Skip to content

Commit

Permalink
snort3: add missing config include and general cleanup
Browse files Browse the repository at this point in the history 
- Add snort config 'include' to allow user customizations in the lua
- Enhance 'check' to test generated nftables file
- Suppress warnings on configuration check unless '-v'erbose
- Replace text logging with json logging to reduce footprint and make reports easier
- Fix some typos in the snort.uc template
- Fix up some error messages suggesting solutions

Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
  • Loading branch information
@efahl
efahl committed Dec 8, 2023
1 parent a4b7f5a commit c29f544
Show file tree
Hide file tree
Showing 5 changed files with 96 additions and 30 deletions.
10 changes: 7 additions & 3 deletions net/snort3/files/main.uc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,8 @@ const snort_config = {
action: config_item("enum", [ "alert", "block", "drop", "reject" ]),
interface: config_item("str", [ uci.get("network", "wan", "device") ]),
snaplen: config_item("range", [ 1518, 65535 ]), // int daq.snaplen = 1518: set snap length (same as -s) { 0:65535 }

include: config_item("path", [ "" ]), // User-defined snort configuration, applied at end of snort.lua.
};

const nfq_config = {
Expand Down Expand Up @@ -123,7 +125,7 @@ snort
your lan range, default is '192.168.1.0/24'
external_net - IP range external to home. Usually 'any', but if you only
care about true external hosts (trusting all lan devices),
then '!$HOMENET' or some specific range
then '!$HOME_NET' or some specific range
mode - 'ids' or 'ips', for detection-only or prevention, respectively
oinkcode - https://www.snort.org/oinkcodes
config_dir - Location of the base snort configuration files. Default /etc/snort
Expand All @@ -138,6 +140,7 @@ snort
action - 'alert', 'block', 'reject' or 'drop'
method - 'pcap', 'afpacket' or 'nfq'
snaplen - int daq.snaplen = 1518: set snap length (same as -s) { 0:65535 }
include - User-defined snort configuration, applied at end of generated snort.lua
nfq - https://github.com/snort3/libdaq/blob/master/modules/nfq/README.nfq.md
queue_maxlen - nfq's '--daq-var queue_maxlen=int'
Expand Down Expand Up @@ -237,7 +240,8 @@ function render_help() {

load_all();

switch (getenv("TYPE")) {
let table_type = getenv("TYPE");
switch (table_type) {
case "snort":
render_snort();
return;
Expand All @@ -255,7 +259,7 @@ switch (getenv("TYPE")) {
return;

default:
print("Invalid table type.\n");
print(`Invalid table type '${table_type}', should be one of snort, nftables, config, help.\n`);
return;
}

Expand Down
9 changes: 7 additions & 2 deletions net/snort3/files/nftables.uc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,13 @@ table inet snort {
chain {{ chain_type }}_{{ snort.mode }} {
type filter hook {{ chain_type }} priority {{ nfq.chain_priority }}
policy accept
{% if (nfq.include) { include(nfq.include, { snort, nfq }); } %}
# tcp flags ack ct direction original ct state established counter accept
{% if (nfq.include) {
// We use the ucode include here, so that the included file is also
// part of the template and can use values passed in from the config.
printf("\n\t\t#-- The following content included from '%s'\n", nfq.include);
include(nfq.include, { snort, nfq });
printf("\t\t#-- End of included file.\n\n");
} %}
counter queue flags bypass to {{ queues }}
}
}
53 changes: 36 additions & 17 deletions net/snort3/files/snort-mgr
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/sh
# Copyright (c) 2023 Eric Fahlgren <eric.fahlgren@gmail.com>
# SPDX-License-Identifier: GPL-2.0
# shellcheck disable=SC2039 # "local" not defined in POSIX sh
# shellcheck disable=SC2039,SC2155 # "local" not defined in POSIX sh

PROG="/usr/bin/snort"
MAIN="/usr/share/snort/main.uc"
Expand All @@ -26,7 +26,7 @@ disable_offload()
{
# From https://forum.openwrt.org/t/snort-3-nfq-with-ips-mode/161172
# https://blog.snort.org/2016/08/running-snort-on-commodity-hardware.html
# Not needed when running the nft daq as defragmentation is done by the kernel.
# Not needed when running the nfq daq as defragmentation is done by the kernel.
# What about pcap?

local filter_method=$(uci -q get snort.snort.method)
Expand Down Expand Up @@ -55,6 +55,8 @@ nft_add_table() {
setup() {
# Generates all the configuration, then reports the config file for snort.
# Does NOT generate the rules file, you'll need to do 'update-rules' first.
local log_dir=$(uci get snort.snort.log_dir)
[ ! -e "$log_dir" ] && mkdir -p "$log_dir"
nft_rm_table
print snort > "$CONF"
nft_add_table
Expand Down Expand Up @@ -82,13 +84,26 @@ check() {
[ "$manual" = 1 ] && return 0

[ -n "$QUIET" ] && OUT=/dev/null || OUT=$STDOUT
[ -n "$VERBOSE" ] && warn='--warn-all' || warn='-q'

local test_conf="${CONF_DIR}/test_conf.lua"
print snort > "${test_conf}" || die "Errors during generation of config."
if $PROG -T -q --warn-all -c "${test_conf}" 2> $OUT ; then
print snort > "${test_conf}" || die "Errors during generation of snort config."
if $PROG -T $warn -c "${test_conf}" 2> $OUT ; then
rm "${test_conf}"
return 0
else
die "Errors in snort config tests. Examine ${test_conf} for issues."
fi

if [ "$(uci -q get snort.snort.method)" = "nfq" ]; then
local test_nft="${CONF_DIR}/test_conf.nft"
print nftables > "${test_nft}" || die "Errors during generation of nftables config."
if nft $VERBOSE --check -f "${test_nft}" ; then
rm "${test_nft}"
else
die "Errors in nftables config tests. Examine ${test_nft} for issues."
fi
fi
die "Errors in snort config tests."

}

report() {
Expand Down Expand Up @@ -120,20 +135,23 @@ report() {
die "Logging is not enabled in snort config."
fi

#if [ -z "$pattern" ]; then
# die "Provide a valid IP and try again."
#fi

[ "$NLINES" = 0 ] && output="cat" || output="head -n $NLINES"

# Fix this to use json file.
local msg src dst dir
tmp="/tmp/snort.report.$$"
echo "Intrusions involving ${pattern:-all IPs}"
grep "\b${pattern}\b" "$log_dir/alert_fast.txt" \
| sed 's/.*"\([^"]*\)".* \([^ :]*\)[: ].*-> \(.*\)/\1#\2#\3/' > "$tmp"
for file in "${log_dir}"/*alert_json.txt; do
while read -r line; do
eval $(jsonfilter -s "$line" -e 'msg=$.msg' -e 'src=$.src_ap' -e 'dst=$.dst_ap' -e 'dir=$.dir')
src=$(echo "$src" | sed 's/:.*$//') # Delete all source ports.
dst=$(echo "$dst" | sed 's/:0$//') # Delete unspecified dest port.
echo "$msg#$src#$dst#$dir"
done < "$file"
done | grep -i "$pattern" > "$tmp"

echo "Events involving ${pattern:-all IPs}"
n_incidents="$(wc -l < $tmp)"
lines=$(sort "$tmp" | uniq -c | sort -nr \
| awk -F'#' '{printf "%-80s %-12s -> %s\n", $1, $2, $3}')
| awk -F'#' '{printf "%-80s %s %-13s -> %s\n", $1, $4, $2, $3}')
echo "$lines" | $output
n_lines=$(echo "$lines" | wc -l)
[ "$NLINES" -gt 0 ] && [ "$NLINES" -lt "$n_lines" ] && echo " ... Only showing $NLINES of $n_lines most frequent incidents."
Expand Down Expand Up @@ -179,7 +197,7 @@ case "$1" in
teardown
;;
resetup)
QUIET=1 check || die "The generated snort lua configuration contains errors, not restarting."
QUIET=1 check || die "The generated snort lua configuration contains errors, not restarting. Run 'snort-mgr check'"
teardown
setup
;;
Expand Down Expand Up @@ -221,7 +239,7 @@ Usage:
Report on incidents. Note this is somewhat experimental, so suggested
improvements are quite welcome.
pattern = IP or piece of IP or something in the message to filter.
pattern = A case-insensitive grep pattern used to filter output.
$0 [-t] update-rules
Expand All @@ -243,6 +261,7 @@ Usage:
snort = The snort configuration file, which is a lua script.
nftables = The nftables script used to define the input queues when using
the 'nfq' DAQ.
help = Display config file help.
$0 [-q] check
Expand Down
4 changes: 3 additions & 1 deletion net/snort3/files/snort.config
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# your lan range, default is '192.168.1.0/24'
# external_net - IP range external to home. Usually 'any', but if you only
# care about true external hosts (trusting all lan devices),
# then '!$HOMENET' or some specific range
# then '!$HOME_NET' or some specific range
# mode - 'ids' or 'ips', for detection-only or prevention, respectively
# oinkcode - https://www.snort.org/oinkcodes
# config_dir - Location of the base snort configuration files. Default /etc/snort
Expand All @@ -28,6 +28,7 @@
# action - 'alert', 'block', 'reject' or 'drop'
# method - 'pcap', 'afpacket' or 'nfq'
# snaplen - int daq.snaplen = 1518: set snap length (same as -s) { 0:65535 }
# include - User-defined snort configuration, applied at end of generated snort.lua
#
# nfq - https://github.com/snort3/libdaq/blob/master/modules/nfq/README.nfq.md
# queue_maxlen - nfq's '--daq-var queue_maxlen=int'
Expand Down Expand Up @@ -61,6 +62,7 @@ config snort 'snort'
option action 'alert' # one of [alert, block, drop, reject]
option interface 'eth0' # a string
option snaplen '1518' # 1518 <= x <= 65535
option include '' # a path string

config nfq 'nfq'
option queue_count '4' # 1 <= x <= 16
Expand Down
50 changes: 43 additions & 7 deletions net/snort3/files/snort.uc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@
let home_net = snort.home_net == 'any' ? "'any'" : snort.home_net;
let external_net = snort.external_net;

let line_mode = snort.mode == "ids" ? "tap" : "inline";
let line_mode = snort.mode == "ids" ? "tap" : "inline";
let mod_mode = snort.mode == "ids" ? "passive" : "inline";

let inputs = null;
let vars = null;
Expand Down Expand Up @@ -50,10 +51,10 @@ snort = {
}

ips = {
mode = {{ line_mode }},
mode = '{{ line_mode }}',
variables = default_variables,
action_override = {{ snort.action }},
include = "{{ snort.config_dir }}/" .. RULE_PATH .. '/snort.rules',
action_override = '{{ snort.action }}',
include = '{{ snort.config_dir }}/' .. RULE_PATH .. '/snort.rules',
}

daq = {
Expand All @@ -63,7 +64,7 @@ daq = {
modules = {
{
name = '{{ snort.method }}',
mode = {{ line_mode }},
mode = '{{ mod_mode }}',
variables = {{ vars }},
}
}
Expand All @@ -78,24 +79,50 @@ alert_syslog = {
output.logdir = "{{ snort.log_dir }}"

-- Maybe add snort.log_type, 'fast', 'json' and 'full'?
-- Json would be best for reporting, see 'snort-mgr report' code.
-- alert_full = { file = true, }

--[[
alert_fast = {
-- bool alert_fast.file = false: output to alert_fast.txt instead of stdout
-- bool alert_fast.packet = false: output packet dump with alert
-- int alert_fast.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ }
file = true,
packet = false,
}
--]]

alert_json = {
-- bool alert_json.file = false: output to alert_json.txt instead of stdout
-- multi alert_json.fields = timestamp pkt_num proto pkt_gen pkt_len dir src_ap dst_ap rule action: selected fields will be output
-- int alert_json.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ }
-- string alert_json.separator = , : separate fields with this character sequence
-- multi alert_json.fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_ap dst_ap'
-- Rule action: selected fields will be output in given order left to right.
-- { action | class | b64_data | client_bytes | client_pkts | dir
-- | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src
-- | eth_type | flowstart_time | geneve_vni | gid | icmp_code
-- | icmp_id | icmp_seq | icmp_type | iface | ip_id | ip_len
-- | msg | mpls | pkt_gen | pkt_len | pkt_num | priority
-- | proto | rev | rule | seconds | server_bytes | server_pkts
-- | service | sgt | sid | src_addr | src_ap | src_port | target
-- | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp
-- | tos | ttl | udp_len | vlan }

-- This is a minimal set of fields that simply supports 'snort-mgr report'
-- and minimizes log size:
fields = 'dir src_ap dst_ap msg',

-- This set also supports the report, but closely matches 'alert_fast' contents.
--fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_ap dst_ap rule action msg',

file = true,
}

--[[
unified2 = {
limit = 10, -- int unified2.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ }
}
--]]

{% endif -%}

normalizer = {
Expand Down Expand Up @@ -124,3 +151,12 @@ appid = {
app_stats_period = 60,
}
{% endif %}

{%
if (snort.include) {
// We use the ucode include here, so that the included file is also
// part of the template and can use values passed in from the config.
printf("-- The following content from included file '%s'\n", snort.include);
include(snort.include, { snort, nfq });
}
%}

0 comments on commit c29f544

Please sign in to comment.