Re: oinkmaster and binary rules

[Seth Art <sethsec () gmail com>]

That is exactly what I discovered as well.  I'm not saying it's
impossible, just that I couldn't find a way to tell oinkmaster which
set of precomiled so files to copy over.  Seems like a something that
could be added to a future version of Oinkmaster.

In the end, as Nathanial mentioned I decided to script the so_rules
part myself, and then let oinkmater take care of the gen 1 rules. Here
is an updated version of the script that I modified for my sguil
sensor at home.  I have abstracted a bunch of the paths to variables
at the top of the script to make it much easier to modify for your own
needs.

-----------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------- BEGIN SCRIPT
------------------------------------------------------

#!/bin/bash
###################################################################
# Purpose: This script is used to update Snort signatures
# Author: Seth Art
# Version: 1.1
###################################################################
DATE=`date`
echo "Date: $DATE"

OINKMASTER_PL_PATH=/usr/local/bin/oinkmaster-2.0/oinkmaster.pl
OINKMASTER_CONF_PATH=/usr/local/bin/oinkmaster-2.0/oinkmaster.conf

SO_RULES_TYPE=/var/tmp/snort-rules/so_rules/precompiled/CentOS-4.6/i386
SO_RULES_VER=2.8.3
SO_RULES_DIR=/usr/local/snortrules-egress/so_rules/

SNORT_RULES_DIR=/usr/local/snortrules-egress/
SNORT_CONF_PATH=/usr/local/snortrules-egress/snort.conf
SNORT_INIT_SCRIPT=/etc/init.d/snort-egress

CREATE_SIDMAP_PL_PATH=/usr/local/bin/oinkmaster-2.0/contrib/create-sidmap.pl

# -- Before running sigupdate, remove old snortrules-snapshots
rm -rf /var/tmp/snortrules-snapshot-2.8*
rm -rf /var/tmp/snort-rules

# -- Pull's the url with the oinkcode from oinkmaster.conf
# -- Downloads the tarball

OINKURL=`grep url $OINKMASTER_CONF_PATH | grep snort | grep -v \# |
awk '{ print $3 }'`
FILENAME=`grep url $OINKMASTER_CONF_PATH | grep snort |  grep -v \# |
awk '{print $3 }' | awk -F / '{print $7}'`
wget --directory-prefix=/var/tmp $OINKURL


# -- Makes a temporary directory
# -- Extracts the tarball
# -- Pulls out the correct shared object rules and puts them in /etc/snort
# -- Has snort parse through the shared objects and create stubs for all rules

mkdir -p /var/tmp/snort-rules
tar zxf /var/tmp/$FILENAME -C /var/tmp/snort-rules/
/bin/cp -fp $SO_RULES_TYPE/$SO_RULES_VER/*.so $SO_RULES_DIR
/usr/sbin/snort -c $SNORT_CONF_PATH --dump-dynamic-rules=$SO_RULES_DIR/stubs/

# -- We are now ready to run oinkmaster and update the "rest" of the rules.
# -- Since we already downloaded the snortrules-snapshot file
manually, we are going to tell oinkmaster to use that file.

$OINKMASTER_PL_PATH -C $OINKMASTER_CONF_PATH -u
file:///var/tmp/$FILENAME -o $SNORT_RULES_DIR
$OINKMASTER_PL_PATH -C $OINKMASTER_CONF_PATH -u
http://www.emergingthreats.net/rules/emerging.rules.tar.gz -o
$SNORT_RULES_DIR

# -- Now we need to create the sid-msg-map files.
# -- First we create the shared object rule map.
# -- Then we create the "normal" rule map.
# -- Then we concatenate them together.
# -- This is what barnyard uses to map signatures names to signature ID's.

$CREATE_SIDMAP_PL_PATH $SO_RULES_DIR/stubs/ | sed -e 's/^./3 || /g' >
$SO_RULES_DIR/stubs/shared-sid-msg.map
$CREATE_SIDMAP_PL_PATH $SNORT_RULES_DIR > $SNORT_RULES_DIR/sid-msg.map
cat $SO_RULES_DIR/stubs/shared-sid-msg.map >> $SNORT_RULES_DIR/sid-msg.map

# -- Finally we cross our fingers and restart snort

$SNORT_INIT_SCRIPT restart

----------------------------------------------------- END SCRIPT
------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------

-Seth


On Thu, Jan 22, 2009 at 10:18 AM, Nathaniel Richmond
<nate+snort () richmond-family org> wrote:
> Tim Maletic wrote:
> > I see how the latest oinkmaster can handle updating the rules files
> > of
> > so rules, but what about the so files themselves?  I'm thinking in
> > particular of the so rules that are being distributed binary-only in
> > VRT rule sets.  -tm
>
> Oinkmaster will not touch the actual .so files, so you have to put
> them in the appropriate directory yourself. Don't forget to run
> Snort against the .so rules with the '--dump-dynamic-rules' option.
> This will generate the required stub files, but they will not
> contain any changes you made to enable or disable specific rules. To
> change which are enabled or disabled, run Oinkmaster with the
> oinkmaster-so-rules.conf pointing to the directory that contains
> your new stubs.
>
> Once you manually go through the process, you will see it is not
> difficult to script. You will have to run Oinkmaster twice, once for
> the standard rules and once for SO rules.
>
> Here is a script example that was previously sent to the list:
> http://sourceforge.net/mailarchive/message.php?msg_name=2ffb4a7c0901091335x2eb34ac2p754076ca1374b39c%40mail.gmail.com
>
> Nate
>
> > On Mon, Jan 19, 2009 at 9:33 AM, Leon Ward <seclists () rm-rf co uk>
> > wrote:
> > >  From the very top of the Oinkmaster home page (
> > > http://oinkmaster.sourceforge.net/
> > >  ) .....
> > >
> > > [2008-02-19]  Updating the shared object rules (so_rules) with
> > > Oinkmaster
> > > By using the latest nightly CVS snapshot tarball you can now keep
> > > track of the shared object rules (so_rules) with Oinkmaster. See
> > > question #34 in the FAQ.
> > >
> > > -Leon
> > >
> > >
> > > On 19 Jan 2009, at 13:56, ty wrote:
> > >
> > > > Can oinkmaster be used to update / replace the binary (so_rules)
> > > > rules from VRT?
> > > >
> > > > If not, any good suggestions existing scripts to keep the binary
> > > > rules updated?
> >
> > ------------------------------------------------------------------------------
> > This SF.net email is sponsored by:
> > SourcForge Community
> > SourceForge wants to tell your story.
> > http://p.sf.net/sfu/sf-spreadtheword
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by:
> SourcForge Community
> SourceForge wants to tell your story.
> http://p.sf.net/sfu/sf-spreadtheword
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users