Re: Using LightSPD rules when we have custom config

Hello Brendan,

I have another doubt regarding setting the ips.variables

Since lua policy within LightSPD is included at the top, it also loads the
snort_variables.lua which uses hard-coded HOME_NET = 'any'. In our
environment, the HOME_NET is usually set to some other value and some
related vars (DNS_SERVERS etc.) may also be set.

To be able to modify these variables, it seems my only choice is to also
modify the policies/common/snort_variables.lua by hand everytime the rules
update or tinker with the ips.variables (.nets, .ports or .paths ) directly
where I have to specify each value because most variables depend on
HOME_NET and get set to "any" by default.

Is there a more maintainable way by which I can define HOME_NET and other
variables at top of the custom config and have lighspd policies pick them
up for correct processing by snort_variables.lua

Thanks,
Dheeraj

On Fri, 16 Aug 2024 at 10:31, Dheeraj Gupta <[email protected]>
wrote:

> Hello Brendan,
>
> Thanks a lot for those insights. The usage of LightSPD is much clearer to
> me now.
>
> Thanks,
> Dheeraj
>
> On Thu, 15 Aug 2024 at 21:44, Brendan Bell (brebell) <[email protected]>
> wrote:
>
>> Dheeraj,
>>
>> I check with some of our techincal experts on LightSPD and have the
>> following feedback
>>
>>
>>    1.  This is the correct understanding.  The best way to do custom
>>    changes, in a permanent and easily maintainable way is to create a custom
>>    policy file where the start of the file is :
>>    include("/path/to/stock/policy.lua") and then the tweaks and changes to
>>    that config are added afterward to layer on top the stock config.
>>    2. Rule states are set by the last rule state read.  So what you can
>>    do is create a file that includes rule state lines of the form alert
>>    (gid:1; sid:39905; enable:no;)  (to turn rules on, you can either do
>>    enable:yes; or simply leave the enable directive off of the line) and then
>>    in your custom configuration file described above, add the line ips.states
>>    = ips.states .. "include /path/to/custom/rulestates.rules\n"
>>    Please note,  since it's the last rule state that matters in this
>>    case, it's only if a previous rule states file turned a rule on. If yours
>>    is loaded last and turns it off, it'll be off.
>>
>>    3. Not at this time.
>>
>>
>> ------------------------------
>> *From:* Snort-users <[email protected]> on behalf of
>> Dheeraj Gupta via Snort-users <[email protected]>
>> *Sent:* Wednesday, August 14, 2024 3:23 AM
>> *To:* [email protected] <[email protected]>
>> *Subject:* [Snort-users] Using LightSPD rules when we have custom config
>>
>> Hi,
>>
>> I have been trying to understand usage of LightSPD rules in order to
>> switch to using them. I had earlier too posted on the same topic in this
>> mailing-list ( https://seclists.org/snort/2024/q1/44 ).
>>
>> My understanding now is that in order to use the LightSPD rules, we do
>> the following:
>>
>> - Find out our snort version (V1)
>> - Unzip the LightSPD tarball and open manifest.json. Then lookup the
>> latest version entry <= V1
>> - Specify architectures -> YOUR_ARCH -> modules_path to --plugin-path
>> switch in snort command
>> - Specify policies_path/POLICY_NAME.lua as value to -c switch in snort
>> command line
>>
>> However, we have some customized configuration in our environment
>> (afpacket daq, perf_monitor, alert_json, home_net,  port spec etc) which we
>> would like to reuse when updating rules.  What is the standard procedure
>> when using LightSPD with custom configuration? I would not like to specify
>> all configuration options in command line but use lua files for the same
>>
>> - Do we define our own config file and keep an include() which is updated
>> with appropriate policy based on LightSPD at every update? or can we use
>> command line switches to specify base and custom policy files?
>> - How can we disable certain rules (in pulledpork we can update
>> disablesid.conf) or enable or modify the rules when deploying rule updates?
>> Would this be done in our lua config and can we use rule sids or gids
>> directly to enable/disable?
>> - Is there a standard tool (something like pulledpork) which can automate
>> extraction of paths from manifest?
>>
>> Regards,
>> Dheeraj
>>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette