Changeset 182

Timestamp:

03/20/05 14:22:07 (5 years ago)

Author:

mbr

Message:

- Updated to not attempt to download Snort rules from snort.org

because the rules are no longer available for automatic downloads

- Changed the install.pl script and the --update-rules mode for

fwsnort to download the latest signature set from
 http://www.bleedingsnort.com/.
(Snort.org is now offering pay-service around their rule sets).

- Added signature test for the "flowbits" keyword.

Location:

fwsnort/trunk

Files:

• ChangeLog (modified) (3 diffs)
• TODO (modified) (1 diff)
• VERSION (modified) (1 diff)
• fwsnort (modified) (6 diffs)
• install.pl (modified) (5 diffs)

fwsnort/trunk/ChangeLog

@@ -1 @@
-fwsnort-0.6.4 (12/18/2004);
+fwsnort-0.6.5 (03/20/2005):
+    - Updated to not attempt to download Snort rules from snort.org
+      because the rules are no longer available for automatic downloads
+    - Changed the install.pl script and the --update-rules mode for
+      fwsnort to download the latest signature set from
+      http://www.bleedingsnort.com/.
+      (Snort.org is now offering pay-service around their rule sets).
+    - Added signature test for the "flowbits" keyword.
+
+fwsnort-0.6.4 (12/18/2004):
     - Updated to Snort-2.3 rules.  FWSnort can convert a total of 1710
       out of 2559 total Snort-2.3 rules.
@@ -8 +17 @@
     - Added --replace-string patches.
 
-fwsnort-0.6.3 (04/04/2004);
+fwsnort-0.6.3 (04/04/2004):
     - Added ignore functionality for both IPs and networks
     - Split --ipt-block into --ipt-drop and --ipt-reject to add DROP
@@ -15 +24 @@
       file to be added.
 
-fwsnort-0.6.2 (03/19/2004);
+fwsnort-0.6.2 (03/19/2004):
     - Added --internal-net and --dmz-net options so that internal and
       dmz networks can be manually specified without having to parse

fwsnort/trunk/TODO

@@ -1 @@
-- Port the string match extension to the 2.6 kernel.
+ - Port the string match extension to the 2.6 kernel.
+ - Have some level of (optional) integration with the --replace-string
+   patches
+ - Allow a list of SIDs to have a manually specified target (such as
+   -j REJECT --reject-with tcp-reset).  The list should come from the
+   command line with a new option and/or be read from a file.

fwsnort/trunk/VERSION

@@ -1 @@
-0.6.4
+0.6.5

fwsnort/trunk/fwsnort

@@ -13 +13 @@
 # Credits: (see the CREDITS file)
 #
-# Version: 0.6.4
+# Version: 0.6.5
 #
 # Copyright (C) 2003 Michael Rash (mbr@cipherdyne.org)
@@ -105 +105 @@
 my $log_dir     = '/var/log';
 
-my $snort_website = 'www.snort.org';
-my $download_rules_file = 'snortrules-snapshot-CURRENT.tar.gz';
+### Snort.org no longer allows auto downloads of signatures
+my $bleeding_snort_website = 'www.bleedingsnort.com';
 
 ### config file
@@ -119 +119 @@
 
 ### version number
-my $version = '0.6.4';
+my $version = '0.6.5';
 
 ### supported variables in snort signatures
@@ -204 +204 @@
         'distance'     => '[\s;]distance:\s*(\d+)\s*;',
         'within'       => '[\s;]within:\s*(\d+)\s*;',
+        'flowbits'     => '[\s;]flowbits:\s*\S+\s*;',
 #        'offset'       => '[\s;]offset:\s*\d+\s*;',
 #        'depth'        => '[\s;]depth:\s*\d+\s*;',
@@ -1695 +1696 @@
     ### make sure we can actually reach snort.org.
     print "[+] Downloading latest rules:\n",
-        "    http://$snort_website/dl/rules/$download_rules_file\n";
-    if (&test_snort_website()) {
-        chdir $fwsnort_dir or die "[*] Could not chdir $fwsnort_dir: $!";
-        if (-e $download_rules_file) {
-            unlink $download_rules_file or die "[*] Could not remove ",
-                "$download_rules_file: $!";
-        }
-        system "$cmds{'wget'} http://$snort_website/dl/rules/" .
-            "$download_rules_file";
-        system "$cmds{'tar'} xvfz $download_rules_file";
-        if (-d 'rules') {
-            if (-d 'snort_rules') {
-                rmtree 'snort_rules.orig' if -d 'snort_rules.orig';
-                move 'snort_rules', 'snort_rules.orig';
-            }
-            move 'rules', 'snort_rules' or die "[*] Could not ",
-                "move rules -> snort_rules: $!";
-        } else {
-            print "[-] $download_rules_file did not appear to ",
-                "contain a\n    \"rules\" directory.  Defaulting to ",
-                "existing snort-2.0 rules.\n";
-        }
-    } else {
-        print "[-] Could not connect to $snort_website on tcp/80.\n",
-            "    Defaulting to existing snort-2.0 rules.\n";
-    }
-    print "[+] Moving rules files to $fwsnort_dir/snort_rules/\n",
-        "[+] Finished.\n";
+        "    http://$bleeding_snort_website/bleeding-all.rules\n";
+    chdir $rules_dir or die "[*] Could not chdir $rules_dir: $!";
+    if (-e 'bleeding-all.rules') {
+        move 'bleeding-all.rules', 'bleeding-all.rules.tmp'
+            or die "[*] Could not move bleeding-all.rules -> ",
+            "bleeding-all.rules.tmp";
+    }
+    system "$cmds{'wget'} http://$bleeding_snort_website/bleeding-all.rules";
+    if (-e 'bleeding-all.rules') {  ### successful download
+        unlink 'bleeding-all.rules.tmp';
+    } else {
+        print "[-] Could not download bleeding-all.rules file.\n";
+        if (-e 'bleeding-all.rules.tmp') {
+            ### move the original back
+            move 'bleeding-all.rules', 'bleeding-all.rules.tmp'
+                or die "[*] Could not move bleeding-all.rules -> ",
+                "bleeding-all.rules.tmp";
+        }
+    }
+    print "[+] Finished.\n";
     exit 0;
-}
-
-sub test_snort_website() {
-    my $sock = new IO::Socket::INET(
-        PeerAddr => $snort_website,
-        PeerPort => 80,
-        Proto    => 'tcp',
-        Timeout  => 7
-    );
-    if (defined($sock)) {
-        close $sock;
-        return 1;
-    }
-    return 0;
 }
 
@@ -1833 +1812 @@
     --dmz-net <net/mask>      - Manually specify a dmz network
                                 (CIDR or standard notation).
-    -u   --update-rules       - Download latest snort rules from
-                                http://$snort_website/
+    -u   --update-rules       - Download latest Bleeding-Snort rules
+                                from http://$bleeding_snort_website/
     -t   --type=<type>        - Only process snort rules of type <type>
                                 (e.g. "ddos" or "backdoor")

fwsnort/trunk/install.pl

@@ -41 +41 @@
 my $rules_dir   = "${fwsnort_dir}/snort_rules";
 
-my $snort_website = 'www.snort.org';
-my $download_rules_file = 'snortrules-snapshot-CURRENT.tar.gz';
+### Snort.org no longer allows auto downloads of signatures
+my $bleeding_snort_website = 'www.bleedingsnort.com';
 
 ### system binaries
@@ -133 +133 @@
 
     my $local_rules_dir = 'snort_rules';
-    if (&query_get_latest_snort_rules()) {
-        ### make sure we can actually reach snort.org.
-        if (&test_snort_website()) {
-            if (-e $download_rules_file) {
-                unlink $download_rules_file or die "[*] Could not remove ",
-                    "$download_rules_file: $!";
-            }
-            system "$cmds{'wget'} http://$snort_website/dl/rules/" .
-                $download_rules_file;
-            if (-e $download_rules_file) {
-                system "$cmds{'tar'} xvfz $download_rules_file";
-                if (-d 'rules') {
-                    rmtree 'downloaded_snort_rules'
-                        if -d 'downloaded_snort_rules';
-                    move 'rules', 'downloaded_snort_rules'
-                        or die "[*] Could not move rules -> ",
-                            "downloaded_snort_rules: $!";
-                    $local_rules_dir = 'downloaded_snort_rules';
-                } else {
-                    print "[-] $download_rules_file did not appear to ",
-                        "contain a\n    \"rules\" directory.  Defaulting to ",
-                        "existing snort-2.3 rules.\n";
-                }
-            } else {
-                print "[-] Could not download $download_rules_file\n",
-                    "    Defaulting to existing snort-2.3 rules.\n";
-            }
+    if (&query_get_bleeding_snort()) {
+        chdir $local_rules_dir or die "[*] Could not chdir $local_rules_dir";
+        if (-e 'bleeding-all.rules') {
+            move 'bleeding-all.rules', 'bleeding-all.rules.tmp'
+                or die "[*] Could not move bleeding-all.rules -> ",
+                "bleeding-all.rules.tmp";
+        }
+        system "$cmds{'wget'} http://$bleeding_snort_website/bleeding-all.rules";
+        if (-e 'bleeding-all.rules') {  ### successful download
+            unlink 'bleeding-all.rules.tmp';
         } else {
-            print "[-] Could not connect to $snort_website on tcp/80.\n",
-                "    Defaulting to existing snort-2.3 rules.\n";
-        }
+            print "[-] Could not download bleeding-all.rules file.\n";
+            if (-e 'bleeding-all.rules.tmp') {
+                ### move the original back
+                move 'bleeding-all.rules', 'bleeding-all.rules.tmp'
+                    or die "[*] Could not move bleeding-all.rules -> ",
+                    "bleeding-all.rules.tmp";
+            }
+        }
+        chdir '..';
     }
 
@@ -175 +164 @@
         next unless $rfile =~ /\.rules$/;
         print "[+] Installing $rfile\n";
-        copy "snort_rules/${rfile}", "${rules_dir}/${rfile}";
+        copy "snort_rules/${rfile}", "${rules_dir}/${rfile}" or
+            die "[*] Could not copy snort_rules/${rfile} ",
+                "-> ${rules_dir}/${rfile}";
     }
 
@@ -274 +265 @@
 }
 
-sub query_get_latest_snort_rules() {
+sub query_get_bleeding_snort() {
     my $ans = '';
-    print "[+] Would you like to download the latest snort rules from \n",
-        "    http://$snort_website/?  If you not (or if you aren't connected\n",
-        "    to the Net, then the installation will default to using \n",
-        "    snort-2.3 signatures.\n";
+    print "[+] Would you like to download the latest Snort rules from \n",
+        "    http://$bleeding_snort_website/?\n";
     while ($ans ne 'y' && $ans ne 'n') {
         print "    ([y]/n)?  ";
@@ -287 +276 @@
     }
     if ($ans eq 'y') {
-        return 1;
-    }
-    return 0;
-}
-
-sub test_snort_website() {
-    my $sock = new IO::Socket::INET(
-        PeerAddr => $snort_website,
-        PeerPort => 80,
-        Proto    => 'tcp',
-        Timeout  => 7
-    );
-    if (defined($sock)) {
-        close $sock;
         return 1;
     }