mirror of https://github.com/OISF/suricata
Adds WinDivert support to Windows builds
Enables IPS functionality on Windows using the open-source (LGPLv3/GPLv2) WinDivert driver and API. From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a user-mode capture/sniffing/modification/blocking/re-injection package for Windows Vista, Windows Server 2008, Windows 7, and Windows 8. WinDivert can be used to implement user-mode packet filters, packet sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without the need to write kernel-mode code." - adds `--windivert [filter string]` and `--windivert-forward [filter string]` command-line options to enable WinDivert IPS mode. `--windivert[-forward] true` will open a filter for all traffic. See https://www.reqrypt.org/windivert-doc.html#filter_language for more information. Limitation: currently limited to `autofp` runmode. Additionally: - `tmm_modules` now zeroed during `RegisterAllModules` - fixed Windows Vista+ `inet_ntop` call in `PrintInet` - fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs - fixed `RandomGetClock` building on Windows builds - Added WMI queries for MTUpull/3402/head
Jacob Masen-Smith
8 years ago
parent
55ad4e4ece
commit
ec77632e84
@ -0,0 +1,64 @@
|
||||
Setting up IPS/inline for Windows
|
||||
=================================
|
||||
|
||||
This guide explains how to work with Suricata in layer 4 inline mode using
|
||||
WinDivert on Windows.
|
||||
|
||||
First start by compiling Suricata with WinDivert support. For instructions, see
|
||||
`Windows Installation
|
||||
<https://redmine.openinfosecfoundation.org/attachments/download/1175/SuricataWinInstallationGuide_v1.4.3.pdf>`_.
|
||||
This documentation has not yet been updated with WinDivert information, so make
|
||||
sure to add the following flags to `configure`:
|
||||
|
||||
::
|
||||
|
||||
--enable-windivert=yes --with-windivert-include=<include-dir> --with-windivert-libraries=<libraries-dir>
|
||||
|
||||
WinDivert.dll and WinDivert.sys must be in the same directory as the Suricata
|
||||
executable. WinDivert automatically installs the driver when it is run. For more
|
||||
information about WinDivert, see https://www.reqrypt.org/windivert-doc.html.
|
||||
|
||||
To check if you have WinDivert enabled in your Suricata, enter the following
|
||||
command in an elevated command prompt or terminal:
|
||||
|
||||
::
|
||||
|
||||
suricata -c suricata.yaml --windivert [filter string]
|
||||
|
||||
For information on the WinDivert filter language, see
|
||||
https://www.reqrypt.org/windivert-doc.html#filter_language
|
||||
|
||||
If Suricata is running on a gateway and is meant to protect the network behind
|
||||
that gateway, you need to run WinDivert at the NETWORK_FORWARD layer. This can
|
||||
be achieved using the following command:
|
||||
|
||||
::
|
||||
|
||||
suricata -c suricata.yaml --windivert-forward [filter string]
|
||||
|
||||
The filter is automatically stopped and normal traffic resumes when Suricata is
|
||||
stopped.
|
||||
|
||||
A quick start is to examine all traffic, in which case you can use the following
|
||||
command:
|
||||
|
||||
::
|
||||
|
||||
suricata -c suricata.yaml --windivert[-forward] true
|
||||
|
||||
A few additional examples:
|
||||
|
||||
Only TCP traffic:
|
||||
::
|
||||
|
||||
suricata -c suricata.yaml --windivert tcp
|
||||
|
||||
Only TCP traffic on port 80:
|
||||
::
|
||||
|
||||
suricata -c suricata.yaml --windivert "tcp.DstPort == 80"
|
||||
|
||||
TCP and ICMP traffic:
|
||||
::
|
||||
|
||||
suricata -c suricata.yaml --windivert "tcp or icmp"
|
||||
@ -0,0 +1,71 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Jacob Masen-Smith <jacob@evengx.com>
|
||||
*
|
||||
* Handling of WinDivert runmodes.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "tm-threads.h"
|
||||
#include "conf.h"
|
||||
#include "runmodes.h"
|
||||
#include "runmode-windivert.h"
|
||||
#include "output.h"
|
||||
|
||||
#include "util-affinity.h"
|
||||
#include "util-cpu.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-device.h"
|
||||
#include "util-runmodes.h"
|
||||
#include "util-time.h"
|
||||
|
||||
|
||||
static const char *default_mode;
|
||||
|
||||
|
||||
const char *RunModeIpsWinDivertGetDefaultMode(void) { return default_mode; }
|
||||
|
||||
void RunModeIpsWinDivertRegister(void)
|
||||
{
|
||||
default_mode = "autofp";
|
||||
|
||||
RunModeRegisterNewRunMode(
|
||||
RUNMODE_WINDIVERT, "autofp",
|
||||
"Multi-threaded WinDivert IPS mode load-balanced by flow",
|
||||
RunModeIpsWinDivertAutoFp);
|
||||
}
|
||||
|
||||
int RunModeIpsWinDivertAutoFp(void)
|
||||
{
|
||||
SCEnter();
|
||||
int ret = 0;
|
||||
#ifdef WINDIVERT
|
||||
RunModeInitialize();
|
||||
|
||||
TimeModeSetLive();
|
||||
|
||||
LiveDeviceHasNoStats();
|
||||
|
||||
ret = RunModeSetIPSAutoFp(WinDivertGetThread, "ReceiveWinDivert",
|
||||
"VerdictWinDivert", "DecodeWinDivert");
|
||||
#endif /* WINDIVERT */
|
||||
return ret;
|
||||
}
|
||||
@ -0,0 +1,32 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Jacob Masen-Smith <jacob@evengx.com>
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __RUNMODE_WINDIVERT_H__
|
||||
#define __RUNMODE_WINDIVERT_H__
|
||||
|
||||
int RunModeIpsWinDivertAutoFp(void);
|
||||
void RunModeIpsWinDivertRegister(void);
|
||||
const char *RunModeIpsWinDivertGetDefaultMode(void);
|
||||
|
||||
#endif /* __RUNMODE_WINDIVERT_H__ */
|
||||
@ -0,0 +1,31 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Jacob Masen-Smith <jacob@evengx.com>
|
||||
*/
|
||||
|
||||
#ifndef __SOURCE_WINDIVERT_PROTOTYPES_H__
|
||||
#define __SOURCE_WINDIVERT_PROTOTYPES_H__
|
||||
|
||||
void TmModuleReceiveWinDivertRegister(void);
|
||||
void TmModuleVerdictWinDivertRegister(void);
|
||||
void TmModuleDecodeWinDivertRegister(void);
|
||||
|
||||
#endif /* __SOURCE_WINDIVERT_PROTOTYPES_H__ */
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,82 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
*
|
||||
* \file
|
||||
*
|
||||
* \author Jacob Masen-Smith <jacob@evengx.com>
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef __SOURCE_WINDIVERT_H__
|
||||
#define __SOURCE_WINDIVERT_H__
|
||||
|
||||
#ifdef WINDIVERT
|
||||
|
||||
#include "windivert.h"
|
||||
|
||||
#define WINDIVERT_FILTER_MAXLEN 128 /* from windivert_device.h */
|
||||
|
||||
typedef void *WinDivertHandle;
|
||||
|
||||
/**
|
||||
* \brief WinDivertQueueVars is the queue configuration and other miscellaneous
|
||||
* information about the specific queue/filter.
|
||||
*
|
||||
* see https://reqrypt.org/windivert-doc.html#divert_open for more info
|
||||
*/
|
||||
typedef struct WinDivertQueueVars_
|
||||
{
|
||||
int queue_num;
|
||||
|
||||
/* see https://reqrypt.org/windivert-doc.html#filter_language */
|
||||
char filter_str[WINDIVERT_FILTER_MAXLEN + 1];
|
||||
WINDIVERT_LAYER layer;
|
||||
int16_t priority;
|
||||
uint64_t flags;
|
||||
|
||||
WinDivertHandle filter_handle;
|
||||
/* only needed for setup/teardown; Recv/Send are internally synchronized */
|
||||
SCMutex filter_init_mutex;
|
||||
|
||||
/* counters */
|
||||
uint32_t pkts;
|
||||
uint64_t bytes;
|
||||
uint32_t errs;
|
||||
uint32_t accepted;
|
||||
uint32_t dropped;
|
||||
uint32_t replaced;
|
||||
SCMutex counters_mutex;
|
||||
} WinDivertQueueVars;
|
||||
|
||||
typedef struct WinDivertPacketVars_
|
||||
{
|
||||
int thread_num;
|
||||
|
||||
WINDIVERT_ADDRESS addr;
|
||||
bool verdicted;
|
||||
} WinDivertPacketVars;
|
||||
|
||||
int WinDivertRegisterQueue(bool forward, char *filter_str);
|
||||
void *WinDivertGetThread(int thread);
|
||||
void *WinDivertGetQueue(int queue);
|
||||
|
||||
void SourceWinDivertRegisterTests(void);
|
||||
|
||||
#endif /* WINDIVERT */
|
||||
#endif /* __SOURCE_WINDIVERT_H__ */
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,53 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Jacob Masen-Smith <jacob@evengx.com>
|
||||
*
|
||||
* Isolation for WMI/COM functionality
|
||||
*/
|
||||
|
||||
#ifndef __WIN32_SYSCALL_H__
|
||||
#define __WIN32_SYSCALL_H__
|
||||
#ifdef OS_WIN32
|
||||
|
||||
#include <inttypes.h>
|
||||
|
||||
#include <iptypes.h>
|
||||
|
||||
#include "util-device.h"
|
||||
|
||||
const char *Win32GetErrorString(DWORD error_code, HMODULE ext_module);
|
||||
|
||||
uint32_t Win32GetAdaptersAddresses(IP_ADAPTER_ADDRESSES **pif_info_list);
|
||||
uint32_t Win32FindAdapterAddresses(IP_ADAPTER_ADDRESSES *if_info_list,
|
||||
const char *adapter_name,
|
||||
IP_ADAPTER_ADDRESSES **pif_info);
|
||||
|
||||
int GetIfaceMTUWin32(const char *pcap_dev);
|
||||
int GetGlobalMTUWin32(void);
|
||||
|
||||
int GetIfaceOffloadingWin32(const char *ifname, int csum, int other);
|
||||
int DisableIfaceOffloadingWin32(LiveDevice *ldev, int csum, int other);
|
||||
int RestoreIfaceOffloadingWin32(LiveDevice *ldev);
|
||||
|
||||
void Win32SyscallRegisterTests(void);
|
||||
|
||||
#endif /* OS_WIN32 */
|
||||
#endif /* __WIN32_SYSCALL_H__ */
|
||||
Loading…
Reference in New Issue