Re: unifed2 log

Eugenio Pérez via Snort-devel <[email protected]> Thu, 22 Mar 2018 16:24:13 +0100

Newsgroups	gmane.comp.security.ids.snort.devel
Message-ID	<CAO2u4Cy88e_unN+qAnzk-P+3Rd_KzLZMg2UZBFoHm30mqOeb0w@mail.gmail.com>

Hi, Ron H, sorry for the late response.

I did a patch some years ago that makes snort don't rotate when writing U2
packet type records. The base version of the patch is outdated 2.9.8.3, but
it shouldn't be too complicated to update that.

As I show in patch doc, this breaks the U2 hard limit so that files could
grow beyond the limit. That was not a problem in my case, but it could be
for yours.

Maybe a better solution could be to modify the spooler to accept the break,
but that was not the path I took.

I hope it helps, regards!

2018-03-08 14:51 GMT+01:00 Ron H via Snort-devel <
[email protected]>:

> Hello Snort-devel,
>
> We use Unifed2 packets logging to log our snort rules. Unifed2 log rotates
> every X MB size by definition.
> Our system, convert this unifed2 log to Pcap file by SigID and send him to
> offline IDS.
>
> The problem with Unifed2 logs can cut in the middle the sessions before
> ended because the logrotate size.
> we interesting to reduce this issue.
>
> We would like to know, How we can resolve this issue?
> One of our solution we thinking is writing log unifed2/Pcap by SigID, It
> can be possible?
>
> Thanks!
>
>
>
>
> <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Virus-free.
> www.avg.com
> <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
> <#m_-3803235937643421740_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
>

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

dont_rotate_on_packets_2_9_8_3.diff (text/x-patch, 3.6 KB)

diff --git a/doc/README.unified2 b/doc/README.unified2
index 0d943cd..45f1127 100644
--- a/doc/README.unified2
+++ b/doc/README.unified2
@@ -106,6 +106,17 @@ I. Configuring Unified2 Output
     generated events for that session.
     * see README.SMTP for more information

+    dont_rotate_on_packets
+
+    This options disable the log rotation when u2 is writing packets.
+    This is useful when you want to see the event with u2spewfoo. This
+    way, you don't have to see two different files.
+
+    However, this option broke the strict limit option, because u2
+    output plugin does not know how long the packet is before write
+    out the event. Depending on the packet length, the limit will be
+    overflow in more or less bytes.
+

 II. Reading Unified2 Files

diff --git a/src/output-plugins/spo_unified2.c b/src/output-plugins/spo_unified2.c
index fc1c969..78a02e2 100644
--- a/src/output-plugins/spo_unified2.c
+++ b/src/output-plugins/spo_unified2.c
@@ -85,6 +85,12 @@ typedef struct _Unified2Config
 #if defined(FEAT_OPEN_APPID)
     int appid_event_types;
 #endif /* defined(FEAT_OPEN_APPID) */
+
+    // Barnyard2 can't print events if they are splitted in many log file.
+    // If you turn on this option, snort will only split in events printing.
+    // However, this will broke the limit implementation: spo_unified2 can
+    // write beyond this limit, until it found an event to rotate on.
+    int dont_rotate_on_packets;
 } Unified2Config;

 typedef struct _Unified2LogCallbackData
@@ -735,7 +741,7 @@ void _WriteExtraData(Unified2Config *config, uint32_t event_id, uint32_t event_s
     alertHdr.event_length = htonl(write_len - sizeof(Serial_Unified2_Header));


-    if ((config->current + write_len) > config->limit)
+    if (!config->dont_rotate_on_packets && (config->current + write_len) > config->limit)
         Unified2RotateFile(config);

     hdr.length = htonl(write_len - sizeof(Serial_Unified2_Header));
@@ -980,7 +986,7 @@ static void _Unified2LogPacketAlert(Packet *p, const char *msg,
         logheader.packet_length = 0;
     }

-    if ((config->current + write_len) > config->limit)
+    if (!config->dont_rotate_on_packets && (config->current + write_len) > config->limit)
         Unified2RotateFile(config);

     hdr.length = htonl(sizeof(Serial_Unified2Packet) - 4 + pkt_length);
@@ -1034,7 +1040,7 @@ static int Unified2LogStreamCallback(DAQ_PktHdr_t *pkth,
         return -1;

     write_len += pkth->caplen;
-    if ((unifiedData->config->current + write_len) > unifiedData->config->limit)
+    if (!unifiedData->config->dont_rotate_on_packets && (unifiedData->config->current + write_len) > unifiedData->config->limit)
         Unified2RotateFile(unifiedData->config);

     hdr.type = htonl(UNIFIED2_PACKET);
@@ -1124,7 +1130,7 @@ static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t *pkth,
             return OB_RET_ERROR;
         }

-        if ((unifiedData->config->current + record_len) > unifiedData->config->limit)
+        if (!unifiedData->config->dont_rotate_on_packets && (unifiedData->config->current + record_len) > unifiedData->config->limit)
             Unified2RotateFile(unifiedData->config);

         hdr.type = htonl(UNIFIED2_PACKET);
@@ -1324,6 +1330,10 @@ static Unified2Config * Unified2ParseArgs(char *args, char *default_filename)
                 config->appid_event_types = 1;
 #endif /* defined(FEAT_OPEN_APPID) */
             }
+            else if(strcasecmp("dont_rotate_on_packets", stoks[0]) == 0)
+            {
+                config->dont_rotate_on_packets = 1;
+            }
             else
             {
                 FatalError("Argument Error in %s(%i): %s\n",