Re: Snort3 IPS questions, issues, and requests

Russ via Snort-devel <[email protected]>
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <[email protected]>
The fix is up on github.

Thanks
Russ

On 11/24/17 6:17 AM, Russ via Snort-devel wrote:
> Got it.  A fix will be out Tuesday.  As you discovered, rule options 
> must be lower case.  Same with Lua config by the way.
>
> Thanks
> Russ
>
> On 11/23/17 12:12 AM, Noah Dietrich wrote:
>> Hi Russ,
>>
>> Regarding the segfault, after a little further testing the issue 
>> appears to occur whenever you don't use all lowercase for your rule 
>> options (msg, gid, sid, et cetera).
>>
>> for example, this rule works:
>>      alert icmp any any -> $HOME_NET any (msg:"ICMP test detected"; 
>> sid:10000001; rev:001; gid:1; classtype:icmp-event;)
>> but any of the following throw a segfault:
>>      alert icmp any any -> $HOME_NET any (msg:"ICMP test detected"; 
>> sid:10000001; rev:001; GID:1; classtype:icmp-event;)
>>      alert icmp any any -> $HOME_NET any (msg:"ICMP test detected"; 
>> Sid:10000001; rev:001; gid:1; classtype:icmp-event;)
>>      alert icmp any any -> $HOME_NET any (Msg:"ICMP test detected"; 
>> sid:10000001; rev:001; gid:1; classtype:icmp-event;)
>>
>> let me know if you need more information.  my configuration and 
>> output is below.
>> Thanks,
>> noah
>>
>> Details of my configuration:
>>
>> snort3 build 240 on Ubuntu 16 x64 with all the additional software 
>> installed (let me know if I've missed any optional software packages):
>> noah@snort3:/etc/snort$ /bin/snort -V
>>
>>    ,,_     -*> Snort++ <*-
>>   o"  )~   Version 3.0.0 (Build 240) from 2.9.8-383
>>    ''''    By Martin Roesch & The Snort Team
>> http://snort.org/contact#team
>>            Copyright (C) 2014-2017 Cisco and/or its affiliates. All 
>> rights reserved.
>>            Copyright (C) 1998-2013 Sourcefire, Inc., et al.
>>            Using DAQ version 2.2.2
>>            Using LuaJIT version 2.0.4
>>            Using OpenSSL 1.0.2g  1 Mar 2016
>>            Using libpcap version 1.7.4
>>            Using PCRE version 8.38 2015-11-23
>>            Using ZLIB version 1.2.8
>>            Using FlatBuffers 1.7.0
>>            Using Hyperscan version 4.6.0 2017-11-18
>>            Using LZMA version 5.1.0alpha
>>
>> *_Files used:_*
>> noah@snort3:/etc/snort$ tree
>> .
>> ├── builtin_rules
>> ├── file_magic.lua
>> ├── lists
>> ├── rules
>> │   ├── ips.include
>> │   ├── local.rules
>> │   ├── sid-msg.map
>> │   └── snort3-community.rules
>> ├── snort_defaults.lua
>> ├── snort.lua
>> └── so_rules
>>
>> _# snort_defaults.lua _(relevant sections):
>>
>> ---------------------------------------------------------------------------
>> -- default paths
>> ---------------------------------------------------------------------------
>> -- Path to your rules files (this can be a relative path)
>>
>> RULE_PATH = '/etc/snort/rules'
>> BUILTIN_RULE_PATH = '/etc/snort/builtin_rules'
>> PLUGIN_RULE_PATH = '/etc/snort/so_rules'
>>
>> -- If you are using reputation preprocessor set these
>> WHITE_LIST_PATH = '/etc/snort/lists'
>> BLACK_LIST_PATH = '/etc/snort/lists'
>>
>> *_# snort.lua_ *(relevant sections)
>> ---------------------------------------------------------------------------
>> -- 2. configure defaults
>> ---------------------------------------------------------------------------
>>
>> -- HOME_NET and EXTERNAL_NET must be set now
>> -- setup the network addresses you are protecting
>> HOME_NET = '10.0.0.0/24 <http://10.0.0.0/24>'
>>
>> -- set up the external network addresses.
>> -- (leave as "any" in most situations)
>> EXTERNAL_NET = 'any'
>>
>> dofile(conf_dir .. '/snort_defaults.lua')
>> dofile(conf_dir .. '/file_magic.lua')
>>
>> appid =
>> {
>>     -- appid requires this to use appids in rules
>> app_detector_dir = '/lib',
>>     log_stats = true,
>> }
>>
>> ips =
>> {
>>     -- use this to enable decoder and inspector alerts
>>     -- enable_builtin_rules = true,
>>
>>     -- use include for rules files; be sure to set your path
>>     -- note that rules files can include other rules files
>>     --include = 'snort3_community.rules'
>>     include = RULE_PATH .. '/ips.include',
>> }
>>
>>
>> *_# ips.include_*
>> #include rules/snort3-community.rules
>> include rules/local.rules
>>
>> *_# local.rules_*
>> alert icmp any any -> $HOME_NET any (msg:"ICMP test detected"; 
>> sid:10000001; rev:001; GID:1; classtype:icmp-event;)
>>
>> *_# Running Snort (and getting segfault):_*
>> noah@snort3:/etc/snort$ sudo /bin/snort -c /etc/snort/snort.lua 
>> --warn-all
>> --------------------------------------------------
>> o")~   Snort++ 3.0.0-240
>> --------------------------------------------------
>> Loading /etc/snort/snort.lua:
>> ssh
>> pop
>> binder
>> stream_tcp
>> gtp_inspect
>> dce_http_proxy
>> stream_icmp
>> normalizer
>> ftp_server
>> stream_udp
>> modbus
>> ips
>> ssl
>> latency
>> wizard
>> appid
>> file_id
>> ftp_data
>> back_orifice
>> smtp
>> port_scan
>> dce_http_server
>> dce_tcp
>> dce_smb
>> telnet
>> classifications
>> sip
>> rpc_decode
>> http_inspect
>> stream_ip
>> stream_user
>> dnp3
>> ftp_client
>> stream
>> references
>> arp_spoof
>> dns
>> dce_udp
>> imap
>> stream_file
>> Finished /etc/snort/snort.lua.
>> Loading /etc/snort/rules/ips.include:
>> Loading rules/local.rules:
>> Segmentation fault (core dumped)
>> noah@snort3:/etc/snort$
>>
>>
>>
>> When i fix the rules to have all lowercase option names, i don't get 
>> a segfault:
>>
>> noah@snort3:/etc/snort$ sudo /bin/snort -c /etc/snort/snort.lua 
>> --warn-all
>> --------------------------------------------------
>> o")~   Snort++ 3.0.0-240
>> --------------------------------------------------
>> Loading /etc/snort/snort.lua:
>> ssh
>> pop
>> binder
>> stream_tcp
>> gtp_inspect
>> dce_http_proxy
>> stream_icmp
>> normalizer
>> ftp_server
>> stream_udp
>> modbus
>> ips
>> ssl
>> latency
>> wizard
>> appid
>> file_id
>> ftp_data
>> back_orifice
>> smtp
>> port_scan
>> dce_http_server
>> dce_tcp
>> dce_smb
>> telnet
>> classifications
>> sip
>> rpc_decode
>> http_inspect
>> stream_ip
>> stream_user
>> dnp3
>> ftp_client
>> stream
>> references
>> arp_spoof
>> dns
>> dce_udp
>> imap
>> stream_file
>> Finished /etc/snort/snort.lua.
>> Loading /etc/snort/rules/ips.include:
>> Loading rules/local.rules:
>> Finished rules/local.rules.
>> Finished /etc/snort/rules/ips.include.
>> --------------------------------------------------
>> rule counts
>>        total rules loaded: 1
>>                text rules: 1
>>             option chains: 1
>>             chain headers: 1
>> --------------------------------------------------
>> port rule counts
>>              tcp     udp    icmp      ip
>>      any       0       0       1       0
>>    total       0       0       1       0
>> WARNING: port rule 1:10000001:1 has no fast pattern
>> WARNING: legacy mode fast pattern searching enabled
>> --------------------------------------------------
>> pcap DAQ configured to passive.
>> --------------------------------------------------
>> memory (heap)
>>     main thread usage: 26400128
>>     allocations: 138043
>>     deallocations: 77420
>>     thread cap: 0
>>     preemptive threshold: 0
>>
>> Snort successfully validated the configuration (with 2 warnings).
>> o")~   Snort exiting
>>
>>
>>
>>
>>
>> On Mon, Nov 20, 2017 at 5:24 PM, Russ <[email protected] 
>> <mailto:[email protected]>> wrote:
>>
>>     Hey Noah, responses inline.
>>
>>     Thanks
>>     Russ
>>
>>     On 11/19/17 3:36 AM, Noah Dietrich wrote:
>>>     Hello,
>>>
>>>     While working with Snort3 (build 240), I have found some issues,
>>>     and have a few questions and requests. I am happy to submit
>>>     these through Github if you'd like.
>>     This is fine.  Whatever works for you.
>>>
>>>     1.  What is the difference between *ips.include* and
>>>     *ips.rules*?  From the manual and examples, it looks like
>>>     ips.include is for legacy rules (although snort3 community rules
>>>     load fine), while ips.rules is for local rules in the same
>>>     file.  can you clarify?
>>     ips.include = filename of Snort 3.0 rules you want to load.  Like
>>     Snort 2.X, you can put include statements in that file to include
>>     other files.  Snort 3.0 will not load Snort 2.X rules (but you
>>     can use snort2lua to convert them).
>>
>>     ips.rules = string variable containing rules directly in the Lua
>>     file.  This is good for simple rules or test configurations or
>>     enabling specific builtins like this:
>>
>>     local_rules =
>>     [[
>>     block ( gid:119; sid:16; )
>>     block ( gid:119; sid:32; )
>>     ]]
>>
>>     ips = { rules = local_rules }
>>
>>>     2.  For best practices, are you expecting people to set
>>>     *$RULE_HOME* in *snort_defaults.lua*, or should this be
>>>     overwritten in *snort.lua*? Should this be moved to snort.lua,
>>>     since the word 'defaults' seems to indicate something the user
>>>     shouldn't change.
>>     I am not familiar with RULE_HOME, but obviously those files are
>>     just starting points and should be modified to meet your needs. 
>>     That said, my suggestion would be to just edit snort.lua and
>>     copy/paste/tweak stuff from snort_defaults.lua into snort.lua or
>>     elsewhere.  That way you can more easily absorb any changes to
>>     snort_defaults.lua.
>>>     3.  If $RULE_HOME is set, when referencing rule files, you are
>>>     now required to have all rules under that folder (with no
>>>     explicit paths to other locations). This seems like a bug.  It
>>>     would be nice if relative files would use the $RULES_HOME
>>>     directory, while full paths to rule files would not use $RULE_HOME.
>>     Are you referring to RULE_PATH?  Regardless, there is no
>>     restriction on where your rules are located or on including one
>>     file from another.  Snort++ intentionally doesn't start guessing
>>     about the location of stuff so I wouldn't call that a bug. 
>>     Sounds like adding a command line option that says look for all
>>     rules files starting with a given path will do what you want.
>>>     4.  When using *ips.include* with a file that lists all rule
>>>     files (example below), the file paths don't seem to be relative
>>>     to $RULE_HOME, but are relative to the snort.lua file, which
>>>     seems odd.
>>     By default, everything should be relative to your current working
>>     directory, which seems normal.  :) How is this different from #3?
>>>     5.  It would be nice to be able to specify multiple rule files
>>>     in your snort.lua, rather than listing them all in ips.include
>>>     (or whatever). The current method of lincluding a list of rule
>>>     files in a text file referenced from *ips.include *seems like a
>>>     kludge and adds an extra layer of work and increases the chance
>>>     of an issue when configuring your rules.  A comma-seperated list
>>>     of files (relative to $RULE_HOME or full paths) would be helpful.
>>     Would this work for you (assuming the new command line option
>>     mentioned in #3)?
>>
>>     local_rules =
>>     [[
>>     include one.rules
>>     include two.rules
>>     # ...
>>     ]]
>>
>>     ips = { rules = local_rules }
>>>     6.  Not sure if this is an issue or not, but if you specify the
>>>     GID keyword in a rule loaded with *ips.include*, snort3 will
>>>     segfault.
>>     Oops.  Any segfault is an issue but I'm unable to reproduce
>>     that.  Can you isolate it and send the rule?
>>>
>>>     Thank you,
>>>     Noah
>>>
>>>
>>>     Here is how my system is configured for the above questions
>>>     (relevant sections only):
>>>
>>>     *_/etc/snort/snort_defaults.lua:_*
>>>     RULE_PATH = '/etc/snort/rules'
>>>
>>>     *_/etc/snort/_**_snort.lua_*
>>>     ips =
>>>     {
>>>         enable_builtin_rules = true,
>>>         include = RULE_PATH .. '/ips.include',
>>>     }
>>>
>>>     *_/etc/snort/rules/ips.include_*
>>>     include rules/snort3-community.rules
>>>     include rules/local.rules
>>>
>>>     ls -l /etc/snort/rules
>>>     -rw-r--r-- 1 root root      64 Nov 19 09:33              ips.include
>>>     -rw-r--r-- 1 root root    1389 Nov 19 09:36            local.rules
>>>     -rw-r--r-- 1 root root  376241 Nov 18 13:42          sid-msg.map
>>>     -rw-r--r-- 1 root root 1504089 Nov 18 13:36       
>>>      snort3-community.rules
>>>
>>>     *_
>>>     _*
>>>     *_noah@snort3:/etc/snort$ /bin/snort -V_*
>>>
>>>        ,,_     -*> Snort++ <*-
>>>       o"  )~   Version 3.0.0 (Build 240) from 2.9.8-383
>>>        ''''    By Martin Roesch & The Snort Team
>>>     http://snort.org/contact#team
>>>                Copyright (C) 2014-2017 Cisco and/or its affiliates.
>>>     All rights reserved.
>>>                Copyright (C) 1998-2013 Sourcefire, Inc., et al.
>>>                Using DAQ version 2.2.2
>>>                Using LuaJIT version 2.0.4
>>>                Using OpenSSL 1.0.2g  1 Mar 2016
>>>                Using libpcap version 1.7.4
>>>                Using PCRE version 8.38 2015-11-23
>>>                Using ZLIB version 1.2.8
>>>                Using FlatBuffers 1.7.0
>>>                Using Hyperscan version 4.6.0 2017-11-18
>>>                Using LZMA version 5.1.0alpha
>>>
>>>
>>>
>>>
>>>     _______________________________________________
>>>     Snort-devel mailing list
>>>     [email protected] <mailto:[email protected]>
>>>     https://lists.snort.org/mailman/listinfo/snort-devel
>>>     <https://lists.snort.org/mailman/listinfo/snort-devel>
>>>
>>>     Please visithttp://blog.snort.org  for the latest news about Snort!
>>
>>
>
>
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.