From: Russ Combs (rucombs) Date: Tue, 6 Jun 2017 15:47:56 +0000 (-0400) Subject: Merge pull request #916 in SNORT/snort3 from conf_updates to master X-Git-Tag: 3.0.0-239~57 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=830605b0f09b45b8aee850aaf0700b4357a2ca1e;p=thirdparty%2Fsnort3.git Merge pull request #916 in SNORT/snort3 from conf_updates to master Squashed commit of the following: commit 647890ba3c1031f60fafa55ef606a8645466582d Author: Russ Combs Date: Sun Jun 4 09:22:51 2017 -0400 conf: refactor for clarity commit a75b80cb43914841fd8821d4f3e4e3dad295d195 Author: Russ Combs Date: Sun Jun 4 08:49:56 2017 -0400 conf: use updated external defaults, change internal defaults to enable file_id type and signature commit 2ec586b505cf8f3e0f9999ecf5b4279c6f10935b Author: Russ Combs Date: Sun Jun 4 08:47:34 2017 -0400 conf: update defaults - remove old http cruft, add smtp defaults --- diff --git a/lua/snort.lua b/lua/snort.lua index 1ee8fc95c..f387b4378 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -2,32 +2,32 @@ -- Snort++ configuration --------------------------------------------------------------------------- +-- 1. configure environment +-- 2. configure dependencies +-- 3. configure modules +-- 4. configure rules + --------------------------------------------------------------------------- --- setup environment +-- 1. configure environment --------------------------------------------------------------------------- + -- given: -- export DIR=/install/path -- configure --prefix=$DIR -- make install --- + -- then: -- export LUA_PATH=$DIR/include/snort/lua/?.lua\;\; -- export SNORT_LUA_PATH=$DIR/etc/snort + --------------------------------------------------------------------------- --------------------------------------------------------------------------- --- setup the basics +-- 2. configure dependencies --------------------------------------------------------------------------- require('snort_config') -- for loading --- Setup the network addresses you are protecting -HOME_NET = 'any' - --- Set up the external network addresses. --- (leave as "any" in most situations) -EXTERNAL_NET = 'any' - conf_dir = os.getenv('SNORT_LUA_PATH') if ( not conf_dir ) then @@ -38,7 +38,7 @@ dofile(conf_dir .. '/snort_defaults.lua') dofile(conf_dir .. '/file_magic.lua') --------------------------------------------------------------------------- --- configure modules +-- 3. configure modules --------------------------------------------------------------------------- -- -- mod = { } uses internal defaults @@ -48,10 +48,10 @@ dofile(conf_dir .. '/file_magic.lua') -- you can also use default_ftp_server and default_wizard --------------------------------------------------------------------------- - -- uncomment normalizer if you are inline or not --pedantic --normalizer = { } +-- uncomment these to analyze Snort performance --latency = { } --profiler = { } --perf_monitor = { } @@ -69,10 +69,8 @@ arp_spoof = { } back_orifice = { } dnp3 = { } dns = { } -gtp_inspect = default_gtp http_inspect = { } imap = { } -smtp = { } pop = { } port_scan = { } reputation = { } @@ -82,16 +80,36 @@ ssh = { } ssl = { } telnet = { } +-- see snort_defaults.lua for default_* +gtp_inspect = default_gtp +smtp = default_smtp + ftp_server = default_ftp_server ftp_client = { } ftp_data = { } -file_id = -{ - enable_type = true, - enable_signature = true, - file_rules = file_magic, -} +-- see file_magic.lua for file id rules +file_id = { file_rules = file_magic } wizard = default_wizard +--------------------------------------------------------------------------- +-- 4. configure rules +--------------------------------------------------------------------------- + +-- setup the network addresses you are protecting +HOME_NET = 'any' + +-- set up the external network addresses. +-- (leave as "any" in most situations) +EXTERNAL_NET = 'any' + +-- see snort_defaults.lua for other nets, ports, and servers +-- and default references and classifications + +references = default_references +classifications = default_classifications + +-- use snort -R $SNORT_LUA_PATH/sample.rules and/or set ips params +ips = { } + diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua index 23d3e2dd9..20224a7b4 100644 --- a/lua/snort_defaults.lua +++ b/lua/snort_defaults.lua @@ -118,7 +118,7 @@ RPC_PORTS = -- default ftp server --------------------------------------------------------------------------- -ftp_default_commands = +ftp_default_cmds = [[ ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP CEL CLNT CMD CONF CWD DELE ENC EPRT EPSV ESTA ESTP FEAT HELP LANG LIST LPRT LPSV MACB MAIL MDTM MIC @@ -213,16 +213,8 @@ ftp_command_specs = default_ftp_server = { - def_max_param_len = 100, - - encrypted_traffic = false, - check_encrypted = true, - print_cmds = false, - telnet_cmds = true, - ignore_telnet_erase_cmds = true, - ignore_data_chan = true, - - ftp_cmds = ftp_default_commands, + -- params not specified here get internal defaults + ftp_cmds = ftp_default_cmds, data_chan_cmds = ftp_default_data_chan_cmds, data_xfer_cmds = ftp_default_data_xfer_cmds, file_put_cmds = ftp_default_file_put_cmds, @@ -234,142 +226,45 @@ default_ftp_server = } --------------------------------------------------------------------------- --- default http profiles +-- default smtp configuration --------------------------------------------------------------------------- -http_profile_default = -{ - profile_type = 'default', - server_flow_depth = 300, - client_flow_depth = 300, - post_depth = -1, - chunk_length = 500000, - ascii = true, - multi_slash = true, - directory = true, - webroot = true, - double_decode = true, - u_encode = true, - bare_byte = true, - iis_unicode = true, - iis_backslash = true, - iis_delimiter = true, - apache_whitespace = true, - non_strict = true, - normalize_utf = true, - normalize_javascript = false, - max_header_length = 0, - max_headers = 0, - max_spaces = 200, - max_javascript_whitespaces = 200, - whitespace_chars ='0x9 0xb 0xc 0xd' -} +smtp_default_auth_cmds = +[[ + AUTH XAUTH X-EXPS +]] -http_profile_apache = -{ - profile_type = 'apache', - server_flow_depth = 300, - client_flow_depth = 300, - post_depth = -1, - chunk_length = 500000, - ascii = true, - multi_slash = true, - directory = true, - webroot = true, - utf_8 = true, - apache_whitespace = true, - non_strict = true, - normalize_utf = true, - normalize_javascript = false, - max_header_length = 0, - max_headers = 0, - max_spaces = 200, - max_javascript_whitespaces = 200, - whitespace_chars ='0x9 0xb 0xc 0xd' -} +smtp_default_binary_data_cmds = +[[ + BDAT XEXCH50 +]] -http_profile_iis = -{ - profile_type = 'iis', - server_flow_depth = 300, - client_flow_depth = 300, - post_depth = -1, - chunk_length = 500000, - ascii = true, - multi_slash = true, - directory = true, - webroot = true, - double_decode = false, - u_encode = true, - bare_byte = true, - iis_unicode = true, - iis_backslash = true, - iis_delimiter = true, - apache_whitespace = true, - non_strict = true, - normalize_utf = true, - normalize_javascript = false, - max_header_length = 0, - max_headers = 0, - max_spaces = 200, - max_javascript_whitespaces = 200, - whitespace_chars ='0x9 0xb 0xc 0xd' -} +smtp_default_data_cmds = +[[ + DATA +]] -http_profile_iis_40 = -{ - profile_type = 'iis_40', - server_flow_depth = 300, - client_flow_depth = 300, - post_depth = -1, - chunk_length = 500000, - ascii = true, - multi_slash = true, - directory = true, - webroot = true, - double_decode = true, - u_encode = true, - bare_byte = true, - iis_unicode = true, - iis_backslash = true, - iis_delimiter = true, - apache_whitespace = true, - non_strict = true, - normalize_utf = true, - normalize_javascript = false, - max_header_length = 0, - max_headers = 0, - max_spaces = 200, - max_javascript_whitespaces = 200, - whitespace_chars ='0x9 0xb 0xc 0xd' -} +smtp_default_normalize_cmds = +[[ + RCPT VRFY EXPN +]] + +smtp_default_valid_cmds = +[[ + ATRN AUTH BDAT DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY EXPN HELO + HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SIZE SOML + STARTTLS TICK TIME TURN TURNME VERB VRFY X-EXPS X-LINK2STATE XADR XAUTH + XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR +]] -http_profile_iis_50 = +default_smtp = { - profile_type = 'iis_50', - server_flow_depth = 300, - client_flow_depth = 300, - post_depth = -1, - chunk_length = 500000, - ascii = true, - multi_slash = true, - directory = true, - webroot = true, - double_decode = true, - u_encode = true, - bare_byte = true, - iis_unicode = true, - iis_backslash = true, - iis_delimiter = true, - apache_whitespace = true, - non_strict = true, - normalize_utf = true, - normalize_javascript = false, - max_header_length = 0, - max_headers = 0, - max_spaces = 200, - max_javascript_whitespaces = 200, - whitespace_chars ='0x9 0xb 0xc 0xd' + -- params not specified here get internal defaults + auth_cmds = smtp_default_auth_cmds, + binary_data_cmds = smtp_default_binary_data_cmds, + data_cmds = smtp_default_data_cmds, + normalize_cmds = smtp_default_normalize_cmds, + valid_cmds = smtp_default_valid_cmds, } --------------------------------------------------------------------------- @@ -389,7 +284,7 @@ http_methods = -- build from default_http_methods 'UNSUBSCRIBE', 'X_MS_ENUMATTS', } -ftp_commands = -- build from ftp_default_commands +ftp_commands = -- build from ftp_default_cmds { 'ABOR', 'ACCT', 'ADAT', 'ALLO', 'APPE', 'AUTH', 'CCC', 'CDUP', 'CEL', 'CLNT', 'CMD', 'CONF', 'CWD', 'DELE', 'ENC', 'EPRT', 'EPSV', 'ESTA', @@ -483,7 +378,7 @@ default_wizard = -- default references --------------------------------------------------------------------------- -references = +default_references = { { name = 'bugtraq', url = 'http://www.securityfocus.com/bid/' }, { name = 'cve', url = 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=' }, @@ -499,7 +394,7 @@ references = -- default classifications --------------------------------------------------------------------------- -classifications = +default_classifications = { { name = 'not-suspicious', priority = 3, text = 'Not Suspicious Traffic' }, diff --git a/src/file_api/file_module.cc b/src/file_api/file_module.cc index da7dbc4c2..e843b626e 100644 --- a/src/file_api/file_module.cc +++ b/src/file_api/file_module.cc @@ -144,10 +144,10 @@ static const Parameter file_id_params[] = { "max_files_cached", Parameter::PT_INT, "8:", "65536", "maximal number of files cached in memory" }, - { "enable_type", Parameter::PT_BOOL, nullptr, "false", + { "enable_type", Parameter::PT_BOOL, nullptr, "true", "enable type ID" }, - { "enable_signature", Parameter::PT_BOOL, nullptr, "false", + { "enable_signature", Parameter::PT_BOOL, nullptr, "true", "enable signature calculation" }, { "enable_capture", Parameter::PT_BOOL, nullptr, "false",