[Prelude Hybrid IDS] #252: gen_id/gid/sig_gid displayed in snort-prelude output plugin reference URL

#252: gen_id/gid/sig_gid displayed in snort-prelude output plugin reference URL
-------------------------------+--------------------------------------------
 Reporter:  [email protected]  |       Owner:  yoann
     Type:  enhancement        |      Status:  new  
 Priority:  normal             |   Milestone:       
Component:  snort              |     Version:  0.9  
 Severity:  normal             |    Keywords:       
-------------------------------+--------------------------------------------
 All references are to snort 2.7.0.1, and I apologize as I'm not a
 programmer.

 Currently, the snort output plugin for prelude creates a reference URL of
 the form:
 http://www.snort.org/pub-bin/sigs.cgi?sid=(sig_id_variable)
 [[BR]]
 ex: http://www.snort.org/pub-bin/sigs.cgi?sid=1893
 [[BR]]
 [[BR]]
 Although this URL works, and provides correct URL references for all
 gen_ids of 1, the following URL is more valid: http://www.snort.org/pub-
 bin/sigs.cgi?sid=(gen_id:sig_id)
 [[BR]]
 ex: http://www.snort.org/pub-bin/sigs.cgi?sid=1:1893

 This URL style has the added benefit of providing information on
 preprocessor alerts, etc.

 This information (the variable which seems to be known throughout snort as
 gen_id, gid, or sig_gid) -- appears to be exposed and available to the
 plugin modules.  It can be seen that such information was added to the
 database plugin, and it accesses it as such:


 {{{
 if (event->sig_generator == 0)
     {
         ret = SnortSnprintf(sig_gid, sizeof(sig_gid), "IS NULL");

         if (ret != SNORT_SNPRINTF_SUCCESS)
             goto bad_query;
     }
     else
     {
         ret = SnortSnprintf(sig_gid, sizeof(sig_gid), "= %u",
 event->sig_generator);

         if (ret != SNORT_SNPRINTF_SUCCESS)
             goto bad_query;
     }

     ret = SnortSnprintf(select0, MAX_QUERY_LENGTH,
                         "SELECT sig_id "
                         "  FROM signature "
                         " WHERE sig_name = '%s' "
                         "   AND sig_rev %s "
                         "   AND sig_sid %s "
                         "   AND sig_gid %s ",
                         sig_name, sig_rev, sig_sid, sig_gid);
 }}}

 It is likely easy to incorporate similar code into prelude's output plugin
 in the event_to_reference or add_snort_reference functions (accessing and
 passing along the sig_gid value along with sig_id, and then putting the
 value into the correct location in the URL).

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/252>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel