keyword_states
output_states
preprocessor_states
+ rule_states
)
add_library( config_states
config_options.cc
+ config_ppm.cc
config_api.h
config_api.cc
)
extern const ConvertMap* paf_max_map;
extern const ConvertMap* pcre_match_limit_map;
extern const ConvertMap* pcre_match_limit_recursion_map;
+extern const ConvertMap* ppm_map;
const std::vector<const ConvertMap*> config_api =
paf_max_map,
pcre_match_limit_map,
pcre_match_limit_recursion_map,
+ ppm_map,
};
****************** FLOWBIT_SIZE ***************************
***********************************************************/
+//template<const std::string *snort_option, const std::string *lua_name>
+//config_int_ctor2<snort_option, lua_name, snort_option>
+
+static const std::string alerts = "alerts";
+static const std::string flowbits_size = "flowbits_size";
+
+static const ConvertMap config_flowbit_size =
+{
+ flowbits_size,
+ config_int_ctor<&flowbits_size, &alerts>,
+};
+
+const ConvertMap* flowbit_size_map = &config_flowbit_size;
+
+#if 0
static ConversionState* flowbit_size_ctor(Converter* cv, LuaData* ld)
{
return new ConfigIntOption(cv, ld, "alerts", "flowbits_size");
const ConvertMap* flowbit_size_map = &config_flowbit_size;
+#endif
+
/*********************************************
******* Enable GTP *********
*********************************************/
};
virtual ~ConfigIntOption() {};
- virtual bool convert(std::stringstream& stream)
+ virtual bool convert(std::istringstream& stream)
{
ld->open_table(table_name);
return parse_int_option(opt_name, stream);
};
virtual ~ConfigStringOption() {};
- virtual bool convert(std::stringstream& stream)
+ virtual bool convert(std::istringstream& stream)
{
ld->open_table(table_name);
return parse_string_option(opt_name, stream);
};
+/**********************************
+ ******** TEMPLATES!! **********
+ **********************************/
+
+template<const std::string *snort_option,
+ const std::string *lua_table_name,
+ const std::string* lua_option_name,
+ bool (*parse_func)(std::string table_name, std::istringstream& stream)>
+class ParseConfigOption : public ConversionState
+{
+public:
+ ParseConfigOption( Converter* cv, LuaData* ld)
+ : ConversionState(cv, ld)
+ {
+ };
+
+ virtual ~ParseConfigOption() {};
+ virtual bool convert(std::istringstream& stream)
+ {
+ // if the two names are not equal ...
+ if((*snort_option).compare((*lua_option_name)))
+ ld->add_diff_option_comment(*snort_option, *lua_option_name);
+
+ ld->open_table((*lua_table_name));
+ return parse_func((*lua_option_name), stream);
+ }
+};
+
+
+template<const std::string *snort_option,
+ const std::string *lua_table_name,
+ const std::string* lua_option_name>
+class ConfigIntTempOption : public ConversionState
+{
+public:
+ ConfigIntTempOption( Converter* cv, LuaData* ld)
+ : ConversionState(cv, ld)
+ {
+ };
+
+ virtual ~ConfigIntTempOption() {};
+ virtual bool convert(std::istringstream& stream)
+ {
+ // if the two names are not equal ...
+ if((*snort_option).compare((*lua_option_name)))
+ ld->add_diff_option_comment(*snort_option, *lua_option_name);
+
+ ld->open_table((*lua_table_name));
+ return parse_int_option(*lua_option_name, stream);
+ }
+};
+
+
+template<const std::string *snort_option, const std::string *lua_name, const std::string *lua_option_name = nullptr>
+static ConversionState* config_int_ctor(Converter* cv, LuaData* ld)
+{
+ if (lua_option_name)
+ return new ConfigIntTempOption<snort_option, lua_name, lua_option_name>(cv, ld);
+ else
+ return new ConfigIntTempOption<snort_option, lua_name, snort_option>(cv, ld);
+}
+
+
+
#endif
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// pps_frag3_global.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "util/converter.h"
+#include "util/util.h"
+
+namespace {
+
+class Ppm : public ConversionState
+{
+public:
+ Ppm(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
+ virtual ~Ppm() {};
+ virtual bool convert(std::istringstream& data_stream);
+};
+
+} // namespace
+
+bool Ppm::convert(std::istringstream& data_stream)
+{
+
+ bool retval = true;
+ std::string keyword;
+ bool test;
+
+ ld->open_table("ppm");
+
+ while(data_stream >> keyword)
+ {
+ bool tmpval = true;
+ bool popped_comma;
+
+ if(keyword.back() == ',')
+ {
+ keyword.pop_back();
+ popped_comma = true;
+ }
+ else
+ {
+ popped_comma = false;
+ }
+
+ if(keyword.empty())
+ continue;
+
+ if(!keyword.compare("threshold"))
+ tmpval = parse_int_option("threshold", data_stream);
+
+ else if(!keyword.compare("fastpath-expensive-packets"))
+ {
+ ld->add_diff_option_comment("fastpath-expensive-packets", "fastpath_expensive_packets");
+ tmpval = ld->add_option_to_table("fastpath_expensive_packets", true);
+ }
+
+ else if(!keyword.compare("max-pkt-time"))
+ {
+ ld->add_diff_option_comment("max-pkt-time", "max_pkt_time");
+ tmpval = parse_int_option("max_pkt_time", data_stream);
+ }
+
+ else if(!keyword.compare("debug-pkts"))
+ {
+ ld->add_diff_option_comment("debug-pkts", "debug_pkts");
+ tmpval = ld->add_option_to_table("debug_pkts", true);
+ }
+
+ else if(!keyword.compare("max-rule-time"))
+ {
+ ld->add_diff_option_comment("max-rule-time", "max_rule_time");
+ tmpval = parse_int_option("max_rule_time", data_stream);
+ }
+
+ else if(!keyword.compare("suspend-expensive-rules"))
+ {
+ ld->add_diff_option_comment("suspend-expensive-rules", "suspend_expensive_rules");
+ tmpval = ld->add_option_to_table("suspend_expensive_rules", true);
+ }
+
+ else if(!keyword.compare("suspend-timeout"))
+ {
+ ld->add_diff_option_comment("suspend-timeout", "suspend_timeout");
+ tmpval = parse_int_option("suspend_timeout", data_stream);
+ }
+
+ else if(!keyword.compare("pkt-log"))
+ {
+ ld->add_diff_option_comment("pkt-log ", "pkt_log");
+ std::string opt1;
+ std::string opt2;
+
+ if(popped_comma)
+ ld->add_option_to_table("pkt_log", "log");
+
+ else if (!(data_stream >> opt1))
+ ld->add_option_to_table("pkt_log", "log");
+
+ else if (opt1.back() == ',')
+ {
+ opt1.pop_back();
+ tmpval = ld->add_option_to_table("pkt_log", opt1);
+ }
+
+ else if (!(data_stream >> opt2))
+ tmpval = ld->add_option_to_table("pkt_log", opt1);
+
+ else
+ tmpval = ld->add_option_to_table("pkt_log", "both");
+ }
+
+ else if(!keyword.compare("rule-log"))
+ {
+ std::string opt1;
+ std::string opt2;
+ popped_comma = false;
+ ld->add_diff_option_comment("rule-log", "rule_log");
+
+ if (!(data_stream >> opt1))
+ tmpval = false;
+
+ else if (opt1.back() == ',')
+ {
+ opt1.pop_back();
+ tmpval = ld->add_option_to_table("rule_log", opt1);
+ }
+
+ else if (!(data_stream >> opt2))
+ tmpval = ld->add_option_to_table("rule_log", opt1);
+
+ else
+ tmpval = ld->add_option_to_table("rule_log", "both");
+ }
+
+ else
+ tmpval = false;
+
+ if (retval)
+ retval = tmpval;
+ }
+#if 0
+
+pkt-log [log] [alert]
+
+#endif
+
+ return retval;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv, LuaData* ld)
+{
+ return new Ppm(cv, ld);
+}
+
+static const ConvertMap config_ppm_api =
+{
+ "ppm",
+ ctor,
+};
+
+const ConvertMap* ppm_map = &config_ppm_api;
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// converter.h author Josh Rosenbaum <jorosenba@cisco.com>
+// conversion_state.h author Josh Rosenbaum <jorosenba@cisco.com>
#ifndef CONVERSION_STATE_H
#define CONVERSION_STATE_H
#include "data/dt_data.h"
+// the following three files are for the function 'set_next_rule_state'
+#include "util/util.h"
+#include "rule_states/rule_api.h"
+#include "util/converter.h"
+
class Converter;
+class ConversionState;
+typedef ConversionState* (*conv_new_f)(Converter*, LuaData* ld);
+
+struct ConvertMap
+{
+ std::string keyword;
+ conv_new_f ctor;
+};
+
+// yes, forward declaring. Without some improvements to design, this needs to stay here.
+namespace rules
+{
+ extern const std::vector<const ConvertMap*> rule_api;
+} // namespace rules.
+
class ConversionState
{
public:
- explicit ConversionState(Converter* cv, LuaData* ld)
+ ConversionState(Converter* cv, LuaData* ld)
{
this->cv = cv;
this->ld = ld;
}
virtual ~ConversionState() {};
- virtual bool convert(std::stringstream& data)=0;
+ virtual bool convert(std::istringstream& data)=0;
protected:
Converter* cv;
List of forward parsing methods. Placing these here so you don't need to
search through the file
- inline bool eat_option(std::stringstream& stream);
+ inline bool eat_option(std::istringstream& stream);
inline bool parse_string_option(std::string opt_name,
- std::stringstream& stream);
+ std::istringstream& stream);
inline bool parse_int_option(std::string opt_name,
- std::stringstream& stream);
+ std::istringstream& stream);
inline bool parse_curly_bracket_list(std::string list_name,
- std::stringstream& stream);
+ std::istringstream& stream);
inline bool parse_yn_bool_option(std::string opt_name,
- std::stringstream& stream);
+ std::istringstream& stream);
inline bool parse_bracketed_byte_list(std::string list_name,
- std::stringstream& stream);
+ std::istringstream& stream);
inline bool parse_bracketed_unsupported_list(std::string list_name,
- std::stringstream& stream);
+ std::istringstream& stream);
inline bool open_table_add_option(std::string table_name,
std::string opt_name,
std::string val);
inline bool parse_deprecation_option(std::string table_name,
- std::stringstream& stream);
+ std::istringstream& stream);
+
+ // explicitly defined due quantity of times called and errors if
+ // not placed here.
+ inline bool set_next_rule_state(std::istringstream& stream)
#endif
- inline bool eat_option(std::stringstream& stream)
+ inline bool eat_option(std::istringstream& stream)
{
std::string val;
return false;
}
- inline bool parse_string_option(std::string opt_name, std::stringstream& stream)
+ inline bool parse_string_option(std::string opt_name, std::istringstream& stream)
{
std::string val;
return false;
}
- inline bool parse_int_option(std::string opt_name, std::stringstream& stream)
+ inline bool parse_int_option(std::string opt_name, std::istringstream& stream)
{
int val;
}
// parse and add a curly bracketed list to the table
- inline bool parse_curly_bracket_list(std::string list_name, std::stringstream& stream)
+ inline bool parse_curly_bracket_list(std::string list_name, std::istringstream& stream)
{
std::string elem;
bool retval = true;
}
// parse and add a yes/no boolean option.
- inline bool parse_yn_bool_option(std::string opt_name, std::stringstream& stream)
+ inline bool parse_yn_bool_option(std::string opt_name, std::istringstream& stream)
{
std::string val;
}
// parse a curly bracketed bit and add it to the table
- inline bool parse_bracketed_byte_list(std::string list_name, std::stringstream& stream)
+ inline bool parse_bracketed_byte_list(std::string list_name, std::istringstream& stream)
{
std::string elem;
bool retval = true;
if (0 <= dig && dig <= 255)
{
- std::stringstream tmp;
+ std::ostringstream tmp;
tmp << "0x" << std::hex << dig;
retval = ld->add_list_to_table(list_name, tmp.str()) && retval;
}
// parse and add a curly bracket list '{...}' which is currently unsupported in Snort++
- inline bool parse_bracketed_unsupported_list(std::string list_name, std::stringstream& stream)
+ inline bool parse_bracketed_unsupported_list(std::string list_name, std::istringstream& stream)
{
std::string tmp = "";
std::string elem;
return ld->add_option_to_table("--" + list_name, tmp );
}
- inline bool open_table_add_option(std::string table_name, std::string opt_name, std::string val)
- {
- ld->open_table(table_name);
- bool tmpval = ld->add_option_to_table(opt_name, val) && tmpval;
- ld->close_table();
- return tmpval;
- }
-
inline bool parse_deprecation_option(std::string opt_name,
- std::stringstream& stream)
+ std::istringstream& stream)
{
std::string val;
}
-private:
+ inline bool set_next_rule_state(std::istringstream& stream)
+ {
+ std::string keyword;
-};
+ std::getline(stream, keyword, ':');
+ util::trim(keyword);
+ if (keyword.empty())
+ return true;
-typedef ConversionState* (*conv_new_f)(Converter*, LuaData* ld);
+ // now, lets get the next option.
+ const ConvertMap* map = util::find_map(rules::rule_api, keyword);
+ if (map)
+ {
+ cv->set_state(map->ctor(cv, ld));
+ return true;
+ }
+
+ return false;
+ }
-struct ConvertMap
-{
- std::string keyword;
- conv_new_f ctor;
-};
+private:
+};
#endif
-add_library(conversion_data
+add_subdirectory(rule)
+
+add_library( conversion_data
dt_data.h
dt_data.cc
dt_var.h
dt_rule.h
dt_rule.cc
)
+
+target_link_libraries( conversion_data
+ rule_data
+)
}
LuaData::LuaData()
+ : curr_rule(nullptr),
+ curr_rule_opt(nullptr)
{
comments = new Comments(start_comments, 0,
Comments::CommentType::MULTI_LINE);
std::stack<Table*> empty;
open_tables.swap(empty );
curr_rule = nullptr;
+ curr_rule_opt = nullptr;
}
void LuaData::open_top_level_table(std::string table_name)
return true;
}
+// compilers are fickle and dangerous creatures. Ensure a literal gets
+// sent here rather to become a bool
+bool LuaData::add_option_to_table(const std::string name, const char* v)
+{
+ return add_option_to_table(name, std::string(v));
+}
+
bool LuaData::add_list_to_table(std::string list_name, std::string next_elem)
{
if(open_tables.size() == 0)
if (open_tables.size() == 0)
{
- add_error_comment("Must open table before adding an option!!: " +
+ add_error_comment("Must open table before adding deprecated comment!!: " +
dep_var);
return false;
}
void LuaData::begin_rule()
{
- curr_rule = new Rule();
- rules.push_back(curr_rule);
+ if (curr_rule != nullptr)
+ {
+ add_error_comment("Attempted to add a nested rules!!");
+ }
+ else
+ {
+ curr_rule = new Rule();
+ rules.push_back(curr_rule);
+ }
}
bool LuaData::add_hdr_data(std::string data)
{
- return curr_rule->add_hdr_data(data);
+ if (curr_rule)
+ return curr_rule->add_hdr_data(data);
+
+ add_error_comment("Must begin a rule before adding a header!");
+ return false;
}
+bool LuaData::add_rule_option(std::string opt_name)
+{
+ if (curr_rule)
+ return curr_rule->add_option(opt_name);
+
+ add_error_comment("Must begin a rule before adding an option!");
+ return false;
+}
+
+bool LuaData::add_rule_option(std::string opt_name, std::string val)
+{
+ if (curr_rule)
+ return curr_rule->add_option(opt_name, val);
+
+ add_error_comment("Must begin a rule before adding an option!");
+ return false;
+}
+
+
+bool LuaData::add_rule_option_before_selected(std::string keyword,
+ std::string val)
+{
+ if (!curr_rule_opt)
+ {
+ comments->add_text("Select an option before placing a "
+ "new option before selected option");
+ return false;
+ }
+
+ return curr_rule->add_option_before_selected(curr_rule_opt, keyword, val);
+}
+
+bool LuaData::add_suboption(std::string keyword)
+{
+ if (curr_rule_opt)
+ return curr_rule_opt->add_suboption(keyword);
+
+ add_error_comment("Select an option before adding a suboption!!");
+ return false;
+}
+
+bool LuaData::add_suboption(std::string keyword, std::string val)
+{
+ if (curr_rule_opt)
+ return curr_rule_opt->add_suboption(keyword, val);
+
+ add_error_comment("Select an option before adding a suboption!!");
+ return false;
+}
+
+bool LuaData::select_option(std::string opt_name)
+{
+ // using add_comment here so this error is right above the failed rule
+
+ if (curr_rule)
+ {
+ curr_rule_opt = curr_rule->select_option(opt_name);
+ if (curr_rule_opt != nullptr)
+ return true;
+ else
+ comments->add_text("Option " + opt_name + "never created for following rule:");
+ }
+ else
+ {
+ comments->add_text("Must begin a rule before selecting an option!");
+ }
+
+ return false;
+}
+
+void LuaData::unselect_option()
+{
+ curr_rule_opt = nullptr;
+}
std::ostream& operator<<( std::ostream &out, const LuaData &data)
{
out << (*data.errors) << std::endl << std::endl;
- for (Variable *v : data.vars)
- out << (*v) << std::endl << std::endl;
+ for (Variable* v : data.vars)
+ out << (*v) << "\n\n";
+
+ out << "default_rules =\n[[\n";
+
+ for (Rule* r : data.rules)
+ out << (*r) << "\n";
+
+ out << "]]\n";
- for (Table *t : data.tables)
- out << (*t) << std::endl << std::endl;
+ for (Table* t : data.tables)
+ out << (*t) << "\n\n";
out << (*data.comments) << std::endl;
bool add_option_to_table(const std::string name, const std::string val);
bool add_option_to_table(const std::string name, const int val);
bool add_option_to_table(const std::string name, const bool val);
+ bool add_option_to_table(const std::string name, const char* v);
// add an option with a list of variables --> table = { name = 'elem1 elem2 ...' }
// corresponds to Parameter::PT_MULTI
bool add_list_to_table(std::string list_name, std::string next_elem);
// RULE PARSING
+ // Create a new rule object.
void begin_rule();
// add a new peice of header_data to the current rule
bool add_hdr_data(std::string data);
+ // add a rule option (keyword and suboption)
+ bool add_rule_option(std::string keyword);
+ // add a rule option (keyword and suboption)
+ bool add_rule_option(std::string keyword, std::string val);
+ // add a rule option (keyword and suboption)
+ bool add_rule_option_before_selected(std::string keyword, std::string val = std::string());
+ // selects the rule option with the given name. MUST BE CALLED BEFORE ADDING A SUBOPTION.
+ bool select_option(std::string keyword);
+ // clear the selected option.
+ void unselect_option();
+ // add a rule option (keyword and suboption)
+ bool add_suboption(std::string keyword);
+ // add a rule option (keyword and suboption)
+ bool add_suboption(std::string keyword, std::string val);
private:
std::vector<Variable*> vars;
Comments* errors;
std::stack<Table*> open_tables;
Rule* curr_rule;
+ RuleOption* curr_rule_opt;
};
Option::Option(std::string name, bool val, int depth)
{
this->name = name;
- this->value = (val) ? "true" : "false";
+ this->value = (val) ? "true" : "ealse";
this->depth = depth;
this->type = OptionType::BOOL;
}
#include "data/dt_rule.h"
-Rule::Rule()
+Rule::Rule() : num_hdr_data(0), bad_rule(false)
{
- bad_rule = false;
- num_hdr_data = 0;
}
Rule::~Rule(){};
}
}
+bool Rule::add_option(std::string keyword)
+{
+ RuleOption* r = new RuleOption(keyword);
+ options.push_back(r);
+ return true;
+}
+
+bool Rule::add_option(std::string keyword, std::string data)
+{
+ RuleOption* r = new RuleOption(keyword, data);
+ options.push_back(r);
+ return true;
+}
+
+bool Rule::add_option_before_selected(RuleOption* selected_opt,
+ std::string keyword,
+ std::string val)
+{
+ for (auto r = options.begin(); r != options.end(); ++r)
+ {
+ if ((*r) == selected_opt)
+ {
+ RuleOption* new_opt = new RuleOption(keyword, val);
+ options.insert(r, new_opt);
+ return true;
+ }
+ }
+
+ // impossible to occur. Since a rule is already selected, we found this rule once.
+ return false;
+}
+
+RuleOption* Rule::select_option(std::string opt_name)
+{
+ for (auto r = options.rbegin(); r != options.rend(); ++r)
+ if (!opt_name.compare((*r)->get_name()))
+ return (*r);
+ return nullptr;
+}
std::ostream &operator<<( std::ostream& out, const Rule &r)
{
- std::string built_string = "";
+ bool first_line = true;
for(int i = 0; i < r.num_hdr_data; i++)
{
- if (!r.hdr_data.empty())
- built_string += r.hdr_data[i];
+ if (first_line)
+ first_line = false;
+ else
+ out << " ";
+
+ out << r.hdr_data[i];
}
+ out << " (";
+ first_line = true;
+
+ for (auto* r : r.options)
+ {
+ if (first_line)
+ first_line = false;
+ else
+ out << ";";
+ out << " " << (*r);
+ }
+ out << " )";
return out;
}
#include <iostream>
#include <array>
+#include "data/rule/rd_option.h"
+
class Rule
{
public:
virtual ~Rule();
bool add_hdr_data(std::string data);
+ bool add_option(std::string keyword);
+ bool add_option(std::string keyword, std::string data);
+ RuleOption* select_option(std::string opt_name);
+ bool add_option_before_selected(RuleOption* selected_opt,
+ std::string keyword,
+ std::string val);
friend std::ostream &operator<<( std::ostream&, const Rule &);
private:
std::array<std::string, 7> hdr_data;
+ std::vector<RuleOption*> options;
int num_hdr_data;
bool bad_rule;
};
--- /dev/null
+
+add_library( rule_data
+ rd_option.h
+ rd_option.cc
+ rd_suboption.h
+ rd_suboption.cc
+)
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// rd_option.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include "data/rule/rd_option.h"
+
+
+
+RuleOption::RuleOption(std::string name) :
+ name(name),
+ value(std::string())
+{}
+
+RuleOption::RuleOption(std::string name, std::string value) :
+ name(name),
+ value(value)
+{}
+
+RuleOption::~RuleOption()
+{
+}
+
+bool RuleOption::add_suboption(std::string name)
+{
+ RuleSubOption* subopt = new RuleSubOption(name);
+ sub_options.push_back(subopt);
+ return true;
+}
+
+bool RuleOption::add_suboption(std::string name, std::string val)
+{
+ RuleSubOption* subopt = new RuleSubOption(name, val);
+ sub_options.push_back(subopt);
+ return true;
+}
+
+std::ostream &operator<<( std::ostream& out, const RuleOption &opt)
+{
+ out << opt.name;
+
+ if (!opt.value.empty())
+ out << ":" << opt.value;
+
+ for (RuleSubOption* rso : opt.sub_options)
+ out << ", " << (*rso);
+
+ return out;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// dt_option.h author Josh Rosenbaum <jorosenba@cisco.com>
+
+#ifndef RD_OPTION_H
+#define RD_OPTION_H
+
+#include <string>
+#include <vector>
+#include <iostream>
+
+#include "data/rule/rd_suboption.h"
+
+class RuleOption
+{
+public:
+ RuleOption(std::string name);
+ RuleOption(std::string name, std::string val);
+ virtual ~RuleOption();
+
+ inline std::string get_name(){ return name; };
+
+ bool add_suboption(std::string name);
+ bool add_suboption(std::string name, std::string val);
+
+ // overloading operators
+ friend std::ostream &operator<<( std::ostream&, const RuleOption &);
+
+private:
+
+ std::string name;
+ std::string value;
+ std::vector<RuleSubOption*> sub_options;
+
+
+};
+
+
+#endif
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// rd_suboption.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <string>
+
+#include "data/rule/rd_suboption.h"
+
+
+RuleSubOption::RuleSubOption(std::string name)
+ : name(name),
+ value(std::string())
+{
+}
+
+RuleSubOption::RuleSubOption(std::string name, std::string value)
+ : name(name),
+ value(value)
+{
+}
+
+RuleSubOption::~RuleSubOption()
+{
+}
+
+// overloading operators
+std::ostream &operator<<( std::ostream& out, const RuleSubOption& subopt)
+{
+ out << subopt.name;
+
+ if (!subopt.value.empty())
+ out << ":" << subopt.value;
+
+ return out;
+}
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// dt_option.h author Josh Rosenbaum <jorosenba@cisco.com>
+
+#ifndef RD_SUBOPTION_H
+#define RD_SUBOPTION_H
+
+#include <string>
+#include <vector>
+#include <iostream>
+
+class RuleSubOption
+{
+public:
+ RuleSubOption(std::string name);
+ RuleSubOption(std::string name, std::string val);
+ virtual ~RuleSubOption();
+
+ // overloading operators
+ friend std::ostream &operator<<( std::ostream&, const RuleSubOption &);
+
+private:
+// enum class OptionType{ STRING, VAR, BOOL, INT};
+
+ std::string name;
+ std::string value;
+// OptionType type;
+};
+
+
+#endif
InitState::InitState(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {}
-bool InitState::convert(std::stringstream& data_stream)
+bool InitState::convert(std::istringstream& data_stream)
{
std::string keyword;
public:
InitState(Converter* cv, LuaData* ld);
virtual ~InitState() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
-static ConversionState* init_state_ctor(Converter* cv, LuaData* ld)
+static inline ConversionState* init_state_ctor(Converter* cv, LuaData* ld)
{
return new InitState(cv, ld);
}
dynamic_map,
// nullptr,
};
+
+#if 0
+
+namespace keywords
+{
+
+void add_new_rule_keyword(std::string keyword_name)
+{
+ struct Convertmap* new_ruletype = new ConvertMap;
+
+ new_ruletype.keyword = keywords.name;
+
+}
+
+} // namespace keywords
+
+#endif
#define KEYWORDS_API_H
#include <vector>
+#include <string>
#include "../conversion_state.h"
extern const std::vector<const ConvertMap*> keyword_api;
+#if 0
+namespace keywords
+{
+
+void add_new_rule_keyword(std::string);
+
+} // namespace keywords
+#endif
+
#endif
public:
Config(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Config() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool Config::convert(std::stringstream& data_stream)
+bool Config::convert(std::istringstream& data_stream)
{
std::string keyword;
public:
Include(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Include() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool Include::convert(std::stringstream& data_stream)
+bool Include::convert(std::istringstream& data_stream)
{
std::string keyword;
bool includ_test;
public:
Output(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Output() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool Output::convert(std::stringstream& data_stream)
+bool Output::convert(std::istringstream& data_stream)
{
std::string keyword;
public:
Preprocessor(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Preprocessor() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool Preprocessor::convert(std::stringstream& data_stream)
+bool Preprocessor::convert(std::istringstream& data_stream)
{
std::string keyword;
public:
explicit RuleHeader(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~RuleHeader() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool RuleHeader::convert(std::stringstream& data_stream)
+bool RuleHeader::convert(std::istringstream& data_stream)
{
std::string hdr_data;
- bool rule_test;
-
- ld->begin_rule();
// should technically be either one or seven options, but I'm
// not doing error checking here.
- while (data_stream >> hdr_data && hdr_data.front() != ('('))
+ std::getline(data_stream, hdr_data, '(');
+ std::istringstream in(hdr_data);
+
+ while (in >> hdr_data)
{
ld->add_hdr_data(hdr_data);
}
- if (!hdr_data.compare("("))
- {
- if(!(data_stream >> hdr_data))
- return false;
- }
- else
- {
- hdr_data.erase(hdr_data.begin());
- }
- if(hdr_data.back() == ':')
- hdr_data.pop_back();
+ // Now, remove the last ')' and anything beyond. We will automatically
+ // add that part back when printing each rule.
+ int curr_pos = data_stream.tellg();
+ std::string rule_string = data_stream.str();
+ int end_pos = rule_string.rfind(')');
+ rule_string = rule_string.substr(0, end_pos);
+ data_stream.str(rule_string);
+ data_stream.seekg(curr_pos); // position was reset. so find curr position
- // now, lets get the next option and start parsing!
- const ConvertMap* map = util::find_map(rules::rule_api, hdr_data);
- if (map)
- {
- cv->set_state(map->ctor(cv, ld));
- return true;
- }
-
- return false;
+ // and call the first keywords
+ return set_next_rule_state(data_stream);
}
/********************************
******* GENERAL API ***********
********************************/
-
-static ConversionState* deprecate_rule_ctor(Converter* cv, LuaData* ld)
+template<const std::string *name>
+static ConversionState* rule_ctor(Converter* cv, LuaData* ld)
{
+ ld->begin_rule();
+ ld->add_hdr_data(*name);
return new RuleHeader(cv, ld);
}
-
-static ConversionState* rule_ctor(Converter* cv, LuaData* ld)
+template<const std::string *name>
+static ConversionState* dep_rule_ctor(Converter* cv, LuaData* ld)
{
+ ld->begin_rule();
+ ld->add_hdr_data(*name);
return new RuleHeader(cv, ld);
}
-static const ConvertMap alert_api = {"alert", rule_ctor};
-static const ConvertMap log_api = {"log", rule_ctor};
-static const ConvertMap pass_api = {"pass", rule_ctor};
-static const ConvertMap drop_api = {"drop", rule_ctor};
-static const ConvertMap reject_api = {"reject", rule_ctor};
-static const ConvertMap sdrop_api = {"sdrop", rule_ctor};
-static const ConvertMap activate_api = {"activate", deprecate_rule_ctor};
-static const ConvertMap dynamic_api = {"dynamic", deprecate_rule_ctor};
+
+static const std::string alert = "alert";
+static const std::string log = "log";
+static const std::string pass = "pass";
+static const std::string drop = "drop";
+static const std::string reject = "reject";
+static const std::string sdrop = "sdrop";
+static const std::string activate = "activate";
+static const std::string dynamic = "dynamic";
+
+static const ConvertMap alert_api = {alert, rule_ctor<&alert>};
+static const ConvertMap log_api = {log, rule_ctor<&log>};
+static const ConvertMap pass_api = {pass, rule_ctor<&pass>};
+static const ConvertMap drop_api = {drop, rule_ctor<&drop>};
+static const ConvertMap reject_api = {reject, rule_ctor<&reject>};
+static const ConvertMap sdrop_api = {sdrop, rule_ctor<&sdrop>};
+static const ConvertMap activate_api = {activate, dep_rule_ctor<&activate>};
+static const ConvertMap dynamic_api = {dynamic, dep_rule_ctor<&dynamic>};
const ConvertMap* alert_map = &alert_api;
public:
RuleType(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~RuleType() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool RuleType::convert(std::stringstream& data_stream)
+bool RuleType::convert(std::istringstream& data_stream)
{
std::string keyword;
#if 0
public:
Suppress(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Suppress() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool Suppress::convert(std::stringstream& data_stream)
+bool Suppress::convert(std::istringstream& data_stream)
{
bool retval = true;
std::string keyword;
public:
Var(Converter* cv, LuaData* ld);
virtual ~Var() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
private:
bool first_line;
is_port_list = false;
}
-bool Var::convert(std::stringstream& data_stream)
+bool Var::convert(std::istringstream& data_stream)
{
std::string ports;// cv->print_line(data_stream);
public:
ArpSpoof(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~ArpSpoof() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool ArpSpoof::convert(std::stringstream& data_stream)
+bool ArpSpoof::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
ArpSpoofHost(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~ArpSpoofHost() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool ArpSpoofHost::convert(std::stringstream& data_stream)
+bool ArpSpoofHost::convert(std::istringstream& data_stream)
{
std::string ip, mac;
public:
explicit Frag3Engine(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Frag3Engine() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
- bool parse_ip_list(std::string, std::stringstream& data_stream);
+ bool parse_ip_list(std::string, std::istringstream& data_stream);
};
} // namespace
bool Frag3Engine::parse_ip_list(std::string list_name,
- std::stringstream& data_stream)
+ std::istringstream& data_stream)
{
std::string prev;
std::string elem;
}
-bool Frag3Engine::convert(std::stringstream& data_stream)
+bool Frag3Engine::convert(std::istringstream& data_stream)
{
bool retval = true;
public:
Frag3Global(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Frag3Global() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool Frag3Global::convert(std::stringstream& data_stream)
+bool Frag3Global::convert(std::istringstream& data_stream)
{
bool retval = true;
public:
FtpTelnet(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~FtpTelnet() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
bool add_ftp_n_telnet_option(std::string opt_name, bool val);
void add_ftp_n_telnet_deprecated(std::string opt_name);
ld->close_table();
}
-bool FtpTelnet::convert(std::stringstream& data_stream)
+bool FtpTelnet::convert(std::istringstream& data_stream)
{
std::string keyword;
public:
FtpServer(Converter* cv, LuaData* ld);
virtual ~FtpServer() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
- bool parse_alt_max_cmd(std::stringstream& data_stream);
- bool parse_cmd_validity_cmd(std::stringstream& data_stream);
+ bool parse_alt_max_cmd(std::istringstream& data_stream);
+ bool parse_cmd_validity_cmd(std::istringstream& data_stream);
static int ftpsever_binding_id;
};
public:
FtpClient(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~FtpClient() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
static int ftpclient_binding_id;
};
public:
Telnet(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Telnet() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
class FtpTelnetProtocol : public ConversionState
public:
FtpTelnetProtocol(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~FtpTelnetProtocol() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
FtpServer::FtpServer(Converter* cv, LuaData* ld) : ConversionState(cv, ld)
{}
-bool FtpServer::parse_alt_max_cmd(std::stringstream& data_stream)
+bool FtpServer::parse_alt_max_cmd(std::istringstream& data_stream)
{
int i_val;
bool tmpval;
return tmpval;
}
-bool FtpServer::parse_cmd_validity_cmd(std::stringstream& data_stream)
+bool FtpServer::parse_cmd_validity_cmd(std::istringstream& data_stream)
{
std::string val;
std::string elem;
return tmpval;
}
-bool FtpServer::convert(std::stringstream& data_stream)
+bool FtpServer::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
int FtpClient::ftpclient_binding_id = 1;
-bool FtpClient::convert(std::stringstream& data_stream)
+bool FtpClient::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
********* Telnet Protocol ************
****************************************/
-bool Telnet::convert(std::stringstream& data_stream)
+bool Telnet::convert(std::istringstream& data_stream)
{
std::string keyword;
int i_val;
****************************************/
-bool FtpTelnetProtocol::convert(std::stringstream& data_stream)
+bool FtpTelnetProtocol::convert(std::istringstream& data_stream)
{
std::string protocol;
public:
HttpInspect(Converter* cv, LuaData* ld);
virtual ~HttpInspect() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
private:
- bool add_decode_option(std::string opt_name, std::stringstream& stream);
+ bool add_decode_option(std::string opt_name, std::istringstream& stream);
};
} // namespace
HttpInspect::HttpInspect(Converter* cv, LuaData* ld) : ConversionState(cv, ld)
{}
-bool HttpInspect::convert(std::stringstream& data_stream)
+bool HttpInspect::convert(std::istringstream& data_stream)
{
std::string keyword;
return retval;
}
-bool HttpInspect::add_decode_option(std::string opt_name, std::stringstream& stream)
+bool HttpInspect::add_decode_option(std::string opt_name, std::istringstream& stream)
{
int val;
public:
HttpInspectServer(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~HttpInspectServer() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
static int binding_id;
int HttpInspectServer::binding_id = 0;
-bool HttpInspectServer::convert(std::stringstream& data_stream)
+bool HttpInspectServer::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
Ip4Normalizer(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Ip4Normalizer() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool Ip4Normalizer::convert(std::stringstream& data_stream)
+bool Ip4Normalizer::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
TcpNormalizer(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~TcpNormalizer() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
bool set_base_w_comment(std::string);
bool set_ecn_w_comment(std::string);
}
-bool TcpNormalizer::convert(std::stringstream& data_stream)
+bool TcpNormalizer::convert(std::istringstream& data_stream)
{
std::string keyword;
std::string value;
public:
PerfMonitor(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~PerfMonitor() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
- bool parse_file_option(std::stringstream& data_stream,
+ bool parse_file_option(std::istringstream& data_stream,
std::string orig_name,
std::string option_name,
std::string new_file_name);
} // namespace
-bool PerfMonitor::parse_file_option(std::stringstream& data_stream,
+bool PerfMonitor::parse_file_option(std::istringstream& data_stream,
std::string orig_name,
std::string option_name,
std::string new_file_name)
return false;
}
-bool PerfMonitor::convert(std::stringstream& data_stream)
+bool PerfMonitor::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
RpcDecode(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~RpcDecode() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool RpcDecode::convert(std::stringstream& data_stream)
+bool RpcDecode::convert(std::istringstream& data_stream)
{
bool retval = true;
public:
PortScan(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~PortScan() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
- bool parse_list(std::string table_name, std::stringstream& data_stream);
- bool parse_option(std::string table_name, std::stringstream& data_stream);
- bool add_portscan_global_option(std::string name, std::stringstream& data_stream);
+ bool parse_list(std::string table_name, std::istringstream& data_stream);
+ bool parse_option(std::string table_name, std::istringstream& data_stream);
+ bool add_portscan_global_option(std::string name, std::istringstream& data_stream);
// a wrapper for parse_list. adds an addition '[..]' around the string
- bool parse_ip_list(std::string table_name, std::stringstream& data_stream);
+ bool parse_ip_list(std::string table_name, std::istringstream& data_stream);
};
} // namespace
-bool PortScan::parse_ip_list(std::string list_name, std::stringstream& data_stream)
+bool PortScan::parse_ip_list(std::string list_name, std::istringstream& data_stream)
{
std::string prev;
std::string elem;
return ld->add_option_to_table(list_name, prev);
}
-bool PortScan::parse_list(std::string list_name, std::stringstream& data_stream)
+bool PortScan::parse_list(std::string list_name, std::istringstream& data_stream)
{
std::string elem;
bool retval = true;
return retval;
}
-bool PortScan::parse_option(std::string list_name, std::stringstream& data_stream)
+bool PortScan::parse_option(std::string list_name, std::istringstream& data_stream)
{
std::string elem;
bool retval = true;
return retval;
}
-bool PortScan::add_portscan_global_option(std::string name, std::stringstream& data_stream)
+bool PortScan::add_portscan_global_option(std::string name, std::istringstream& data_stream)
{
int val;
std::string garbage;
}
-bool PortScan::convert(std::stringstream& data_stream)
+bool PortScan::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
Smtp(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Smtp() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool Smtp::convert(std::stringstream& data_stream)
+bool Smtp::convert(std::istringstream& data_stream)
{
#if 0
public:
StreamGlobal(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~StreamGlobal() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool StreamGlobal::convert(std::stringstream& data_stream)
+bool StreamGlobal::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
StreamTcp(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~StreamTcp() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
private:
- bool parse_small_segments(std::stringstream& data_stream);
- bool parse_ports(std::stringstream& data_stream);
+ bool parse_small_segments(std::istringstream& data_stream);
+ bool parse_ports(std::istringstream& data_stream);
};
} // namespace
-bool StreamTcp::parse_small_segments(std::stringstream& data_stream)
+bool StreamTcp::parse_small_segments(std::istringstream& data_stream)
{
std::string s_val;
int i_val;
}
-bool StreamTcp::parse_ports(std::stringstream& data_stream)
+bool StreamTcp::parse_ports(std::istringstream& data_stream)
{
std::string s_val;
std::string opt_name;
}
-bool StreamTcp::convert(std::stringstream& data_stream)
+bool StreamTcp::convert(std::istringstream& data_stream)
{
std::string keyword;
bool retval = true;
public:
StreamUdp(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~StreamUdp() {};
- virtual bool convert(std::stringstream& data_stream);
+ virtual bool convert(std::istringstream& data_stream);
};
} // namespace
-bool StreamUdp::convert(std::stringstream& data_stream)
+bool StreamUdp::convert(std::istringstream& data_stream)
{
bool retval = true;
add_library( rule_states
rule_content.cc
+ rule_unchanged.cc
rule_api.cc
rule_api.h
)
#include <string>
#include "rule_states/rule_api.h"
-
+#include "util/util.h"
+#include "util/converter.h"
namespace rules
{
extern const ConvertMap* content_map;
+extern const ConvertMap* gid_map;
+extern const ConvertMap* msg_map;
+extern const ConvertMap* protected_content_map;
+extern const ConvertMap* rev_map;
+extern const ConvertMap* sid_map;
+extern const ConvertMap* uricontent_map;
const std::vector<const ConvertMap*> rule_api =
{
content_map,
+ gid_map,
+ msg_map,
+ protected_content_map,
+ rev_map,
+ sid_map,
+ uricontent_map,
};
} // namespace rules
*/
// converter.h author Josh Rosenbaum <jorosenba@cisco.com>
-#include <sstream>
-#include "conversion_state.h"
#ifndef RULE_API_H
#define RULE_API_H
-
+#include <sstream>
+#include <istream>
#include <vector>
+
#include "conversion_state.h"
namespace rules
{
-// vector containing all of hte rule keywords
+// vector containing all of the rule keywords
extern const std::vector<const ConvertMap*> rule_api;
+//bool set_next_rule_state(std::istringstream, Converter* cv, LuaData* ld);
} // namespace rules
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// kws_ruletype.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// rule_content.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
#include "conversion_state.h"
#include "util/converter.h"
+#include "rule_states/rule_api.h"
+#include "util/util.h"
namespace rules
{
namespace {
+
+template<const std::string *option_name>
class Content : public ConversionState
{
public:
Content(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
virtual ~Content() {};
- virtual bool convert(std::stringstream& data);
+ virtual bool convert(std::istringstream& data);
};
} // namespace
-bool Content::convert(std::stringstream& data_stream)
+template<const std::string *option_name>
+bool Content<option_name>::convert(std::istringstream& data_stream)
{
std::string keyword;
-#if 0
- if(data_stream >> keyword)
+ std::string val;
+ bool retval = true;
+
+ std::getline(data_stream, val, ';');
+ retval = ld->add_rule_option(*option_name, val);
+ ld->select_option(*option_name);
+
+ int pos = data_stream.tellg();
+ std::getline(data_stream, val, ';');
+ std::istringstream subopts(val);
+
+ while(subopts >> val)
{
+ bool tmpval = true;
+ util::trim(val);
+ int keyword_pos = val.find_first_of(':');
+ std::string keyword;
+
+ if (keyword_pos != std::string::npos)
+ {
+ keyword = val.substr(0, keyword_pos);
+ val = val.substr(keyword_pos + 1, std::string::npos);
+// subopts.str(val); // reset the subopts buffer for someone else
+ }
+ else
+ {
+ keyword = val;
+ val = std::string();
+ }
+
+ if (!keyword.compare("offset"))
+ tmpval = ld->add_suboption("offset", val);
+
+ else if (!keyword.compare("distance"))
+ tmpval = ld->add_suboption("distance", val);
+
+ else if (!keyword.compare("within"))
+ tmpval = ld->add_suboption("within", val);
+
+ else if (!keyword.compare("depth"))
+ tmpval = ld->add_suboption("depth", val);
+
+ else if (!keyword.compare("nocase"))
+ tmpval = ld->add_suboption("nocase");
+
+ else if (!keyword.compare("rawbytes"))
+ tmpval = ld->add_rule_option_before_selected("pkt_data");
+
+ else if (!keyword.compare("http_client_body"))
+ tmpval = ld->add_rule_option_before_selected("http_client_body");
+
+ else if (!keyword.compare("http_cookie"))
+ tmpval = ld->add_rule_option_before_selected("http_cookie");
+
+ else if (!keyword.compare("http_raw_cookie"))
+ tmpval = ld->add_rule_option_before_selected("http_raw_cookie");
+
+ else if (!keyword.compare("http_header"))
+ tmpval = ld->add_rule_option_before_selected("http_header");
+
+ else if (!keyword.compare("http_raw_header"))
+ tmpval = ld->add_rule_option_before_selected("http_raw_header");
+
+ else if (!keyword.compare("http_method"))
+ tmpval = ld->add_rule_option_before_selected("http_method");
+
+ else if (!keyword.compare("http_uri"))
+ tmpval = ld->add_rule_option_before_selected("http_uri");
+
+ else if (!keyword.compare("http_raw_uri"))
+ tmpval = ld->add_rule_option_before_selected("http_raw_uri");
+
+ else if (!keyword.compare("http_stat_code"))
+ tmpval = ld->add_rule_option_before_selected("http_stat_code");
+
+ else if (!keyword.compare("http_stat_msg"))
+ tmpval = ld->add_rule_option_before_selected("http_stat_msg");
- if(keyword.back() == ':')
- keyword.pop_back();
+ else if (!keyword.compare("hash")) // PROTECTED CONTENT
+ tmpval = ld->add_suboption("hash", val);
- const ConvertMap* map = util::find_map(rules::rule_api, keyword);
- if (map)
+ else if (!keyword.compare("length")) // PROTECTED CONTENT
+ tmpval = ld->add_suboption("length", val);
+
+ else if (!keyword.compare("fast_pattern"))
+ {
+ if (val.empty())
+ tmpval = ld->add_suboption("fast_pattern");
+
+ else if(!val.compare("only"))
+ tmpval = true; // deprecated. ignore.
+
+ else
+ {
+ // don't let the program catch for invalid syntax.
+ try
+ {
+ std::size_t pos;
+ int offset = std::stoi(val, &pos);
+ if (val[pos] == ',')
+ {
+ pos++;
+ int length = std::stoi(val.substr(pos, std::string::npos));
+ tmpval = ld->add_suboption("fast_pattern");
+ tmpval = ld->add_suboption("fast_pattern_offset", std::to_string(offset));
+ tmpval = ld->add_suboption("fast_pattern_length", std::to_string(length));
+ }
+ else
+ tmpval = false;
+ }
+ catch(std::exception&)
+ {
+ tmpval = false;
+ }
+ }
+ }
+
+ else
{
- cv->set_state(map->ctor(cv, ld));
- return true;
+ // since we don't know this next option, check for any other options
+ ld->unselect_option(); // don't reference this option anymore
+ data_stream.seekg(pos);
+ data_stream.clear(); // Might have already hit end of stream
+ return set_next_rule_state(data_stream) && retval;
}
- }
-#endif
- return false;
+
+ if (retval)
+ retval = tmpval;
+
+ // lets get the next keyword
+ pos = data_stream.tellg();
+ std::getline(data_stream, val, ';');
+ subopts.clear();
+ subopts.str(val);
+ };
+
+ // can only get here if we finish parsing this rule
+ return true;
}
/**************************
******* A P I ***********
**************************/
-static ConversionState* ctor(Converter* cv, LuaData* ld)
+
+template<const std::string *rule_name>
+static ConversionState* content_ctor(Converter* cv, LuaData* ld)
+{
+ return new Content<rule_name>(cv, ld);
+}
+
+static const std::string content = "content";
+static const std::string protected_content = "protected_content";
+static const std::string uricontent = "uricontent";
+
+
+// Uricontent:"foo" --> http_uti; content:"foo".
+// So, just add the 'http_uri' option first, then parse as if content
+static ConversionState* uricontent_ctor(Converter* cv, LuaData* ld)
{
- return new Content(cv, ld);
+ ld->add_rule_option("http_uri");
+ return new Content<&content>(cv, ld);
}
-static const ConvertMap rule_content_api =
+
+
+static const ConvertMap rule_content_api =
+{
+ content,
+ content_ctor<&content>,
+};
+
+static const ConvertMap rule_protected_content_api =
+{
+ protected_content,
+ content_ctor<&protected_content>,
+};
+
+static const ConvertMap rule_uricontent_api =
{
- "content",
- ctor,
+ uricontent,
+ uricontent_ctor,
};
+
const ConvertMap* content_map = &rule_content_api;
+const ConvertMap* protected_content_map = &rule_protected_content_api;
+const ConvertMap* uricontent_map = &rule_uricontent_api;
} // namespace rules
\ No newline at end of file
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// rule_content.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "util/converter.h"
+#include "rule_states/rule_api.h"
+#include "util/util.h"
+
+namespace rules
+{
+
+/*
+ * To use this template, declared an 'unchanged_rule_ctor<rule_name>'
+ * in the ConvertMap struct. Everything else will be taken care of and
+ * all of the data between two semicolons will be placed in the new rule AS IS!!
+ * Examples are below the line marked 'FINISHED TEMPLATES'.
+ */
+
+template<const std::string *rule_name>
+class UnchangedRuleOption : public ConversionState
+{
+public:
+ UnchangedRuleOption( Converter* cv, LuaData* ld)
+ : ConversionState(cv, ld)
+ { };
+ virtual ~UnchangedRuleOption() {};
+
+ friend bool set_next_rule_state(std::istringstream& stream, Converter* cv, LuaData* ld);
+ virtual bool convert(std::istringstream& stream)
+ {
+ std::string val;
+
+ std::getline(stream, val, ';');
+ bool retval = ld->add_rule_option(*rule_name, val);
+ return retval && set_next_rule_state(stream);
+ }
+};
+
+
+template<const std::string *rule_name>
+static ConversionState* unchange_rule_ctor(Converter* cv, LuaData* ld)
+{
+ return new UnchangedRuleOption<rule_name>(cv, ld);
+}
+
+
+
+/****************************************
+ ******* FINISHED TEMPLATES ***********
+ ****************************************/
+
+/************************************
+ ********** M S G ******************
+ ************************************/
+
+
+static const std::string msg = "msg";
+static const ConvertMap rule_msg =
+{
+ msg,
+ unchange_rule_ctor<&msg>,
+};
+
+const ConvertMap* msg_map = &rule_msg;
+
+
+/************************************
+ ********** G I D ******************
+ ************************************/
+
+
+static const std::string gid = "gid";
+static const ConvertMap rule_gid =
+{
+ gid,
+ unchange_rule_ctor<&gid>,
+};
+
+const ConvertMap* gid_map = &rule_gid;
+
+
+/************************************
+ ********** S I D *****************
+ ************************************/
+
+
+static const std::string sid = "sid";
+static const ConvertMap rule_sid =
+{
+ sid,
+ unchange_rule_ctor<&sid>,
+};
+
+const ConvertMap* sid_map = &rule_sid;
+
+
+/************************************
+ ********** R E V *****************
+ ************************************/
+
+
+static const std::string rev = "rev";
+static const ConvertMap rule_rev =
+{
+ rev,
+ unchange_rule_ctor<&rev>,
+};
+
+const ConvertMap* rev_map = &rule_rev;
+
+
+} // namespace rule
#include <iostream>
#include "util/converter.h"
#include "conversion_state.h"
-#include "init_state.h"
#include "util/util.h"
// without this, "default_rules" is considered a bool for some odd reason.
std::string s = std::string("$default_rules");
- // create a rules string and point the ips to it
- ld.add_variable("default_rules", " ");
+ // point the ips to a 'default_rules' variable
ld.open_table("ips");
ld.add_option_to_table("rules", s);
ld.close_table();
}
else
{
- std::stringstream data_stream(orig_text);
+ std::istringstream data_stream(orig_text);
while(data_stream.tellg() != -1)
{
if ((state == nullptr) || !state->convert(data_stream))
data.add_comment(comment);
}
-void Converter::add_comment_to_file(std::string comment, std::stringstream& stream)
+void Converter::add_comment_to_file(std::string comment, std::istringstream& stream)
{
int pos = stream.tellg();
- std::ostringstream oss;
+ std::oistringstream oss;
oss << stream.rdbuf();
comment += oss.str();
data.add_comment(comment);
// std::cout << "\t\t" << error_string << std::endl << std::endl;
}
-void Converter::print_line(std::stringstream& in)
+void Converter::print_line(std::istringstream& in)
{
int pos = in.tellg();
std::ostringstream oss;
#include <sstream>
#include <stack>
#include <iostream>
+#include <istream>
+#include <ostream>
#include "data/dt_data.h"
#include "data/dt_var.h"
-#include "conversion_state.h"
+
+// typedef redefined from 'conversion_state.h'
class ConversionState;
+class Converter;
+typedef ConversionState* (*conv_new_f)(Converter*, LuaData* ld);
class Converter
{
// comment will appear immediately below the lua configuration
void add_comment_to_file(std::string comment);
// add the entire stream as a comment in the new lua file
- void add_comment_to_file(std::string comment, std::stringstream& stream);
+ void add_comment_to_file(std::string comment, std::istringstream& stream);
// attach a comment about a deprecated option to a file or table
void add_deprecated_comment(std::string dep_var);
// add a comment with telling the user an option has changed
// log an error in the new lua file
void log_error(std::string);
- void print_line(std::stringstream& in);
+ void print_line(std::istringstream& in);
void print_line(std::ostringstream& in);
void print_line(std::string& in);
char delim,
std::vector<std::string> &elems)
{
- std::stringstream ss(s);
+ std::istringstream ss(s);
std::string item;
while (std::getline(ss, item, delim))
{
projects / thirdparty / snort3.git / commitdiff
