Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Suricata improvements #330

Closed
wants to merge 5 commits into from
Closed

Suricata improvements #330

wants to merge 5 commits into from

Conversation

securitym0nkey
Copy link
Contributor

This are some improvements for the suricata SID content mgmt.

It resolves 2 bugs in the SID content mgmt:

  • Only the last SID in a list get modified
  • Modification to all SIDs not working. Neither via the wildcard '*' nor with just the search term and replacement as showed in the example config.

Additionally it adds support to modify all signatures from a certain category

@securitym0nkey
Fixed wildcard SID modification
6111c3c 
Wildcard sid modifications are not working due to wrong iteration over $rule_map[1] instead of $rule_map. Replaced this iteration with an array check as the code is only working on GID 1 anyway.
@securitym0nkey
Fixed modified signatures missing the modify icon at the webgui
485d3d8 
Set "modified" attribute at the rule_map entry when rules get modified by SID Mgmt
@securitym0nkey
Fixed rule modification for multiple comma separated SIDs
8f50b71 
Added a new mode for suricata_parse_sidconf_file to NOT split lines at commas. This mode is used to get the $sid_mods from the "Modify SID File". That $sid_mods goes into suricata_modify_sid_content. suricata_modify_sid_content is splitting the list itself. If the list is splitted by suricata_parse_sidconf_file only the last "SID mod token" for a line retains the FROM & TO elements.
@securitym0nkey
New feature for the SID Mgmt: rule content modification by category
9b0d73d 
This commit adds functionality to modify all signatures within a category.

suricata_modify_sid_content was restructured to walk always over the sid list. Now it is actually a list is of sids,category and the wildcard '*'. If an item is a specific SID it gets modified otherwise the whole rule_map is walk thru to find all rules that need be changed.
@securitym0nkey
Improved regex for SID content mgmt
bf9b6f0
@netgate-git-updates
Copy link

Before this pull request can be accepted you must first sign a CLA as described at https://www.pfsense.org/about-pfsense/#cla. Please read for more details.

doktornotor
doktornotor reviewed Mar 12, 2017
View reviewed changes
security/pfSense-pkg-suricata/files/var/db/suricata/sidmods/modifysid-sample.conf
@@ -19,5 +19,13 @@
# "HTTP_PORTS" "HTTPS_PORTS"

# multiple sids can be specified as noted below:
# 302,429,1821 "\$EXTERNAL_NET" "\$HOME_NET"
# 302,429,1821 "$EXTERNAL_NET" "$HOME_NET"
Copy link
Contributor

@doktornotor doktornotor Mar 12, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pretty sure these should remain escaped as it was before, and any added example should have those escaped, otherwise it's never going to match things in the rulesets. IOW, this it to replace the string $EXTERNAL_NET with a string $HOME_NET for the matching SIDs, not to expand those things to whatever is defined there and stick that in the rules.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code is escaping it itself. See line 2506. Actually that way you can't use regex for replacement. pulledpork supports replacement by regex in such case you need to escape it. I thought of removing the preg_quote so that the current example would be correct. But dropped that idea to no break the config for people who have noticed that escaping is not needed as displayed in the example.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, currently the code performs internal escaping of the regex.

doktornotor
doktornotor reviewed Mar 12, 2017
View reviewed changes
security/pfSense-pkg-suricata/files/var/db/suricata/sidmods/modifysid-sample.conf
# emerging-scan,emerging-sql "$EXTERNAL_NET" "any"

# modify all signatures for a category and specific SIDs from other categories
# emerging-sql,2100691,2009817 "$EXTERNAL_NET" "any"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See previous comment.

@rbgarga
Copy link
Member

rbgarga commented Mar 29, 2017

Can you take a look at these changes @bmeeks8 ?

@bmeeks8
Copy link
Contributor

bmeeks8 commented Mar 29, 2017

I am OK with the changes submitted. Thank you to the submitter for improving the Suricata package!

@rbgarga
Copy link
Member

rbgarga commented Apr 12, 2017

@securitym0nkey can you please rebase your fork and bump PORTREVISION so I can get it merged

@rbgarga
Copy link
Member

rbgarga commented Apr 12, 2017

@bmeeks8 if you believe it's easier for you to include these changes together with the update you are working on just let me know

@bmeeks8
Copy link
Contributor

bmeeks8 commented Apr 12, 2017

I just submitted the pull request for the new Suricata 3.2.1 package update, but it was before I saw this notice. My update is not touching the files referenced in this pull request.

@rbgarga
Copy link
Member

rbgarga commented Apr 12, 2017

Manually merged it, thanks!

@rbgarga rbgarga closed this Apr 12, 2017
netgate-git-updates pushed a commit that referenced this pull request Jun 26, 2019
@DonLewisFreeBSD
Upgrade devel/protobuf-c to version 1.3.2:
cb888de 
  [ Robert Edmonds ]
  * Release 1.3.2.

  * Use protobuf 3.7.1 in the Travis-CI environment (#368).

  * Fix test suite build failure on newer versions of protobuf (#369).

  [ Ilya Lipnitskiy ]
  * Fix proto3 repeated scalar field default packing behavior (#330, #377).

  [ Adam Cozzette ]
  * Fix out-of-bounds read in scan_length_prefixed_data() (#375, #376).

  [ Jurriaan Bremer ]
  * Fix -Wdeclaration-after-statement warning in parse_oneof_member() (#360).

  [ Hayri Ugur Koltuk ]
  * Fix SIGSEGV in protobuf_c_message_check() on messages with unpopulated
    oneof members (#358).

  [ Italo Guerrieri ]
  * Do not allow tag values of 0 in protobuf messages, as these are not
    allowed by proto2 or proto3 (#299).

The patch for version 1.3.1 is no longer required.

Sort Makefile statements to pacify portlint.

Reported by:	portscout
Sponsored by:	Farsight Security, Inc.
netgate-git-updates pushed a commit that referenced this pull request Jul 5, 2022
@fraggerfox
www/jira-cli: Update to 1.0.0
fad7042 
Changes since 0.3.0:

We reached v1.0.0

- fix!: Replace limit flag with paginate by @ankitpokhrel in #359
- fix!: Append components on edit instead of overriding by @ankitpokhrel in #368
- feat!: Append label to an issue, show labels at issue list view by @stchar in #300
- refactor!: Move boards and project list to subcommand by @ankitpokhrel in #314

- feat: Support custom fields on issue create by @ankitpokhrel in #319
- feat: Add support to read from .netrc by @adolsalamanca in #329
- feat: Add support for OS keyrings/-chains by @boyvanamstel in #348
- feat: Support auth with personal access tokens by @marek-veber / @ankitpokhrel in #327
- feat: Allow to set fixVersions on issue creation by @ankitpokhrel in #276
- feat: Allow insecure TLS by @ankitpokhrel in #305
- feat: Add --no-browser option to open cmd by @ankitpokhrel in #308
- feat: Add search option for boards on jira init by @ankitpokhrel in #322
- feat: Add issues unlink command by @sushilkg in #347
- feat: Support refresh for issues list by @GZLiew in #325
- feat: Ability to delete issue by @ankitpokhrel in #336
- feat: Allow to set custom fields on epic create by @ankitpokhrel in #364
- feat: Allow to edit release-info/fixVersions by @ankitpokhrel in #365
- feat: Allow removing labels on edit by @ankitpokhrel in #371
- feat: Support creating issues with custom subtask type by @danobi in #372
- feat: Allow removing component on edit by @ankitpokhrel in #374
- feat: Allow removing fixVersions on edit by @ankitpokhrel in #376
- feat: Support custom fields on issue edit by @ankitpokhrel in #377
- feat: Jira init non-interactive by @ankitpokhrel in #381
- feat: Show subtasks in issue view by @ankitpokhrel in #382
- feat: Allow project filter in raw jql by @ankitpokhrel in #395

- fix: Makefile compatiblity with Make 3.81 by @danmichaelo in #252
- fix: Config generation issue by @ankitpokhrel in #275
- fix(cfg): Strip trailing slash on server name by @ankitpokhrel in #295
- fix: Jira client should respect timeout opt by @ankitpokhrel in #304
- fix: Respect GLAMOUR_STYLE env on issue view by @ankitpokhrel in #317
- fix: Get subtask handle from config by @ankitpokhrel in #296
- fix: Jira wiki parser by @ankitpokhrel in #326
- fix: Display correctly columns in list sprint command help by @adolsalamanca in #320
- fix: Panic on empty sub-list by @ankitpokhrel in #330
- fix: Issue with assigning user by @ankitpokhrel in #321
- fix: OOM bug on issue view by @ankitpokhrel in #350
- fix: Assign parent key as is on edit by @ankitpokhrel in #351
- fix: Add additional check for total boards returned by @ankitpokhrel in #360
- fix: Issue with query param in user assignment by @ankitpokhrel in #380
- fix: Subtask clone by @ankitpokhrel in #383
- fix: editing issue with custom field in non interactive mode by @DrudgeRajen in #391

- dep: Upgrade charmbracelet/glamour to 0.5.0 by @ankitpokhrel in #309
- dep: Upgrade rivo/tview to latest by @ankitpokhrel in #310
- dep: Upgrade outdated packages by @ankitpokhrel in #311
- dep: Upgrade cobra to 1.4.0 by @ankitpokhrel in #373

- Use md ext for tmp file to trigger vim syntax by @ElementalWarrior in #318

Full Changelog: ankitpokhrel/jira-cli@v0.3.0...v1.0.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@doktornotor doktornotor doktornotor left review comments

@bmeeks8 bmeeks8 bmeeks8 left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
5 participants
@securitym0nkey @netgate-git-updates @rbgarga @bmeeks8 @doktornotor