ipvar range patch for snort 2.9.9.0
"寻风之迹" <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <[email protected]> |
hello,
I am trying to add ip-ranges for IP Variables,and the patch to Snort2.9.9.0 works fine after test;
use command:
cd snort-2.9.9.0
patch -p1 < snort-2990-iprange.patch
Now we can define ipvar in snort.conf like this:
# Setup the network addresses you are protecting
ipvar HOME_NET [192.168.1.1-192.168.1.255]
# Set up the external network addresses. Leave as "any" in most situations
ipvar EXTERNAL_NET [192.168.1.1-192.168.254.255]
snort is a great project, I want to make a contribution for it.
Thanks in advance for your help!
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
Please visit http://blog.snort.org for the latest news about Snort!
snort-2990-iprange.patch
(application/octet-stream, 6.4 KB)
diff -uNr snort-orig/src/sfutil/sf_ip.h snort-new/src/sfutil/sf_ip.h
--- snort-orig/src/sfutil/sf_ip.h 2016-12-28 14:11:51.966179587 +0800
+++ snort-new/src/sfutil/sf_ip.h 2016-12-28 14:17:06.874169097 +0800
@@ -446,6 +446,120 @@
return 1;
}
+/*add for ipvar ip-range*/
+static inline int sfip_fast_cont4(const sfcidr_t *ip1, const sfcidr_t *ip1_h , const sfaddr_t *ip2) {
+ uint32_t shift = 128 - sfip_bits(ip1);
+ uint32_t ip = ntohl(sfaddr_get_ip4_value(ip2));
+ uint32_t ip3 = ntohl(sfip_get_ip4_value(ip1));
+
+ ip >>= shift;
+ ip <<= shift;
+
+ if(ip1_h == NULL)
+ {
+
+ if(ip3 == 0)
+ return 1;
+
+ return (ip3 == ip);
+ }
+ else
+ {
+ uint32_t ip3_h = ntohl(sfip_get_ip4_value(ip1_h));
+ if(ip >= ip3 && ip <= ip3_h)
+ {
+ return 1;
+ }
+ }
+ return 0;
+}
+
+/*add for ipvar ip-range*/
+static inline int sfip_fast_cont6(const sfcidr_t *ip1,const sfcidr_t *ip1_h, const sfaddr_t *ip2) {
+ uint32_t ip;
+ int i, bits = sfip_bits(ip1);
+ int words = bits / 32;
+ bits = 32 - (bits % 32);
+
+ if(ip1_h == NULL)
+ {
+ for ( i = 0; i < words; i++ ) {
+ if ( ip1->ip32[i] != ip2->ia32[i] )
+ return 0;
+ }
+
+ if ( bits == 32 ) return 1;
+
+ ip = ntohl(ip2->ia32[i]);
+
+ ip >>= bits;
+ ip <<= bits;
+
+ return ntohl(ip1->ip32[i]) == ip;
+ }
+
+ for ( i = 0; i < words; i++ )
+ {
+ if ( ip1->ip32[i] == ip2->ia32[i] )
+ {
+ continue;
+ }
+ else if(ip1->ip32[i] > ip2->ia32[i])
+ {
+ return 0;
+ }
+ else
+ {
+ break;
+ }
+ }
+
+ if ( bits == 32 ) return 1;
+
+ ip = ntohl(ip2->ia32[i]);
+ ip >>= bits;
+ ip <<= bits;
+
+ if(ip < ntohl(ip1->ip32[i]))
+ {
+ return 0;
+ }
+
+ bits = sfip_bits(ip1_h);
+ words = bits / 32;
+ bits = 32 - (bits % 32);
+
+ for ( i = 0; i < words; i++ )
+ {
+ if ( ip1_h->ip32[i] == ip2->ia32[i] )
+ {
+ continue;
+ }
+ else if(ip1_h->ip32[i] < ip2->ia32[i])
+ {
+ return 0;
+ }
+ else
+ {
+ break;
+ }
+ }
+
+ if ( bits == 32 ) return 1;
+
+ ip = ntohl(ip2->ia32[i]);
+ ip >>= bits;
+ ip <<= bits;
+
+ if(ip > ntohl(ip1_h->ip32[i]))
+ {
+ return 0;
+ }
+
+ return 1;
+}
+
+#if 0
/* Checks if ip2 is equal to ip1 or contained within the CIDR ip1 */
static inline int sfip_fast_cont4(const sfcidr_t *ip1, const sfaddr_t *ip2) {
uint32_t shift = 128 - sfip_bits(ip1);
@@ -482,6 +596,7 @@
return ntohl(ip1->ip32[i]) == ip;
}
+#endif
/* Compares two IPs
* Returns 1 for equal and 0 for not equal
diff -uNr snort-orig/src/sfutil/sf_ipvar.c snort-new/src/sfutil/sf_ipvar.c
--- snort-orig/src/sfutil/sf_ipvar.c 2016-12-28 14:11:56.821595725 +0800
+++ snort-new/src/sfutil/sf_ipvar.c 2016-12-28 14:17:04.486964500 +0800
@@ -136,13 +136,33 @@
#endif
}
- else if( (ret->ip = sfip_alloc(str, status)) == NULL )
+ else
{
- /* Failed to parse this string, so free and return */
- if(status)
- *status = SFIP_INET_PARSE_ERR;
- free(ret);
- return NULL;
+ /*add for ipvar ip-range*/
+ if(strchr(str,'-') != NULL)
+ {
+ char* str_l = strtok(str,"-");
+ char* str_h = strtok(NULL,"-");
+ if( (ret->ip = sfip_alloc(str_l, status)) == NULL || (ret->ip_h = sfip_alloc(str_h, status)) == NULL)
+ {
+ if(status)
+ *status = SFIP_INET_PARSE_ERR;
+ free(ret);
+ return NULL;
+ }
+ }
+ else
+ {
+ /* Failed to parse this string, so free and return */
+ ret->ip_h = NULL;
+ if( (ret->ip = sfip_alloc(str, status)) == NULL )
+ {
+ if(status)
+ *status = SFIP_INET_PARSE_ERR;
+ free(ret);
+ return NULL;
+ }
+ }
}
/* Check if this is a negated, zero'ed IP (equivalent of a "!any") */
@@ -813,6 +833,18 @@
if(idx->ip)
memcpy(temp->ip, idx->ip, sizeof(sfcidr_t));
+ /* add for ipvar range,ip_h store the high address */
+ if(idx->ip_h)
+ {
+ if( (temp->ip_h = (sfcidr_t*)calloc(1, sizeof(sfcidr_t))) == NULL )
+ {
+ sfip_node_freelist(ret);
+ free(temp);
+ return NULL;
+ }
+ memcpy(temp->ip_h, idx->ip_h, sizeof(sfcidr_t));
+ }
+
if(prev)
prev->next = temp;
else
@@ -856,7 +888,7 @@
if(sfaddr_family(&neg_idx->ip->addr) != AF_INET)
continue;
- if(sfip_fast_cont4(neg_idx->ip, ip))
+ if(sfip_fast_cont4(neg_idx->ip,neg_idx->ip_h, ip))
{
return 0;
}
@@ -870,7 +902,7 @@
if(neg_idx)
{
if(sfaddr_family(&neg_idx->ip->addr) == AF_INET &&
- sfip_fast_cont4(neg_idx->ip, ip))
+ sfip_fast_cont4(neg_idx->ip, neg_idx->ip_h, ip))
{
return 0;
}
@@ -888,7 +920,7 @@
if(sfip_is_set(pos_idx->ip))
{
if(sfaddr_family(&pos_idx->ip->addr) == AF_INET &&
- sfip_fast_cont4(pos_idx->ip, ip))
+ sfip_fast_cont4(pos_idx->ip, pos_idx->ip_h, ip))
{
match = 1;
}
@@ -925,7 +957,7 @@
if(sfaddr_family(&neg_idx->ip->addr) != AF_INET6)
continue;
- if(sfip_fast_cont6(neg_idx->ip, ip))
+ if(sfip_fast_cont6(neg_idx->ip,neg_idx->ip_h, ip))
{
return 0;
}
@@ -939,7 +971,7 @@
if(neg_idx)
{
if(sfaddr_family(&neg_idx->ip->addr) == AF_INET6 &&
- sfip_fast_cont6(neg_idx->ip, ip))
+ sfip_fast_cont6(neg_idx->ip,neg_idx->ip_h, ip))
{
return 0;
}
@@ -958,7 +990,7 @@
{
if(sfaddr_family(&pos_idx->ip->addr) == AF_INET6 &&
- sfip_fast_cont6(pos_idx->ip, ip))
+ sfip_fast_cont6(pos_idx->ip, pos_idx->ip, ip))
{
match = 1;
}
diff -uNr snort-orig/src/sfutil/sf_ipvar.h snort-new/src/sfutil/sf_ipvar.h
--- snort-orig/src/sfutil/sf_ipvar.h 2016-12-28 14:11:55.322467239 +0800
+++ snort-new/src/sfutil/sf_ipvar.h 2016-12-28 14:17:03.005837557 +0800
@@ -45,6 +45,7 @@
/* Used by the "list" mode. A doubly linked list of sfcidr_t objects. */
typedef struct _ip_node {
sfcidr_t *ip;
+ sfcidr_t *ip_h; /* add for ipvar range*/
struct _ip_node *next;
int flags;
// XXX