The Open Information Security Foundation
We have a great number of new features coming out with Suricata. Many are already there so we want to start talking about them and making everyone aware. To be clear though, Suricata supports all of the current rule syntax directives. We're just adding new to accommodate the new features we're building.
The first one I'd like to bring to your attention is Flowint. This is a precursor to the Global Variables task we have due very soon, which will allow the capture, storage and comparison of data in a variable. Cool, yes. But it's not just for the stream, it'll be as the name implies Global. So you can compare data from packets in unrelated streams. More on that when it's ready, probably around February 2010.
Flowint allows storage and mathematical operations using variables. It operates much like flowbits but with the addition of mathematical capabilities and the fact that an integer can be stored and manipulated, not just a flag set. We can use this for a number of very useful things, such as counting occurrences, adding or subtracting occurrences, or doing thresholding within a stream in relation to multiple factors. This will be expanded to a global context very soon so we can do these operations between streams. More on that when it's in there!
The syntax is as follows:
flowint: , ;
Define a var (not required), or check that one is set or not set.
flowint: , , ;
flowint: , < +,-,=,>,<,>=,<=,==, != >, ;
Compare or alter a var. Add, subtract, compare greater than or less than, greater than or equal to, and less than or equal to are available. The item to compare with can be an integer or another variable.
For example, lets say we want to count how many times a username is seen in a particular stream and alert if it's over 5.
alert tcp any any -> any any (msg:"Counting Usernames"; content:"jonkman"; \
flowint: usernamecount, +, 1; flowint:noalert;)
This will count each occurrence and increment the var usernamecount and not generate an alert for each.
Now say we want to generate an alert if there are more than five hits in the stream.
alert tcp any any -> any any (msg:"More than Five Usernames!"; content:"jonkman"; \
flowint: usernamecount, +, 1; flowint:usernamecount, >, 5;)
So we'll get an alert ONLY if usernamecount is over five.
So now lets say we want to get an alert as above but NOT if there have been more occurences of that username logging out. Assuming this particular protocol indicates a log out with "jonkman logout", lets try:
alert tcp any any -> any any (msg:"Username Logged out"; content:"logout jonkman"; \
flowint: usernamecount, -, 1; flowint:usernamecount, >, 5;)
So now we'll get an alert ONLY if there are more than five active logins for this particular username.
This is a rather simplistic example, but I believe it shows the power of what such a simple function can do for rule writing. I see a lot of applications in things like login tracking, IRC state machines, malware tracking, and brute force login detection.
Lets say we're tracking a protocol that normally allows five login fails per connection, but we have a vulnerability where an attacker can continue to login after that five attempts, and we need to know about it.
alert tcp any any -> any any (msg:"Start a login count"; content:"login failed"; \
flowint:loginfail, notset; flowint:loginfail, =, 1; flowint:noalert;)
So we detect the initial fail if the variable is not yet set and set it to 1 if so. Our first hit.
alert tcp any any -> any any (msg:"Counting Logins"; content:"login failed"; \
flowint:loginfail, isset; flowint:loginfail, +, 1; flowint:noalert;)
We are now incrementing the counter if it's set.
alert tcp any any -> any any (msg:"More than Five login fails in a Stream"; content:"login failed"; \
flowint:loginfail, isset; flowint:loginfail, >, 5;)
Now we'll generate an alert if we cross five login fails in the same stream.
But let's also say we also need alert if there are two successful logins and a failed login after that.
alert tcp any any -> any any (msg:"Counting Good Logins"; content:"login successful"; \
flowint:loginsuccess, +, 1; flowint:noalert;)
Here we're counting good logins, so now we'll count good logins relevant to fails:
alert tcp any any -> any any (msg:"Login fail after two successes"; content:"login failed"; \
flowint:loginsuccess, isset; flowint:loginsuccess, =, 2;)
Here are some other general examples:
alert tcp any any -> any any (msg:"Setting a flowint counter"; content:"GET"; \
flowint:myvar, notset; flowint:maxvar,notset; flowint:myvar,=,1; flowint: maxvar,=,6;)
alert tcp any any -> any any (msg:"Adding to flowint counter"; content:"Unauthorized"; \
flowint:myvar,isset; flowint: myvar,+,2;)
alert tcp any any -> any any (msg:"if the flowint counter is 3 create a new counter"; content:"Unauthorized"; \
flowint:myvar, isset; flowint:myvar,==,3; flowint:cntpackets,notset; flowint:cntpackets, =, 0;)
alert tcp any any -> any any (msg:"and count the rest of the packets received without generating alerts!!!"; \
flowint:cntpackets,isset; flowint:cntpackets, +, 1; flowint:noalert;)
alert tcp any any -> any any (msg:" and fire this when it reach 6"; flowint: cntpackets, isset; \
flowint: maxvar,isset; flowint: cntpackets, ==, maxvar;)
