From: Russ Combs <rucombs@cisco.com>
Date: Wed, 8 Oct 2014 22:28:07 +0000 (-0400)
Subject: updates to default conf
X-Git-Tag: 3.0.0-233~1383^2~15
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aefd70bd78885d97cedfa287a5f6bc8f855af39d;p=thirdparty%2Fsnort3.git

updates to default conf
---

diff --git a/ChangeLog b/ChangeLog
index 5eb311131..d784e0687 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,7 @@
 -- fixed stream_icmp flow key init
 -- added --warn-flowbits
 -- tweaked flowbits counts start up output
+-- updates to snort.lua and snort_defaults.lua
 
 123
 -- refactored documentation
diff --git a/lua/snort.lua b/lua/snort.lua
index 493464843..b836e3a67 100644
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -24,8 +24,8 @@ require('snort_config')  -- for loading
 -- Setup the network addresses you are protecting
 HOME_NET = 'any'
 
--- Set up the external network addresses. Leave as "any" in most
--- situations
+-- Set up the external network addresses.
+-- (leave as "any" in most situations)
 EXTERNAL_NET = 'any'
 
 dir = os.getenv('SNORT_LUA_PATH')
@@ -43,7 +43,7 @@ dofile(dir .. 'reference.lua')
 ---------------------------------------------------------------------------
 --
 -- mod = { } uses internal defaults
--- you can see them with --help-module mod
+-- you can see them with snort --help-module mod
 -- comment or delete to disable mod functionality
 --
 -- you can also use default_ftp_server and default_wizard
@@ -64,11 +64,7 @@ port_scan = { }
 
 http_inspect = { }
 http_server = { }
---nhttp_inspect =
---{
---    test_input = false,
---    test_output = false
---}
+--nhttp_inspect = { }
 
 telnet = { }
 
@@ -95,14 +91,23 @@ wizard = default_wizard
 local_rules =
 [[
 # snort-classic comments, includes, and rules with $VARIABLES
-alert tcp any any -> any 80 ( sid:1; http_method; content:"GET"; )
+
+alert tcp any any -> any [80 81] ( sid:1; msg:"test"; http_method; content:"GE", offset 0, depth 2; content:"T", distance 0, within 1; )
+
+#alert tcp any any -> any [80 81] ( sid:1; msg:"test"; http_method; find:"pat = 'GET'"; )
 ]]
 
 ips =
 {
     --include = '../test.rules',
     --include = '../rules/active.rules',
-    rules = local_rules,
+    --rules = local_rules,
     --enable_builtin_rules = true
 }
 
+---------------------------------------------------------------------------
+-- set up any custom loggers
+---------------------------------------------------------------------------
+
+alert_test = { file = false }
+
diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index 44a386ffd..41434b308 100644
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -1,5 +1,5 @@
 ---------------------------------------------------------------------------
--- Snort++ defaults -- DO NOT EDIT
+-- Snort++ defaults
 --
 -- include in your snort.lua with a dofile statement
 -- after you set HOME_NET and EXTERNAL_NET
@@ -206,9 +206,35 @@ default_ftp_server =
 -- default wizard
 ---------------------------------------------------------------------------
 
-http_methods = { 'GET', 'POST', 'HEAD' } -- build from default_http_methods
-ftp_commands = { 'USER' } -- add others
-sip_methods = { 'INVITE', 'NOTIFY' } -- add others
+http_methods =  -- build from default_http_methods
+{
+    'GET', 'POST', 'PUT', 'SEARCH', 'MKCOL', 'COPY', 'MOVE', 'LOCK', 'UNLOCK',
+    'NOTIFY', 'POLL', 'BCOPY', 'BDELETE', 'BMOVE', 'LINK', 'UNLINK', 'OPTIONS',
+    'HEAD', 'DELETE', 'TRACE', 'TRACK', 'CONNECT', 'SOURCE', 'SUBSCRIBE',
+    'UNSUBSCRIBE', 'PROPFIND', 'PROPPATCH', 'BPROPFIND', 'BPROPPATCH',
+    'RPC_CONNECT', 'PROXY_SUCCESS', 'BITS_POST', 'CCM_POST', 'SMS_POST',
+    'RPC_IN_DATA', 'RPC_OUT_DATA', 'RPC_ECHO_DATA'
+}
+
+ftp_commands =  -- build from ftp_default_commands
+{
+    'ABOR', 'ACCT', 'ADAT', 'ALLO', 'APPE', 'AUTH', 'CCC', 'CDUP', 'CEL',
+    'CLNT', 'CMD', 'CONF', 'CWD', 'DELE', 'ENC', 'EPRT', 'EPSV', 'ESTA',
+    'ESTP', 'FEAT', 'HELP', 'LANG', 'LIST', 'LPRT', 'LPSV', 'MACB', 'MAIL',
+    'MDTM', 'MIC', 'MKD', 'MLSD', 'MLST', 'MODE', 'NLST', 'NOOP', 'OPTS',
+    'PASS', 'PASV', 'PBSZ', 'PORT', 'PROT', 'PWD', 'QUIT', 'REIN', 'REST',
+    'RETR', 'RMD', 'RNFR', 'RNTO', 'SDUP', 'SITE', 'SIZE', 'SMNT', 'STAT',
+    'STOR', 'STOU', 'STRU', 'SYST', 'TEST', 'TYPE', 'USER', 'XCUP', 'XCRC',
+    'XCWD', 'XMAS', 'XMD5', 'XMKD', 'XPWD', 'XRCP', 'XRMD', 'XRSQ', 'XSEM',
+    'XSEN', 'XSHA1', 'XSHA256'
+}
+
+sip_methods =
+{
+    'INVITE', 'CANCEL', 'ACK', 'BYE', 'REGISTER', 'OPTIONS', 'REFER', 'SUBSCRIBE',
+    'UPDATE', 'JOIN', 'INFO', 'MESSAGE', 'NOTIFY', 'PRACK'
+}
+
 isakmp_hex = { '?????????????????|01|', '?????????????????|10|' }
 
 telnet_commands =