets to stdout:

    -
    snort -r /path/to/my.pcap -K text
    +
    snort -r /path/to/my.pcap -L dump

    Dump packets with application data and layer 2 headers

    -
    snort -r /path/to/my.pcap -K text -d -e
    +
    snort -r /path/to/my.pcap -L dump -d -e
    @@ -12443,18 +13128,18 @@ export SNORT_LUA_PATH=$my_path/etc/snort +"snort -Ldump" will work.
    Command line options must be specified separately. "snort -de" won’t work. You can still concatenate options and their arguments, however, so -"snort -Ktext" will work.

    Dump packets from all pcaps in a directory:

    -
    snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K text -d -e
    +
    snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -d -e

    Log packets to a directory:

    -
    snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K pcap -l /path/to/log/dir
    +
    snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -l /path/to/log/dir
    @@ -13642,11 +14327,6 @@ int alerts.event_filter_memcap = 1048576: set available memory

  • -int alerts.flowbits_size = 1024: maximum number of allowed unique flowbits { 0:2048 } -

    -
    • -
  • -

    string alerts.order = pass drop alert log: change the order of rule action application

    • @@ -13742,7 +14422,7 @@ implied base64_decode.relative: Apply offset to cursor instead

  • -enum binder[].use.action = inspect: what to do with matching traffic { block | allow | inspect } +enum binder[].use.action = inspect: what to do with matching traffic { reset | block | allow | inspect }

  • @@ -15017,6 +15697,11 @@ enum log_hext.units = B: bytes | KB | MB | GB { B | K | M | G }

  • +int log_hext.width = 20: set line width (0 is unlimited) { 0: } +

    +
    • +
  • +

    int log_pcap.limit = 0: set limit (0 is unlimited) { 0: }

    • @@ -15782,7 +16467,7 @@ bool search_engine.enable_single_rule_group = false: put all ru

  • -bool search_engine.inspect_stream_inserts = true: inspect reassembled payload - disabling is good for performance, bad for detection +bool search_engine.inspect_stream_inserts = false: inspect reassembled payload - disabling is good for performance, bad for detection

  • @@ -15867,6 +16552,76 @@ int sid.~: signature id { 1: }

  • +bool sip.ignore_call_channel = false: enables the support for ignoring audio/video data channel +

    +
    • +
  • +

    +int sip.max_call_id_len = 256: maximum call id field size { 0:65535 } +

    +
    • +
  • +

    +int sip.max_contact_len = 256: maximum contact field size { 0:65535 } +

    +
    • +
  • +

    +int sip.max_content_len = 1024: maximum content length of the message body { 0:65535 } +

    +
    • +
  • +

    +int sip.max_dialogs = 4: maximum number of dialogs within one stream session { 1:4194303 } +

    +
    • +
  • +

    +int sip.max_from_len = 256: maximum from field size { 0:65535 } +

    +
    • +
  • +

    +int sip.max_requestName_len = 20: maximum request name field size { 0:65535 } +

    +
    • +
  • +

    +int sip.max_sessions = 10000: maximum number of sessions that can be allocated { 1024:4194303 } +

    +
    • +
  • +

    +int sip.max_to_len = 256: maximum to field size { 0:65535 } +

    +
    • +
  • +

    +int sip.max_uri_len = 256: maximum request uri field size { 0:65535 } +

    +
    • +
  • +

    +int sip.max_via_len = 1024: maximum via field size { 0:65535 } +

    +
    • +
  • +

    +string sip.methods = invite cancel ack bye register options: list of methods to check in sip messages +

    +
    • +
  • +

    +string sip_method.*method: sip method +

    +
    • +
  • +

    +int sip_stat_code.*code: stat code { 1:999 } +

    +
    • +
  • +

    string smtp.alt_max_command_line_len[].command: command string

    • @@ -16577,17 +17332,147 @@ int ssh.max_server_version_len = 80: limit before alerting on s

  • -int stream.icmp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +int ssl.max_heartbeat_length = 0: maximum length of heartbeat record allowed { 0:65535 } +

    +
    • +
  • +

    +bool ssl.trust_servers = false: disables requirement that application (encrypted) data must be observed on both sides +

    +
    • +
  • +

    +implied ssl_state.!client_hello: check for records that are not client hello +

    +
    • +
  • +

    +implied ssl_state.!client_keyx: check for records that are not client keyx +

    +
    • +
  • +

    +implied ssl_state.!server_hello: check for records that are not server hello +

    +
    • +
  • +

    +implied ssl_state.!server_keyx: check for records that are not server keyx +

    +
    • +
  • +

    +implied ssl_state.!unknown: check for records that are not unknown +

    +
    • +
  • +

    +implied ssl_state.client_hello: check for client hello +

    +
    • +
  • +

    +implied ssl_state.client_keyx: check for client keyx +

    +
    • +
  • +

    +implied ssl_state.server_hello: check for server hello +

    +
    • +
  • +

    +implied ssl_state.server_keyx: check for server keyx +

    +
    • +
  • +

    +implied ssl_state.unknown: check for unknown record +

    +
    • +
  • +

    +implied ssl_version.!sslv2: check for records that are not sslv2 +

    +
    • +
  • +

    +implied ssl_version.!sslv3: check for records that are not sslv3 +

    +
    • +
  • +

    +implied ssl_version.!tls1.0: check for records that are not tls1.0 +

    +
    • +
  • +

    +implied ssl_version.!tls1.1: check for records that are not tls1.1 +

    +
    • +
  • +

    +implied ssl_version.!tls1.2: check for records that are not tls1.2 +

    +
    • +
  • +

    +implied ssl_version.sslv2: check for sslv2 +

    +
    • +
  • +

    +implied ssl_version.sslv3: check for sslv3 +

    +
    • +
  • +

    +implied ssl_version.tls1.0: check for tls1.0 +

    +
    • +
  • +

    +implied ssl_version.tls1.1: check for tls1.1 +

    +
    • +
  • +

    +implied ssl_version.tls1.2: check for tls1.2 +

    +
    • +
  • +

    +int stream.file_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

    +
    • +
  • +

    +int stream.file_cache.max_sessions = 128: maximum simultaneous sessions tracked before pruning { 1: } +

    +
    • +
  • +

    +int stream.file_cache.memcap = 0: maximum cache memory before pruning (0 is unlimited) { 0: } +

    +
    • +
  • +

    +int stream.file_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

    +
    • +
  • +

    +int stream.icmp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.icmp_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +int stream.icmp_cache.max_sessions = 32768: maximum simultaneous sessions tracked before pruning { 1: }

  • -int stream.icmp_cache.memcap = 0: maximum cache memory { 0: } +int stream.icmp_cache.memcap = 1048576: maximum cache memory before pruning (0 is unlimited) { 0: }

  • @@ -16597,17 +17482,17 @@ int stream.icmp_cache.pruning_timeout = 30: minimum inactive ti

  • -int stream.ip_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.ip_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 1: }

  • -int stream.ip_cache.memcap = 0: maximum cache memory { 0: } +int stream.ip_cache.memcap = 23920640: maximum cache memory before pruning (0 is unlimited) { 0: }

  • @@ -16617,17 +17502,17 @@ int stream.ip_cache.pruning_timeout = 30: minimum inactive time

  • -int stream.tcp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +int stream.tcp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.tcp_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +int stream.tcp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 1: }

  • -int stream.tcp_cache.memcap = 0: maximum cache memory { 0: } +int stream.tcp_cache.memcap = 268435456: maximum cache memory before pruning (0 is unlimited) { 0: }

  • @@ -16637,17 +17522,17 @@ int stream.tcp_cache.pruning_timeout = 30: minimum inactive tim

  • -int stream.udp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: } +int stream.udp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.udp_cache.max_sessions = 262144: maximum simultaneous tcp sessions tracked before pruning { 0: } +int stream.udp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 1: }

  • -int stream.udp_cache.memcap = 0: maximum cache memory { 0: } +int stream.udp_cache.memcap = 0: maximum cache memory before pruning (0 is unlimited) { 0: }

  • @@ -16657,6 +17542,26 @@ int stream.udp_cache.pruning_timeout = 30: minimum inactive tim

  • +int stream.user_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

    +
    • +
  • +

    +int stream.user_cache.max_sessions = 1024: maximum simultaneous sessions tracked before pruning { 1: } +

    +
    • +
  • +

    +int stream.user_cache.memcap = 1048576: maximum cache memory before pruning (0 is unlimited) { 0: } +

    +
    • +
  • +

    +int stream.user_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

    +
    • +
  • +

    bool stream_file.upload = false: indicate file transfer direction

    • @@ -16797,11 +17702,6 @@ int stream_tcp.small_segments.count = 0: limit number of small

  • -bit_list stream_tcp.small_segments.ignore_ports: limit number of small segments queued { 65535 } -

    -
    • -
  • -

    int stream_tcp.small_segments.maximum_size = 0: limit number of small segments queued { 0:2048 }

    • @@ -17027,6 +17927,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +binder.resets: reset bindings +

    +
    • +
  • +

    daq.allow: total allow verdicts

    • @@ -17132,37 +18037,82 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +detection.alt searches: alt fast pattern searches in packet data +

    +
    • +
  • +

    detection.analyzed: packets sent to detection

  • +detection.body searches: fast pattern searches in body buffer +

    +
    • +
  • +

    +detection.cooked searches: fast pattern searches in cooked packet data +

    +
    • +
  • +

    detection.event limit: events filtered

  • -detection.log limit: events queued but not logged +detection.file searches: fast pattern searches in file buffer +

    +
    • +
  • +

    +detection.header searches: fast pattern searches in header buffer +

    +
    • +
  • +

    +detection.key searches: fast pattern searches in key buffer +

    +
    • +
  • +

    +detection.log limit: events queued but not logged +

    +
    • +
  • +

    +detection.logged: logged packets +

    +
    • +
  • +

    +detection.match limit: fast pattern matches not processed +

    +
    • +
  • +

    +detection.passed: passed packets

  • -detection.logged: logged packets +detection.pkt searches: fast pattern searches in packet data

  • -detection.match limit: fast pattern matches not processed +detection.queue limit: events not queued because queue full

  • -detection.passed: passed packets +detection.raw searches: fast pattern searches in raw packet data

  • -detection.queue limit: events not queued because queue full +detection.slow searches: non-fast pattern rule evaluations

  • @@ -17612,6 +18562,41 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +sip.dialogs: total dialogs +

    +
    • +
  • +

    +sip.events: events generated +

    +
    • +
  • +

    +sip.ignored channels: total channels ignored +

    +
    • +
  • +

    +sip.ignored sessions: total sessions ignored +

    +
    • +
  • +

    +sip.requests: total requests +

    +
    • +
  • +

    +sip.responses: total responses +

    +
    • +
  • +

    +sip.sessions: total sessions +

    +
    • +
  • +

    smtp.packets: total packets

    • @@ -17652,6 +18637,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +ssl.packets: total packets +

    +
    • +
  • +

    stream.file flows: total file sessions

    • @@ -18187,6 +19177,16 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +137: ssl +

    +
    • +
  • +

    +140: sip +

    +
    • +
  • +

    141: imap

    • @@ -19767,6 +20767,161 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +137:1 (ssl) Invalid Client HELLO after Server HELLO Detected +

    +
    • +
  • +

    +137:2 (ssl) Invalid Server HELLO without Client HELLO Detected +

    +
    • +
  • +

    +137:3 (ssl) Heartbeat Read Overrun Attempt Detected +

    +
    • +
  • +

    +137:4 (ssl) Large Heartbeat Response Detected +

    +
    • +
  • +

    +140:1 (sip) Maximum sessions reached +

    +
    • +
  • +

    +140:2 (sip) Empty request URI +

    +
    • +
  • +

    +140:3 (sip) URI is too long +

    +
    • +
  • +

    +140:4 (sip) Empty call-Id +

    +
    • +
  • +

    +140:5 (sip) Call-Id is too long +

    +
    • +
  • +

    +140:6 (sip) CSeq number is too large or negative +

    +
    • +
  • +

    +140:7 (sip) Request name in CSeq is too long +

    +
    • +
  • +

    +140:8 (sip) Empty From header +

    +
    • +
  • +

    +140:9 (sip) From header is too long +

    +
    • +
  • +

    +140:10 (sip) Empty To header +

    +
    • +
  • +

    +140:11 (sip) To header is too long +

    +
    • +
  • +

    +140:12 (sip) Empty Via header +

    +
    • +
  • +

    +140:13 (sip) Via header is too long +

    +
    • +
  • +

    +140:14 (sip) Empty Contact +

    +
    • +
  • +

    +140:15 (sip) Contact is too long +

    +
    • +
  • +

    +140:16 (sip) Content length is too large or negative +

    +
    • +
  • +

    +140:17 (sip) Multiple SIP messages in a packet +

    +
    • +
  • +

    +140:18 (sip) Content length mismatch +

    +
    • +
  • +

    +140:19 (sip) Request name is invalid +

    +
    • +
  • +

    +140:20 (sip) Invite replay attack +

    +
    • +
  • +

    +140:21 (sip) Illegal session information modification +

    +
    • +
  • +

    +140:22 (sip) Response status code is not a 3 digit number +

    +
    • +
  • +

    +140:23 (sip) Empty Content-type header +

    +
    • +
  • +

    +140:24 (sip) SIP version is invalid +

    +
    • +
  • +

    +140:25 (sip) Mismatch in METHOD of request and the CSEQ header +

    +
    • +
  • +

    +140:26 (sip) Method is unknown +

    +
    • +
  • +

    +140:27 (sip) Maximum dialogs within a session reached +

    +
    • +
  • +

    141:1 (imap) Unknown IMAP3 command

    • @@ -20077,7 +21232,7 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -219:53 (new_http_inspect) Input apparently not HTTP +219:53 (new_http_inspect) Chunk length has excessive leading zeros

  • @@ -20117,6 +21272,31 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +219:61 (new_http_inspect) Chunk header options present +

    +
    • +
  • +

    +219:62 (new_http_inspect) URI badly formatted +

    +
    • +
  • +

    +219:63 (new_http_inspect) URI bad port number +

    +
    • +
  • +

    +219:64 (new_http_inspect) HTTP chunk misformatted +

    +
    • +
  • +

    +219:65 (new_http_inspect) White space following chunk length +

    +
    • +
  • +

    256:1 (dpx) too much data sent to port

    • @@ -20363,8 +21543,10 @@ change -> rule_state: 'disabled' ==> 'enable' change -> rule_state: 'enabled' ==> 'enable' change -> sfportscan: 'proto' ==> 'protos' change -> sfportscan: 'scan_type' ==> 'scan_types' +change -> sip: 'ports' ==> 'bindings' change -> smtp: 'ports' ==> 'bindings' change -> ssh: 'server_ports' ==> 'bindings' +change -> ssl: 'ports' ==> 'bindings' change -> stream5_global: 'max_active_responses' ==> 'max_responses' change -> stream5_global: 'max_icmp' ==> 'max_sessions' change -> stream5_global: 'max_ip' ==> 'max_sessions' @@ -20451,6 +21633,7 @@ deleted -> config ' flexresp2_attempts' deleted -> config ' flexresp2_interface' deleted -> config ' flexresp2_memcap' deleted -> config ' flexresp2_rows' +deleted -> config ' flowbits_size' deleted -> config ' include_vlan_in_alerts' deleted -> config ' interface' deleted -> config ' layer2resets' @@ -20492,6 +21675,7 @@ deleted -> rule_state: 'action' deleted -> sfportscan: 'detect_ack_scans' deleted -> sfportscan: 'disabled' deleted -> sfportscan: 'logfile' +deleted -> sip: 'disabled' deleted -> smtp: 'alert_unknown_cmds' deleted -> smtp: 'disabled' deleted -> smtp: 'enable_mime_decoding' @@ -20509,6 +21693,7 @@ deleted -> ssh: 'enable_recognition' deleted -> ssh: 'enable_respoverflow' deleted -> ssh: 'enable_srvoverflow' deleted -> ssh: 'enable_ssh1crc32' +deleted -> ssl: 'noinspect_encrypted' deleted -> stream5_global: 'disabled' deleted -> stream5_global: 'flush_on_alert' deleted -> stream5_global: 'no_midstream_drop_alerts' @@ -21158,6 +22343,31 @@ deleted -> unified2: 'filename'

  • +sip (inspector): sip inspection +

    +
    • +
  • +

    +sip_body (ips_option): rule option to set the detection cursor to the request body +

    +
    • +
  • +

    +sip_header (ips_option): rule option to set the detection cursor to the SIP header buffer +

    +
    • +
  • +

    +sip_method (ips_option): detection option for sip stat code +

    +
    • +
  • +

    +sip_stat_code (ips_option): detection option for sip stat code +

    +
    • +
  • +

    smtp (inspector): smtp inspection

    • @@ -21183,6 +22393,21 @@ deleted -> unified2: 'filename'

  • +ssl (inspector): ssl inspection +

    +
    • +
  • +

    +ssl_state (ips_option): detection option for ssl state +

    +
    • +
  • +

    +ssl_version (ips_option): detection option for ssl version +

    +
    • +
  • +

    stream (inspector): common flow tracking

    • @@ -21633,6 +22858,11 @@ deleted -> unified2: 'filename'

  • +inspector::sip: sip inspection +

    +
    • +
  • +

    inspector::smtp: smtp inspection

    • @@ -21643,6 +22873,11 @@ deleted -> unified2: 'filename'

  • +inspector::ssl: ssl inspection +

    +
    • +
  • +

    inspector::stream: common flow tracking

    • @@ -21978,6 +23213,26 @@ deleted -> unified2: 'filename'

  • +ips_option::sip_body: rule option to set the detection cursor to the request body +

    +
    • +
  • +

    +ips_option::sip_header: rule option to set the detection cursor to the SIP header buffer +

    +
    • +
  • +

    +ips_option::sip_method: detection option for sip stat code +

    +
    • +
  • +

    +ips_option::sip_stat_code: detection option for sip stat code +

    +
    • +
  • +

    ips_option::so: rule option to call custom eval function

    • @@ -21988,6 +23243,16 @@ deleted -> unified2: 'filename'

  • +ips_option::ssl_state: detection option for ssl state +

    +
    • +
  • +

    +ips_option::ssl_version: detection option for ssl version +

    +
    • +
  • +

    ips_option::stream_reassemble: detection option for stream reassembly control

    • @@ -22140,7 +23405,7 @@ deleted -> unified2: 'filename'
    diff --git a/doc/default_snort_manual.pdf b/doc/default_snort_manual.pdf index 4b231bb7b..910bc6f6e 100644 Binary files a/doc/default_snort_manual.pdf and b/doc/default_snort_manual.pdf differ diff --git a/doc/default_snort_manual.text b/doc/default_snort_manual.text index b19bc90ad..ffc43775f 100644 --- a/doc/default_snort_manual.text +++ b/doc/default_snort_manual.text @@ -29,6 +29,7 @@ Table of Contents 2.5. Help 2.6. Common Errors 2.7. Gotchas + 2.8. Bugs 3. Basic Modules @@ -78,123 +79,155 @@ Table of Contents 4.17. pgm 4.18. pppoe 4.19. tcp - 4.20. udp - 4.21. vlan - 4.22. wlan - -5. Data Modules -6. Inspector Modules - - 6.1. arp_spoof - 6.2. back_orifice - 6.3. binder - 6.4. dns - 6.5. ftp_client - 6.6. ftp_data - 6.7. ftp_server - 6.8. http_global - 6.9. http_inspect - 6.10. imap - 6.11. new_http_inspect - 6.12. normalizer - 6.13. perf_monitor - 6.14. pop - 6.15. port_scan - 6.16. port_scan_global - 6.17. rpc_decode - 6.18. ssh - 6.19. stream - 6.20. stream_icmp - 6.21. stream_ip - 6.22. stream_tcp - 6.23. stream_udp - 6.24. telnet - 6.25. wizard - -7. IPS Action Modules - - 7.1. react - 7.2. reject - 7.3. rewrite - -8. IPS Option Modules - - 8.1. ack - 8.2. asn1 - 8.3. base64_decode - 8.4. bufferlen - 8.5. byte_extract - 8.6. byte_jump - 8.7. byte_test - 8.8. classtype - 8.9. content - 8.10. cvs - 8.11. detection_filter - 8.12. dsize - 8.13. file_data - 8.14. flags - 8.15. flow - 8.16. flowbits - 8.17. fragbits - 8.18. fragoffset - 8.19. gid - 8.20. http_client_body - 8.21. http_cookie - 8.22. http_header - 8.23. http_method - 8.24. http_raw_cookie - 8.25. http_raw_header - 8.26. http_raw_uri - 8.27. http_stat_code - 8.28. http_stat_msg - 8.29. http_uri - 8.30. icmp_id - 8.31. icmp_seq - 8.32. icode - 8.33. id - 8.34. ip_proto - 8.35. ipopts - 8.36. isdataat - 8.37. itype - 8.38. md5 - 8.39. metadata - 8.40. msg - 8.41. pcre - 8.42. pkt_data - 8.43. priority - 8.44. raw_data - 8.45. reference - 8.46. rem - 8.47. replace - 8.48. rev - 8.49. rpc - 8.50. seq - 8.51. session - 8.52. sha256 - 8.53. sha512 - 8.54. sid - 8.55. so - 8.56. soid - 8.57. stream_reassemble - 8.58. stream_size - 8.59. tag - 8.60. tos - 8.61. ttl - 8.62. window - -9. Search Engine Modules -10. SO Rule Modules -11. Logger Modules - - 11.1. alert_csv - 11.2. alert_fast - 11.3. alert_full - 11.4. alert_syslog - 11.5. alert_test - 11.6. alert_unixsock - 11.7. log_codecs - 11.8. log_pcap - 11.9. unified2 + 4.20. token_ring + 4.21. udp + 4.22. vlan + 4.23. wlan + +5. Inspector Modules + + 5.1. arp_spoof + 5.2. back_orifice + 5.3. binder + 5.4. data_log + 5.5. dns + 5.6. dpx + 5.7. ftp_client + 5.8. ftp_data + 5.9. ftp_server + 5.10. http_global + 5.11. http_inspect + 5.12. imap + 5.13. new_http_inspect + 5.14. normalizer + 5.15. perf_monitor + 5.16. pop + 5.17. port_scan + 5.18. port_scan_global + 5.19. rpc_decode + 5.20. sip + 5.21. smtp + 5.22. ssh + 5.23. ssl + 5.24. stream + 5.25. stream_file + 5.26. stream_icmp + 5.27. stream_ip + 5.28. stream_tcp + 5.29. stream_udp + 5.30. stream_user + 5.31. telnet + 5.32. wizard + +6. IPS Action Modules + + 6.1. react + 6.2. reject + 6.3. rewrite + +7. IPS Option Modules + + 7.1. ack + 7.2. asn1 + 7.3. base64_decode + 7.4. bufferlen + 7.5. byte_extract + 7.6. byte_jump + 7.7. byte_test + 7.8. classtype + 7.9. content + 7.10. cvs + 7.11. detection_filter + 7.12. dsize + 7.13. file_data + 7.14. flags + 7.15. flow + 7.16. flowbits + 7.17. fragbits + 7.18. fragoffset + 7.19. gid + 7.20. http_client_body + 7.21. http_cookie + 7.22. http_header + 7.23. http_method + 7.24. http_raw_cookie + 7.25. http_raw_header + 7.26. http_raw_uri + 7.27. http_stat_code + 7.28. http_stat_msg + 7.29. http_uri + 7.30. icmp_id + 7.31. icmp_seq + 7.32. icode + 7.33. id + 7.34. ip_proto + 7.35. ipopts + 7.36. isdataat + 7.37. itype + 7.38. md5 + 7.39. metadata + 7.40. msg + 7.41. pcre + 7.42. pkt_data + 7.43. priority + 7.44. raw_data + 7.45. reference + 7.46. rem + 7.47. replace + 7.48. rev + 7.49. rpc + 7.50. seq + 7.51. session + 7.52. sha256 + 7.53. sha512 + 7.54. sid + 7.55. sip_body + 7.56. sip_header + 7.57. sip_method + 7.58. sip_stat_code + 7.59. so + 7.60. soid + 7.61. ssl_state + 7.62. ssl_version + 7.63. stream_reassemble + 7.64. stream_size + 7.65. tag + 7.66. tos + 7.67. ttl + 7.68. urg + 7.69. window + +8. Search Engine Modules +9. SO Rule Modules +10. Logger Modules + + 10.1. alert_csv + 10.2. alert_ex + 10.3. alert_fast + 10.4. alert_full + 10.5. alert_syslog + 10.6. alert_unixsock + 10.7. log_codecs + 10.8. log_hext + 10.9. log_pcap + 10.10. unified2 + +11. DAQ Modules + + 11.1. Building the DAQ Library and DAQ Modules + 11.2. PCAP Module + 11.3. AFPACKET Module + 11.4. NFQ Module + 11.5. IPQ Module + 11.6. IPFW Module + 11.7. Dump Module + 11.8. Netmap Module + 11.9. Notes on iptables + 11.10. Notes on FreeBSD::IPFW + 11.11. Notes on OpenBSD::IPFW + 11.12. Socket Module + 11.13. File Module + 11.14. Hext Module 12. Snort++ vs Snort @@ -211,30 +244,51 @@ Table of Contents 13.2. Known Problems 13.3. Usage -14. Reference - - 14.1. Terminology - 14.2. Usage - 14.3. Plugins - 14.4. Output Files - 14.5. Optional Features - 14.6. Environment Variables - 14.7. Command Line Options - 14.8. Parameters - 14.9. Configuration - 14.10. Counts - 14.11. Generators - 14.12. Builtin Rules - 14.13. Command Set - 14.14. Signals - 14.15. Configuration Changes - 14.16. Module Listing - 14.17. Extending Snort++ +14. Extending Snort++ + + 14.1. Plugins + 14.2. Modules + 14.3. Inspectors + 14.4. Codecs + 14.5. IPS Actions + +15. Coding Style + + 15.1. General + 15.2. Naming + 15.3. Comments + 15.4. Logging + 15.5. Types + 15.6. Macros (aka defines) + 15.7. Formatting + 15.8. Headers + 15.9. Warnings + 15.10. Other + 15.11. Uncrustify + +16. Reference + + 16.1. Terminology + 16.2. Usage + 16.3. Plugins + 16.4. Output Files + 16.5. Optional Features + 16.6. Environment Variables + 16.7. Command Line Options + 16.8. Parameters + 16.9. Configuration + 16.10. Counts + 16.11. Generators + 16.12. Builtin Rules + 16.13. Command Set + 16.14. Signals + 16.15. Configuration Changes + 16.16. Module Listing Snorty ,,_ -*> Snort++ <*- -o" )~ Version 3.0.0-a1 (Build 150) from 2.9.7-177 +o" )~ Version 3.0.0-a1 (Build 160) from 2.9.7-177 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved. @@ -571,11 +625,11 @@ pass some HTTP and SIP preprocessor data to app ID. However, it remains a peripheral feature and still requires the production of data that may not be consumed. -The basic processing steps Snort takes are similar to Snort’s as seen -in the following diagram. The preprocess step employs specific +The basic processing steps Snort++ takes are similar to Snort’s as +seen in the following diagram. The preprocess step employs specific inspector types instead of a generalized list, but the basic procedure includes stateless packet decoding, TCP stream reassembly, -and service specific analysis in both cases. (Snort provides hooks +and service specific analysis in both cases. (Snort++ provides hooks for arbitrary inspectors, but they are not central to basic flow processing and are not shown.) @@ -600,8 +654,9 @@ configuration, you will get a simple URI logger. Inspection events coupled with pluggable inspectors provide a very flexible framework for implementing new features. And JIT buffer -stuffers allow Snort to work smarter, not harder. These capabilities -will be leveraged more and more as Snort development continues. +stuffers allow Snort++ to work smarter, not harder. These +capabilities will be leveraged more and more as Snort++ development +continues. --------------------------------------------------------------------- @@ -636,11 +691,15 @@ Optional: * asciidoc from http://www.methods.co.nz/asciidoc/ to build the HTML manual + * check from http://check.sourceforge.net to build unit tests * dblatex from http://dblatex.sourceforge.net to build the pdf manual (in addition to asciidoc) + * lzma from http://www.7-zip.org/sdk.html for decompression of SWF + fles. + * openssl from https://www.openssl.org for SHA and MD5 file + signatures and the protected_content rule option. * w3m from http://sourceforge.net/projects/w3m/ to build the plain text manual - * check from http://check.sourceforge.net to build unit tests 2.2. Building @@ -689,6 +748,10 @@ Optional: ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/Snort++/tree run eclipse and do File > Import > Existing Eclipse Project + * To build with clang++ on OS X with gcc installed, do this first: + + export CXX=clang++ + 2.3. Run @@ -953,6 +1016,66 @@ WARNING: unknown symbol x EXTERNAL_NET = '!' .. MY_SERVERS +2.8. Bugs + +------------ + +2.8.1. Build + + * configure bombs on OSX with g++ wrapper to clang because g + version < 4.8 (compare g\ -dumpversion and g++ --version) + + workaround: export CXX=clang++ + + * export CXX=clang++ to build with clang; coughs up these warnings: + + Wunused-but-set-variable is not understood by clang + clang: warning: argument unused during compilation: '-pthread' + + * Cmake doc/ has a problem when SNORT_PLUGIN_PATH is set to get + extras included in the manual. + * Making in doc/ may fail complaining something about xmllint. Just + make again and it will succeed. Appears to be an unknown + dependency but it works for me! + +2.8.2. Config + + * Parsing issue with IP lists. can’t parse rules with $EXTERNAL_NET + defined as below because or the space between ! and 10. + + HOME_NET = [[ 10.0.17.0/24 10.0.14.0/24 10.247.0.0/16 10.246.0.0/16 ]] + EXTERNAL_NET = '! ' .. HOME_NET + + * Multiple versions of luajit scripts are not handled correctly. + The first loaded version will always be executed even though + plugin manager saves the correct version. + +2.8.3. Rules + + * metdata:service foo; metadata:service foo; won’t cause a + duplicate service warning as does metadata:service foo, service + foo; + * ip_proto doesn’t work properly with reassembled packets so it + can’t be used to restrict the protocol of service rules. + +2.8.4. snort2lua + + * uricontent:"foo"; content:"bar"; → http_uri; content:"foo"; + content:"bar"; (missing pkt_data) + * stream_tcp ports and protocols both go into a single binder.when; + this is incorrect as the when fields are logically anded together + (ie must all be true). should create 2 separate bindings. + * There is a bug in pps_stream_tcp.cc.. when stream_tcp: is + specified without any arguments, snort2lua doesn’t convert it + * Loses the ip list delimiters [ ]; change to ( ) + + in snort.conf: var HOME_NET [A,B,C] + in snort.lua: HOME_NET = [[A B C]] + + * Won’t convert packet rules (alert tcp etc.) to service rules + (alert http etc.). + + --------------------------------------------------------------------- 3. Basic Modules @@ -1001,8 +1124,6 @@ Configuration: memory for filters { 0: } * int alerts.event_filter_memcap = 1048576: set available memory for filters { 0: } - * int alerts.flowbits_size = 1024: maximum number of allowed unique - flowbits { 0:2048 } * string alerts.order = pass drop alert log: change the order of rule action application * int alerts.rate_filter_memcap = 1048576: set available memory for @@ -1074,7 +1195,7 @@ Configuration: Peg counts: - * daq.pcaps: total files processed + * daq.pcaps: total files and interfaces processed * daq.received: total packets received from DAQ * daq.analyzed: total packets analyzed from DAQ * daq.dropped: packets dropped @@ -1136,6 +1257,16 @@ Configuration: Peg counts: * detection.analyzed: packets sent to detection + * detection.slow searches: non-fast pattern rule evaluations + * detection.raw searches: fast pattern searches in raw packet data + * detection.cooked searches: fast pattern searches in cooked packet + data + * detection.pkt searches: fast pattern searches in packet data + * detection.alt searches: alt fast pattern searches in packet data + * detection.key searches: fast pattern searches in key buffer + * detection.header searches: fast pattern searches in header buffer + * detection.body searches: fast pattern searches in body buffer + * detection.file searches: fast pattern searches in file buffer * detection.alerts: alerts not including IP reputation * detection.total alerts: alerts including IP reputation * detection.logged: logged packets @@ -1220,6 +1351,11 @@ Configuration: * string file_id.file_rules[].magic[].content: file magic content * int file_id.file_rules[].magic[].offset = 0: file magic offset { 0: } + * bool file_id.trace_type = false: enable runtime dump of type info + * bool file_id.trace_signature = false: enable runtime dump of + signature info + * bool file_id.trace_stream = false: enable runtime dump of file + data 3.11. hosts @@ -1318,8 +1454,6 @@ Configuration: * bool output.quiet = false: suppress non-fatal information (still show alerts, same as -q) * string output.logdir = .: where to put log files (same as -l) - * bool output.nolog = false: turn off logging (alerts still work, - same as -N) * bool output.obfuscate = false: obfuscate the logged IP addresses (same as -O) * bool output.show_year = false: include year in timestamp in the @@ -1522,8 +1656,9 @@ Configuration: compiling into state machine (0 means no maximum) { 0: } * int search_engine.max_queue_events = 5: maximum number of matching fast pattern states to queue per packet - * bool search_engine.no_stream_inserts = false: don’t inspect - reassembled payload - good for performance, bad for detection + * bool search_engine.inspect_stream_inserts = false: inspect + reassembled payload - disabling is good for performance, bad for + detection * string search_engine.search_method = ac_bnfa_q: set fast pattern algorithm - choose available search engine * bool search_engine.split_any_any = false: evaluate any-any rules @@ -1561,15 +1696,14 @@ Configuration: * implied snort.-H: make hash tables deterministic * string snort.-i: … list of interfaces * port snort.-j: to listen for telnet connections - * select snort.-K = none: logging mode { none|text|pcap } * enum snort.-k = all: checksum mode (all,noip,notcp,noudp,noicmp,none) { all|noip|notcp|noudp|noicmp| none } + * string snort.-L: logging mode (none, dump, pcap, or log_*) * string snort.-l: log to this directory instead of current directory * implied snort.-M: log messages to syslog (not alerts) * int snort.-m: set umask = { 0: } - * implied snort.-N: ignored - for REG_TEST only * int snort.-n: stop after count packets { 0: } * implied snort.-O: obfuscate the logged IP addresses * implied snort.-Q: enable inline mode operation @@ -1578,7 +1712,7 @@ Configuration: * string snort.-R: include this rules file in the default policy * string snort.-r: … (same as --pcap-list) - * string snort.-S: set rules file variable n equal to value v + * string snort.-S: set config variable x equal to value v * int snort.-s = 1514: (same as --snaplen) { 68:65535 } * implied snort.-T: test and report on the current Snort configuration @@ -1597,7 +1731,7 @@ Configuration: * implied snort.-y: include year in timestamp in the alert and log files * int snort.-z = 1: maximum number of packet threads (same - as --max-packet-threads) 0 gets the number of CPU cores reported + as --max-packet-threads); 0 gets the number of CPU cores reported by the system { 0: } * implied snort.--alert-before-pass: process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,… @@ -1660,8 +1794,7 @@ Configuration: for multiple snorts (same as -G) { 0:65535 } * implied snort.--markup: output help in asciidoc compatible format * int snort.--max-packet-threads = 1: configure maximum - number of packet threads (same as -z) 0 gets the number of CPU - cores reported by the system { 0: } + number of packet threads (same as -z) { 0: } * implied snort.--nostamps: don’t include timestamps in log file names * implied snort.--nolock-pidfile: do not try to lock Snort PID file @@ -1681,7 +1814,6 @@ Configuration: getting pcaps from file or directory * implied snort.--pcap-reload: if reading multiple pcaps, reload snort config between pcaps - * implied snort.--pcap-reset: ignored - for REG_TEST only * implied snort.--pcap-show: print a line saying what pcap is currently being read * implied snort.--pedantic: warnings are fatal @@ -1714,6 +1846,8 @@ Configuration: * implied snort.--warn-flowbits: warn about flowbits that are checked but not set and vice-versa * implied snort.--warn-hosts: warn about host table issues + * implied snort.--warn-plugins: warn about issues that prevent + plugins from loading * implied snort.--warn-rules: warn about duplicate rules and rule parsing issues * implied snort.--warn-scripts: warn about issues discovered while @@ -2192,7 +2326,23 @@ Peg counts: * tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums -4.20. udp +4.20. token_ring + +------------ + +What: support for token ring decoding + +Type: codec + +Rules: + + * 116:140 (token_ring) (token_ring) Bad Token Ring Header + * 116:141 (token_ring) (token_ring) Bad Token Ring ETHLLC Header + * 116:142 (token_ring) (token_ring) Bad Token Ring MRLENHeader + * 116:143 (token_ring) (token_ring) Bad Token Ring MR Header + + +4.21. udp ------------ @@ -2223,7 +2373,7 @@ Peg counts: * udp.bad checksum (ip6): nonzero udp over ipv6 checksums -4.21. vlan +4.22. vlan ------------ @@ -2238,7 +2388,7 @@ Rules: * 116:132 (vlan) bad extra LLC info -4.22. wlan +4.23. wlan ------------ @@ -2254,19 +2404,7 @@ Rules: --------------------------------------------------------------------- -5. Data Modules - ---------------------------------------------------------------------- - -Data modules are adjunct configurations for use with certain -inspectors. - -no match no match - - ---------------------------------------------------------------------- - -6. Inspector Modules +5. Inspector Modules --------------------------------------------------------------------- @@ -2274,7 +2412,7 @@ These modules perform a variety of functions, including analysis of protocols beyond basic decoding. -6.1. arp_spoof +5.1. arp_spoof ------------ @@ -2299,7 +2437,7 @@ Peg counts: * arp_spoof.packets: total packets -6.2. back_orifice +5.2. back_orifice ------------ @@ -2319,7 +2457,7 @@ Peg counts: * back_orifice.packets: total packets -6.3. binder +5.3. binder ------------ @@ -2335,13 +2473,13 @@ Configuration: * bit_list binder[].when.vlans: list of VLAN IDs { 4095 } * addr_list binder[].when.nets: list of networks * enum binder[].when.proto: protocol { any | ip | icmp | tcp | udp - } + | user | file } * bit_list binder[].when.ports: list of ports { 65535 } * enum binder[].when.role = any: use the given configuration on one or any end of a session { client | server | any } * string binder[].when.service: override default configuration * enum binder[].use.action = inspect: what to do with matching - traffic { block | allow | inspect } + traffic { reset | block | allow | inspect } * string binder[].use.file: use configuration in given file * string binder[].use.service: override automatic service identification @@ -2351,12 +2489,30 @@ Configuration: Peg counts: * binder.packets: initial bindings + * binder.resets: reset bindings * binder.blocks: block bindings * binder.allows: allow bindings * binder.inspects: inspect bindings -6.4. dns +5.4. data_log + +------------ + +What: log selected published data to data.log + +Type: inspector + +Configuration: + + * string data_log.key = http_uri: name of data buffer to log + +Peg counts: + + * data_log.packets: total packets + + +5.5. dns ------------ @@ -2375,7 +2531,29 @@ Peg counts: * dns.packets: total packets -6.5. ftp_client +5.6. dpx + +------------ + +What: dynamic inspector example + +Type: inspector + +Configuration: + + * port dpx.port: port to check + * int dpx.max = 0: maximum payload before alert { 0:65535 } + +Rules: + + * 256:1 (dpx) too much data sent to port + +Peg counts: + + * dpx.packets: total packets + + +5.7. ftp_client ------------ @@ -2399,7 +2577,7 @@ Configuration: sequences on ftp control channel -6.6. ftp_data +5.8. ftp_data ------------ @@ -2412,7 +2590,7 @@ Peg counts: * ftp_data.packets: total packets -6.7. ftp_server +5.9. ftp_server ------------ @@ -2479,7 +2657,7 @@ Peg counts: * ftp_server.packets: total packets -6.8. http_global +5.10. http_global ------------ @@ -2574,7 +2752,7 @@ Peg counts: * http_global.decompressed bytes: total bytes decompressed -6.9. http_inspect +5.11. http_inspect ------------ @@ -2718,7 +2896,7 @@ Rules: * 120:17 (http_inspect) HTTP response PDF file parse failure -6.10. imap +5.12. imap ------------ @@ -2750,7 +2928,7 @@ Peg counts: * imap.packets: total packets -6.11. new_http_inspect +5.13. new_http_inspect ------------ @@ -2825,9 +3003,23 @@ Rules: * 219:50 (new_http_inspect) PDF file cascaded compression * 219:51 (new_http_inspect) PDF file parse failure * 219:52 (new_http_inspect) HTTP misformatted or not really HTTP + * 219:53 (new_http_inspect) Chunk length has excessive leading + zeros + * 219:54 (new_http_inspect) White space before or between messages + * 219:55 (new_http_inspect) Request message without URI + * 219:56 (new_http_inspect) Control character in reason phrase + * 219:57 (new_http_inspect) Illegal extra whitespace in start line + * 219:58 (new_http_inspect) Corrupted HTTP version + * 219:59 (new_http_inspect) Unknown HTTP version + * 219:60 (new_http_inspect) Format error in HTTP header + * 219:61 (new_http_inspect) Chunk header options present + * 219:62 (new_http_inspect) URI badly formatted + * 219:63 (new_http_inspect) URI bad port number + * 219:64 (new_http_inspect) HTTP chunk misformatted + * 219:65 (new_http_inspect) White space following chunk length -6.12. normalizer +5.14. normalizer ------------ @@ -2975,7 +3167,7 @@ Peg counts: segments -6.13. perf_monitor +5.15. perf_monitor ------------ @@ -3015,7 +3207,7 @@ Peg counts: * perf_monitor.packets: total packets -6.14. pop +5.16. pop ------------ @@ -3047,7 +3239,7 @@ Peg counts: * pop.packets: total packets -6.15. port_scan +5.17. port_scan ------------ @@ -3105,7 +3297,7 @@ Rules: * 122:27 (port_scan) open port -6.16. port_scan_global +5.18. port_scan_global ------------ @@ -3123,7 +3315,7 @@ Peg counts: * port_scan_global.packets: total packets -6.17. rpc_decode +5.19. rpc_decode ------------ @@ -3144,7 +3336,156 @@ Peg counts: * rpc_decode.packets: total packets -6.18. ssh +5.20. sip + +------------ + +What: sip inspection + +Type: inspector + +Configuration: + + * bool sip.ignore_call_channel = false: enables the support for + ignoring audio/video data channel + * int sip.max_call_id_len = 256: maximum call id field size { + 0:65535 } + * int sip.max_contact_len = 256: maximum contact field size { + 0:65535 } + * int sip.max_content_len = 1024: maximum content length of the + message body { 0:65535 } + * int sip.max_dialogs = 4: maximum number of dialogs within one + stream session { 1:4194303 } + * int sip.max_from_len = 256: maximum from field size { 0:65535 } + * int sip.max_requestName_len = 20: maximum request name field size + { 0:65535 } + * int sip.max_sessions = 10000: maximum number of sessions that can + be allocated { 1024:4194303 } + * int sip.max_to_len = 256: maximum to field size { 0:65535 } + * int sip.max_uri_len = 256: maximum request uri field size { + 0:65535 } + * int sip.max_via_len = 1024: maximum via field size { 0:65535 } + * string sip.methods = invite cancel ack bye register options: list + of methods to check in sip messages + +Rules: + + * 140:1 (sip) Maximum sessions reached + * 140:2 (sip) Empty request URI + * 140:3 (sip) URI is too long + * 140:4 (sip) Empty call-Id + * 140:5 (sip) Call-Id is too long + * 140:6 (sip) CSeq number is too large or negative + * 140:7 (sip) Request name in CSeq is too long + * 140:8 (sip) Empty From header + * 140:9 (sip) From header is too long + * 140:10 (sip) Empty To header + * 140:11 (sip) To header is too long + * 140:12 (sip) Empty Via header + * 140:13 (sip) Via header is too long + * 140:14 (sip) Empty Contact + * 140:15 (sip) Contact is too long + * 140:16 (sip) Content length is too large or negative + * 140:17 (sip) Multiple SIP messages in a packet + * 140:18 (sip) Content length mismatch + * 140:19 (sip) Request name is invalid + * 140:20 (sip) Invite replay attack + * 140:21 (sip) Illegal session information modification + * 140:22 (sip) Response status code is not a 3 digit number + * 140:23 (sip) Empty Content-type header + * 140:24 (sip) SIP version is invalid + * 140:25 (sip) Mismatch in METHOD of request and the CSEQ header + * 140:26 (sip) Method is unknown + * 140:27 (sip) Maximum dialogs within a session reached + +Peg counts: + + * sip.sessions: total sessions + * sip.events: events generated + * sip.dialogs: total dialogs + * sip.ignored channels: total channels ignored + * sip.ignored sessions: total sessions ignored + * sip.requests: total requests + * sip.responses: total responses + + +5.21. smtp + +------------ + +What: smtp inspection + +Type: inspector + +Configuration: + + * string smtp.alt_max_command_line_len[].command: command string + * int smtp.alt_max_command_line_len[].length = 0: specify + non-default maximum for command { 0: } + * string smtp.auth_cmds: commands that initiate an authentication + exchange + * string smtp.binary_data_cmds: commands that initiate sending of + data and use a length value after the command + * int smtp.bitenc_decode_depth = 25: depth used to extract the + non-encoded MIME attachments { -1:65535 } + * int smtp.b64_decode_depth = 25: depth used to decode the base64 + encoded MIME attachments { -1:65535 } + * string smtp.data_cmds: commands that initiate sending of data + with an end of data delimiter + * int smtp.email_hdrs_log_depth = 1464: depth for logging email + headers { 0:20480 } + * bool smtp.ignore_data = false: ignore data section of mail + * bool smtp.ignore_tls_data = false: ignore TLS-encrypted data when + processing rules + * string smtp.invalid_cmds: alert if this command is sent from + client side + * bool smtp.log_email_hdrs = false: log the SMTP email headers + extracted from SMTP data + * bool smtp.log_filename = false: log the MIME attachment filenames + extracted from the Content-Disposition header within the MIME + body + * bool smtp.log_mailfrom = false: log the sender’s email address + extracted from the MAIL FROM command + * bool smtp.log_rcptto = false: log the recipient’s email address + extracted from the RCPT TO command + * int smtp.max_command_line_len = 0: max Command Line Length { + 0:65535 } + * int smtp.max_header_line_len = 0: max SMTP DATA header line { + 0:65535 } + * int smtp.max_response_line_len = 0: max SMTP response line { + 0:65535 } + * enum smtp.normalize = none: turns on/off normalization { none | + cmds | all } + * string smtp.normalize_cmds: list of commands to normalize + * int smtp.qp_decode_depth = 25: quoted-Printable decoding depth { + -1:65535 } + * int smtp.uu_decode_depth = 25: unix-to-Unix decoding depth { + -1:65535 } + * string smtp.valid_cmds: list of valid commands + * enum smtp.xlink2state = alert: enable/disable xlink2state alert { + disable | alert | drop } + +Rules: + + * 124:1 (smtp) Attempted command buffer overflow + * 124:2 (smtp) Attempted data header buffer overflow + * 124:3 (smtp) Attempted response buffer overflow + * 124:4 (smtp) Attempted specific command buffer overflow + * 124:5 (smtp) Unknown command + * 124:6 (smtp) Illegal command + * 124:7 (smtp) Attempted header name buffer overflow + * 124:8 (smtp) Attempted X-Link2State command buffer overflow + * 124:10 (smtp) Base64 Decoding failed. + * 124:11 (smtp) Quoted-Printable Decoding failed. + * 124:13 (smtp) Unix-to-Unix Decoding failed. + * 124:14 (smtp) Cyrus SASL authentication attack. + +Peg counts: + + * smtp.packets: total packets + + +5.22. ssh ------------ @@ -3176,7 +3517,34 @@ Peg counts: * ssh.packets: total packets -6.19. stream +5.23. ssl + +------------ + +What: ssl inspection + +Type: inspector + +Configuration: + + * bool ssl.trust_servers = false: disables requirement that + application (encrypted) data must be observed on both sides + * int ssl.max_heartbeat_length = 0: maximum length of heartbeat + record allowed { 0:65535 } + +Rules: + + * 137:1 (ssl) Invalid Client HELLO after Server HELLO Detected + * 137:2 (ssl) Invalid Server HELLO without Client HELLO Detected + * 137:3 (ssl) Heartbeat Read Overrun Attempt Detected + * 137:4 (ssl) Large Heartbeat Response Detected + +Peg counts: + + * ssl.packets: total packets + + +5.24. stream ------------ @@ -3186,48 +3554,85 @@ Type: inspector Configuration: - * int stream.icmp_cache.memcap = 0: maximum cache memory { 0: } - * int stream.icmp_cache.idle_timeout = 60: maximum inactive time - before retiring session tracker { 1: } - * int stream.icmp_cache.pruning_timeout = 30: minimum inactive time + * int stream.ip_cache.max_sessions = 16384: maximum simultaneous + sessions tracked before pruning { 1: } + * int stream.ip_cache.memcap = 23920640: maximum cache memory + before pruning (0 is unlimited) { 0: } + * int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } - * int stream.icmp_cache.max_sessions = 262144: maximum simultaneous - tcp sessions tracked before pruning { 0: } - * int stream.ip_cache.memcap = 0: maximum cache memory { 0: } - * int stream.ip_cache.idle_timeout = 60: maximum inactive time + * int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } - * int stream.ip_cache.pruning_timeout = 30: minimum inactive time + * int stream.icmp_cache.max_sessions = 32768: maximum simultaneous + sessions tracked before pruning { 1: } + * int stream.icmp_cache.memcap = 1048576: maximum cache memory + before pruning (0 is unlimited) { 0: } + * int stream.icmp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } - * int stream.ip_cache.max_sessions = 262144: maximum simultaneous - tcp sessions tracked before pruning { 0: } - * int stream.tcp_cache.memcap = 0: maximum cache memory { 0: } - * int stream.tcp_cache.idle_timeout = 60: maximum inactive time + * int stream.icmp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } + * int stream.tcp_cache.max_sessions = 131072: maximum simultaneous + sessions tracked before pruning { 1: } + * int stream.tcp_cache.memcap = 268435456: maximum cache memory + before pruning (0 is unlimited) { 0: } * int stream.tcp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } - * int stream.tcp_cache.max_sessions = 262144: maximum simultaneous - tcp sessions tracked before pruning { 0: } - * int stream.udp_cache.memcap = 0: maximum cache memory { 0: } - * int stream.udp_cache.idle_timeout = 60: maximum inactive time + * int stream.tcp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } + * int stream.udp_cache.max_sessions = 65536: maximum simultaneous + sessions tracked before pruning { 1: } + * int stream.udp_cache.memcap = 0: maximum cache memory before + pruning (0 is unlimited) { 0: } * int stream.udp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } - * int stream.udp_cache.max_sessions = 262144: maximum simultaneous - tcp sessions tracked before pruning { 0: } + * int stream.udp_cache.idle_timeout = 180: maximum inactive time + before retiring session tracker { 1: } + * int stream.user_cache.max_sessions = 1024: maximum simultaneous + sessions tracked before pruning { 1: } + * int stream.user_cache.memcap = 1048576: maximum cache memory + before pruning (0 is unlimited) { 0: } + * int stream.user_cache.pruning_timeout = 30: minimum inactive time + before being eligible for pruning { 1: } + * int stream.user_cache.idle_timeout = 180: maximum inactive time + before retiring session tracker { 1: } + * int stream.file_cache.max_sessions = 128: maximum simultaneous + sessions tracked before pruning { 1: } + * int stream.file_cache.memcap = 0: maximum cache memory before + pruning (0 is unlimited) { 0: } + * int stream.file_cache.pruning_timeout = 30: minimum inactive time + before being eligible for pruning { 1: } + * int stream.file_cache.idle_timeout = 180: maximum inactive time + before retiring session tracker { 1: } Peg counts: + * stream.ip flows: total ip sessions + * stream.ip prunes: ip sessions pruned + * stream.icmp flows: total icmp sessions + * stream.icmp prunes: icmp sessions pruned * stream.tcp flows: total tcp sessions * stream.tcp prunes: tcp sessions pruned * stream.udp flows: total udp sessions * stream.udp prunes: udp sessions pruned - * stream.icmp flows: total icmp sessions - * stream.icmp prunes: icmp sessions pruned - * stream.ip flows: total ip sessions - * stream.ip prunes: ip sessions pruned + * stream.user flows: total user sessions + * stream.user prunes: user sessions pruned + * stream.file flows: total file sessions + * stream.file prunes: file sessions pruned + + +5.25. stream_file + +------------ + +What: stream inspector for file flow tracking and processing + +Type: inspector +Configuration: + + * bool stream_file.upload = false: indicate file transfer direction -6.20. stream_icmp + +5.26. stream_icmp ------------ @@ -3246,7 +3651,7 @@ Peg counts: * stream_icmp.released: icmp session trackers released -6.21. stream_ip +5.27. stream_ip ------------ @@ -3302,7 +3707,7 @@ Peg counts: * stream_ip.nodes deleted: fragments deleted from tracker -6.22. stream_tcp +5.28. stream_tcp ------------ @@ -3322,7 +3727,7 @@ Configuration: * int stream_tcp.overlap_limit = 0: maximum number of allowed overlapping segments per session { 0:255 } * int stream_tcp.max_pdu = 16384: maximum reassembled PDU size { - 1460:63780 } + 1460:65535 } * enum stream_tcp.policy = bsd: determines operating system characteristics like reassembly { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | @@ -3341,8 +3746,6 @@ Configuration: segments queued { 0:2048 } * int stream_tcp.small_segments.maximum_size = 0: limit number of small segments queued { 0:2048 } - * bit_list stream_tcp.small_segments.ignore_ports: limit number of - small segments queued { 65535 } * int stream_tcp.session_timeout = 30: session tracking timeout { 1:86400 } * int stream_tcp.footprint = 0: use zero for production, non-zero @@ -3412,7 +3815,7 @@ Peg counts: flushed when session released -6.23. stream_udp +5.29. stream_udp ------------ @@ -3435,7 +3838,21 @@ Peg counts: * stream_udp.timeouts: udp session timeouts -6.24. telnet +5.30. stream_user + +------------ + +What: stream inspector for user flow tracking and reassembly + +Type: inspector + +Configuration: + + * int stream_user.session_timeout = 30: session tracking timeout { + 1:86400 } + + +5.31. telnet ------------ @@ -3464,7 +3881,7 @@ Peg counts: * telnet.packets: total packets -6.25. wizard +5.32. wizard ------------ @@ -3499,11 +3916,13 @@ Peg counts: * wizard.tcp hits: tcp identifications * wizard.udp scans: udp payload scans * wizard.udp hits: udp identifications + * wizard.user scans: user payload scans + * wizard.user hits: user identifications --------------------------------------------------------------------- -7. IPS Action Modules +6. IPS Action Modules --------------------------------------------------------------------- @@ -3516,7 +3935,7 @@ the parser. For the reject rule, you can set reject = { } to get the rule to parse. -7.1. react +6.1. react ------------ @@ -3532,7 +3951,7 @@ Configuration: body) -7.2. reject +6.2. reject ------------ @@ -3548,7 +3967,7 @@ Configuration: |all } -7.3. rewrite +6.3. rewrite ------------ @@ -3559,14 +3978,14 @@ Type: ips_action --------------------------------------------------------------------- -8. IPS Option Modules +7. IPS Option Modules --------------------------------------------------------------------- IPS options are the building blocks of IPS rules. -8.1. ack +7.1. ack ------------ @@ -3580,7 +3999,7 @@ Configuration: max | min -8.2. asn1 +7.2. asn1 ------------ @@ -3602,7 +4021,7 @@ Configuration: * int asn1.relative_offset: relative offset from the cursor. -8.3. base64_decode +7.3. base64_decode ------------ @@ -3621,7 +4040,7 @@ Configuration: start of buffer. -8.4. bufferlen +7.4. bufferlen ------------ @@ -3634,7 +4053,7 @@ Configuration: * string bufferlen.~range: len | min<>max | min -8.5. byte_extract +7.5. byte_extract ------------ @@ -3665,7 +4084,7 @@ Configuration: * implied byte_extract.dec: convert from decimal string -8.6. byte_jump +7.6. byte_jump ------------ @@ -3699,7 +4118,7 @@ Configuration: * implied byte_jump.dec: convert from decimal string -8.7. byte_test +7.7. byte_test ------------ @@ -3728,7 +4147,7 @@ Configuration: * implied byte_test.dec: convert from decimal string -8.8. classtype +7.8. classtype ------------ @@ -3741,7 +4160,7 @@ Configuration: * string classtype.~: classification for this rule -8.9. content +7.9. content ------------ @@ -3769,7 +4188,7 @@ Configuration: from cursor -8.10. cvs +7.10. cvs ------------ @@ -3782,7 +4201,7 @@ Configuration: * implied cvs.invalid-entry: looks for an invalid Entry string -8.11. detection_filter +7.11. detection_filter ------------ @@ -3801,7 +4220,7 @@ Configuration: 1: } -8.12. dsize +7.12. dsize ------------ @@ -3815,7 +4234,7 @@ Configuration: max | min -8.13. file_data +7.13. file_data ------------ @@ -3824,7 +4243,7 @@ What: rule option to set detection cursor to file data Type: ips_option -8.14. flags +7.14. flags ------------ @@ -3838,7 +4257,7 @@ Configuration: * string flags.~mask_flags: these flags are don’t cares -8.15. flow +7.15. flow ------------ @@ -3862,7 +4281,7 @@ Configuration: * implied flow.only_frag: match on defragmented packets only -8.16. flowbits +7.16. flowbits ------------ @@ -3877,7 +4296,7 @@ Configuration: * string flowbits.~arg2: group if arg1 is bits -8.17. fragbits +7.17. fragbits ------------ @@ -3890,7 +4309,7 @@ Configuration: * string fragbits.~flags: these flags are tested -8.18. fragoffset +7.18. fragoffset ------------ @@ -3904,7 +4323,7 @@ Configuration: min<>max | min -8.19. gid +7.19. gid ------------ @@ -3917,7 +4336,7 @@ Configuration: * int gid.~: generator id { 1: } -8.20. http_client_body +7.20. http_client_body ------------ @@ -3926,7 +4345,7 @@ What: rule option to set the detection cursor to the request body Type: ips_option -8.21. http_cookie +7.21. http_cookie ------------ @@ -3935,7 +4354,7 @@ What: rule option to set the detection cursor to the HTTP cookie Type: ips_option -8.22. http_header +7.22. http_header ------------ @@ -3949,7 +4368,7 @@ Configuration: * string http_header.~name: restrict to given header -8.23. http_method +7.23. http_method ------------ @@ -3959,7 +4378,7 @@ method Type: ips_option -8.24. http_raw_cookie +7.24. http_raw_cookie ------------ @@ -3969,7 +4388,7 @@ cookie Type: ips_option -8.25. http_raw_header +7.25. http_raw_header ------------ @@ -3979,7 +4398,7 @@ headers Type: ips_option -8.26. http_raw_uri +7.26. http_raw_uri ------------ @@ -3988,7 +4407,7 @@ What: rule option to set the detection cursor to the unnormalized URI Type: ips_option -8.27. http_stat_code +7.27. http_stat_code ------------ @@ -3997,7 +4416,7 @@ What: rule option to set the detection cursor to the HTTP status code Type: ips_option -8.28. http_stat_msg +7.28. http_stat_msg ------------ @@ -4007,7 +4426,7 @@ message Type: ips_option -8.29. http_uri +7.29. http_uri ------------ @@ -4017,7 +4436,7 @@ buffer Type: ips_option -8.30. icmp_id +7.30. icmp_id ------------ @@ -4031,7 +4450,7 @@ Configuration: >min -8.31. icmp_seq +7.31. icmp_seq ------------ @@ -4045,7 +4464,7 @@ Configuration: min<>max | min -8.32. icode +7.32. icode ------------ @@ -4059,7 +4478,7 @@ Configuration: | >min -8.33. id +7.33. id ------------ @@ -4073,7 +4492,7 @@ Configuration: min -8.34. ip_proto +7.34. ip_proto ------------ @@ -4086,7 +4505,7 @@ Configuration: * string ip_proto.~proto: [!|>|<] name or number -8.35. ipopts +7.35. ipopts ------------ @@ -4100,7 +4519,7 @@ Configuration: lsrre|ssrr|satid|any } -8.36. isdataat +7.36. isdataat ------------ @@ -4115,7 +4534,7 @@ Configuration: buffer -8.37. itype +7.37. itype ------------ @@ -4129,7 +4548,7 @@ Configuration: | >min -8.38. md5 +7.38. md5 ------------ @@ -4147,7 +4566,7 @@ Configuration: of buffer -8.39. metadata +7.39. metadata ------------ @@ -4162,7 +4581,7 @@ Configuration: * string metadata.*: additional parameters not used by snort -8.40. msg +7.40. msg ------------ @@ -4175,7 +4594,7 @@ Configuration: * string msg.~: message describing rule -8.41. pcre +7.41. pcre ------------ @@ -4188,7 +4607,7 @@ Configuration: * string pcre.~regex: Snort regular expression -8.42. pkt_data +7.42. pkt_data ------------ @@ -4198,7 +4617,7 @@ packet data Type: ips_option -8.43. priority +7.43. priority ------------ @@ -4212,7 +4631,7 @@ Configuration: 1: } -8.44. raw_data +7.44. raw_data ------------ @@ -4221,7 +4640,7 @@ What: rule option to set the detection cursor to the raw packet data Type: ips_option -8.45. reference +7.45. reference ------------ @@ -4235,7 +4654,7 @@ Configuration: * string reference.~id: reference id -8.46. rem +7.46. rem ------------ @@ -4248,7 +4667,7 @@ Configuration: * string rem.~: comment -8.47. replace +7.47. replace ------------ @@ -4261,7 +4680,7 @@ Configuration: * string replace.~: byte code to replace with -8.48. rev +7.48. rev ------------ @@ -4274,7 +4693,7 @@ Configuration: * int rev.~: revision { 1: } -8.49. rpc +7.49. rpc ------------ @@ -4289,7 +4708,7 @@ Configuration: * string rpc.~proc: procedure number or * for any -8.50. seq +7.50. seq ------------ @@ -4303,7 +4722,7 @@ Configuration: max | min -8.51. session +7.51. session ------------ @@ -4316,7 +4735,7 @@ Configuration: * enum session.~mode: output format { printable|binary|all } -8.52. sha256 +7.52. sha256 ------------ @@ -4334,7 +4753,7 @@ Configuration: start of buffer -8.53. sha512 +7.53. sha512 ------------ @@ -4352,7 +4771,7 @@ Configuration: start of buffer -8.54. sid +7.54. sid ------------ @@ -4365,7 +4784,52 @@ Configuration: * int sid.~: signature id { 1: } -8.55. so +7.55. sip_body + +------------ + +What: rule option to set the detection cursor to the request body + +Type: ips_option + + +7.56. sip_header + +------------ + +What: rule option to set the detection cursor to the SIP header +buffer + +Type: ips_option + + +7.57. sip_method + +------------ + +What: detection option for sip stat code + +Type: ips_option + +Configuration: + + * string sip_method.*method: sip method + + +7.58. sip_stat_code + +------------ + +What: detection option for sip stat code + +Type: ips_option + +Configuration: + + * int sip_stat_code.*code: stat code { 1:999 } + + +7.59. so ------------ @@ -4378,7 +4842,7 @@ Configuration: * string so.~func: name of eval function -8.56. soid +7.60. soid ------------ @@ -4391,7 +4855,59 @@ Configuration: * string soid.~: SO rule ID has | format, like 3|12345 -8.57. stream_reassemble +7.61. ssl_state + +------------ + +What: detection option for ssl state + +Type: ips_option + +Configuration: + + * implied ssl_state.client_hello: check for client hello + * implied ssl_state.server_hello: check for server hello + * implied ssl_state.client_keyx: check for client keyx + * implied ssl_state.server_keyx: check for server keyx + * implied ssl_state.unknown: check for unknown record + * implied ssl_state.!client_hello: check for records that are not + client hello + * implied ssl_state.!server_hello: check for records that are not + server hello + * implied ssl_state.!client_keyx: check for records that are not + client keyx + * implied ssl_state.!server_keyx: check for records that are not + server keyx + * implied ssl_state.!unknown: check for records that are not + unknown + + +7.62. ssl_version + +------------ + +What: detection option for ssl version + +Type: ips_option + +Configuration: + + * implied ssl_version.sslv2: check for sslv2 + * implied ssl_version.sslv3: check for sslv3 + * implied ssl_version.tls1.0: check for tls1.0 + * implied ssl_version.tls1.1: check for tls1.1 + * implied ssl_version.tls1.2: check for tls1.2 + * implied ssl_version.!sslv2: check for records that are not sslv2 + * implied ssl_version.!sslv3: check for records that are not sslv3 + * implied ssl_version.!tls1.0: check for records that are not + tls1.0 + * implied ssl_version.!tls1.1: check for records that are not + tls1.1 + * implied ssl_version.!tls1.2: check for records that are not + tls1.2 + + +7.63. stream_reassemble ------------ @@ -4410,7 +4926,7 @@ Configuration: remainder of the session -8.58. stream_size +7.64. stream_size ------------ @@ -4425,7 +4941,7 @@ Configuration: direction(s) { either|to_server|to_client|both } -8.59. tag +7.65. tag ------------ @@ -4442,7 +4958,7 @@ Configuration: * int tag.bytes: tag for this many bytes { 1: } -8.60. tos +7.66. tos ------------ @@ -4456,7 +4972,7 @@ Configuration: max | min -8.61. ttl +7.67. ttl ------------ @@ -4470,7 +4986,21 @@ Configuration: max | min -8.62. window +7.68. urg + +------------ + +What: detection for TCP urgent pointer + +Type: ips_option + +Configuration: + + * string urg.~range: check if urgent offset is min<>max | + min + + +7.69. window ------------ @@ -4486,7 +5016,7 @@ Configuration: --------------------------------------------------------------------- -9. Search Engine Modules +8. Search Engine Modules --------------------------------------------------------------------- @@ -4498,7 +5028,7 @@ Related configuration is done with the basic detection module. --------------------------------------------------------------------- -10. SO Rule Modules +9. SO Rule Modules --------------------------------------------------------------------- @@ -4509,14 +5039,14 @@ typically do not have associated modules. --------------------------------------------------------------------- -11. Logger Modules +10. Logger Modules --------------------------------------------------------------------- All output of events and packets is done by Loggers. -11.1. alert_csv +10.1. alert_csv ------------ @@ -4528,18 +5058,35 @@ Configuration: * bool alert_csv.file = false: output to alert_csv.txt instead of stdout - * multi alert_csv.csv = timestamp gid sid rev src_addr src_port - dst_addr dst_port: selected fields will be output in given order - left to right { timestamp | gid | sid | rev | msg | proto | - src_addr | dst_addr | src_port | dst_port | eth_src | eth_dst | - eth_type | eth_len | ttl | tos | id | ip_len | dgm_len | - icmp_type | icmp_code | icmp_id | icmp_seq | tcp_flags | tcp_seq - | tcp_ack | tcp_len | tcp_win | udp_len } + * multi alert_csv.fields = timestamp pkt_num proto pkt_gen dgm_len + dir src_ap dst_ap rule action: selected fields will be output in + given order left to right { action | dir | dgm_len | dst_addr | + dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid + | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len | + msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr | + src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq | + tcp_win | timestamp | tos | ttl | udp_len } * int alert_csv.limit = 0: set limit (0 is unlimited) { 0: } + * string alert_csv.separator = , : separate fields with this + character sequence * enum alert_csv.units = B: bytes | KB | MB | GB { B | K | M | G } -11.2. alert_fast +10.2. alert_ex + +------------ + +What: output gid:sid:rev for alerts + +Type: logger + +Configuration: + + * bool alert_ex.upper = false: true/false → convert to upper/lower + case + + +10.3. alert_fast ------------ @@ -4556,7 +5103,7 @@ Configuration: * enum alert_fast.units = B: bytes | KB | MB | GB { B | K | M | G } -11.3. alert_full +10.4. alert_full ------------ @@ -4573,7 +5120,7 @@ Configuration: K | M | G } -11.4. alert_syslog +10.5. alert_syslog ------------ @@ -4593,50 +5140,50 @@ Configuration: cons | ndelay | perror | pid } -11.5. alert_test +10.6. alert_unixsock ------------ -What: output event in custom tsv format +What: output event over unix socket Type: logger -Configuration: - - * bool alert_test.file = false: output to alert_test.txt instead of - stdout - * bool alert_test.rebuilt = false: include type:count where type is - S for stream and F for frag - * bool alert_test.session = false: include src-dst each of form - -addr:port - * bool alert_test.msg = false: include alert msg - -11.6. alert_unixsock +10.7. log_codecs ------------ -What: output event over unix socket +What: log protocols in packet by layer Type: logger +Configuration: + + * bool log_codecs.file = false: output to log_codecs.txt instead of + stdout + * bool log_codecs.msg = false: include alert msg + + +10.8. log_hext -11.7. log_codecs - ------------ -What: log protocols in packet by layer +What: output payload suitable for daq hext Type: logger Configuration: - * bool log_codecs.file = false: output to log_codecs.txt instead of + * bool log_hext.file = false: output to log_hext.txt instead of stdout - * bool log_codecs.msg = false: include alert msg + * bool log_hext.raw = false: output all full packets if true, else + just TCP payload + * int log_hext.limit = 0: set limit (0 is unlimited) { 0: } + * enum log_hext.units = B: bytes | KB | MB | GB { B | K | M | G } + * int log_hext.width = 20: set line width (0 is unlimited) { 0: } -11.8. log_pcap +10.9. log_pcap ------------ @@ -4650,7 +5197,7 @@ Configuration: * enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G } -11.9. unified2 +10.10. unified2 ------------ @@ -4670,6 +5217,644 @@ Configuration: events +--------------------------------------------------------------------- + +11. DAQ Modules + +--------------------------------------------------------------------- + +The Data AcQuisition library (DAQ), provides pluggable packet I/O. +The DAQ replaces direct calls to libraries like libpcap with an +abstraction layer that facilitates operation on a variety of hardware +and software interfaces without requiring changes to Snort. It is +possible to select the DAQ type and mode when invoking Snort to +perform pcap readback or inline operation, etc. The DAQ library may +be useful for other packet processing applications and the modular +nature allows you to build new modules for other platforms. + +The DAQ library is provided as an external package on snort.org. +There are a few additional modules provided with Snort++. This +section summarizes the important things you need to know to use these +DAQ modules. There are also 3rd DAQ modules available. + + +11.1. Building the DAQ Library and DAQ Modules + +------------ + +The DAQ is bundled with Snort but must be built first using these +steps: + +./configure +make +sudo make install + +This will build and install both static and dynamic DAQ modules. + +Note that pcap >= 1.0.0 is required. pcap 1.1.1 is available at the +time of this writing and is recommended. + +Also, libdnet is required for IPQ and NFQ DAQs. If you get a +relocation error trying to build those DAQs, you may need to +reinstall libdnet and configure it with something like this: + +./configure "CFLAGS=-fPIC -g -O2" + +You may also experience problems trying to find the dynamic dnet +library because it isn’t always named properly. Try creating a link +to the shared library (identified by its .x or .x.y etc. extension) +with the same name but with ".so" inserted as follows: + +$ ln -s libdnet.1.1 libdnet.so.1.1 +$ ldconfig -Rv /usr/local/lib 2>&1 | grep dnet + Adding /usr/local/lib/libdnet.so.1.1 + +Alternatively, you should be able to fix both issues as follows: + +libtoolize --copy --force +aclocal -I config +autoheader +autoconf +automake --foreign + +When the DAQ library is built, both static and dynamic flavors will +be generated. The various DAQ modules will be built if the requisite +headers and libraries are available. You can disable individual +modules, etc. with options to configure. For the complete list of +configure options, run: + +./configure --help + + +11.2. PCAP Module + +------------ + +pcap is the default DAQ. If snort is run w/o any DAQ arguments, it +will operate as it always did using this module. These are +equivalent: + +./snort -i +./snort -r + +./snort --daq pcap --daq-mode passive -i +./snort --daq pcap --daq-mode read-file -r + +You can specify the buffer size pcap uses with: + +./snort --daq pcap --daq-var buffer_size=<#bytes> + + * The pcap DAQ does not count filtered packets. * + + +11.3. AFPACKET Module + +------------ + +afpacket functions similar to the pcap DAQ but with better +performance: + +./snort --daq afpacket -i + [--daq-var buffer_size_mb=<#MB>] + [--daq-var debug] + +If you want to run afpacket in inline mode, you must craft the device +string as one or more interface pairs, where each member of a pair is +separated by a single colon and each pair is separated by a double +colon like this: + +eth0:eth1 + +or this: + +eth0:eth1::eth2:eth3 + +By default, the afpacket DAQ allocates 128MB for packet memory. You +can change this with: + +--daq-var buffer_size_mb=<#MB> + +Note that the total allocated is actually higher, here’s why. +Assuming the default packet memory with a snaplen of 1518, the +numbers break down like this: + + * The frame size is 1518 (snaplen) + the size of the AFPacket + header (66 bytes) = 1584 bytes. + * The number of frames is 128 MB / 1518 = 84733. + * The smallest block size that can fit at least one frame is 4 KB = + 4096 bytes @ 2 frames per block. + * As a result, we need 84733 / 2 = 42366 blocks. + * Actual memory allocated is 42366 * 4 KB = 165.5 MB. + +Note + +Linux kernel version 2.6.31 or higher is required for the AFPacket +DAQ module due to its dependency on both TPACKET v2 and +PACKET_TX_RING support. + + +11.4. NFQ Module + +------------ + +NFQ is the new and improved way to process iptables packets: + +./snort --daq nfq \ + [--daq-var device=] \ + [--daq-var proto=] \ + [--daq-var queue=] + + ::= ip | eth0, etc; default is IP injection + ::= ip4 | ip6 |; default is ip4 + ::= 0..65535; default is 0 + +This module can not run unprivileged so ./snort -u -g will produce a +warning and won’t change user or group. + +Notes on iptables are given below. + + +11.5. IPQ Module + +------------ + +IPQ is the old way to process iptables packets. It replaces the +inline version available in pre-2.9 versions built with this: + +./configure --enable-inline + +Note that layer 2 resets are not supported with the IPQ DAQ: + +config layer2resets[: ] + +Start the IPQ DAQ as follows: + +./snort --daq ipq \ + [--daq-var device=] \ + [--daq-var proto=] \ + + ::= ip | eth0, etc; default is IP injection + ::= ip4 | ip6; default is ip4 + +This module can not run unprivileged so ./snort -u -g will produce a +warning and won’t change user or group. + +Notes on iptables are given below. + + +11.6. IPFW Module + +------------ + +IPFW is available for BSD systems. It replaces the inline version +available in pre-2.9 versions built with this: + +./configure --enable-ipfw + +This command line argument is no longer supported: + +./snort -J + +Instead, start Snort like this: + +./snort --daq ipfw [--daq-var port=] + + ::= 1..65535; default is 8000 + + * IPFW only supports ip4 traffic. + +Notes on FreeBSD and OpenBSD are given below. + + +11.7. Dump Module + +------------ + +The dump DAQ allows you to test the various inline mode features +available in 2.9 Snort like injection and normalization. + +./snort -i --daq dump +./snort -r --daq dump + +By default a file named inline-out.pcap will be created containing +all packets that passed through or were generated by snort. You can +optionally specify a different name. + +./snort --daq dump --daq-var file= + +dump uses the pcap daq for packet acquisition. It therefore does not +count filtered packets (a pcap limitation). + +Note that the dump DAQ inline mode is not an actual inline mode. +Furthermore, you will probably want to have the pcap DAQ acquire in +another mode like this: + +./snort -r -Q --daq dump --daq-var load-mode=read-file +./snort -i -Q --daq dump --daq-var load-mode=passive + + +11.8. Netmap Module + +------------ + +The netmap project is a framework for very high speed packet I/O. It +is available on both FreeBSD and Linux with varying amounts of +preparatory setup required. Specific notes for each follow. + +./snort --daq netmap -i + [--daq-var debug] + +If you want to run netmap in inline mode, you must craft the device +string as one or more interface pairs, where each member of a pair is +separated by a single colon and each pair is separated by a double +colon like this: + +em1:em2 + +or this: + +em1:em2::em3:em4 + +Inline operation performs Layer 2 forwarding with no MAC filtering, +akin to the AFPacket module’s behavior. All packets received on one +interface in an inline pair will be forwarded out the other interface +unless dropped by the reader and vice versa. + +Important + +The interfaces will need to be up and in promiscuous mode in order to +function (ifconfig em1 up promisc). The DAQ module does not currently +do either of these configuration steps for itself. + +11.8.1. FreeBSD + +In FreeBSD 10.0, netmap has been integrated into the core OS. In +order to use it, you must recompile your kernel with the line + +device netmap + +added to your kernel config. + +11.8.2. Linux + +You will need to download the netmap source code from the project’s +repository: + +https://code.google.com/p/netmap/ + +Follow the instructions on the project’s homepage for compiling and +installing the code: + +http://info.iet.unipi.it/~luigi/netmap/ + +It will involve a standalone kernel module (netmap_lin) as well as +patching and rebuilding the kernel module used to drive your network +adapters. The following drivers are supported under Linux at the time +of writing (June 2014): + +e1000 +e1000e +forcedeth +igb +ixgbe +r8169 +virtio + +TODO: + + * Support for attaching to only a single ring (queue) on a network + adapter. + * Support for VALE and netmap pipes. + + +11.9. Notes on iptables + +------------ + +These notes are just a quick reminder that you need to set up +iptables to use the IPQ or NFQ DAQs. Doing so may cause problems with +your network so tread carefully. The examples below are intentionally +incomplete so please read the related documentation first. + +Here is a blog post by Marty for historical reference: + +http://archives.neohapsis.com/archives/snort/2000-11/0394.html + +You can check this out for queue sizing tips: + +http://www.inliniac.net/blog/2008/01/23/improving-snort_inlines-nfq-performance.html + +You might find useful IPQ info here: + +http://snort-inline.sourceforge.net/ + +Use this to examine your iptables: + +sudo /sbin/iptables -L + +Use something like this to set up NFQ: + +sudo /sbin/iptables + -I [] [] + -j NFQUEUE --queue-num 1 + +Use something like this to set up IPQ: + +sudo iptables -I FORWARD -j QUEUE + +Use something like this to "disconnect" snort: + +sudo /sbin/iptables -D
    + +Be sure to start Snort prior to routing packets through NFQ with +iptables. Such packets will be dropped until Snort is started. + +The queue-num is the number you must give Snort. + +If you are running on a system with both NFQ and IPQ support, you may +experience some start-up failures of the sort: + +The solution seems to be to remove both modules from the kernel like +this: + +modprobe -r nfnetlink_queue +modprobe -r ip_queue + +and then install the module you want: + +modprobe ip_queue + +or: + +modprobe nfnetlink_queue + +These DAQs should be run with a snaplen of 65535 since the kernel +defrags the packets before queuing. Also, no need to configure frag3. + + +11.10. Notes on FreeBSD::IPFW + +------------ + +Check the online manual at: + +http://www.freebsd.org/doc/handbook/firewalls-ipfw.html. + +Here is a brief example to divert icmp packets to Snort at port 8000: + +To enable support for divert sockets, place the following lines in +the kernel configuration file: + +options IPFIREWALL +options IPDIVERT + +(The file in this case was: /usr/src/sys/i386/conf/GENERIC; which is +platform dependent.) + +You may need to also set these to use the loadable kernel modules: + +/etc/rc.conf: +firewall_enable="YES" + +/boot/loader.conf: +ipfw_load="YES" +ipdivert_load="YES" + +$ dmesg | grep ipfw +ipfw2 (+ipv6) initialized, divert loadable, nat loadable, rule-based +forwarding disabled, default to deny, logging disabled + +$ kldload -v ipdivert +Loaded ipdivert, id=4 + +$ ipfw add 75 divert 8000 icmp from any to any +00075 divert 8000 icmp from any to any + +$ ipfw list +... +00075 divert 8000 icmp from any to any +00080 allow icmp from any to any +... + + * Note that on FreeBSD, divert sockets don’t work with bridges! + +Please refer to the following articles for more information: + + * https://forums.snort.org/forums/support/topics/ + snort-inline-on-freebsd-ipfw + * http://freebsd.rogness.net/snort_inline/ + +NAT gateway can be used with divert sockets if the network +environment is conducive to using NAT. + +The steps to set up NAT with ipfw are as follows: + + 1. Set up NAT with two interface em0 and em1 by adding the following + to /etc/rc.conf. Here em0 is connected to external network and + em1 to host-only LAN. + + gateway_enable="YES" + natd_program="/sbin/natd" # path to natd + natd_enable="YES" # Enable natd (if firewall_enable == YES) + natd_interface="em0" # Public interface or IP Address + natd_flags="-dynamic" # Additional flags + defaultrouter="" + ifconfig_em0="DHCP" + ifconfig_em1="inet 192.168.1.2 netmask 255.255.255.0" + firewall_enable="YES" + firewall_script="/etc/rc.firewall" + firewall_type="simple" + + 2. Add the following divert rules to divert packets to Snort above + and below the NAT rule in the "Simple" section of /etc/ + rc.firewall. + + ... + # Inspect outbound packets (those arriving on "inside" interface) + # before NAT translation. + ${fwcmd} add divert 8000 all from any to any in via ${iif} + case ${natd_enable} in + [Yy][Ee][Ss]) + if [ -n "${natd_interface}" ]; then + ${fwcmd} add divert natd all from any to any via ${natd_interface} + fi + ;; + esac + ... + # Inspect inbound packets (those arriving on "outside" interface) + # after NAT translation that aren't blocked for other reasons, + # after the TCP "established" rule. + ${fwcmd} add divert 8000 all from any to any in via ${oif} + + +11.11. Notes on OpenBSD::IPFW + +------------ + +OpenBSD supports divert sockets as of 4.7, so we use the ipfw DAQ. + +Here is one way to set things up: + + 1. Configure the system to forward packets: + + $ sysctl net.inet.ip.forwarding=1 + $ sysctl net.inet6.ip6.forwarding=1 + + (You can also put that in /etc/sysctl.conf to enable on boot.) + + 2. Set up interfaces + + $ dhclient vic1 + $ dhclient vic2 + + 3. Set up packet filter rules: + + $ echo "pass out on vic1 divert-packet port 9000 keep-state" > rules.txt + $ echo "pass out on vic2 divert-packet port 9000 keep-state" >> rules.txt + + $ pfctl -v -f rules.txt + + 4. Analyze packets diverted to port 9000: + + $ ./snort --daq ipfw --daq-var port=9000 + + + Note that on OpenBSD, divert sockets don’t work with bridges! + + +11.12. Socket Module + +------------ + +The socket module provides provides a stream socket server that will +accept up to 2 simultaneous connections and bridge them together +while also passing data to Snort++ for inspection. The first +connection accepted is considered the client and the second +connection accepted is considered the server. If there is only one +connection, stream data can’t be forwarded but it is still inspected. + +Each read from a socket of up to snaplen bytes is passed as a packet +to Snort++ along with a DAQ_SktHdr_t pointer in +DAQ_PktHdr_t→priv_ptr. DAQ_SktHdr_t conveys IP4 address, ports, +protocol, and direction. Socket packets can be configured to be TCP +or UDP. The socket DAQ can be operated in inline mode and is able to +block packets. + +The socket DAQ uses DLT_SOCKET and requires that Snort++ load the +socket codec which is included in the extra package. + +To use the socket DAQ, start Snort++ like this: + +./snort --plugin-path /path/to/lib/snort_extra \ + --daq socket [--daq-var port=] [--daq-var proto=] [-Q] + + ::= 1..65535; default is 8000 + ::= tcp | udp + + * This module only supports ip4 traffic. + * This module is only supported by Snort++. It is not compatible + with Snort. + * This module is primarily for development and test. + + +11.13. File Module + +------------ + +The file module provides the ability to process files directly w/o +having to extract them from pcaps. Use the file module with Snort’s +stream_file to get file type identification and signature services. +The usual IPS detection and logging etc. is available too. + +You can process all the files in a directory recursively using 8 +threads with these Snort options: + +--pcap-dir path -z 8 + + * This module is only supported by Snort++. It is not compatible + with Snort. + * This module is primarily for development and test. + + +11.14. Hext Module + +------------ + +The hext module generates packets suitable for processing by Snort +from hex/plain text. Raw packets include full headers and are +processed normally. Otherwise the packets contain only payload and +are accompanied with flow information (4-tuple) suitable for +processing by stream_user. + +The first character of the line determines it’s purpose: + +'$' command +'#' comment +'"' quoted string packet data +'x' hex packet data +' ' empty line separates packets + +The available commands are: + +$client +$server + +$packet -> client +$packet -> server + +$packet -> + +Client and server are determined as follows. $packet → client +indicates to the client (from server) and $packet → server indicates +a packet to the server (from client). $packet followed by a 4-tuple +uses the heuristic that the client is the side with the lower port +number. + +The default client and server are 192.168.1.1 12345 and 10.1.2.3 80 +respectively. $packet commands with a 4-tuple do not change client +and server set with the other $packet commands. + +$packet commands should be followed by packet data, which may contain +any combination of hex and strings. Data for a packet ends with the +next command or a blank line. Data after a blank line will start +another packet with the same tuple as the prior one. + +Strings may contain the following escape sequences: + +\r = 0x0D = carriage return +\n = 0x0A = new line +\t = 0x09 = tab +\\ = 0x5C = \ + +Format your input carefully; there is minimal error checking and +little tolerance for arbitrary whitespace. You can use Snort’s -L +hext option to generate hext input from a pcap. + + * This module only supports ip4 traffic. + * This module is only supported by Snort++. It is not compatible + with Snort. + * This module is primarily for development and test. + +The hext DAQ also supports a raw mode which is activated by setting +the data link type. For example, you can input full ethernet packets +with --daq-var dlt=1 (Data link types are defined in the DAQ include +sfbpf_dlt.h.) Combine that with the hext logger in raw mode for a +quick (and dirty) way to edit pcaps. With --lua "log_hext = { raw = +true }", the hext logger will dump the full packet in a way that can +be read by the hext DAQ in raw mode. Here is an example: + +# 3 [96] + +x02 09 08 07 06 05 02 01 02 03 04 05 08 00 45 00 00 52 00 03 # ..............E..R.. +x00 00 40 06 5C 90 0A 01 02 03 0A 09 08 07 BD EC 00 50 00 00 # ..@.\............P.. +x00 02 00 00 00 02 50 10 20 00 8A E1 00 00 47 45 54 20 2F 74 # ......P. .....GET /t +x72 69 67 67 65 72 2F 31 20 48 54 54 50 2F 31 2E 31 0D 0A 48 # rigger/1 HTTP/1.1..H +x6F 73 74 3A 20 6C 6F 63 61 6C 68 6F 73 74 0D 0A # ost: localhost.. + +A comment indicating packet number and size precedes each packet +dump. Note that the commands are not applicable in raw mode and have +no effect. + + --------------------------------------------------------------------- 12. Snort++ vs Snort @@ -4928,7 +6113,7 @@ in Lua. Snort2Lua is a program specifically designed to convert Snort 2.9.X configuration files into Lua files that Snort 3.0 can understand. -Snort2Lua reads your legacy Snort conf file(s) and generates Snort\++ +Snort2Lua reads your legacy Snort conf file(s) and generates Snort++ Lua and rules files. When running this program, the only mandatory option is to provide Snort2Lua with a Snort configuration file. The default output file file is snort.lua, the default error file will be @@ -4990,7 +6175,7 @@ differences. As expected, quiet mode produces a Snort++ configuration. All errors (aside from Fatal Snort2Lua errors), differences, and comments will omitted from the final output file. Default mode will print everything. That mean you will be able to see -exactly what changes have occurred between Snort and Snort\++ in +exactly what changes have occurred between Snort and Snort++ in addition to the new syntax, the original file’s comments, and all errors that have occurred. Finally, differences mode will not actually output a valid Snort3.0 configuration. Instead, you can see @@ -5181,3581 +6366,4022 @@ appended to the original filename. --------------------------------------------------------------------- -14. Reference +14. Extending Snort++ --------------------------------------------------------------------- -14.1. Terminology +14.1. Plugins ------------ - * basic module: a module integrated into Snort that does not come - from a plugin. - * binder: inspector that maps configuration to traffic - * builtin rules: codec and inspector rules for anomalies detected - internally. - * codec: short for coder / decoder. These plugins are used for - basic protocol decoding, anomaly detection, and construction of - active responses. - * data module: an adjunct configuration plugin for use with certain - inspectors. - * dynamic rules: plugin rules loaded at runtime. See SO rules. - * fast pattern: the content in an IPS rule that must be found by - the search engine in order for a rule to be evaluated. - * fast pattern matcher: see search engine. - * hex: a type of protocol magic that the wizard uses to identify - binary protocols. - * inspector: plugin that processes packets (similar to the legacy - Snort preprocessor) - * IPS: intrusion prevention system, like Snort. - * IPS action: plugin that allows you to perform custom actions when - events are generated. Unlike loggers, these are invoked before - thresholding and can be used to control external agents or send - active responses. - * IPS option: this plugin is the building blocks of IPS rules. - * logger: a plugin that performs output of events and packets. - Events are thresholded before reaching loggers. - * module: the user facing portion of a Snort component. Modules - chiefly provide configuration parameters, but may also provide - commands, builtin rules, profiling statistics, peg counts, etc. - Note that not all modules are plugins and not all plugins have - modules. - * peg count: the number of times a given event or condition occurs. - * plugin: one of several types of software components that can be - loaded from a dynamic library when Snort starts up. Some plugins - are coupled with the main engine in such a way that they must be - built statically, but a newer version can be loaded dynamically. - * search engine: a plugin that performs multipattern searching of - packets and payload to find rules that should be evaluated. There - are currently no specific modules, although there are several - search engine plugins. Related configuration is done with the - basic detection module. Aka fast pattern matcher. - * SO rule: a IPS rule plugin that performs custom detection that - can’t be done by a text rule. These rules typically do not have - associated modules. SO comes from shared object, meaning dynamic - library. - * spell: a type of protocol magic that the wizard uses to identify - ASCII protocols. - * text rule: a rule loaded from the configuration that has a header - and body. The header specifies action, protocol, source and - destination IP addresses and ports, and direction. The body - specifies detection and non-detection options. - * wizard: inspector that applies protocol magic to determine which - inspectors should be bound to traffic absent a port specific - binding. See hex and spell. - - -14.2. Usage - ------------- +Snort++ uses a variety of plugins to accomplish much of its +processing objectives, including: -For the following examples "$my_path" is assumed to be the path to -the Snort++ install directory. Additionally, it is assumed that -"$my_path/bin" is in your PATH. + * Codec - to decode and encode packets + * Inspector - like the prior preprocessors, for normalization, etc. + * IpsOption - for detection in Snort++ rules + * IpsAction - for custom actions + * Logger - for handling events + * Mpse - for fast pattern matching + * So - for dynamic rules -14.2.1. Environment +Plugins have an associated API defined for each type, all of which +share a common header, called the BaseApi. A dynamic library makes +its plugins available by exporting the snort_plugins symbol, which is +a null terminated array of BaseApi pointers. -LUA_PATH is used directly by Lua to load and run required libraries. -SNORT_LUA_PATH is used by Snort to load supplemental configuration -files. +The BaseApi includes type, name, API version, plugin version, and +function pointers for constructing and destructing a Module. The +specific API add various other data and functions for their given +roles. -export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\; -export SNORT_LUA_PATH=$my_path/etc/snort -14.2.2. Help +14.2. Modules -Print the help summary: +------------ -snort --help +The Module is pervasive in Snort+. It is how everything, including +plugins, are configured. It also provides access to builtin rules. +And as the glue that binds functionality to Snort+, the capabilities +of a Module are expected to grow to include statistics support, etc. -Get help on a specific module ("stream", for example): +Module configuration is handled by a list of Parameters. Most +parameters can be validated by the framework, which means for example +that conversion from string to number is done in exactly one place. +Providing the builtin rules allows the documentation to include them +automatically and also allows for autogenerating the rules at +startup. -snort --help-module stream +If we are defining a new Inspector called, say, gadget, it might be +configured in snort.lua like this: -Get help on the "-A" command line option: +gadget = +{ + brain = true, + claw = 3 +} -snort --help-options A +When the gadget table is processed, Snort++ will look for a module +called gadget. If that Module has an associated API, it will be used +to configure a new instance of the plugin. In this case, a +GadgetModule would be instantiated, brain and claw would be set, and +the Module instance would be passed to the GadgetInspector +constructor. -Grep for help on threads: +Module has three key virtual methods: -snort --help-config | grep thread + * begin() - called when Snort++ starts processing the associated + Lua table. This is a good place to allocate any required data and + set defaults. + * set() - called to set each parameter after validation. + * end() - called when Snort++ finishes processing the associated + Lua table. This is where additional integrity checks of related + parameters should be done. -Output help on "rule" options in AsciiDoc format: +The configured Module is passed to the plugin constructor which pulls +the configuration data from the Module. For non-trivial +configurations, the working paradigm is that Module hands a pointer +to the configured data to the plugin instance which takes ownership. -snort --markup --help-options rule +Note that there is at most one instance of a given Module, even if +multiple plugin instances are created which use that Module. +(Multiple instances require Snort++ binding configuration.) -Note -Snort++ stops reading command-line options after the "--help-" and -"--list-" options, so any other options should be placed before them. +14.3. Inspectors -14.2.3. Sniffing and Logging +------------ -Read a pcap: +There are several types of inspector, which determines which +inspectors are executed when: -snort -r /path/to/my.pcap + * IT_BINDER - determines which inspectors apply to given flows + * IT_WIZARD - determines which service inspector to use if none + explicitly bound + * IT_PACKET - used to process all packets before session and + service processing (e.g. normalize) + * IT_NETWORK - processes packets w/o service (e.g. arp_spoof, + back_orifice) + * IT_STREAM - for flow tracking, ip defrag, and tcp reassembly + * IT_SERVICE - for http, ftp, telnet, etc. + * IT_PROBE - process all packets after all the above (e.g. + perf_monitor, port_scan) -Dump the packets to stdout: -snort -r /path/to/my.pcap -K text +14.4. Codecs -Dump packets with application data and layer 2 headers +------------ -snort -r /path/to/my.pcap -K text -d -e +The Snort3.0 Codecs decipher raw packets. These Codecs are now +completely pluggable; almost every Snort3.0 Codec can be built +dynamically and replaced with an alternative, customized Codec. The +pluggable nature has also made it easier to build new Codecs for +protocols without having to touch the Snort3.0 code base. -Note +The first step in creating a Codec is defining its class and +protocol. Every Codec must inherit from the Snort3.0 Codec class +defined in "framework/codec.h". The following is an example Codec +named "example" and has an associated struct that is 14 bytes long. -Command line options must be specified separately. "snort -de" won’t -work. You can still concatenate options and their arguments, however, -so "snort -Ktext" will work. +#include +#include +#include “framework/codec.h” +#include "main/snort_types.h" -Dump packets from all pcaps in a directory: +#define EX_NAME “example” +#define EX_HELP “example codec help string” -snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K text -d -e +struct Example +{ + uint8_t dst[6]; + uint8_t src[6]; + uint16_t ethertype; -Log packets to a directory: + static inline uint8_t size() + { return 14; } +} -snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K pcap -l /path/to/log/dir +class ExCodec : public Codec +{ +public: + ExCodec() : Codec(EX_NAME) { } + ~ExCodec() { } -14.2.4. Configuration + bool decode(const RawData&, CodecData&, DecodeData&) override; + void get_protocol_ids(std::vector&) override; +}; -Validate a configuration file: +After defining ExCodec, the next step is adding the Codec’s decode +functionality. The function below does this by implementing a valid +decode function. The first parameter, which is the RawData struct, +provides both a pointer to the raw data that has come from a wire and +the length of that raw data. The function takes this information and +validates that there are enough bytes for this protocol. If the raw +data’s length is less than 14 bytes, the function returns false and +Snort3.0 discards the packet; the packet is neither inspected nor +processed. If the length is greater than 14 bytes, the function +populates two fields in the CodecData struct, next_prot_id and +lyr_len. The lyr_len field tells Snort3.0 the number of bytes that +this layer contains. The next_prot_id field provides Snort3.0 the +value of the next EtherType or IP protocol number. -snort -c $my_path/etc/snort/snort.lua +bool ExCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) +{ + if ( raw.len < Example::size() ) + return false; -Validate a configuration file and a separate rules file: + const Example* const ex = reinterpret_cast(raw.data); + codec.next_prot_id = ntohs(ex->ethertype); + codec.lyr_len = ex->size(); + return true; +} -snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules +For instance, assume this decode function receives the following raw +data with a validated length of 32 bytes: -Read rules from stdin and validate: +00 11 22 33 44 55 66 77 88 99 aa bb 08 00 45 00 +00 38 00 01 00 00 40 06 5c ac 0a 01 02 03 0a 09 -snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules +The Example struct’s EtherType field is the 13 and 14 bytes. +Therefore, this function tells Snort that the next protocol has an +EtherType of 0x0800. Additionally, since the lyr_len is set to 14, +Snort knows that the next protocol begins 14 bytes after the +beginning of this protocol. The Codec with EtherType 0x0800, which +happens to be the IPv4 Codec, will receive the following data with a +validated length of 18 ( == 32 – 14): -Enable warnings for Lua configurations and make warnings fatal: +45 00 00 38 00 01 00 00 40 06 5c ac 0a 01 02 03 +0a 09 -snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic +How does Snort3.0 know that the IPv4 Codec has an EtherType of +0x0800? The Codec class has a second virtual function named +get_protocol_ids(). When implementing the function, a Codec can +register for any number of values between 0x0000 - 0xFFFF. Then, if +the next_proto_id is set to a value for which this Codec has +registered, this Codec’s decode function will be called. As a general +note, the protocol ids between [0, 0x00FF] are IP protocol numbers, +[0x0100, 0x05FF] are custom types, and [0x0600, 0xFFFF] are +EtherTypes. -Tell Snort++ where to look for additional Lua scripts: +For example, in the get_protocol_ids function below, the ExCodec +registers for the protocols numbers 17, 787, and 2054. 17 happens to +be the protocol number for UDP while 2054 is ARP’s EtherType. +Therefore, this Codec will now attempt to decode UDP and ARP data. +Additionally, if any Codec sets the next_protocol_id to 787, +ExCodec’s decode function will be called. Some custom protocols are +already defined in the file "protocols/protocol_ids.h" -snort --script-path /path/to/script/dir +void ExCodec::get_protocol_ids(std::vector&v) +{ + v.push_back(0x0011); // == 17 == UDP + v.push_back(0x1313); // == 787 == custom + v.push_back(0x0806); // == 2054 == ARP +} -14.2.5. IDS mode +To register a Codec for Data Link Type’s rather than protocols, the +function get_data_link_type() can be similarly implemented. -Run Snort++ in IDS mode, reading packets from a pcap: +The final step to creating a pluggable Codec is the snort_plugins +array. This array is important because when Snort3.0 loads a dynamic +library, the program only find plugins that are inside the +snort_plugins array. In other words, if a plugin has not been added +to the snort_plugins array, that plugin will not be loaded into +Snort3.0. -snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap - -Log any generated alerts to the console using the "-A" option: +Although the details will not be covered in this post, the following +code snippet is a basic CodecApi that Snort3.0 can load. This snippet +can be copied and used with only three minor changes. First, in the +function ctor, ExCodec should be replaced with the name of the Codec +that is being built. Second, EX_NAME must match the Codec’s name or +Snort will be unable to load this Codec. Third, EX_HELP should be +replaced with the general description of this Codec. Once this code +snippet has been added, ExCodec is ready to be compiled and plugged +into Snort3.0. -snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full +static Codec* ctor(Module*) +{ return new ExCodec; } -Add or modify a configuration from the command line using the "--lua" -option: +static void dtor(Codec *cd) +{ delete cd; } -snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \ - --lua 'ips = { enable_builtin_rules = true }' +static const CodecApi ex_api = +{ + { + PT_CODEC, + EX_NAME, + EX_HELP, + CDAPI_PLUGIN_V0, + 0, + nullptr, + nullptr, + }, + nullptr, // pointer to a function called during Snort's startup. + nullptr, // pointer to a function called during Snort's exit. + nullptr, // pointer to a function called during thread's startup. + nullptr, // pointer to a function called during thread's destruction. + ctor, // pointer to the codec constructor. + dtor, // pointer to the codec destructor. +}; -Note +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &ex_api.base, + nullptr +}; -The "--lua" option can be specified multiple times. +Two example Codecs are available in the extra directory on git and +the extra tarball on the Snort3.0 page. One of those examples is the +Token Ring Codec while the other example is the PIM Codec. -Run Snort++ in IDS mode on an entire directory of pcaps, processing -each input source on a separate thread: +As a final note, there are four more virtual functions that a Codec +should implement: encode, format, update, and log. If the functions +are not implemented Snort will not throw any errors. However, Snort +may also be unable to accomplish some of its basic functionality. -snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \ - --pcap-filter '*.pcap' --max-packet-threads 8 + * encode is called whenever Snort actively responds and needs to + builds a packet, i.e. whenever a rule using an IPS ACTION like + react, reject, or rewrite is triggered. This function is used to + build the response packet protocol by protocol. + * format is called when Snort is rebuilding a packet. For instance, + every time Snort reassembles a TCP stream or IP fragment, format + is called. Generally, this function either swaps any source and + destination fields in the protocol or does nothing. + * update is similar to format in that it is called when Snort is + reassembling a packet. Unlike format, this function only sets + length fields. + * log is called when either the log_codecs logger or a custom + logger that calls PacketManager::log_protocols is used when + running Snort3.0. -14.3. Plugins +14.5. IPS Actions ------------ -Load external plugins and use the "ex" alert: - -snort -c $my_path/etc/snort/snort.lua \ - --plugin-path $my_path/lib/snort_extra \ - -A alert_ex -r /path/to/my.pcap +Action plugins specify a builtin action in the API which is used to +determine verdict. (Conversely, builtin actions don’t have an +associated plugin function.) -Test the LuaJIT rule option find loaded from stdin: -snort -c $my_path/etc/snort/snort.lua \ - --script-path $my_path/lib/snort_extra \ - --stdin-rules -A cmg -r /path/to/my.pcap << END -alert tcp any any -> any 80 ( - sid:3; msg:"found"; content:"GET"; - find:"pat='HTTP/1%.%d'" ; ) -END +--------------------------------------------------------------------- +15. Coding Style -14.4. Output Files +--------------------------------------------------------------------- ------------- +All new code should try to follow these style guidelines. These are +not yet firm so feedback is welcome to get something we can live +with. -To make it simple to configure outputs when you run with multiple -packet threads, output files are not explicitly configured. Instead, -you can use the options below to format the paths: -/[][][] +15.1. General -Log to unified in the current directory: +------------ -snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 + * Generally try to follow http://google-styleguide.googlecode.com/ + svn/trunk/cppguide.xml, but there are a few differences. -Log to unified in the current directory with a different prefix: -snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \ - --run-prefix take2 +15.2. Naming -Log to unified in /tmp: +------------ -snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp + * Use camel case for namespaces, classes, and types like + WhizBangPdfChecker. + * Use lower case identifiers with underscore separators, e.g. + some_function() and my_var. + * Use lower case filenames with underscores. -Run 4 packet threads and log with thread number prefix (0-3): -snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \ - --pcap-filter '*.pcap' -z 4 -A unified2 +15.3. Comments -Run 4 packet threads and log in thread number subdirs (0-3): +------------ -snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \ - --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir + * Write comments sparingly with a mind towards future proofing. + Often the comments can be obviated with better code. Clear code + is better than a comment. + * Function comment blocks are generally just noise that quickly + becomes obsolete. If you absolutely must comment on parameters, + put each on a separate line along with the comment. That way + changing the signature may prompt a change to the comments too. + * Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left + for a day or even just a minute. That way we can find them easily + and won’t lose track of them. + * Presently using FIXIT-X where X = P | H | M | L, indicating perf, + high, med, or low priority. For now, H, M, or L can indicate + alpha 1, 2, or 3. Perf changes fall between alpha 1 and 2. + * Put the copyright(s) and license in a comment block at the top of + each source file (.h and .cc). Don’t bother with trivial scripts + and make foo. Some interesting Lua code should get a comment + block too. Copy and paste exactly from src/main.h (don’t + reformat). + * Put author, description, etc. in separate comment(s) following + the license. Do not put such comments in the middle of the + license foo. -Note -subdirectories are created automatically if required. Log filename is -based on module name that writes the file. All text mode outputs -default to stdout. These options can be combined. +15.4. Logging -14.4.1. Shell +------------ -You must build with --enable-shell to make the command line shell -available. + * Messages intended for the user should not look like debug + messages. Eg, the function name should not be included. + * Most debug messages should just be deleted. + * Don’t bang your error messages (no !). The user feels bad enough + about the problem already w/o you shouting at him. -Enable shell mode: -snort --shell +15.5. Types -You will see the shell mode command prompt, which looks like this: +------------ -o")~ + * Use logical types to make the code clearer and to help the + compiler catch problems. typedef uint16_t Port; bool foo(Port) is + way better than int foo(int port). + * Use forward declarations (e.g. struct SnortConfig;) instead of + void*. + * Try not to use extern data unless absolutely necessary and then + put the extern in an appropriate header. + * Use const liberally. In most cases, const char* s = "foo" should + be const char* const s = "foo". The former goes in the + initialized data section and the latter in read only data + section. + * But use const char s[] = "foo" instead of const char* s = "foo" + when possible. The latter form allocates a pointer variable and + the data while the former allocates only the data. + * Use static wherever possible to minimize public symbols and + eliminate unneeded relocations. + * Declare functions virtual only in the parent class introducing + the function (not in a derived class that is overriding the + function). This makes it clear which class introduces the + function. + * Declare functions as override if they are intended to override a + function. This makes it possible to find derived implementations + that didn’t get updated and therefore won’t get called due a + change in the parent signature. + * Use bool functions instead of int unless there is truly a need + for multiple error returns. The C-style use of zero for success + and -1 for error is less readable and often leads to messy code + that either ignores the various errors anyway or needlessly and + ineffectively tries to do something aobut them. -(The prompt can be changed with the SNORT_PROMPT environment -variable.) -You can pause immediately after loading the configuration and again -before exiting with: +15.6. Macros (aka defines) -snort --shell --pause +------------ -In that case you must issue the resume() command to continue. Enter -quit() to terminate Snort or detach() to exit the shell. You can list -the available commands with help(). + * In many cases, even in C++, use #define name "value" instead of a + const char* const name = "value" because it will eliminate a + symbol from the binary. + * Use inline functions instead of macros where possible (pretty + much all cases except where stringification is necessary). + Functions offer better typing, avoid re-expansions, and a + debugger can break there. + * All macros except simple const values should be wrapped in () and + all args should be wrapped in () too to avoid surprises upon + expansion. Example: -To enable local telnet access on port 12345: + #define SEQ_LT(a,b) ((int)((a) - (b)) < 0) -snort --shell -j 12345 + * Multiline macros should be blocked (i.e. inside { }) to avoid + if-else type surprises. -The command line interface is still under development. Suggestions -are welcome. -14.4.2. Signals +15.7. Formatting -Note +------------ -The following examples assume that Snort++ is currently running and -has a process ID of . + * Indent 4 space chars … no tabs! + * If you need to indent many times, something could be rewritten or + restructured to make it clearer. Fewer indents is generally + easier to write, easier to read, and overall better code. + * Braces go on the line immediately following a new scope (function + signature, if, else, loop, switch, etc. + * Use consistent spacing and line breaks. Always indent 4 spaces + from the breaking line. Keep lines less than 100 chars; it + greatly helps readability. -Modify and Reload Configuration: + No: + calling_a_func_with_a_long_name(arg1, + arg2, + arg3); -echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua -kill -hup + Yes: + calling_a_func_with_a_long_name( + arg1, arg2, arg3); -Dump stats to stdout: + * Put function signature on one line, except when breaking for the + arg list: -kill -usr1 + No: + inline + bool foo() + { // ... -Shutdown normally: + Yes: + inline bool foo() + { // ... -kill -term + * Put conditional code on the line following the if so it is easy + to break on the conditional block: -Exit without flushing packets: + No: + if ( test ) foo(); -kill -quit + Yes: + if ( test ) + foo(); -List available signals: -snort --help-signals +15.8. Headers -Note +------------ -The available signals may vary from platform to platform. + * Don’t hesitate to create a new header if it is needed. Don’t lump + unrelated stuff into an header because it is convenient. + * Write header guards like this (leading underscores are reserved + for system stuff). In my_header.h: + #ifndef MY_HEADER_H + #define MY_HEADER_H + // ... + #endif -14.5. Optional Features + * Includes from a different directory should specify parent + directory. This makes it clear exactly what is included and + avoids the primordial soup that results from using -I this -I + that -I the_other_thing … . ------------- + // given: + src/foo/foo.cc + src/bar/bar.cc + src/bar/baz.cc -Listed below are the features that must be explicitly enabled so they -are built into the Snort binary. For a full list of build features, -run ./configure --help. + // in baz.cc + #include "bar.h" - * --enable-ppm: enable packet and rule performance monitoring and - coarse latency enforcement. - * --enable-perf-profiling: enable module and rule performance - profiling. - * --enable-shell: enable local and remote command line shell - support. + // in foo.cc + #include "bar/bar.h" + + * Just because it is a #define doesn’t mean it goes in a header. + Everything should be scoped as tightly as possible. Shared + implementation declarations should go in a separate header from + the interface. And so on. + * A .cc should include its own .h before any others (including + system headers). This ensures that the header stands on its own + and can be used by clients without include prerequisites. + * Include required headers, all required headers, and nothing but + required headers. Don’t just clone a bunch of headers because it + is convenient. + * Any file depending of #ifdefs should include config.h as shown + below. A .h should include it before any other includes, and a + .cc should include it immediately after the include of its own + .h. + + #ifdef HAVE_CONFIG_H + #include "config.h" + #endif + + * Do not put using statements in headers. -14.6. Environment Variables +15.9. Warnings ------------ - * HOSTTYPE: optional string that is output with the version at end - of line. - * LUA_PATH: you must export as follows so LuaJIT can find required - files. + * With g++, use at least these compiler flags: - LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\; + -Wall -Wextra -pedantic -Wformat -Wformat-security + -Wunused-but-set-variable -Wno-deprecated-declarations - * SNORT_IGNORE: the list of symbols Snort should ignore when - parsing the Lua conf. Unknown symbols not in SNORT_IGNORE will - cause warnings with --warn-unknown or fatals with --warn-unknown - --pedantic. - * SNORT_LUA_PATH: an optional path where Snort can find - supplemental conf files such as classification.lua. - * SNORT_PROMPT: the character sequence that is printed at startup, - shutdown, and in the shell. The default is the mini-pig: o")~ . - * SNORT_PLUGIN_PATH: an optional path where Snort can find - supplemental shared libraries. This is only used when Snort is - building manuals. Modules in supplemental shared libraries will - be added to the manuals. + * Then Fix All Warnings. None Allowed. -14.7. Command Line Options - ------------- - - 0 gets the number of CPU cores reported by the system - 0 gets the number of CPU cores reported by the system -* *--alert-before-pass* process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,... -* *--bpf* are standard BPF options, as seen in TCPDump -* *--c2x* output hex for given char (see also --x2c) -* *--create-pidfile* create PID file, even when not in Daemon mode -* *--daq* select packet acquisition module (default is pcap) -* *--daq-dir* tell snort where to find desired DAQ -* *--daq-list* list packet acquisition modules available in optional dir, default is static modules only -* *--daq-mode* select the DAQ operating mode -* *--daq-var* specify extra DAQ configuration variable -* *--dirty-pig* don't flush packets on shutdown -* *--dump-builtin-rules* [] output stub rules for selected modules -* *--dump-defaults* [] output module defaults in Lua format -* *--dump-dynamic-rules* output stub rules for all loaded rules libraries -* *--dump-version* output the version, the whole version, and only the version -* *--enable-inline-test* enable Inline-Test Mode Operation -* *--help* list command line options -* *--help-commands* [] output matching commands -* *--help-config* [] output matching config options -* *--help-counts* [] output matching peg counts -* *--help-module* output description of given module -* *--help-modules* list all available modules with brief help -* *--help-options*