Merge pull request #1504 in SNORT/snort3 from ~SHASLAD/snort3:new_binder_ports_type...

Squashed commit of the following:

commit 65994e4ea71a5918cbca8216a911b88e287a7d8f
Author: shaslad <shaslad@cisco.com>
Date:   Fri Feb 8 00:24:30 2019 -0500

    snort2lua: adding when.role for specific inspectors

diff --git a/.gitignore b/.gitignore
index 753712449d37ddaaab283297aa47748488fe26ce..def2f38af487cd2e3de27917c20f761b409efb76 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -1,13 +1,14 @@
+*.gcda
+*.gcno
+*.gcov
 *.log
 *.out
 *.rej
 *.swp
-*.gcno
-*.gcda
-*.gcov
 *.trs
 *~
 ._Xcode*
+.vscode/
 Cbuild/
 Xcode*/
 doc/basic.txt
@@ -15,9 +16,9 @@ doc/builtin.txt
 doc/codec.txt
 doc/commands.txt
 doc/config.txt
-doc/counts.txt
 doc/config_changes.txt
 doc/connector.txt
+doc/counts.txt
 doc/data.txt
 doc/docbook-xsl.css
 doc/gids.txt
@@ -33,8 +34,8 @@ doc/plugins.txt
 doc/search_engine.txt
 doc/signals.txt
 doc/snort2lua_cmds.txt
-doc/snort_manual.chunked/
 doc/snort_manual.chunked.tgz
+doc/snort_manual.chunked/
 doc/snort_manual.tgz
 doc/snort_manual.xml
 doc/version.txt
@@ -42,9 +43,9 @@ extra/rule.xxd
 extra/snort_examples-1.0.tar.gz
 snort.pc
 src/framework/api_options.h
-GTAGS
-GRTAGS
 GPATH
+GRTAGS
+GTAGS
 HTML
 
 # These are related to the build-scripts

diff --git a/lua/snort.lua.in b/lua/snort.lua.in
index 347e735e099b04b909c48b2609e6acfeeec51434..92424bbaa3b1c0172f4ec1f309afe76dfd47e183 100644 (file)
--- a/lua/snort.lua.in
+++ b/lua/snort.lua.in
@@ -141,10 +141,11 @@ wizard = default_wizard
 binder =
 {
     -- port bindings required for protocols without wizard support
-    { when = { proto = 'udp', ports = '53' },  use = { type = 'dns' } },
-    { when = { proto = 'tcp', ports = '111' }, use = { type = 'rpc_decode' } },
-    { when = { proto = 'tcp', ports = '502' }, use = { type = 'modbus' } },
-    { when = { proto = 'tcp', ports = '2123 2152 3386' }, use = { type = 'gtp' } },
+    { when = { proto = 'udp', ports = '53', role='server' },  use = { type = 'dns' } },
+    { when = { proto = 'tcp', ports = '53', role='server' },  use = { type = 'dns' } },
+    { when = { proto = 'tcp', ports = '111', role='server' }, use = { type = 'rpc_decode' } },
+    { when = { proto = 'tcp', ports = '502', role='server' }, use = { type = 'modbus' } },
+    { when = { proto = 'tcp', ports = '2123 2152 3386', role='server' }, use = { type = 'gtp' } },
 
     { when = { proto = 'tcp', service = 'dcerpc' }, use = { type = 'dce_tcp' } },
     { when = { proto = 'udp', service = 'dcerpc' }, use = { type = 'dce_udp' } },

diff --git a/tools/snort2lua/preprocessor_states/pps_dns.cc b/tools/snort2lua/preprocessor_states/pps_dns.cc
index 78ac3e20382a4e955e49ae839b5fce418a409b58..bb3653b95dcde66200f617614942fb3e7e6c48e0 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_dns.cc
+++ b/tools/snort2lua/preprocessor_states/pps_dns.cc
@@ -73,6 +73,7 @@ bool Dns::convert(std::istringstream& data_stream)
                 while (data_stream >> keyword && keyword != "}")
                 {
                     ports_set = true;
+                    bind.set_when_role("server");
                     bind.add_when_port(keyword);
                 }
             }
@@ -95,8 +96,11 @@ bool Dns::convert(std::istringstream& data_stream)
         }
     }
 
-    if (!ports_set)
+    if (!ports_set) 
+    {
+        bind.set_when_role("server");
         bind.add_when_port("53");
+    }
 
     return retval;
 }

diff --git a/tools/snort2lua/preprocessor_states/pps_gtp.cc b/tools/snort2lua/preprocessor_states/pps_gtp.cc
index df06af6ea8f90134874cbb46188fb50a07f12885..31d33c28fb0fbb2c36ccbffef98827fe7295dfe9 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_gtp.cc
+++ b/tools/snort2lua/preprocessor_states/pps_gtp.cc
@@ -50,6 +50,7 @@ Gtp::~Gtp()
 
     auto& bind = cv.make_binder();
     bind.set_when_proto("udp");
+    bind.set_when_role("server");
     bind.add_when_port("2123");
     bind.add_when_port("3386");
     bind.set_use_type("gtp_inspect");
@@ -86,6 +87,7 @@ bool Gtp::convert(std::istringstream& data_stream)
                 while (data_stream >> keyword && keyword != "}")
                 {
                     ports_set = true;
+                    bind.set_when_role("server");
                     bind.add_when_port(keyword);
                 }
             }
@@ -110,6 +112,7 @@ bool Gtp::convert(std::istringstream& data_stream)
 
     if (!ports_set)
     {
+        bind.set_when_role("server");
         bind.add_when_port("2123");
         bind.add_when_port("3386");
     }

diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index ddc1b54ad8a2ad98636df1f162998581217e92eb..42c70c22c2d9f5a0dc17bf45cac655ad6fcde69a 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -285,6 +285,7 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
                 while (data_stream >> keyword && keyword != "}")
                 {
                     ports_set = true;
+                    bind.set_when_role("server");
                     bind.add_when_port(keyword);
                 }
             }
@@ -346,8 +347,10 @@ bool HttpInspectServer::convert(std::istringstream& data_stream)
     }
 
     if (!ports_set)
+    {
+        bind.set_when_role("server");
         bind.add_when_port("80");
-
+    }
     return retval;
 }
 

diff --git a/tools/snort2lua/preprocessor_states/pps_modbus.cc b/tools/snort2lua/preprocessor_states/pps_modbus.cc
index 4ed7e7f652923ed743412d5cc34078984e0f5362..31f58841d542f0a5545419e7dcb967cc0756b84e 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_modbus.cc
+++ b/tools/snort2lua/preprocessor_states/pps_modbus.cc
@@ -49,6 +49,7 @@ Modbus::~Modbus()
 
     auto& bind = cv.make_binder();
     bind.set_when_proto("tcp");
+    bind.set_when_role("server");
     bind.add_when_port("502");
     bind.set_use_type("modbus");
 
@@ -84,6 +85,7 @@ bool Modbus::convert(std::istringstream& data_stream)
                 while (data_stream >> keyword && keyword != "}")
                 {
                     ports_set = true;
+                    bind.set_when_role("server");
                     bind.add_when_port(keyword);
                 }
             }
@@ -107,7 +109,10 @@ bool Modbus::convert(std::istringstream& data_stream)
     }
 
     if (!ports_set)
+    {
+        bind.set_when_role("server");
         bind.add_when_port("502");
+    }
 
     table_api.close_table();
     return retval;

diff --git a/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc b/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc
index 13b8d024f2cf1a27183a9622d4f4287e6a1c447b..5da4bd744b278400123ca35250aa7485629fe13d 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc
+++ b/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc
@@ -52,6 +52,7 @@ RpcDecode::~RpcDecode()
     {
         auto& bind = cv.make_binder();
         bind.set_when_proto("tcp");
+        bind.set_when_role("server");
         bind.add_when_port("111");
         bind.add_when_port("32271");
         bind.set_use_type("rpc_decode");
@@ -90,6 +91,7 @@ bool RpcDecode::convert(std::istringstream& data_stream)
 
         else if (isdigit(keyword[0]))
         {
+            bind.set_when_role("server");
             bind.add_when_port(keyword);
             ports_set = true;
         }
@@ -102,6 +104,7 @@ bool RpcDecode::convert(std::istringstream& data_stream)
 
     if (!ports_set)
     {
+        bind.set_when_role("server");
         bind.add_when_port("111");
         bind.add_when_port("32271");
     }