From: Russ Combs Date: Thu, 28 Aug 2014 15:38:47 +0000 (-0400) Subject: fixed bind action X-Git-Tag: 3.0.0-233~1417^2~12^2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=76ee9a043f2c002ea8a46d69f05dec86fea12b19;p=thirdparty%2Fsnort3.git fixed bind action --- diff --git a/ChangeLog b/ChangeLog index 1d8366128..801217f9a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,6 @@ +118 +-- fixed bind action + 117 -- added --stdin-rules -- added #begin / #end comments for rules diff --git a/src/flow/flow.h b/src/flow/flow.h index 8c01fda20..028a6263f 100644 --- a/src/flow/flow.h +++ b/src/flow/flow.h @@ -161,7 +161,10 @@ public: void set_ttl(Packet*, bool client); - bool was_blocked() + void block() + { s5_state.session_flags |= SSNFLAG_BLOCK; }; + + bool was_blocked() const { return (s5_state.session_flags & SSNFLAG_BLOCK) != 0; }; void set_client(Inspector* ins) diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index 89c2e232e..e69f5762f 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -274,6 +274,7 @@ unsigned FlowControl::process(FlowCache* cache, Packet* p) switch ( flow->flow_state ) { case 1: // block + // FIXIT-H this clears flow state! stream.drop_packet(p); break; diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc index 1edb13bb8..a419498fc 100644 --- a/src/network_inspectors/binder/bind_module.cc +++ b/src/network_inspectors/binder/bind_module.cc @@ -30,7 +30,16 @@ using namespace std; #include "binder.h" #include "protocols/packet.h" -THREAD_LOCAL SimpleStats bstats; +THREAD_LOCAL BindStats bstats; + +static const char* bind_pegs[] = +{ + "packets", + "blocks", + "allows", + "inspects", + nullptr +}; //------------------------------------------------------------------------- // binder module @@ -64,7 +73,7 @@ static const Parameter binder_when_params[] = static const Parameter binder_use_params[] = { - { "action", Parameter::PT_ENUM, "inspect | allow | block", "inspect", + { "action", Parameter::PT_ENUM, "block | allow | inspect", "inspect", "what to do with matching traffic" }, { "file", Parameter::PT_STRING, nullptr, nullptr, @@ -146,7 +155,7 @@ bool BinderModule::set(const char* fqn, Value& v, SnortConfig*) // use else if ( v.is("action") ) - work->action = (BindAction)v.get_long(); + work->action = (BindAction)(v.get_long() + 1); else if ( v.is("file") ) work->file = v.get_string(); @@ -187,7 +196,7 @@ vector BinderModule::get_data() } const char** BinderModule::get_pegs() const -{ return simple_pegs; } +{ return bind_pegs; } PegCount* BinderModule::get_counts() const { return (PegCount*)&bstats; } diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h index 5425fff4e..82999a7ae 100644 --- a/src/network_inspectors/binder/bind_module.h +++ b/src/network_inspectors/binder/bind_module.h @@ -27,7 +27,13 @@ #include "framework/module.h" #include "main/thread.h" -extern THREAD_LOCAL SimpleStats bstats; +struct BindStats +{ + PegCount packets; + PegCount verdicts[3]; +}; + +extern THREAD_LOCAL BindStats bstats; extern THREAD_LOCAL ProfileStats bindPerfStats; struct Binding; diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index 8744f7802..a38ac98db 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -108,7 +108,8 @@ public: { bindings.push_back(b); }; private: - int check_rules(Flow*, Packet*); + Binding* get_binding(Flow*, Packet*); + BindAction apply(Flow*, Binding*); void init_flow(Flow*); private: @@ -129,8 +130,12 @@ Binder::~Binder() void Binder::eval(Packet* p) { Flow* flow = p->flow; - flow->flow_state = check_rules(flow, p); - ++bstats.total_packets; + + Binding* pb = get_binding(flow, p); + flow->flow_state = apply(flow, pb); + + ++bstats.verdicts[flow->flow_state - 1]; + ++bstats.packets; } // FIXIT-H implement inspector lookup from policy / bindings @@ -182,7 +187,7 @@ int Binder::exec(int, void* pv) // FIXIT-H bind services - this is a temporary hack that just looks at ports, // need to examine all key fields for matching. ultimately need a routing // table, scapegoat tree, etc. -int Binder::check_rules(Flow* flow, Packet* p) +Binding* Binder::get_binding(Flow* flow, Packet* p) { Binding* pb; unsigned i, sz = bindings.size(); @@ -201,12 +206,26 @@ int Binder::check_rules(Flow* flow, Packet* p) if ( pb->ports.test(port) ) break; } - + + // absent a specific rule, we must choose a course of action + // so we act as if binder wasn't configured at all if ( i == sz ) - return BA_ALLOW; // default action FIXIT-H make configurable + return nullptr; + + return pb; +} + +BindAction Binder::apply(Flow* flow, Binding* pb) +{ + if ( !pb ) + return BA_ALLOW; if ( pb->action != BA_INSPECT ) + { + if ( pb->action == BA_BLOCK ) + stream.drop_traffic(flow, SSN_DIR_BOTH); return pb->action; + } init_flow(flow); Inspector* ins; diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc index 94178aad4..0e1fcb30c 100644 --- a/src/stream/stream_api.cc +++ b/src/stream/stream_api.cc @@ -273,8 +273,7 @@ uint32_t Stream::get_packet_direction(Packet *p) return (p->packet_flags & (PKT_FROM_SERVER|PKT_FROM_CLIENT)); } -void Stream::drop_traffic( - Packet*, Flow* flow, char dir) +void Stream::drop_traffic(Flow* flow, char dir) { if (!flow) return; @@ -305,7 +304,7 @@ void Stream::drop_packet(Packet *p) flow->session->clear(); if (!(p->packet_flags & PKT_STATELESS)) - drop_traffic(p, flow, SSN_DIR_BOTH); + drop_traffic(flow, SSN_DIR_BOTH); } uint32_t Stream::set_session_flags(Flow* flow, uint32_t flags) diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h index 57bfbc3d8..3c01be2bb 100644 --- a/src/stream/stream_api.h +++ b/src/stream/stream_api.h @@ -117,7 +117,7 @@ public: /* Drop traffic arriving on session. */ - static void drop_traffic(Packet*, Flow*, char dir); + static void drop_traffic(Flow*, char dir); /* Drop retransmitted packet arriving on session. */