Changeset 1664

Timestamp:

11/16/06 20:59:00 (2 years ago)

Author:

mbr

Message:

added code to differentiate between fwsnort sig matches vs. psad sig matches

Files:

• psad/branches/sigdevel/psad (modified) (22 diffs)

psad/branches/sigdevel/psad

@@ -229 +229 @@
-### (http://www.cipherdyne.org/fwsnort/) will automatically
-### build such a ruleset from snort signatures.
-snort_ms
+fwsnort_si
-
-### Cache snort classification.config file for class priorities
@@ -1245 +1245 @@
-        unless ($no_snort_sids) {
-            if ($pkt{'fwsnort_sid'}) {
+
-                ### found a snort sid in the packet log message
-                my $dl = &add_snort_sid(\%pkt);
+
-                $curr_sids_dl{$pkt{'src'}} = $dl if $dl;
+
-            } else {
-                ### attempt to match any tcp/udp/icmp signatures in the
@@ -1410 +1413 @@
-                ($pkt_hr->{'flags'} =~ /ACK/ || $pkt_hr->{'flags'} =~ /RST/)) {
-
-
+            
-
-            ### FIXME: ignore TCP packets that have the ACK or RST
@@ -1422 +1425 @@
-            return $PKT_IGNORE;
-        }
+
-        ### per page 595 of the Camel book, "if /blah1|blah2/"
-        ### can be slower than "if /blah1/ || /blah2/
@@ -1704 +1708 @@
-                    {'sid'}{$sid}{$pkt_hr->{'chain'}}{'pkts'}++;
-
+                $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{'tcp'}
+                    {'sid'}{$sid}{$pkt_hr->{'chain'}}{'is_fwsnort'} = 0;
+
-            }
-        } elsif ($sig_hr->{'proto'} eq 'udp') {
@@ -1714 +1721 @@
-                    {'sid'}{$sid}{$pkt_hr->{'chain'}}{'dp'}
-                         = $pkt_hr->{'dp'};
+
-                $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{'udp'}
-                    {'sid'}{$sid}{$pkt_hr->{'chain'}}{'pkts'}++;
+
+                $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{'udp'}
+                    {'sid'}{$sid}{$pkt_hr->{'chain'}}{'is_fwsnort'} = 0;
-            }
-        } elsif ($sig_hr->{'proto'} eq 'icmp') {
@@ -1748 +1759 @@
-                $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{'icmp'}{'sid'}
-                    {$sid}{$pkt_hr->{'chain'}}{'pkts'}++;
+
+                $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{'icmp'}{'sid'}
+                    {$sid}{$pkt_hr->{'chain'}}{'is_fwsnort'} = 0;
-            }
-        }
@@ -1781 +1795 @@
-            "$sig_hr->{'sid'} (psad_id: $sig_hr->{'psad_id'})\n";
-    }
-
+
+
+
-}
-
@@ -1802 +1818 @@
-            "$sig_hr->{'sid'} (psad_id: $sig_hr->{'psad_id'})\n";
-    }
-
+
+
+
-}
-
@@ -1828 +1846 @@
-            "$sig_hr->{'sid'} (psad_id: $sig_hr->{'psad_id'})\n";
-    }
-
+
+
+
-}
-
@@ -1855 +1875 @@
-            {$sig_hr->{'sid'}}{$pkt_hr->{'chain'}}{'pkts'}++;
-
-
+
+
+
+
+
-    }
-    return 1;
@@ -2171 +2195 @@
-}
-
+sub get_largest_sid_dl() {
+    my ($sid, $sig_dl, $classtype) = @_;
+
+    my $dl = $sig_dl;
+
+    ### see if /etc/psad/snort_rule_dl gives a higher DL
+    if (defined $snort_rule_dl{$sid}) {
+        if ($snort_rule_dl{$sid} > $dl) {
+            print STDERR "[+] get_largest_sid_dl() snort_rule_dl ",
+                "assigning SID $sid a danger level of ",
+                "$snort_rule_dl{$sid}\n" if $debug;
+            $dl = $snort_rule_dl{$sid};
+        }
+    }
+
+    ### see if /etc/psad/snort_rules/classification.config gives
+    ### a higher DL
+    if (defined $snort_class_dl{$classtype}) {
+        if ($snort_class_dl{$classtype} > $dl) {
+            print STDERR "[+] get_largest_sid_dl() classification.config ",
+                "assigning SID $sid a danger level of ",
+                "$snort_class_dl{$classtype}\n" if $debug;
+            $dl = $snort_class_dl{$classtype};
+        }
+    }
+
+    return $dl;
+}
+
-sub add_snort_sid() {
-    my $pkt_hr = shift;
@@ -2176 +2229 @@
-    my $sid = $pkt_hr->{'fwsnort_sid'};
-
-snort_ms
+fwsnort_si
-
-        $scan{$pkt_hr->{'src'}}{$pkt_hr->{'dst'}}{$pkt_hr->{'proto'}}
-            {'sid'}{$sid}{$pkt_hr->{'chain'}}{'pkts'}++;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
-    }
-    return 0;
@@ -2777 +2811 @@
-            }
-
-snort_ms
+fwsnort_si
-                if $line =~ /msg:\s*\"(.*?)\"\s*;/;
-
-
-
-
-
+
+
+
+
+
+
+
-                if $line =~ /[\s;]priority:\s*(\d+)\s*;/;
-
@@ -2790 +2827 @@
-            ### multiple content strings.
-            while ($line =~ /[\s;](?:uri)?content:\s*\"(.*?)\"\s*;/g) {
-snort_ms
+fwsnort_si
-            }
-
@@ -2797 +2834 @@
-                if ($ref =~ /^(\w+),(\S+)/) {
-                    ### reference:bugtraq,9732;
-snort_ms
-
-
-
-snort_ms
-snort_ms
-snort_ms
+fwsnort_si
+
+
+
+fwsnort_si
+fwsnort_si
+fwsnort_si
-        }
-    }
@@ -2817 +2854 @@
-    &import_snort_rule_dl();
-
-snort_ms
+fwsnort_si
-    &Psad::psyslog('psad', 'imported Snort rules')
-        unless $no_syslog_alerts;
@@ -3023 +3060 @@
-        }
-
+        ### classtype field
+        if ($rule_options =~ /[\s;]classtype:\s*(.+?)\s*;/) {
+            $sig{'classtype'} = $1;
+        } else {
+            $sig{'classtype'} = '';
+        }
+
+        ### reference field
+
+        while ($rule_options =~ /[\s;]reference:\s*(.*?)\s*;/g) {
+            my $ref = $1;
+            if ($ref =~ /^(\w+),(\S+)/) {
+                ### reference:bugtraq,9732;
+                push @{$sig{'reference'}{lc($1)}}, $2;
+            }
+        }
+
-        ### psad danger level
-        $sig{'dl'} = 2;  ### default danger level
-
+[\s;]
-            $sig{'dl'} = $1;
-        }
@@ -4287 +4341 @@
-            for my $sid (keys %{$href->{'sid'}}) {
-                for my $chain (keys %{$href->{'sid'}->{$sid}}) {
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-
-                    my $dp    = -1;
@@ -4298 +4362 @@
-                    my $pkts = $href->{'sid'}->{$sid}->{$chain}->{'pkts'};
-
-m
+ig
-                    if ($proto eq 'tcp' or $proto eq 'udp') {
-                        if ($chain eq 'INPUT') {
@@ -4314 +4378 @@
-                        }
-                    }
-
-
+
+
+
+
+
-                    }
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                            my $baseurl = '';
-                            if (defined $snort_ref_baseurl{$reftype}) {
@@ -4329 +4407 @@
-                                next;
-                            }
-m
+ig
-                                print $fh "       reference: ($reftype) ",
-                                    "${baseurl}$ref\n";