Re: [Prelude Hybrid IDS] #232: ssh.rules does not handle IPv6 address

#232: ssh.rules does not handle IPv6 address
---------------------------------+------------------------------------------
 Reporter:  [email protected]  |        Owner:  yoann             
     Type:  defect               |       Status:  assigned          
 Priority:  normal               |    Milestone:  Prelude-LML 0.9.11
Component:  prelude-lml          |      Version:  0.9               
 Severity:  normal               |   Resolution:                    
 Keywords:                       |  
---------------------------------+------------------------------------------
Comment (by yoann):

 I don't like the idea of having the Normalizer moving entry from
 ''node.address.address'' to ''node.name'', since it would encourage bad
 ruleset/alert writing behavior.

 Original, IPv4 and IPv6 compliant version:
 {{{
 regex=Accepted (\S+) for root from ([A-Fa-f\d:\.]+) port (\d+); \
  source(0).node.address(0).address=$2; \
  source(0).service.port=$3; \
 }}}

 ----

 Version that can handle IPv4, IPv6, as well as hostname:
 {{{
 regex=Accepted (\S+) for root from (([A-Fa-f\d:\.]+)|(\S+)) port (\d+); \
  source(0).node.address(0).address=$3; \
  source(0).node.name = $4; \
  source(0).service.port=$5; \
 }}}

 Using multiple regular expression to capture different type of input work,
 but it make rules difficult to understand. Paradoxically, it make it more
 clear to the experienced reader what is currently going on by exclusively
 relying on PCRE.

 ----

 Another solution would be to create some kind of PCRE macro:

 {{{
 regex=Accepted (\S+) for root from $get_name_or_address($host1, $addr1)
 port (\d+); \
  source(0).node.address(0).address=$addr1; \
  source(0).node.name = $host1; \
  source(0).service.port=$2; \
 }}}

 Or:

 {{{
 regex=Accepted (\S+) for root from
 $get_name_or_address(source(0).node.name,
 source(0).node.address(0).address) port (\d+); \
  source(0).service.port=$2; \
 }}}

 Comments?

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/232#comment:7>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel