From: Russ Combs Date: Thu, 22 Jan 2015 21:55:46 +0000 (-0500) Subject: snort2lua default port bindings X-Git-Tag: 3.0.0-233~1072 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b49201fcda224e52cb561330212c842ee8da232c;p=thirdparty%2Fsnort3.git snort2lua default port bindings --- diff --git a/ChangeLog b/ChangeLog index cbb877b40..3f220763b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ pending - build 134 +-- snort2lua changed to add bindings for default ports if not explicitly + configured -- added md5, sha256, and sha512 rule options based on Snort 2.X protected_content diff --git a/tools/snort2lua/config_states/config_ignore_ports.cc b/tools/snort2lua/config_states/config_ignore_ports.cc index 7dc944493..9c2c12cbe 100644 --- a/tools/snort2lua/config_states/config_ignore_ports.cc +++ b/tools/snort2lua/config_states/config_ignore_ports.cc @@ -47,7 +47,6 @@ public: bool IgnorePorts::convert(std::istringstream& data_stream) { - Binder bind(table_api); bool retval = true; std::string keyword; std::string port; @@ -67,6 +66,8 @@ bool IgnorePorts::convert(std::istringstream& data_stream) return false; } + // Only add to the binder once we have validated the configuration. + Binder bind(table_api); bind.set_when_proto(keyword); while (data_stream >> port) @@ -121,11 +122,13 @@ bool IgnorePorts::convert(std::istringstream& data_stream) { data_api.failed_conversion(data_stream, "can't convert " + port); retval = false; + bind.print_binding(false); // don't print the binding if an error occured } catch(std::out_of_range) { data_api.failed_conversion(data_stream, "Port" + port + " must be <= 65535"); retval = false; + bind.print_binding(false); // don't print the binding if an error occured } } diff --git a/tools/snort2lua/helpers/util_binder.h b/tools/snort2lua/helpers/util_binder.h index 826cbe19d..49715454e 100644 --- a/tools/snort2lua/helpers/util_binder.h +++ b/tools/snort2lua/helpers/util_binder.h @@ -26,14 +26,18 @@ class TableApi; -// If the user never adds add_to_configuration, -// the destructor will call the method +// The Binders destrutor will add the Objects configuration to the +// table_api. class Binder { public: Binder(TableApi&); ~Binder(); + // By calling add_to_configuration(), you are adding this Binder Object + // "as is" to the table_api. Additionally, after calling + // add_to_configuration(), the destructor will NOT add the object to the + // table_api unless 'print_binding(true)' is called. void add_to_configuration(); void print_binding(bool should_print) { printed = !should_print; } diff --git a/tools/snort2lua/keyword_states/kws_attribute_table.cc b/tools/snort2lua/keyword_states/kws_attribute_table.cc index 14bdd0686..a99c4b094 100644 --- a/tools/snort2lua/keyword_states/kws_attribute_table.cc +++ b/tools/snort2lua/keyword_states/kws_attribute_table.cc @@ -24,6 +24,7 @@ #include "conversion_state.h" #include "helpers/s2l_util.h" +#include "helpers/parse_cmd_line.h" namespace keywords @@ -438,10 +439,20 @@ bool AttributeTable::convert(std::istringstream& data_stream) if (!util::file_exists(file)) { - table_api.open_table("hosts"); - table_api.add_comment("unable to open the attribute file: " + file); - table_api.close_table(); - return false; + std::string full_file = parser::get_conf_dir() + file; + + if (!util::file_exists(full_file)) + { + table_api.open_table("hosts"); + table_api.add_comment("unable to open the attribute file: " + file); + table_api.close_table(); + + std::string error_string = "Can't find file " + file + ". " + " Searched locations: " + file + ", " + full_file; + data_api.failed_conversion(data_stream, error_string); + return false; + } + file = full_file; } table_api.open_table("hosts"); diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc index 92681de3a..317c34922 100644 --- a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc +++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc @@ -184,6 +184,7 @@ bool FtpServer::convert(std::istringstream& data_stream) { std::string keyword; bool retval = true; + bool ports_set = false; Binder bind(table_api); bind.set_use_type("ftp_server"); bind.set_when_proto("tcp"); @@ -276,12 +277,14 @@ bool FtpServer::convert(std::istringstream& data_stream) { table_api.add_diff_option_comment("ports", "bindings"); table_api.add_comment("check bindings table for port information"); - // add commented list for now - std::string tmp = ""; + if ((data_stream >> keyword) && !keyword.compare("{")) { while (data_stream >> keyword && keyword.compare("}")) + { bind.add_when_port(keyword); + ports_set = true; + } } else { @@ -336,6 +339,9 @@ bool FtpServer::convert(std::istringstream& data_stream) table_api.close_table(); } + if (!ports_set) + bind.add_when_port("21"); + return retval; } @@ -373,6 +379,7 @@ bool FtpClient::convert(std::istringstream& data_stream) { if(!keyword.compare("default")) { + bind.add_when_service("ftp"); table_api.open_table("ftp_client"); } else @@ -500,7 +507,7 @@ public: bool Telnet::convert(std::istringstream& data_stream) { std::string keyword; - int i_val; + bool ports_set = false; bool retval = true; Binder bind(table_api); @@ -511,17 +518,22 @@ bool Telnet::convert(std::istringstream& data_stream) while(data_stream >> keyword) { bool tmpval = true; - if(!keyword.compare("ayt_attack_thresh")) + + if(!keyword.compare("normalize")) + tmpval = table_api.add_option("normalize", true); + + else if(!keyword.compare("detect_anomalies")) + table_api.add_deleted_comment("detect_anomalies"); + + else if(!keyword.compare("ayt_attack_thresh")) { + int i_val; + if(data_stream >> i_val) tmpval = table_api.add_option("ayt_attack_thresh", i_val); else tmpval = false; } - - else if(!keyword.compare("normalize")) - tmpval = table_api.add_option("normalize", true); - else if(!keyword.compare("ports")) { table_api.add_diff_option_comment("ports", "bindings"); @@ -531,23 +543,34 @@ bool Telnet::convert(std::istringstream& data_stream) if ((data_stream >> keyword) && !keyword.compare("{")) { while (data_stream >> keyword && keyword != "}") + { + ports_set = true; bind.add_when_port(keyword); + } } else { - tmpval = false; + data_api.failed_conversion(data_stream, "ports - invalid port list"); + retval = false; } } - - else if(!keyword.compare("detect_anomalies")) - table_api.add_deleted_comment("detect_anomalies"); - else + { tmpval = false; + } - retval = tmpval && retval; + + if (!tmpval) + { + data_api.failed_conversion(data_stream, keyword); + retval = false; + } } + // adding the defualt port. + if (!ports_set) + bind.add_when_port("23"); + return retval; } diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc index 4303ab94e..e2ee13553 100644 --- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc +++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc @@ -56,6 +56,7 @@ bool HttpInspectServer::convert(std::istringstream& data_stream) { std::string keyword; bool retval = true; + bool ports_set = false; Binder bind(table_api); bind.set_when_proto("tcp"); @@ -380,7 +381,10 @@ bool HttpInspectServer::convert(std::istringstream& data_stream) if ((data_stream >> keyword) && !keyword.compare("{")) { while (data_stream >> keyword && keyword.compare("}")) + { + ports_set = true; bind.add_when_port(keyword); + } } else { @@ -461,6 +465,9 @@ bool HttpInspectServer::convert(std::istringstream& data_stream) } } + if (!ports_set) + bind.add_when_port("80"); + return retval; } diff --git a/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc b/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc index f3dffaeaf..76f3d0bef 100644 --- a/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc +++ b/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc @@ -33,31 +33,51 @@ namespace { class RpcDecode : public ConversionState { public: - RpcDecode(Converter& c) : ConversionState(c) {}; - virtual ~RpcDecode() {}; + RpcDecode(Converter& c); + virtual ~RpcDecode(); virtual bool convert(std::istringstream& data_stream); + +private: + bool converted_args; }; } // namespace -bool RpcDecode::convert(std::istringstream& data_stream) +RpcDecode::RpcDecode(Converter& c) : ConversionState(c) { + converted_args = false; +} +RpcDecode::~RpcDecode() +{ + if (!converted_args) + { + Binder bind(table_api); + bind.set_when_proto("tcp"); + bind.add_when_port("111"); + bind.add_when_port("32271"); + bind.set_use_type("rpc_decode"); + + table_api.open_table("rpc_decode"); + table_api.close_table(); + } +} + +bool RpcDecode::convert(std::istringstream& data_stream) +{ bool retval = true; + bool ports_set = false; std::string keyword; // adding the binder entry Binder bind(table_api); bind.set_when_proto("tcp"); bind.set_use_type("rpc_decode"); - std::string port_list = std::string(); table_api.open_table("rpc_decode"); while(data_stream >> keyword) { - bool tmpval = true; - if(!keyword.compare("no_alert_multiple_requests")) table_api.add_deleted_comment("no_alert_multiple_requests"); @@ -71,18 +91,25 @@ bool RpcDecode::convert(std::istringstream& data_stream) table_api.add_deleted_comment("no_alert_incomplete"); else if (isdigit(keyword[0])) + { bind.add_when_port(keyword); - + ports_set = true; + } else - tmpval = false; - - if (!tmpval) { data_api.failed_conversion(data_stream, keyword); retval = false; + } } + if (!ports_set) + { + bind.add_when_port("111"); + bind.add_when_port("32271"); + } + + converted_args = true; return retval; } @@ -91,9 +118,7 @@ bool RpcDecode::convert(std::istringstream& data_stream) **************************/ static ConversionState* ctor(Converter& c) -{ - return new RpcDecode(c); -} +{ return new RpcDecode(c); } static const ConvertMap preprocessor_rpc_decode = { diff --git a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc index 27510c537..b8db22148 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc @@ -42,7 +42,10 @@ private: Binder* bind_client; Binder* bind_server; Binder* bind_any; + Binder* bind_default; bool binding_chosen; + bool ports_set; + bool protos_set; std::vector client_protocols; std::vector server_protocols; std::vector any_protocols; @@ -60,7 +63,10 @@ StreamTcp::StreamTcp(Converter& c) : ConversionState(c) bind_client = nullptr; bind_server = nullptr; bind_any = nullptr; + bind_default = nullptr; binding_chosen = false; + ports_set = false; + protos_set = false; } void StreamTcp::add_to_bindings(binder_func func, std::string param) @@ -154,11 +160,14 @@ bool StreamTcp::parse_ports(std::istringstream& arg_stream) bind_client->set_when_role("client"); } bind->print_binding(true); + bind_default = bind; // do nothing if no ports provided if (arg_stream >> port ) { - // for all, don't set the ports variable + ports_set = true; + + // don't set the ports variable for "all" if (!port.compare("all")) void(0); @@ -226,11 +235,14 @@ bool StreamTcp::parse_protocol(std::istringstream& arg_stream) bind_client->set_when_role("client"); } bind->print_binding(true); + bind_default = bind; // do nothing if no ports provided if (arg_stream >> protocol ) { - // for all, don't set the ports variable + protos_set = true; + + // for all, don't set the protos variable if (!protocol.compare("all")) void(0); @@ -283,6 +295,7 @@ bool StreamTcp::convert(std::istringstream& data_stream) bind_client = &client; bind_server = &server; bind_any = &any; + bind_default = bind_client; add_to_bindings(&Binder::set_when_proto, "tcp"); add_to_bindings(&Binder::set_use_type, "stream_tcp"); @@ -473,6 +486,30 @@ bool StreamTcp::convert(std::istringstream& data_stream) } } + if (!ports_set) + { + const std::vector default_ports = {"21", "23", "25", "42", + "53", "80", "110", "111", "135", "136", "137", "139", "143", "445", + "513", "514", "1433", "1521", "2401", "3306"}; + + for (const std::string& s : default_ports) + bind_default->add_when_port(s); + } + + if (!protos_set) + { + const std::vector default_protos = {"ftp", "telnet", + "smtp", "nameserver", "dns", "http", "pop3", "sunrpc", "dcerpc", + "netbios-ssn", "imap", "login", "shell", "mssql", "oracle", "cvs", + "mysql"}; + + for (const std::string& s : default_protos) + { + Binder b = *bind_default; + b.set_when_service(s); + } + bind_default->print_binding(false); // Binder was added in the for loop + } if (!client_protocols.empty()) @@ -481,9 +518,8 @@ bool StreamTcp::convert(std::istringstream& data_stream) { Binder b = client; b.set_when_service(s); - b.add_to_configuration(); } - client.print_binding(false); // we just printed + client.print_binding(false); // Binder was added in the for loop } if (!server_protocols.empty()) @@ -492,9 +528,8 @@ bool StreamTcp::convert(std::istringstream& data_stream) { Binder b = server; b.set_when_service(s); - b.add_to_configuration(); } - server.print_binding(false); // we just printed + server.print_binding(false); // Binder was added in the for loop } if (!any_protocols.empty()) @@ -503,9 +538,8 @@ bool StreamTcp::convert(std::istringstream& data_stream) { Binder b = any; b.set_when_service(s); - b.add_to_configuration(); } - any.print_binding(false); // we just printed + any.print_binding(false); // Binder was added in the for loop } table_api.close_table(); // "tcp_stream"