(no subject)

[Bob Apthorpe <apthorpe+snort () cynistar net>]

Hi,

I think there's a problem with MySQL database logging in Snort 2.0.2 for
Win32, specifically when the interface is set in the sensor table. It
appears that you can't set the interface name and the implied name of the
interface is '\' (a single literal unescaped backslash) which causes MySQL
to choke.

See James Howarth's post on 3 September for a similar occurence:
http://lists.virus.org/snort-users-0309/msg00035.html

In my case, I configured logging with

  output database: log, mysql, user=snort, password=[redacted],
dbname=snort20, host=localhost

and I ran

  snort.exe -c C:\Snort\etc\snort.conf -l C:\logs\snort -i 4 -T -v

stdout gives me:

=====
Initializing Preprocessors!
Initializing Plug-ins!
database: compiled support for ( mysql odbc )
database: configured to use mysql
database:          user = snort
database: password is set
database: database name = snort20
database:          host = localhost
database:   sensor name = ADRASTEA:\
=====

and stderr yields:

=====
Running in IDS mode
Log directory = C:\logs\snort

Initializing Network Interface \

        --== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface \
Parsing Rules file C:\Snort\etc\snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Zero out flushed packets: INACTIVE
    flush_data_diff_size: 500
    Ports: 21 23 25 53 80 110 111 143 513 1433
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
http_decode arguments:
    Unicode decoding
    IIS alternate Unicode decoding
    IIS double encoding vuln
    Flip backslash to slash
    Include additional whitespace separators
    Ports to decode http on: 80
rpc_decode arguments:
    Ports to decode RPC on: 111 32771
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119
Node unique name is: ADRASTEA:\

database: mysql_error: You have an error in your SQL syntax near '\'
AND detail = '1' AND encoding = '0' AND filter IS NULL' at line 1
database: mysql_error: You have an error in your SQL syntax near
'\','1','0', '0')' at line 1
SQL=INSERT INTO sensor (hostname, interface, detail, encoding,
last_cid) VALUES ('ADRASTEA:\','\','1','0', '0')
database: mysql_error: You have an error in your SQL syntax near '\'
AND detail = '1' AND encoding = '0' AND filter IS NULL' at line 1
database: Problem obtaining SENSOR ID (sid) from snort20->sensor
ERROR:
 When this plugin starts, a SELECT query is run to find the sensor id
for the
 currently running sensor. If the sensor id is not found, the plugin
will run
 an INSERT query to insert the proper data and generate a new sensor
id. Then a
 SELECT query is run to get the newly allocated sensor id. If that
fails then
 this error message is generated.

 Some possible causes for this error are:
  * the user does not have proper INSERT or SELECT privileges
  * the sensor table does not exist

 If you are _absolutely_ certain that you have the proper privileges
set and
 that your database structure is built properly please let me know if
you
 continue to get this error. You can contact me at
(roman () danyliw com).

Fatal Error, Quitting..
=====

(FWIW, the table snort20.sensor exists and the snort user has full
permissions on the snort20 database.)

If Snort is actually sending the query

  INSERT INTO sensor (hostname, interface, detail, encoding, last_cid) \
    VALUES ('ADRASTEA:\','\','1','0', '0')

without escaping the \ in 'ADRASTEA:\' or '\', I strongly suspect that's
what's causing the problem that both James and I are seeing.

I can change sensor_name to anything I want in snort.conf and I can
specify the interface when invoking Snort; neither of those
have any affect on the value passed to sensor.interface.

What's really odd is that db logging worked fine on Win32 before upgrading
from Snort 1.9(?) to 2.0.2. The previous version of Snort set sensor_name
to ADRASTEA:DevicePacket_{EF7842F4-A0D6-49BE-B93A-D0110C4C467F} and
interface to DevicePacket_{EF7842F4-A0D6-49BE-B93A-D0110C4C467F} .

`snort.exe -W` gives:

Interface       Device          Description
-------------------------------------------
1  \Device\Packet_NdisWanIp (NdisWan Adapter)
2 \Device\Packet_NdisWanBh (NdisWan Adapter)
3 \Device\Packet_NdisWanAtalk (NdisWan Adapter)
4 \Device\Packet_{EF7842F4-A0D6-49BE-B93A-D0110C4C467F} (3Com EtherLink
PCI)

so I've got no idea why interface 4 is being read as \.

And yes, I've created a new db, ran all the db creation scripts, checked
permissions, and tried to verify as much of this as I could manually
(tried sending data to two different MySQL instances, one on Win32 and one
on Linux, both giving the same error.) I can't make that INSERT statement
work on a command line and all signs point to either bad escaping or bad
interface name determination.

Other wrinkles - I upgraded WinPCAP to v3; realized my mistake,
uninstalled it and reinstalled v2.3. Who knows if there's any lingering
crud left over from that fiasco (though wouldn't `snort -W` have coughed
up a lung on the device list if WinPCAP was broken?)

Any hints? I don't think I've missed anything obvious but I wouldn't be
surprised if I had. :/

Thanks much,

-- 
Bob Apthorpe


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users