Re: Snort3: binder and wizard inspectors

[Russ via Snort-users <snort-users () lists snort org>]

See below.
Russ

On 11/2/18 7:16 PM, Meridoff via Snort-users wrote:
> Hello, it's very brief info in manual about using wizard and binder.
>
> I have some questions concerning the most common use of them.
>
> 1. Binder and wizard has "first match wins" logic in their config ?
Binder has first match wins logic for each of the things it looks for 
(stream inspector, service inspector, policy).  Wizard searches for all 
matches in parallel, with first match wins at any given step.
> 2. In binder we have "when" table - the match logic and "use" table - 
> what to do  if match occure. Are the keys in when{}  have AND logic? 
> (e.g.: when.ports and when.nets etc.. must match togather if specified)
Yes.
> 3. In binder use.type - is the inspector to use for match case. But 
> what means when.service and use.service?
> As far as I understand:
>  3.1 we can define own 'service' in binder by    { when {port=123 }, 
> use { service = "myserv" }  }
You can't define services in the binder rules, you can only use existing 
services.
>  3.2 we can define own 'service' in wizard by spell/hexes tables
Same thing.  You can define match criteria for a service, but it only 
helps if an inspector supports that service.
>  3.3 if we have 'service' then we can use it in binder.use logic
when.service, user.type is the most common case which is done in the 
default snort.lua.  use.service allows you to map other criteria to a 
service, and a later rule in the current table or a sub table can can be 
a when.service rule.  You wouldn't normally use both when.service and 
use.service in the same rule.
> 4. What meaning of binder[].use.name <http://use.name> ? Where its 
> value can be used?
You can have multiple configurations for a given service.  Eg:

http_inspect = { }  -- default http config
other_http = { decompress_swf = true }  -- default http with one change

To use other_http as an http_inspect config, you need a binding like:

{ when = { service = 'http' }, use = { name = 'other_http', type = 
'http_inspect' }

You would typically have other when criteria to distinguish this a 
binding for other_http from the default.
> 5.So binder{} is evaluated 1st to identify service and 2nd to identify 
> what inspector to use for this service or what action to do 
> (reset|block...).
To be precise, binder does not identify service, wizard does that.
> 6. Wizard usually goes last in binder{} so it is used to identify 
> service that was failed to identify by bindings in binder ? And if we 
> can identify serivce in wizard than we look into binder 2n time to 
> decide what to do with it - what inspector or action to use and so on..
Yes.
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
>         snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette