Because the stock code would not return a value for a FQDN Alias.  For example, as a test, if I used "cnn.com" as a host in an Alias; then when I called filter_expand_alias()  on that Alias it would return an empty string.  It returned defined IP addresses just fine, but not a FQDN.

 

Here is the rest of the new code.  This code unpacks nested Aliases and correctly handles FQDN hosts.  The function below is changed a bit for what is currently submitted for 2.6.0.  I had to change from a pfctl call to get the table value to a plain gethostbynamel() call in PHP.

 

function snort_unpack_alias($alias) {

 

      /**************************************************/

      /* This function unpacks an Alias to determine    */

      /* the actual values it represents.  Any nested   */

      /* Aliases encountered are also unpacked via      */

      /* recursive calls to this function.              */

      /*                                                */

      /* Fully-qualified-domain-name (FQDN) aliases     */

      /* are detected and resolved via DNS.             */

      /**************************************************/

 

      global $config;

      $value = "";

 

      // Find the matching Alias entry in config

      foreach ($config['aliases']['alias'] as $aliased) {

            if($aliased['name'] == $alias) {

                  $addr = array();

                  $addr = explode(" ", trim($aliased['address']));

                  foreach ($addr as $a) {

                        if (!is_alias($a) && !empty($a)) {

                              if (is_ipaddr($a) || is_subnet($a) || is_port($a))

                                    // If address, subnet or port, we found the final value

                                    $value .= $a . " ";

                              elseif (is_hostname($a)) {

                                    // Found a FQDN value for this Alias, so resolve it

                                    $entries = gethostbynamel($a);

                                    if ($entries !== FALSE)

                                          $value .= trim(implode(" ", $entries)) . " ";

                                    else

                                          log_error(gettext("[Snort] Failed to resolve FQDN '{$a}' in Alias '{$alias}'..."));

                              }

                              else

                                    continue;

                        }

                        elseif (is_alias($a))

                              // Found a nested Alias, so recursively resolve it

                              $value .= snort_unpack_alias($a) . " ";

                  }

                  return trim($value);

            }

      }

      return $value;

}

 

Bill Meeks

Vidalia, GA  30474

(912) 537-1091

 

From: Ermal Luçi [mailto:notifications@github.com] 
Sent: Monday, September 30, 2013 4:36 AM
To: pfsense/pfsense-packages
Cc: Bill Meeks
Subject: Re: [pfsense-packages] Snort Package v2.6.0 Update (#514)

 

In config/snort/snort.inc:

> +     // If no Aliases are defined in the configuration,
> +     // return an empty string.
> +     if (empty($config['aliases']))
> +            return $tmp;
> +
> +     // See if we were passed a valid Alias and return
> +     // an empty string if not.
> +     if (!is_alias($alias))
> +            return $tmp;
> +
> +     // We have a valid Alias, so find its value or 
> +     // values and return as a string.
> +     return snort_unpack_alias($alias);
> +}
> +
> +function snort_unpack_alias($alias) {

I do not like this at all!
Why was this handled in a custom source? What is the purpose here?

—
Reply to this email directly or view it on GitHub <https://github.com/pfsense/pfsense-packages/pull/514/files#r6652191> .  <https://github.com/notifications/beacon/R-JShtnbK5EIHjDbYnegTTxEVj5UwJq6Hsnj3N-42mp5xXN5oj9Bs93s4Lyl6kR7.gif>