From: Hui Cao (huica) Date: Fri, 1 Jul 2016 15:49:12 +0000 (-0400) Subject: Merge pull request #548 in SNORT/snort3 from appid_ws2_plugins_101 to master X-Git-Tag: 3.0.0-233~344 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ca3d6fcc943d8265c0130aa2f1f2d99b56de55eb;p=thirdparty%2Fsnort3.git Merge pull request #548 in SNORT/snort3 from appid_ws2_plugins_101 to master Squashed commit of the following: commit 72cc1d3181ddb17e6ee58fd50c17da7b2bde1971 Author: davis mcpherson Date: Tue Jun 28 16:27:10 2016 -0400 enable bit torrent client & service detectors Added count of SSH clients detected. fix appid usage of SearchTool match callback position parameter to ignore for ssh clients bit torrent client pattern check should be don't care on pattern position in the payload add statistics for bittorrent clients/services, fix imap stats counting remove old comment, use #def for banner string length --- diff --git a/src/main/snort_debug.h b/src/main/snort_debug.h index 0049e26c6..540add35a 100644 --- a/src/main/snort_debug.h +++ b/src/main/snort_debug.h @@ -91,7 +91,7 @@ #define DEBUG_APPID 0x0400000000000000LL #ifdef PIGLET -#define DEBUG_PIGLET 0x0400000000000000LL +#define DEBUG_PIGLET 0x0800000000000000LL #endif diff --git a/src/network_inspectors/appid/appid_module.cc b/src/network_inspectors/appid/appid_module.cc index 5fd5f6335..5a27b4fa0 100644 --- a/src/network_inspectors/appid/appid_module.cc +++ b/src/network_inspectors/appid/appid_module.cc @@ -37,6 +37,9 @@ THREAD_LOCAL ProfileStats appidPerfStats; const PegInfo appid_pegs[] = { { "packets", "count of packets processed by appid" }, + { "bit_clients", "count of bittorrent clients discovered by appid" }, + { "bit_flows", "count of bittorrent flows discovered by appid" }, + { "bittracker_clients", "count of bittorrent tracker clients discovered by appid" }, { "dns_udp_flows", "count of dns flows over udp discovered by appid" }, { "dns_tcp_flows", "count of dns flows over tcp discovered by appid" }, { "ftp_flows", "count of ftp flows discovered by appid" }, @@ -46,6 +49,7 @@ const PegInfo appid_pegs[] = { "pop flows", "count of pop service flows discovered by appid" }, { "smtp_flows", "count of smtp flows discovered by appid" }, { "smtps_flows", "count of smtps flows discovered by appid" }, + { "ssh_clients", "count of ssh clients discovered by appid" }, { "ssh_flows", "count of ssh flows discovered by appid" }, { "ssl_flows", "count of ssl flows discovered by appid" }, { "telnet_flows", "count of telnet flows discovered by appid" }, diff --git a/src/network_inspectors/appid/appid_module.h b/src/network_inspectors/appid/appid_module.h index b9f63b743..9c5c22c6c 100644 --- a/src/network_inspectors/appid/appid_module.h +++ b/src/network_inspectors/appid/appid_module.h @@ -38,6 +38,9 @@ extern THREAD_LOCAL ProfileStats appidPerfStats; struct AppIdStats { PegCount packets; + PegCount bit_clients; + PegCount bit_flows; + PegCount bittracker_clients; PegCount dns_udp_flows; PegCount dns_tcp_flows; PegCount ftp_flows; @@ -47,6 +50,7 @@ struct AppIdStats PegCount pop_flows; PegCount smtp_flows; PegCount smtps_flows; + PegCount ssh_clients; PegCount ssh_flows; PegCount ssl_flows; PegCount telnet_flows; diff --git a/src/network_inspectors/appid/client_plugins/client_app_base.cc b/src/network_inspectors/appid/client_plugins/client_app_base.cc index c443819d1..e4e02c1df 100644 --- a/src/network_inspectors/appid/client_plugins/client_app_base.cc +++ b/src/network_inspectors/appid/client_plugins/client_app_base.cc @@ -120,6 +120,7 @@ extern RNAClientAppModule http_client_mod; static RNAClientAppModule* static_client_list[] = { &smtp_client_mod, + &ssh_client_mod, #ifdef REMOVED_WHILE_NOT_IN_USE &msn_client_mod, @@ -127,10 +128,11 @@ static RNAClientAppModule* static_client_list[] = &ym_client_mod, &sip_udp_client_mod, &sip_tcp_client_mod, +#endif &bit_client_mod, &bit_tracker_client_mod, +#ifdef REMOVED_WHILE_NOT_IN_USE &rtp_client_mod, - &ssh_client_mod, &timbuktu_client_mod, &tns_client_mod, &vnc_client_mod, @@ -185,9 +187,9 @@ const RNAClientAppModule* ClientAppGetClientAppModule(RNAClientAppFCN fcn, struc return nullptr; } -void add_pattern_data(SearchTool* st, const RNAClientAppModule* li, int position, const - uint8_t* const pattern, unsigned size, - unsigned nocase, int* count, ClientAppConfig* pClientAppConfig) +void add_pattern_data(SearchTool* st, const RNAClientAppModule* li, int position, + const uint8_t* const pattern, unsigned size, unsigned nocase, + int* count, ClientAppConfig* pClientAppConfig) { ClientPatternData* pd = (ClientPatternData*)snort_calloc(sizeof(ClientPatternData)); pd->ca = li; @@ -211,34 +213,22 @@ static void clientCreatePattern(IpProtocol proto, const uint8_t* const pattern, if (proto == IpProtocol::TCP) { - if (pClientAppConfig->tcp_patterns) - delete pClientAppConfig->tcp_patterns; - pClientAppConfig->tcp_patterns = new SearchTool("ac_full"); - pClientAppConfig->udp_patterns = nullptr; + if (!pClientAppConfig->tcp_patterns) + pClientAppConfig->tcp_patterns = new SearchTool("ac_full"); count = &pClientAppConfig->tcp_pattern_count; add_pattern_data(pClientAppConfig->tcp_patterns, li, position, pattern, size, nocase, count, pClientAppConfig); } else if (proto == IpProtocol::UDP) { - if (pClientAppConfig->udp_patterns) - delete pClientAppConfig->udp_patterns; - pClientAppConfig->udp_patterns = new SearchTool("ac_full"); - pClientAppConfig->tcp_patterns = nullptr; + if (!pClientAppConfig->udp_patterns) + pClientAppConfig->udp_patterns = new SearchTool("ac_full"); count = &pClientAppConfig->udp_pattern_count; add_pattern_data(pClientAppConfig->udp_patterns, li, position, pattern, size, nocase, count, pClientAppConfig); } else { - if (pClientAppConfig->tcp_patterns) - delete pClientAppConfig->tcp_patterns; - pClientAppConfig->tcp_patterns = nullptr; - - if (pClientAppConfig->udp_patterns) - delete pClientAppConfig->udp_patterns; - pClientAppConfig->udp_patterns = nullptr; - ErrorMessage("Invalid protocol when registering a pattern: %u\n",(unsigned)proto); } } @@ -287,8 +277,8 @@ void ClientAppRegisterPattern(RNAClientAppFCN fcn, IpProtocol proto, const uint8 { if ((li->module->validate == fcn) && (li->module->userData == userData)) { - clientCreatePattern(proto, pattern, size, position, nocase, li->module, - pClientAppConfig); + clientCreatePattern(proto, pattern, size, position, nocase, + li->module, pClientAppConfig); break; } } @@ -965,8 +955,8 @@ static void ClientAppID(Packet* p, const int /*direction*/, AppIdData* flowp, co } } -int AppIdDiscoverClientApp(Packet* p, int direction, AppIdData* rnaData, const - AppIdConfig* pConfig) +int AppIdDiscoverClientApp(Packet* p, int direction, AppIdData* rnaData, + const AppIdConfig* pConfig) { if (!pConfig->clientAppConfig.enabled) return APPID_SESSION_SUCCESS; diff --git a/src/network_inspectors/appid/client_plugins/client_app_bit.cc b/src/network_inspectors/appid/client_plugins/client_app_bit.cc index 286b00538..cfd92aa50 100644 --- a/src/network_inspectors/appid/client_plugins/client_app_bit.cc +++ b/src/network_inspectors/appid/client_plugins/client_app_bit.cc @@ -21,6 +21,7 @@ #include "client_app_api.h" #include "application_ids.h" +#include "appid_module.h" #include "main/snort_debug.h" #include "utils/util.h" @@ -101,7 +102,7 @@ struct Client_App_Pattern static Client_App_Pattern patterns[] = { - { (const uint8_t*)BIT_BANNER, sizeof(BIT_BANNER)-1, 0, APP_ID_BITTORRENT }, + { (const uint8_t*)BIT_BANNER, BIT_BANNER_LEN, -1, APP_ID_BITTORRENT }, }; static AppRegistryEntry appIdRegistry[] = @@ -224,6 +225,7 @@ inprocess: done: bit_client_mod.api->add_app(flowp, APP_ID_BITTORRENT, APP_ID_BITTORRENT, nullptr); setAppIdFlag(flowp, APPID_SESSION_CLIENT_DETECTED); + appid_stats.bit_clients++; return CLIENT_APP_SUCCESS; } diff --git a/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc b/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc index 0d96299be..2b6cc0e83 100644 --- a/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc +++ b/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc @@ -27,6 +27,7 @@ #include "app_info_table.h" #include "application_ids.h" #include "client_app_api.h" +#include "appid_module.h" static const char UDP_BIT_QUERY[] = "d1:a"; static const char UDP_BIT_RESPONSE[] = "d1:r"; @@ -99,9 +100,9 @@ struct Client_App_Pattern static Client_App_Pattern udp_patterns[] = { - { (const uint8_t*)UDP_BIT_QUERY, sizeof(UDP_BIT_QUERY), 0, APP_ID_BITTRACKER_CLIENT }, - { (const uint8_t*)UDP_BIT_RESPONSE, sizeof(UDP_BIT_RESPONSE), 0, APP_ID_BITTRACKER_CLIENT }, - { (const uint8_t*)UDP_BIT_ERROR, sizeof(UDP_BIT_ERROR), 0, APP_ID_BITTRACKER_CLIENT }, + { (const uint8_t*)UDP_BIT_QUERY, sizeof(UDP_BIT_QUERY) - 1, -1, APP_ID_BITTRACKER_CLIENT }, + { (const uint8_t*)UDP_BIT_RESPONSE, sizeof(UDP_BIT_RESPONSE) - 1, -1, APP_ID_BITTRACKER_CLIENT }, + { (const uint8_t*)UDP_BIT_ERROR, sizeof(UDP_BIT_ERROR) - 1, -1, APP_ID_BITTRACKER_CLIENT }, }; static AppRegistryEntry appIdRegistry[] = @@ -269,6 +270,7 @@ done: bit_tracker_client_mod.api->add_app(flowp, APP_ID_BITTORRENT, APP_ID_BITTRACKER_CLIENT, nullptr); setAppIdFlag(flowp, APPID_SESSION_CLIENT_DETECTED); + appid_stats.bittracker_clients++; return CLIENT_APP_SUCCESS; } diff --git a/src/network_inspectors/appid/client_plugins/client_app_ssh.cc b/src/network_inspectors/appid/client_plugins/client_app_ssh.cc index b4ad94729..b63447914 100644 --- a/src/network_inspectors/appid/client_plugins/client_app_ssh.cc +++ b/src/network_inspectors/appid/client_plugins/client_app_ssh.cc @@ -27,6 +27,7 @@ #include "app_info_table.h" #include "application_ids.h" #include "client_app_api.h" +#include "appid_module.h" static const char SSH_CLIENT_BANNER[] = "SSH-"; #define SSH_CLIENT_BANNER_LEN (sizeof(SSH_CLIENT_BANNER)-1) @@ -183,11 +184,11 @@ struct Client_App_Pattern static Client_App_Pattern patterns[] = { - { (const uint8_t*)SSH_CLIENT_BANNER, sizeof(SSH_CLIENT_BANNER)-1, 0, APP_ID_SSH }, - { (const uint8_t*)OPENSSH_BANNER, sizeof(OPENSSH_BANNER)-1, 0, APP_ID_OPENSSH }, - { (const uint8_t*)PUTTY_BANNER, sizeof(PUTTY_BANNER)-1, 0, APP_ID_PUTTY }, - { (const uint8_t*)LSH_BANNER, sizeof(LSH_BANNER)-1, 0, APP_ID_LSH }, - { (const uint8_t*)DROPBEAR_BANNER, sizeof(DROPBEAR_BANNER)-1, 0, APP_ID_DROPBEAR }, + { (const uint8_t*)SSH_CLIENT_BANNER, sizeof(SSH_CLIENT_BANNER) - 1, 0, APP_ID_SSH }, + { (const uint8_t*)OPENSSH_BANNER, sizeof(OPENSSH_BANNER) - 1, -1, APP_ID_OPENSSH }, + { (const uint8_t*)PUTTY_BANNER, sizeof(PUTTY_BANNER) - 1, -1, APP_ID_PUTTY }, + { (const uint8_t*)LSH_BANNER, sizeof(LSH_BANNER) - 1, 0, APP_ID_LSH }, + { (const uint8_t*)DROPBEAR_BANNER, sizeof(DROPBEAR_BANNER) - 1, -1, APP_ID_DROPBEAR }, }; static AppRegistryEntry appIdRegistry[] = @@ -633,6 +634,7 @@ static CLIENT_APP_RETCODE ssh_client_validate(const uint8_t* data, uint16_t size ssh_client_mod.api->add_app(flowp, APP_ID_SSH, fd->client_id, (const char*)fd->version); setAppIdFlag(flowp, APPID_SESSION_CLIENT_DETECTED); + appid_stats.ssh_clients++; return CLIENT_APP_SUCCESS; } diff --git a/src/network_inspectors/appid/detector_plugins/detector_imap.cc b/src/network_inspectors/appid/detector_plugins/detector_imap.cc index 689118888..2c06209e5 100644 --- a/src/network_inspectors/appid/detector_plugins/detector_imap.cc +++ b/src/network_inspectors/appid/detector_plugins/detector_imap.cc @@ -1052,7 +1052,6 @@ static int imap_validate(ServiceValidationArgs* args) else { clearAppIdFlag(flowp, APPID_SESSION_CONTINUE); - appid_stats.imap_flows++; return SERVICE_SUCCESS; } diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc index 2a256589e..1d355ab78 100644 --- a/src/network_inspectors/appid/service_plugins/service_base.cc +++ b/src/network_inspectors/appid/service_plugins/service_base.cc @@ -209,9 +209,9 @@ static RNAServiceValidationModule* static_service_list[] = &battlefield_service_mod, &mdns_service_mod, &timbuktu_service_mod, - &bit_service_mod, &tns_service_mod, #endif + &bit_service_mod, &pattern_service_mod, &http_service_mod }; diff --git a/src/network_inspectors/appid/service_plugins/service_bit.cc b/src/network_inspectors/appid/service_plugins/service_bit.cc index 0afabc95d..801d5cfcd 100644 --- a/src/network_inspectors/appid/service_plugins/service_bit.cc +++ b/src/network_inspectors/appid/service_plugins/service_bit.cc @@ -19,10 +19,13 @@ // service_bit.cc author Sourcefire Inc. -#include "main/snort_debug.h" -#include "utils/util.h" + #include "application_ids.h" #include "service_api.h" +#include "appid_module.h" + +#include "main/snort_debug.h" +#include "utils/util.h" static const char svc_name[] = "bt"; static const uint8_t BIT_BANNER[] = "\023BitTorrent protocol"; @@ -202,6 +205,7 @@ inprocess: success: bit_service_mod.api->add_service(flowp, args->pkt, args->dir, &svc_element, APP_ID_BITTORRENT, nullptr, nullptr, nullptr); + appid_stats.bit_flows++; return SERVICE_SUCCESS; fail: diff --git a/src/search_engines/ac_full.cc b/src/search_engines/ac_full.cc index 1726c2970..b73fbfedd 100644 --- a/src/search_engines/ac_full.cc +++ b/src/search_engines/ac_full.cc @@ -77,9 +77,9 @@ public: void* context, int* current_state) override { if ( !obj->dfa_enabled() ) - return 0; // nfa + all not supported - - return acsm_search_dfa_full_all(obj, T, n, match, context, current_state); + return acsm_search_nfa(obj, T, n, match, context, current_state); + else + return acsm_search_dfa_full_all(obj, T, n, match, context, current_state); } int print_info() override diff --git a/src/search_engines/test/search_tool_test.cc b/src/search_engines/test/search_tool_test.cc index fad9fed1a..941cdf59b 100644 --- a/src/search_engines/test/search_tool_test.cc +++ b/src/search_engines/test/search_tool_test.cc @@ -206,6 +206,35 @@ TEST(search_tool_tests, ac_full) delete stool; } +TEST(search_tool_tests, search_all_ac_full) +{ + SearchTool *stool = new SearchTool("ac_full"); + CHECK(stool->mpse); + + pattern_id = 1; + stool->add("the", 3, pattern_id); + CHECK(stool->max_len == 3); + + pattern_id = 77; + stool->add("uba", 3, pattern_id); + CHECK(stool->max_len == 3); + + pattern_id = 2112; + stool->add("away", 4, pattern_id); + CHECK(stool->max_len == 4); + + pattern_id = 1000; + stool->add("nothere", 7, pattern_id); + CHECK(stool->max_len == 7); + + stool->prep(); + + const char *datastr = "the tuba ran away"; + int result = stool->find_all(datastr, strlen(datastr), Test_SearchStrFound); + CHECK(result == 3); + delete stool; +} + //------------------------------------------------------------------------- // main //-------------------------------------------------------------------------