Changeset 1658

Timestamp:

11/12/06 16:40:29 (2 years ago)

Author:

mbr

Message:

first working version of new Snort signature rules interface, support for many new Snort keywords and additional signatures (about 50) have been added

Files:

• psad/branches/sigdevel/psad (modified) (19 diffs)

psad/branches/sigdevel/psad

@@ -1044 +1044 @@
-            ### sid matching, Netfilter logging prefixes and chains, etc.)
-            'fwsnort_sid' => 0,
-nf_chain'
-nf_log_prefix'
+chain'       
+log_prefix' 
-            'dshield_str' => '',
-            'syslog_host' => '',
@@ -1153 +1153 @@
-        $scan{$pkt{'src'}}{$pkt{'dst'}}{'absnum'}++;
-        $scan{$pkt{'src'}}{$pkt{'dst'}}{'chain'}
-nf_
+
-        $curr_scan{$pkt{'src'}}{$pkt{'dst'}}{$pkt{'proto'}}{'pkts'}++;
-        $curr_scan{$pkt{'src'}}{$pkt{'dst'}}
@@ -1166 +1166 @@
-            {$pkt{'syslog_host'}} = '' if $pkt{'syslog_host'};
-
-nf_
+
-            ### see if the logging prefix matches the blocking
-            ### regex, and if not the IP will not be blocked
@@ -1174 +1174 @@
-                ### we require a match
-                if (not defined $auto_block_regex_match{$pkt{'src'}}
-nf_
+
-                    $auto_block_regex_match{$pkt{'src'}} = '';
-                }
-            }
-        } else {
-nf_
+
-        }
-
-        ### keep track of Netfilter chain and logging prefix
-        $curr_scan{$pkt{'src'}}{$pkt{'dst'}}{$pkt{'proto'}}{'chain'}
-nf_chain'}}{$pkt{'nf_
+chain'}}{$pkt{'
-
-        unless ($pkt{'proto'} eq 'icmp') {
@@ -1246 +1246 @@
-            ### found a snort sid in the packet log message
-            my $dl = &add_snort_sid($pkt{'src'}, $pkt{'dst'},
-nf_
+
-            $curr_sids_dl{$pkt{'src'}} = $dl if $dl;
-        } else {
@@ -1303 +1303 @@
-    ### "kernel:" string is preceded by .*).
-    if ($pkt_str =~ /.*kernel:\s+(.*?)\s*IN=/) {
-nf_
-nf_
+
+
-            if ($config{'IGNORE_LOG_PREFIXES'} ne 'NONE') {
-nf_
+
-                        =~ m|$config{'IGNORE_LOG_PREFIXES'}|;
-            }
-nf_
+
-        }
-    }
@@ -1571 +1571 @@
-    my $pkt_hr = shift;
-
+    my $dl = 0;
+
-    ### always run the IP protocol sigs
-    for my $proto ($pkt_hr->{'proto'}, 'ip') {
@@ -1636 +1638 @@
-                                        ### and sp/dp, so match any Snort
-                                        ### keywords
-
+my $dl_tmp = 
-                                                $dp_hr->{$dp_s}->{$dp_e});
+
+                                        ### return maximal danger level from all
+                                        ### signature matches
+                                        $dl = $dl_tmp if $dl_tmp > $dl;
-                                    }
-                                }
@@ -1646 +1652 @@
-                    ### now we have the set of applicable icmp
-                    ### signatures that match the sip/dip
-
+my $dl_tmp = 
-                            $sig_search{$proto}{$src}{$dst});
-
-
-
-
-
-
+
+
+
+
+
+
+
-}
-
@@ -1659 +1667 @@
-    my ($pkt_hr, $sigs_ids_hr) = @_;
-
-
+
+
+
-
-    ### see if all Snort keywords match the packet
@@ -1671 +1681 @@
-        ### values (at least for ipv4, see
-        ### linux/net/ipv4/netfilter/ipt_LOG.c)
-
+
+
+
+
-
-        if ($sig_hr->{'proto'} eq 'tcp') {
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-        } elsif ($sig_hr->{'proto'} eq 'udp') {
-
-
-
+
+
+
+
+
+
+
+
-        } elsif ($sig_hr->{'proto'} eq 'icmp') {
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -1694 +1753 @@
-
-    if (defined $sig_hr->{'flags'}) {
-
-
-
-
+0 
+
+
+0 
-            ($pkt_hr->{'ip_len'}-$IP_HEADER_LEN-$TCP_HEADER_LEN),
-            'dsize', $sig_hr
-    );
-
-
+0 
-            ($pkt_hr->{'ip_len'}-$IP_HEADER_LEN-$TCP_HEADER_LEN),
-            'psad_dsize', $sig_hr
-    );
-
-
-
-
+0 
+0 
+0 
-
-    ### matched the signature
-
-
+
+
+
+
+
-}
-
@@ -1719 +1781 @@
-    my ($pkt_hr, $sig_hr) = @_;
-
-
+0 
-            ($pkt_hr->{'udp_len'}-$UDP_HEADER_LEN),
-            'dsize', $sig_hr
-    );
-
-
+0 
-            ($pkt_hr->{'udp_len'}-$UDP_HEADER_LEN),
-            'psad_dsize', $sig_hr
@@ -1730 +1792 @@
-
-    ### matched the signature
-
-
+
+
+
+
+
-}
-
@@ -1737 +1802 @@
-    my ($pkt_hr, $sig_hr) = @_;
-
-
+0 
-            ($pkt_hr->{'ip_len'}-$IP_HEADER_LEN-$ICMP_HEADER_LEN),
-            'dsize', $sig_hr
-    );
-
-
+0 
-            ($pkt_hr->{'ip_len'}-$IP_HEADER_LEN-$ICMP_HEADER_LEN),
-            'psad_dsize', $sig_hr
-    );
-
-
-
-
-
+0 
+0 
+0 
+0 
-
-    ### matched the signature
-
-
+
+
+
+
+
-}
-
@@ -1773 +1841 @@
-    if ($sig_hr->{'proto'} eq 'ip') {
-        ### signature match
-
-
-
+
+
+
+
+
+
-    return 1;
-}
@@ -1812 +1883 @@
-    }
-    return 0;
-}
-
-
-sub old_match_sigs() {
-    my ($src, $dst, $chain, $sp, $dp, $proto,
-        $flags, $len, $ttl, $type, $code, $id, $seq) = @_;
-
-    my $dl = 0;
-    if ($proto eq 'tcp') {
-        for my $sid (keys %{$sigs{'tcp'}}) {
-            next unless defined $sigs{'tcp'}{$sid}{'flags'};
-            if (&check_port($sp, $dp, $sigs{'tcp'}{$sid})
-                    and $flags eq $sigs{'tcp'}{$sid}{'flags'}
-                    and &check_src($chain, $src, $sigs{'tcp'}{$sid}{'src'})
-                    and &check_dst($chain, $dst, $sigs{'tcp'}{$sid}{'dst'})) {
-                ### future
-#               && &check_misc_fields($sid, $proto, $len, $ttl)) {
-                ### tripped a tcp signature
-                print STDERR "[+] match_sigs(): matched tcp $dp,$sp,$flags, ",
-                    "sid: $sid\n" if $debug;
-                if ($dl < $sigs{$sid}{'dl'}) {
-                    $dl = $sigs{$sid}{'dl'};
-                }
-                $scan{$src}{$dst}{$proto}{'curr_sig'}
-                    {$sid}{$chain}{'dp'}{$dp}++;
-                $scan{$src}{$dst}{$proto}{'curr_sig'}
-                    {$sid}{$chain}{'flags'}{$dp} = $flags;
-            }
-        }
-    } elsif ($proto eq 'udp') {
-        for my $sid (keys %{$sigs{'udp'}}) {
-            if (&check_src($chain, $src, $sigs{'udp'}{$sid}{'src'})
-                    and &check_dst($chain, $dst, $sigs{'udp'}{$sid}{'dst'})
-                    and &check_port($sp, $dp, $sigs{'udp'}{$sid})) {
-#               && &check_misc_fields($sid, $proto, $len, $ttl)) {
-                ### tripped a udp signature
-                print STDERR "[+] match_sigs(): matched udp $dp,$sp, ",
-                    "sid: $sid\n" if $debug;
-                if ($dl < $sigs{$sid}{'dl'}) {
-                    $dl = $sigs{$sid}{'dl'};
-                }
-                $scan{$src}{$dst}{$proto}{'curr_sig'}
-                    {$sid}{$chain}{'dp'}{$dp}++;
-            }
-        }
-    } elsif ($proto eq 'icmp') {
-        ### check icmp type and code fields against the official values
-        ### in RFC 792.  See %inval_type_code for corresponding signature
-        ### message text and danger levels.
-        my $type_code_rv = &check_icmp_type($type, $code);
-        if ($type_code_rv == 1) {  ### bad type
-            if ($dl < 2) {
-                $dl = 2;  ### FIXME: hard-coded as dl 2 for now.
-            }
-            $scan{$src}{$dst}{'icmp'}{'invalid_type'}
-                {$type}{$chain}{'pkts'}++;
-        } elsif ($type_code_rv == 2) {
-            if ($dl < 2) {
-                $dl = 2;  ### FIXME: hard-coded as dl 2 for now.
-            }
-            $scan{$src}{$dst}{'icmp'}{'invalid_code'}
-                {$type}{$code}{$chain}{'pkts'}++;
-        }
-        for my $sid (keys %{$sigs{'icmp'}}) {
-            if (&check_src($chain, $src, $sigs{'icmp'}{$sid}{'src'})
-                    and &check_dst($chain, $dst, $sigs{'icmp'}{$sid}{'dst'})
-                    and &check_icmp_sig($sid, $ttl, $type, $code,
-                        $id, $seq)) {
-                print STDERR "[+] match_sigs(): matched icmp sid: $sid\n"
-                    if $debug;
-                if ($dl < $sigs{$sid}{'dl'}) {
-                    $dl = $sigs{$sid}{'dl'};
-                }
-                $scan{$src}{$dst}{'icmp'}{'curr_sig'}
-                    {$sid}{$chain}{'pkts'}++;
-            }
-        }
-    }
-    return $dl;
-}
-
@@ -3267 +3259 @@
-
-        ### psad danger level
+        $sig{'dl'} = 2;  ### default danger level
-        if ($rule_options =~ /psad_dl:\s*(\d+)/) {
-            $sig{'dl'} = $1;
-        } else {
-            die "[*] import_signatures(): could not find ",
-                qq|"psad_dl" on line: $line_num|;
-        }
-
@@ -4322 +4312 @@
-                if (defined $curr_scan_hr->{$src}->{$dst}->{'tcp'}->{'chain'}) {
-                    &print_chains_and_prefixes(
-
-
+
-                    );
-                }