8000 Suricata: Add support for all available EVE types by 0xThiebaut · Pull Request #8442 · opnsense/core · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Suricata: Add support for all available EVE types #8442

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Suricata: Add support for all available EVE types #8442

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions src/opnsense/mvc/app/controllers/OPNsense/IDS/forms/generalSettings.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,4 +171,16 @@
<help>Custom TLS fields to include in eve-log for TLS. (Overrides extended if non-empty).</help>
<advanced>true</advanced>
</field>
<field>
<id>ids.general.eveLog.types.enabled</id>
<label>Enabled EVE types</label>
<type>select_multiple</type>
<help>The type of events to include in the EVE log.</help>
</field>
<field>
<id>ids.general.eveLog.types.extended</id>
<label>Extended EVE types</label>
<type>select_multiple</type>
<help>The type of events which, if enabled in the EVE log, will contain extended information.</help>
</field>
</form>
41 changes: 41 additions & 0 deletions src/opnsense/mvc/app/models/OPNsense/IDS/IDS.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,6 +293,47 @@
<Multiple>Y</Multiple>
</custom>
</tls>
<types>
<enabled type="OptionField">
<OptionValues>
<dns>DNS</dns>
<files>Files</files>
<smtp>SMTP</smtp>
<dnp3>DNP3</dnp3>
<ftp>FTP</ftp>
<rdp>RDP</rdp>
<nfs>NFS</nfs>
<smb>SMB</smb>
<tftp>TFTP</tftp>
<ike>IKE</ike>
<dcerpc>DCE-RPC</dcerpc>
<krb5>Kerberos</krb5>
<bittorrent-dht>BitTorrent DHT</bittorrent-dht>
<snmp>SNMP</snmp>
<rfb>RFB/VNC</rfb>
<sip>SIP</sip>
<quic>QUIC</quic>
<dhcp>DHCP</dhcp>
<mqtt>MQTT</mqtt>
<http2>HTTP/2</http2>
<pgsql>PostgreSQL</pgsql>
<stats>Statistics</stats>
<flow>Bi-directional Flows</flow>
<netflow>Uni-directional Netflows</netflow>
</OptionValues>
<Multiple>Y</Multiple>
</enabled>
<extended type="OptionField">
<OptionValues>
<files>Files</files>
<smtp>SMTP</smtp>
<dhcp>DHCP</dhcp>
<mqtt>MQTT</mqtt>
<pgsql>PostgreSQL</pgsql>
</OptionValues>
<Multiple>Y</Multiple>
</extended>
</types>
</eveLog>
</general>
</items>
Expand Down
99 changes: 26 additions & 73 deletions src/opnsense/service/templates/OPNsense/IDS/suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,34 +220,6 @@ outputs:
dump-all-headers: {{OPNsense.IDS.general.eveLog.http.dumpAllHeaders}}
{% endif %}
{% endif %}
# - dns:
# This configuration uses the new DNS logging format,
# the old configuration is still available:
# https://docs.suricata.io/en/latest/output/eve/eve-json-output.html#dns-v1-format

# As of Suricata 5.0, version 2 of the eve dns output
# format is the default.
#version: 2

# Enable/disable this logger. Default: enabled.
#enabled: yes

# Control logging of requests and responses:
# - requests: enable logging of DNS queries
# - responses: enable logging of DNS answers
# By default both requests and responses are logged.
#requests: no
#responses: no

# Format of answer logging:
# - detailed: array item per answer
# - grouped: answers aggregated by type
# Default: all
#formats: [detailed, grouped]

# DNS record types to log, based on the query type.
# Default: all.
#types: [a, aaaa, cname, mx, ns, ptr, txt]
{% if not helpers.empty('OPNsense.IDS.general.eveLog.tls.enable') %}
- tls:
extended: {{ 'no' if helpers.empty('OPNsense.IDS.general.eveLog.tls.extended') else 'yes' }}
Expand All @@ -259,19 +231,25 @@ outputs:
custom: [{{ OPNsense.IDS.general.eveLog.tls.custom }}]
{% endif %}
{% endif %}
#- files:
force-magic: no # force logging magic on all logged files
# force logging of checksums, available hash functions are md5,
# sha1 and sha256
#force-hash: [md5]

- drop:
alerts: yes # log alerts that caused drops
flows: start # start or all: 'start' logs only a single drop
# per flow direction. All logs each dropped pkt.

#- smtp:
#extended: yes # enable this for extended logging information
- ssh

{% set eveLog_types_enabled = (OPNsense.IDS.general.eveLog.types.enabled|default('')).split(',') %}
{% set eveLog_types_extended = (OPNsense.IDS.general.eveLog.types.extended|default('')).split(',') %}
{% 8000 for opt in eveLog_types_enabled %}
- {{opt}}:
{% if opt == 'files' and opt in eveLog_types_extended %}
force-magic: yes # force logging magic on all logged files
# force logging of checksums, available hash functions are md5,
# sha1 and sha256
#force-hash: [md5]
{% elif opt == 'smtp' and opt in eveLog_types_extended %}
extended: yes # enable this for extended logging information
# this includes: bcc, message-id, subject, x_mailer, user-agent
# custom fields logging from the list:
# reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
Expand All @@ -282,43 +260,18 @@ outputs:
# for the body you need to set app-layer.protocols.smtp.mime.body-md5
# to yes
#md5: [body, subject]

#- dnp3
#- ftp
#- rdp
#- nfs
#- smb
#- tftp
#- ike
#- dcerpc
#- krb5
#- bittorrent-dht
#- snmp
#- rfb
#- sip
#- quic
#- dhcp:
#enabled: yes
{% elif opt == 'dhcp' and opt in eveLog_types_extended %}
# When extended mode is on, all DHCP messages are logged
# with full detail. When extended mode is off (the
# default), just enough information to map a MAC address
# to an IP address is logged.
#extended: no
- ssh
#- mqtt:
# passwords: yes # enable output of passwords
#- http2
#- pgsql:
#enabled: no
# passwords: yes # enable output of passwords. Disabled by default
#- stats:
#totals: yes # stats for all threads merged together
#threads: no # per thread stats
#deltas: no # include delta values
# bi-directional flows
#- flow
# uni-directional flows
#- netflow
extended: yes
{% elif opt == 'mqtt' and opt in eveLog_types_extended %}
passwords: yes # enable output of passwords
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this feels like a possible security concern...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree it is a security concern but due to the fact it transits in plaintext over the wire, not due to its logging. A similar already existing risk is the logging of HTTP headers which might contain bearer tokens and/or cookies.

If you nonetheless object to this specific logging, I can remove it from the fields supporting extended logging.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@0xThiebaut that's true, let me think about this, adding an extra warning in the help text might be enough and more generic anyway.

{% elif opt == 'pgsql' and opt in eveLog_types_extended %}
passwords: yes # enable output of passwords. Disabled by default
{% endif %}
{% endfor %}

# Metadata event type. Triggered whenever a pktvar is saved
# and will include the pktvars, flowvars, flowbits and
Expand Down Expand Up @@ -942,7 +895,7 @@ app-layer:
#encryption-handling: default

pgsql:
enabled: no
enabled: {{ 'yes' if 'pgsql' in eveLog_types_enabled else 'no' }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't this also move into the loop? I expect it duplicates the item now, or am I mistaken?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this is the engine's application layer configuration (i.e., used for detections), not related to the EVE logging configuration.

I don't think this (and following) causes duplicated logging entries.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@0xThiebaut ok, thanks, I'll need to try this on my end before merging. these yaml files can be sensitive in my experience.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I really appreciate the time and care you're taking for community contributions!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@0xThiebaut you're welcome, we can't pull-in everything, but do make an effort when possible.

# Stream reassembly size for PostgreSQL. By default, track it completely.
stream-depth: 0
# Maximum number of live PostgreSQL transactions per flow
Expand Down Expand Up @@ -998,14 +951,14 @@ app-layer:
#log-url-scheme: yes
# Set to yes to compute the md5 of the mail body. You will then
# be able to journalize it.
body-md5: no
body-md5: {{ 'yes' if 'smtp' in eveLog_types_extended else 'no' }}
# Configure inspected-tracker for file_data keyword
inspected-tracker:
content-limit: 100000
content-inspect-min-size: 32768
content-inspect-window: 4096
imap:
enabled: detection-only
enabled: {{ 'yes' if 'imap' in eveLog_types_enabled else 'detection-only' }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

smb:
enabled: yes
detection-ports:
Expand Down Expand Up @@ -1171,7 +1124,7 @@ app-layer:

# DNP3
dnp3:
enabled: no
enabled: {{ 'yes' if 'dnp3' in eveLog_types_enabled else 'no' }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

detection-ports:
dp: 20000

Expand All @@ -1192,7 +1145,7 @@ app-layer:
enabled: yes

sip:
#enabled: yes
enabled: {{ 'yes' if 'sip' in eveLog_types_enabled else 'no' }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here


# Limit for the maximum number of asn1 frames to decode (default 256)
asn1-max-frames: 256
Expand Down
0