TABLE OF CONTENTS Rule-based pattern matching can often fail on protocols for which data can be represented in many different ways. For example, Web servers accept many different ways of writing a URL. IIS, for example, will accept backslash "\" characters in place of forward-slash "/" characters in URLs. Another example is Telnet, where an inline protocol negotiation can interrupt data that might be matched. Two characters in a pattern might be separated in the datastream by 4 bytes of Telnet negotiation codes. In each of these cases, you can define a single "right," or canonical, way to write the data that you're matching. We can change all of the URLs to match the way that rule writers expect to see them. We can remove all negotiation codes from Telnet data. These types of preprocessors might even be used to convert binary protocols into text-based representations or some other form that makes them easier to run through the detection engine. At the time of this book's publication, there exist decoding/normalization plug-ins for only the Telnet, HTTP, and RPC protocols.
The Telnet protocol features an inline negotiation protocol to signal what features the client and server can offer each other. The client and server intersperse this negotiation data with the normal payload data. Unfortunately, it's usually the payload data that we want to match our rules against. Snort solves the resulting problem with the telnet_negotiation preprocessor, in spp_telnet_negotiation.c, which removes all Telnet negotiation codes, leaving...
