iplab 2011

Barnyard2はBarnyardにUnified2フォーマットの読み込みを追加したものである。

BarnyardはSnortには含まれていないため、オフィシャルページ( http://www.securixlive.com/barnyard2/index.php )より、ソースファイルをダウンロードする。

├── barnyard2-1.9
│   ├── COPYING
│   ├── LICENSE
│   ├── Makefile.am
│   ├── Makefile.in
│   ├── README
│   ├── RELEASE.NOTES
│   ├── aclocal.m4
│   ├── config.guess
│   ├── config.h.in
│   ├── config.sub
│   ├── configure
│   ├── configure.in
│   ├── doc
│   │   ├── INSTALL
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── README.aruba
│   │   ├── README.database
│   │   └── README.sguil
│   ├── etc
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   └── barnyard2.conf
│   ├── install-sh
│   ├── ltmain.sh
│   ├── m4
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── libprelude.m4
│   │   ├── libtool.m4
│   │   ├── ltoptions.m4
│   │   ├── ltsugar.m4
│   │   ├── ltversion.m4
│   │   └── lt~obsolete.m4
│   ├── missing
│   ├── rpm
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── barnyard2
│   │   ├── barnyard2.config
│   │   └── barnyard2.spec
│   ├── schemas
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── create_db2
│   │   ├── create_mssql
│   │   ├── create_mysql
│   │   ├── create_oracle.sql
│   │   └── create_postgresql
│   └── src
│   ├── Makefile.am
│   ├── Makefile.in
│   ├── barnyard2.c
│   ├── barnyard2.h
│   ├── bounds.h
│   ├── checksum.h
│   ├── debug.c
│   ├── debug.h
│   ├── decode.c
│   ├── decode.h
│   ├── fatal.h
│   ├── generators.h
│   ├── input-plugins
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── spi_unified2.c
│   │   └── spi_unified2.h
│   ├── ipv6_port.h
│   ├── log.c
│   ├── log.h
│   ├── log_text.c
│   ├── log_text.h
│   ├── map.c
│   ├── map.h
│   ├── mstring.c
│   ├── mstring.h
│   ├── output-plugins
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── spo_alert_arubaaction.c
│   │   ├── spo_alert_arubaaction.h
│   │   ├── spo_alert_bro.c
│   │   ├── spo_alert_bro.h
│   │   ├── spo_alert_cef.c
│   │   ├── spo_alert_cef.h
│   │   ├── spo_alert_csv.c
│   │   ├── spo_alert_csv.h
│   │   ├── spo_alert_fast.c
│   │   ├── spo_alert_fast.h
│   │   ├── spo_alert_full.c
│   │   ├── spo_alert_full.h
│   │   ├── spo_alert_prelude.c
│   │   ├── spo_alert_prelude.h
│   │   ├── spo_alert_syslog.c
│   │   ├── spo_alert_syslog.h
│   │   ├── spo_alert_test.c
│   │   ├── spo_alert_test.h
│   │   ├── spo_alert_unixsock.c
│   │   ├── spo_alert_unixsock.h
│   │   ├── spo_common.c
│   │   ├── spo_common.h
│   │   ├── spo_database.c
│   │   ├── spo_database.h
│   │   ├── spo_log_ascii.c
│   │   ├── spo_log_ascii.h
│   │   ├── spo_log_null.c
│   │   ├── spo_log_null.h
│   │   ├── spo_log_tcpdump.c
│   │   ├── spo_log_tcpdump.h
│   │   ├── spo_platypus.c
│   │   ├── spo_platypus.h
│   │   ├── spo_sguil.c
│   │   └── spo_sguil.h
│   ├── parser.c
│   ├── parser.h
│   ├── pcap_pkthdr32.h
│   ├── plugbase.c
│   ├── plugbase.h
│   ├── rules.h
│   ├── sf_types.h
│   ├── sfutil
│   │   ├── Makefile.am
│   │   ├── Makefile.in
│   │   ├── bitop.h
│   │   ├── getopt.h
│   │   ├── getopt1.h
│   │   ├── getopt_long.c
│   │   ├── sf_ip.c
│   │   ├── sf_ip.h
│   │   ├── sf_iph.c
│   │   ├── sf_iph.h
│   │   ├── sf_ipvar.c
│   │   ├── sf_ipvar.h
│   │   ├── sf_textlog.c
│   │   ├── sf_textlog.h
│   │   ├── sf_vartable.c
│   │   ├── sf_vartable.h
│   │   ├── sfhashfcn.h
│   │   ├── sfmemcap.c
│   │   ├── sfmemcap.h
│   │   ├── sfprimetable.c
│   │   ├── sfprimetable.h
│   │   ├── sfxhash.c
│   │   └── sfxhash.h
│   ├── spooler.c
│   ├── spooler.h
│   ├── strlcatu.c
│   ├── strlcatu.h
│   ├── strlcpyu.c
│   ├── strlcpyu.h
│   ├── timersub.h
│   ├── unified2.h
│   ├── util.c
│   └── util.h
└── barnyard2-1.9.tar.gz

barnyard2/doc/INSTALLに従い、ビルドを行う。
1. *** Make sure you have libpcap HEADERS installed!!! ***
2. ./autogen.sh
3. ./configure
4. make
5. make install
6. Create a sample rules file (eg. look at etc/barnyard2.conf)
7. barnyard2 -?
8. HAVE FUN!

/usr/local/bin/barnyard2 /usr/local/etc/barnyard2.confがインストールされる。

最新の27 Dec 10のバージョンにはautogen.shが入っていなくて
autoreconf -fvi -I ./m4 としろとなっている。
そして、注意書きとして
If you've used barnyard before, there may be a little variance in the commandline parameters.
だってさ。

どうも資料が見つからないけど、Barnyardと同じようにやればいいのかな(^_^;)

ヘッダとソースに分割して作成し、他のプラグインと同様にsrc/plugbase.cに追加を行なっていきます。スケルトンは特に用意されていないので、spo_alert_test.c/hあたりをコピーして始めるのがいいと思われます。
src/plugbase.c

作成したヘッダを読み込むようにします。

/* built-in output plugins */
#include "output-plugins/spo_alert_arubaaction.h"
#include "output-plugins/spo_alert_bro.h"
(略)
#include "output-plugins/spo_sguil.h"
// add
#include "output-plugins/spo_alert_newpligin.h"

セットアップを呼び出すようにします。

void RegisterOutputPlugins(void)
{
    LogMessage("Initializing Output Plugins!\n");

    AlertCEFSetup();
    AlertSyslogSetup();
    LogTcpdumpSetup();
    DatabaseSetup();
(略)
    AlertTestSetup();

    // add
    AlertNerpluginSetup();

    PlatypusSetup();
    SguilSetup();
}

src/output-plugins/Makefile.amのlibop_a_SOURCEの最後に追加したソースファイルを追加する。

http://www.securixlive.com/barnyard2/docs/unified....

/* 
** The Unified2EventCommon structure is the common structure that occurs
** at the beginning of all Unified2Event* structures.
** 
** This structure allows the safe casting of any Unified2Event* structure
** in order to obtain common event information
*/
typedef struct _Unified2EventCommon
{
    uint32_t sensor_id;
    uint32_t event_id;
    uint32_t event_second;
    uint32_t event_microsecond;
    uint32_t signature_id;
    uint32_t generator_id;
    uint32_t signature_revision;
    uint32_t classification_id;
    uint32_t priority_id;
} Unified2EventCommon;

typedef struct _Packet
{
    const struct pcap_pkthdr *pkth;   /* BPF data */
    const uint8_t *pkt;         /* base pointer to the raw packet data */

    EtherARP *ah;
    const EtherHdr *eh;         /* standard TCP/IP/Ethernet/ARP headers */
    const VlanTagHdr *vh;
    EthLlc *ehllc;
    EthLlcOther *ehllcother;
    const GREHdr *greh;
    uint32_t *mpls;

    const IPHdr *iph, *orig_iph;/* and orig. headers for ICMP_*_UNREACH family */
    const IPHdr *inner_iph;     /* if IP-in-IP, this will be the inner IP header */
    const IPHdr *outer_iph;     /* if IP-in-IP, this will be the outer IP header */
    const TCPHdr *tcph, *orig_tcph;
    const UDPHdr *udph, *orig_udph;
    const ICMPHdr *icmph, *orig_icmph;

    const uint8_t *data;        /* packet payload pointer */
    const uint8_t *ip_data;     /* IP payload pointer */
    const uint8_t *outer_ip_data;  /* Outer IP payload pointer */
    const uint8_t *ip_frag_start;
    const uint8_t *ip_options_data;
    const uint8_t *tcp_options_data;

    void *ssnptr;               /* for tcp session tracking info... */
    void *fragtracker;          /* for ip fragmentation tracking info... */
    void *flow;                 /* for flow info */
    void *streamptr;            /* for tcp pkt dump */
    
    IP4Hdr *ip4h, *orig_ip4h;   /* SUP_IP6 members */
    IP6Hdr *ip6h, *orig_ip6h;
    ICMP6Hdr *icmp6h, *orig_icmp6h;

    IPH_API* iph_api;
    IPH_API* orig_iph_api;
    IPH_API* outer_iph_api;
    IPH_API* outer_orig_iph_api;

    IP4Hdr inner_ip4h, inner_orig_ip4h;
    IP6Hdr inner_ip6h, inner_orig_ip6h;
    IP4Hdr outer_ip4h, outer_orig_ip4h;
    IP6Hdr outer_ip6h, outer_orig_ip6h;

    MplsHdr   mplsHdr;

    int family;
    int orig_family;
    int outer_family;
    int bytes_to_inspect;       /* Number of bytes to check against rules */
                                /* this is not set - always 0 (inspect all) */

    uint32_t preprocessor_bits; /* flags for preprocessors to check */
    uint32_t preproc_reassembly_pkt_bits;

    /* int ip_payload_len; */   /* Replacement for IP_LEN(p->iph->ip_len) << 2 */
    /* int ip_payload_off; */   /* IP_LEN(p->iph->ip_len) << 2 + p->data */

    uint32_t caplen;
    uint32_t http_pipeline_count; /* Counter for HTTP pipelined requests */
    uint32_t packet_flags;      /* special flags for the packet */
    uint32_t proto_bits;

    uint16_t dsize;             /* packet payload size */
    uint16_t ip_dsize;          /* IP payload size */
    uint16_t alt_dsize;         /* the dsize of a packet before munging (used for log)*/
    uint16_t actual_ip_len;     /* for logging truncated pkts (usually by small snaplen)*/
    uint16_t outer_ip_dsize;    /* Outer IP payload size */

    uint16_t frag_offset;       /* fragment offset number */
    uint16_t ip_frag_len;
    uint16_t ip_options_len;
    uint16_t tcp_options_len;

    uint16_t sp;                /* source port (TCP/UDP) */
    uint16_t dp;                /* dest port (TCP/UDP) */
    uint16_t orig_sp;           /* source port (TCP/UDP) of original datagram */
    uint16_t orig_dp;           /* dest port (TCP/UDP) of original datagram */

    int16_t application_protocol_ordinal;

    uint8_t frag_flag;          /* flag to indicate a fragmented packet */
    uint8_t mf;                 /* more fragments flag */
    uint8_t df;                 /* don't fragment flag */
    uint8_t rf;                 /* IP reserved bit */

    uint8_t uri_count;          /* number of URIs in this packet */
    uint8_t csum_flags;         /* checksum flags */
    uint8_t encapsulated;

    uint8_t ip_option_count;    /* number of options in this packet */
    uint8_t tcp_option_count;
    uint8_t ip6_extension_count;
    uint8_t ip6_frag_index;

    uint8_t ip_lastopt_bad;     /* flag to indicate that option decoding was
                                   halted due to a bad option */
    uint8_t tcp_lastopt_bad;    /* flag to indicate that option decoding was
                                   halted due to a bad option */

#ifndef NO_NON_ETHER_DECODER
    const Fddi_hdr *fddihdr;    /* FDDI support headers */
    Fddi_llc_saps *fddisaps;
    Fddi_llc_sna *fddisna;
    Fddi_llc_iparp *fddiiparp;    
    Fddi_llc_other *fddiother;

    const Trh_hdr *trh;         /* Token Ring support headers */
    Trh_llc *trhllc;
    Trh_mr *trhmr;

    Pflog1Hdr *pf1h;            /* OpenBSD pflog interface header - version 1 */
    Pflog2Hdr *pf2h;            /* OpenBSD pflog interface header - version 2 */
    Pflog3Hdr *pf3h;            /* OpenBSD pflog interface header - version 3 */

    const SLLHdr *sllh;         /* Linux cooked sockets header */
    const WifiHdr *wifih;       /* wireless LAN header */
    const PPPoEHdr *pppoeh;     /* Encapsulated PPP of Ether header */

    const EtherEapol *eplh;     /* 802.1x EAPOL header */
    const EAPHdr *eaph;
    const uint8_t *eaptype;
    EapolKey *eapolk;
#endif

    // nothing after this point is zeroed ...
    Options ip_options[IP_OPTMAX];         /* ip options decode structure */
    Options tcp_options[TCP_OPTLENMAX];    /* tcp options decode struct */
    IP6Option ip6_extensions[IP6_EXTMAX];  /* IPv6 Extension References */

    /**policyId provided in configuration file. Used for correlating configuration 
     * with event output
     */
    uint16_t configPolicyId;

    int         linktype;       /* packet specific linktype */
} Packet;