inline const char* get_name() const
{return name; }
// Registers this Codec's data link type (as defined by libpcap)
- virtual void get_data_link_type(std::vector<int>&)
+ virtual void get_data_link_type(std::vector<int>&) // FIXIT-M J return a vector == efficient in c++11
{ }
// Register the code's protocol ID's and Ethertypes
- virtual void get_protocol_ids(std::vector<uint16_t>&)
+ virtual void get_protocol_ids(std::vector<uint16_t>&) // FIXIT-M J return a vector == efficient in c++11
{ }
/*
TableApi& table_api;
RuleApi& rule_api;
+
#if 0
Forward declaration fo parsing methods. Since these are all inline,
unable to forward declare in regular code.
// Yes, I need to redo this API.
-// FIXIT-L J add_rule_option means select_option(). CHANGE_IT!!
+// FIXIT-L J Simplify this API. Several options functions are no longer necessary!!
class RuleApi
{
virtual bool convert(std::istringstream& data);
private:
- bool parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream);
+ void fix_separators(std::istringstream& stream);
};
} // namespace
-static inline int check_list(std::string listToCheck)
-{
- int brackets = 0;
-
- for (char& c : listToCheck)
- {
- if (c == '[')
- brackets++;
-
- else if (c == ']')
- brackets--;
- }
- return brackets;
-}
-
-bool RateFilter::parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream)
+void RateFilter::fix_separators(std::istringstream& stream)
{
- std::string tmp;
- int list = 0;
-
- // will automatically extract entire string since originally delineated on comma
- std::getline(arg_stream, tmp, ',');
- std::string fullIpList = util::trim(tmp);
- list = check_list(tmp);
-
+ const std::streamoff pos = stream.tellg();
+ std::size_t curr = pos;
+ std::string s = stream.str();
+ int cnt = 0;
- while (list > 0)
+ while ( (curr = s.find_first_of("[],", curr)) != std::string::npos )
{
- fullIpList += ",";
- std::getline(data_stream, tmp, ',');
- list += check_list(tmp);
- fullIpList += tmp;
+ switch(s[curr])
+ {
+ case '[':
+ cnt++;
+ break;
+ case ']':
+ cnt--;
+ break;
+ case ',':
+ if (cnt == 0)
+ s[curr] = ';';
+ break;
+ }
+ ++curr;
}
- if (arg_stream.bad() && data_stream.bad())
- return false;
-
- table_api.add_option("apply_to", fullIpList);
- return true;
+ stream.str(s);
+ stream.clear();
+ stream.seekg(pos);
}
+
bool RateFilter::convert(std::istringstream& data_stream)
{
bool retval = true;
std::string args;
-
table_api.open_table("rate_filter");
+ fix_separators(data_stream);
- while(std::getline(data_stream, args, ','))
+ while(std::getline(data_stream, args, ';'))
{
std::string keyword;
std::istringstream arg_stream(args);
arg_stream >> keyword;
-
if(keyword.empty())
continue;
tmpval = parse_string_option("new_action", arg_stream);
else if (!keyword.compare("apply_to"))
- tmpval = parse_ip_list(arg_stream, data_stream);
-
+ {
+ std::getline(arg_stream, keyword);
+ util::trim(keyword);
+ table_api.add_option("apply_to", keyword);
+ }
else if(!keyword.compare("gen_id"))
{
table_api.add_diff_option_comment("gen_id", "gid");
virtual bool convert(std::istringstream& data);
private:
- bool parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream);
+ void fix_separators(std::istringstream& stream);
};
} // namespace
-static inline int check_list(std::string listToCheck)
-{
- int brackets = 0;
-
- for (char& c : listToCheck)
- {
- if (c == '[')
- brackets++;
-
- else if (c == ']')
- brackets--;
- }
-
- return brackets;
-}
-bool Suppress::parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream)
+void Suppress::fix_separators(std::istringstream& stream)
{
- std::string tmp;
- int list = 0;
+ const std::streamoff pos = stream.tellg();
+ std::size_t curr = pos;
+ std::string s = stream.str();
+ int cnt = 0;
- // will automatically extract entire string since originally delineated on comma
- std::getline(arg_stream, tmp, ',');
- std::string fullIpList = util::trim(tmp);
- list = check_list(tmp);
-
-
- while (list > 0)
+ while ( (curr = s.find_first_of("[],", curr)) != std::string::npos )
{
- fullIpList += ",";
- std::getline(data_stream, tmp, ',');
- list += check_list(tmp);
- fullIpList += tmp;
+ switch(s[curr])
+ {
+ case '[':
+ cnt++;
+ break;
+ case ']':
+ cnt--;
+ break;
+ case ',':
+ if (cnt == 0)
+ s[curr] = ';';
+ break;
+ }
+ ++curr;
}
- if (arg_stream.bad() && data_stream.bad())
- return false;
-
- table_api.add_option("ip", fullIpList);
- return true;
+ stream.str(s);
+ stream.clear();
+ stream.seekg(pos);
}
bool Suppress::convert(std::istringstream& data_stream)
table_api.add_diff_option_comment("sig_id", "sid");
table_api.open_table();
- while(std::getline(data_stream, args, ','))
+ fix_separators(data_stream);
+
+ while(std::getline(data_stream, args, ';'))
{
std::string keyword;
std::istringstream arg_stream(args);
else if (!keyword.compare("track"))
tmpval = parse_string_option("track", arg_stream);
- else if (!keyword.compare("ip"))
- tmpval = parse_ip_list(arg_stream, data_stream);
-
else if(!keyword.compare("gen_id"))
tmpval = parse_int_option("gid", arg_stream);
else if (!keyword.compare("sig_id"))
tmpval = parse_int_option("sid", arg_stream);
+ else if (!keyword.compare("ip"))
+ {
+ std::getline(arg_stream, keyword);
+ util::trim(keyword);
+ table_api.add_option("ip", keyword);
+ }
else
tmpval = false;
- if (retval)
- retval = tmpval;
+ if (!tmpval)
+ {
+ data_api.failed_conversion(data_stream, args);
+ retval = false;
+ }
}
return retval;
#include "conversion_state.h"
#include "utils/converter.h"
#include "utils/s2l_util.h"
+#include "utils/util_binder.h"
+
namespace preprocessors
{
virtual bool convert(std::istringstream& data_stream);
private:
- bool parse_ip_list(std::string, std::istringstream& data_stream);
+ std::string choose_table_name(std::istringstream& data_stream);
};
} // namespace
-
-bool Frag3Engine::parse_ip_list(std::string list_name,
- std::istringstream& data_stream)
+std::string Frag3Engine::choose_table_name(std::istringstream& data_stream)
{
- std::string prev;
- std::string elem;
-
- if(!(data_stream >> elem) || (elem.front() != '['))
- return false;
-
- if(!(data_stream >> elem))
- return false;
-
- // there can be no spaces between the square bracket and string
- prev = "[" + elem;
-
- while (data_stream >> elem && elem.back() != ']')
- prev = prev + ' ' + elem;
+ static uint32_t binding_id = 0;
+ const std::streamoff pos = data_stream.tellg();
+ std::string keyword;
- prev = prev + "]";
- return table_api.add_option(list_name, prev);
+ while (data_stream >> keyword)
+ {
+ if (!keyword.compare("bind_to"))
+ {
+ data_stream.seekg(pos);
+ data_stream.clear();
+ return "stream_ip_" + std::to_string(binding_id++);
+ }
+ }
+ data_stream.seekg(pos);
+ data_stream.clear();
+ return "stream_ip";
}
bool Frag3Engine::convert(std::istringstream& data_stream)
{
-
bool retval = true;
std::string keyword;
- table_api.open_table("stream_ip");
+ const std::string table_name = choose_table_name(data_stream);
+ table_api.open_table(table_name);
while(data_stream >> keyword)
{
table_api.add_deleted_comment("detect_anomalies");
else if(!keyword.compare("bind_to"))
- parse_ip_list("bind_to", data_stream);
+ {
+ std::string ip_list;
+ if ( !(data_stream >> ip_list) )
+ {
+ data_api.failed_conversion(data_stream, "bind_to <ip_list>");
+ }
+ else
+ {
+ Binder b(table_api);
+ b.set_when_proto("ip");
+ b.add_when_net(ip_list);
+ b.set_use_type("stream_ip");
+ b.set_use_name(table_name);
+ }
+ }
else if(!keyword.compare("min_ttl"))
{
if (!parse_int_option("min_ttl", data_stream))
**************************/
static ConversionState* ctor(Converter& c)
-{
- return new StreamIp(c);
-}
+{ return new StreamIp(c); }
static const ConvertMap preprocessor_stream_ip =
{
std::string addr;
if (arg_stream >> addr)
+ {
+ std::string tmp;
+ while (arg_stream >> tmp)
+ addr += " " + tmp;
+
add_to_bindings(&Binder::add_when_net, addr);
+ }
else
+ {
tmpval = false;
+ }
}
-
else if (!keyword.compare("dont_reassemble_async"))
{
table_api.add_diff_option_comment("dont_reassemble_async", "reassemble_async");
tmpval = table_api.add_option("reassemble_async", false);
}
-
else if (!keyword.compare("use_static_footprint_sizes"))
{
table_api.add_diff_option_comment("use_static_footprint_sizes", "footprint");
table_api.add_comment("default footprint == 192");
tmpval = table_api.add_option("footprint", 192);
}
-
else if (!keyword.compare("timeout"))
{
table_api.add_diff_option_comment("timeout", "session_timeout");
tmpval = parse_int_option("session_timeout", arg_stream);
}
-
else if (!keyword.compare("max_queued_segs"))
{
table_api.add_diff_option_comment("max_queued_segs", "queue_limit.max_segments");
tmpval = parse_int_option("max_segments", arg_stream);
table_api.close_table();
}
-
else if (!keyword.compare("max_queued_bytes"))
{
table_api.add_diff_option_comment("max_queued_bytes", "queue_limit.max_bytes");
tmpval = parse_int_option("max_bytes", arg_stream);
table_api.close_table();
}
-
else if (!keyword.compare("policy"))
{
std::string policy;
table_api.add_diff_option_comment("policy win2003", "stream_tcp.policy = win-2003");
table_api.add_option("policy", "win-2003");
}
-
else if (!policy.compare("win2k3"))
{
table_api.add_diff_option_comment("policy win2k3", "stream_tcp.policy = win-2003");
table_api.add_option("policy", "win-2003");
}
-
else if (!policy.compare("hpux11"))
{
table_api.add_diff_option_comment("policy hpux11", "stream_tcp.policy = hpux");
table_api.add_option("policy", "hpux");
}
-
else if (!policy.compare("grannysmith"))
{
table_api.add_diff_option_comment("policy grannysmith", "stream_tcp.policy = macos");
table_api.add_option("policy", "macos");
}
-
else
{
data_api.failed_conversion(data_stream, "stream5_tcp: policy " + policy);
}
}
-
else
{
tmpval = false;
min_ttl 2 \
bind_to 192.1.2.7/24
+preprocessor frag3_engine: \
+ policy last \
+ policy bsd \
+ policy linux \
+ policy solaris \
+ detect_anomalies \
+ overlap_limit 10 \
+ min_fragment_length 100 \
+ timeout 0 \
+ timeout 180 \
+ min_ttl 2 \
+ bind_to [10.1.47.0/24,172.16.8.0/24]
+
+preprocessor frag3_engine: \
+ policy last \
+ policy bsd \
+ policy linux \
+ policy solaris \
+ detect_anomalies \
+ overlap_limit 10 \
+ min_fragment_length 100 \
+ timeout 0 \
+ timeout 180 \
+ min_ttl 2
# Target-Based stateful inspection/stream reassembly. For more inforation, see README.stream5
preprocessor stream5_global: track_tcp yes, \
projects / thirdparty / snort3.git / commitdiff
