# If ruby is present, built the configuration differences
if (RUBY_EXECUTABLE)
+ set (input ${CMAKE_CURRENT_LIST_DIR}/config_changes.txt)
set (output ${CMAKE_CURRENT_BINARY_DIR}/config_changes.txt)
add_custom_command(
OUTPUT ${output}
COMMAND ${RUBY_EXECUTABLE}
- ${CMAKE_CURRENT_SOURCE_DIR}/get_differences.rb
+ ${CMAKE_CURRENT_LIST_DIR}/get_differences.rb
${CMAKE_SOURCE_DIR}/tools/snort2lua
- > ${output}
+ > ${input}
+ COMMAND ${CMAKE_COMMAND} -E copy ${input} ${output}
DEPENDS snort2lua
COMMENT "Documents: building config_changes.txt"
)
change: icmptype ==> icmp_type
change: intel-cpm ==> intel_cpm
change: iplen ==> ip_len
+change: ips_option: threshold ==> event_filter
change: log_alert ==> level = alert
change: log_auth ==> facility = auth
change: log_authpriv ==> facility = authpriv
change: nopcre ==> pcre_enable
change: overlap_limit ==> max_overlaps
change: pad ==> base
+change: paf_max [0:63780] ==> paf_max [1460:63780]
change: pkt-log ==> pkt_log
change: pkt_count ==> limit
change: pktcnt ==> packets
+change: policy bsd-right ==> policy = bsd_right
change: policy_mode ==> mode
change: ports ==> bindings
change: ports ==> gtp_ports
change: ports both ==> both_ports
change: ports client ==> client_ports
change: ports server ==> server_ports
+change: post_depth [-1:65495] ==> post_depth [-1:65535]
change: preprocessor normalize_icmp4 ==> icmp4 == <bool>
change: preprocessor normalize_icmp6 ==> icmp6 == <bool>
change: preprocessor normalize_ip6 ==> ip6 == <bool>
"gzip packets",
"compressed bytes",
"decompressed bytes",
+ nullptr,
};
THREAD_LOCAL int hiDetectCalled = 0;
//-------------------------------------------------------------------------
static const char* policies =
- "first | linux | bsd | bsd_right |last | windows | solaris";
+ "first | linux | bsd | bsd_right | last | windows | solaris";
static const RuleMap stream_ip_rules[] =
{
config_one_int_option.cc
config_one_string_option.cc
config_order.cc
+ config_paf_max.cc
config_ppm.cc
config_profile.cc
config_reference.cc
config_one_int_option.cc \
config_one_string_option.cc \
config_order.cc \
+config_paf_max.cc \
config_ppm.cc \
config_profile.cc \
config_reference.cc \
const ConvertMap* new_ttl_map = &new_ttl_api;
-/*************************************************
- ****************** paf_max *******************
- *************************************************/
-
-static const std::string paf_max = "paf_max";
-static const ConvertMap paf_max_api =
-{
- paf_max,
- config_int_ctor<&paf_max, &stream_tcp>,
-};
-
-const ConvertMap* paf_max_map = &paf_max_api;
-
/*************************************************
************** pcre_match_limit **************
*************************************************/
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// config_paf_max.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "utils/converter.h"
+#include "utils/snort2lua_util.h"
+
+namespace config
+{
+
+namespace {
+
+class PafMax : public ConversionState
+{
+public:
+ PafMax(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
+ virtual ~PafMax() {};
+ virtual bool convert(std::istringstream& data_stream);
+};
+
+} // namespace
+
+bool PafMax::convert(std::istringstream& data_stream)
+{
+ bool retval = true;
+ int val;
+
+ ld->open_table("stream_tcp");
+
+ if (data_stream >> val)
+ {
+ if (val < 1460)
+ retval = ld->add_diff_option_comment("paf_max [0:63780]", "paf_max [1460:63780]");
+ else
+ retval = ld->add_option_to_table("paf_max", val);
+ }
+ else
+ retval = false;
+
+ ld->close_table();
+ return retval;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv, LuaData* ld)
+{
+ return new PafMax(cv, ld);
+}
+
+static const ConvertMap paf_max_api =
+{
+ "paf_max",
+ ctor,
+};
+
+const ConvertMap* paf_max_map = &paf_max_api;
+
+} // namespace config
char rawvarname[128], varname[128], varaux[128], varbuffer[128];
char varmodifier;
const char* varcontents;
- int varname_completed, c, i, j, iv, jv, l_string, name_only;
+ std::size_t varname_completed, i, j, iv, jv, l_string, name_only;
+ char c;
int quote_toggle = 0;
if(string.empty() || string.rfind('$') == std::string::npos)
p = strchr(rawvarname, ':');
if (p)
{
- std::strncpy(varname, rawvarname, p - rawvarname);
+ std::strncpy(varname, rawvarname, (std::size_t)(p - rawvarname));
if(strlen(p) >= 2)
{
if(varcontents)
{
- int l_varcontents = strlen(varcontents);
+ std::size_t l_varcontents = strlen(varcontents);
iv = 0;
open_tables.push(t);
}
-void LuaData::open_new_top_level_table(std::string table_name)
-{
- Table *t = new Table(table_name, 0);
-
- if (t != nullptr)
- {
- tables.push_back(t);
- open_tables.push(t);
- }
- else
- {
- std::cout << "OUT OF MEMORY!!" << std::endl;
- }
-
-}
-
void LuaData::open_table()
{
// if no open tables, create a top-level table
void open_top_level_table(std::string name);
// open a nested named table --> 'name = {...}')
void open_table(std::string name);
- // create a new table with this name...even if a table with the same name already exists
- void open_new_top_level_table(std::string name);
// open a nested table that does not contain a name --> {...})
void open_table();
// close the nested table. go to previous table level
whitespace += " ";
if(!t.name.empty())
- out << whitespace << t.name << " = " << std::endl;
+ out << whitespace << t.name << " =" << std::endl;
out << whitespace << '{' << std::endl;
if (!t.comments->empty() && !LuaData::is_quiet_mode())
std::string args;
bool retval = true;
- ld->open_new_top_level_table("event_filter");
+ ld->open_table("event_filter");
+ ld->open_table();
while (std::getline(data_stream, args, ','))
{
}
+ ld->close_table();
+ ld->close_table();
return retval;
}
bool retval = true;
int count = 0;
- ld->open_new_top_level_table("rule_state");
+ ld->open_table("rule_state");
+ ld->open_table();
while (util::get_string(data_stream, arg, ", "))
{
retval = false;
}
+ ld->close_table();
+ ld->close_table();
return retval;
}
if(!keyword.compare("min_ttl"))
tmpval = parse_int_option("min_ttl", data_stream);
- else if(!keyword.compare("policy"))
- tmpval = parse_string_option("policy", data_stream);
-
else if(!keyword.compare("detect_anomalies"))
ld->add_deleted_comment("detect_anomalies");
else if(!keyword.compare("bind_to"))
parse_ip_list("bind_to", data_stream);
- else if(!keyword.compare("timeout"))
- {
- tmpval = parse_int_option("session_timeout", data_stream);
- ld->add_diff_option_comment("timeout", "session_timeout");
- }
-
else if(!keyword.compare("overlap_limit"))
{
tmpval = parse_int_option("max_overlaps", data_stream);
ld->add_diff_option_comment("min_fragment_length", "min_frag_length");
}
+ else if(!keyword.compare("timeout"))
+ {
+ std::string val;
+ ld->add_diff_option_comment("timeout", "session_timeout");
+
+ if (data_stream >> val)
+ {
+ int seconds = std::stoi(val);
+ if (seconds == 0)
+ {
+ tmpval = ld->add_option_to_table("session_timeout", 256);
+ ld->add_comment_to_table("preprocessor frag3_engine: "
+ "timeout 0 ==> session_timeout 256");
+ }
+ else
+ {
+ tmpval = ld->add_option_to_table("session_timeout", seconds);
+ }
+ }
+ }
+
+
+ else if(!keyword.compare("policy"))
+ {
+ std::string policy;
+
+ if (!(data_stream >> policy))
+ tmpval = false;
+
+ else if (!policy.compare("first"))
+ tmpval = ld->add_option_to_table("policy", "first");
+
+ else if (!policy.compare("bsd"))
+ tmpval = ld->add_option_to_table("policy", "bsd");
+
+ else if (!policy.compare("last"))
+ tmpval = ld->add_option_to_table("policy", "last");
+
+ else if (!policy.compare("windows"))
+ tmpval = ld->add_option_to_table("policy", "windows");
+
+ else if (!policy.compare("linux"))
+ tmpval = ld->add_option_to_table("policy", "linux");
+
+ else if (!policy.compare("solaris"))
+ tmpval = ld->add_option_to_table("policy", "solaris");
+
+ else if (!policy.compare("bsd-right"))
+ {
+ ld->add_diff_option_comment("policy bsd-right", "policy = bsd_right");
+ tmpval = ld->add_option_to_table("policy", "bsd_right");
+ }
+
+ else
+ {
+ tmpval = false;
+ }
+ }
+
else
tmpval = false;
else if (!keyword.compare("client_flow_depth"))
tmpval = parse_int_option("client_flow_depth", data_stream);
- else if (!keyword.compare("post_depth"))
- tmpval = parse_int_option("post_depth", data_stream);
-
else if (!keyword.compare("chunk_length"))
tmpval = parse_int_option("chunk_length", data_stream);
else if (!keyword.compare("base36"))
tmpval = eat_option(data_stream);
+ else if (!keyword.compare("post_depth"))
+ {
+ tmpval = parse_int_option("post_depth", data_stream);
+ ld->add_diff_option_comment("post_depth [-1:65495]", "post_depth [-1:65535]");
+ }
+
else if (!keyword.compare("non_rfc_char"))
{
ld->add_diff_option_comment("non_rfc_char", "non_rfc_chars");
rule_http_encode.cc
rule_metadata.cc
rule_pcre.cc
+ rule_threshold.cc
rule_unchanged.cc
rule_urilen.cc
rule_api.cc
rule_http_encode.cc \
rule_metadata.cc \
rule_pcre.cc \
+rule_threshold.cc \
rule_unchanged.cc \
rule_urilen.cc \
rule_api.cc \
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// rule_threshold.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "utils/converter.h"
+#include "rule_states/rule_api.h"
+#include "utils/snort2lua_util.h"
+
+namespace rules
+{
+
+namespace {
+
+
+class Threshold : public ConversionState
+{
+public:
+ Threshold(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
+ virtual ~Threshold() {};
+ virtual bool convert(std::istringstream& data);
+};
+
+} // namespace
+
+bool Threshold::convert(std::istringstream& data_stream)
+{
+ std::string args;
+ std::string value;
+ bool retval = true;
+
+ args = util::get_rule_option_args(data_stream);
+ std::istringstream arg_stream(args);
+
+
+ ld->open_table("event_filter");
+ ld->add_diff_option_comment("ips_option: threshold", "event_filter");
+ ld->open_table();
+
+ while (util::get_string(arg_stream, value, ","))
+ {
+ std::string keyword;
+ std::string val;
+ bool tmpval = true;
+ std::istringstream subopt_stream(value);
+
+ if (!(subopt_stream >> keyword) || !(subopt_stream >> val))
+ tmpval = false;
+
+ else if (!(keyword.compare("count")))
+ tmpval = ld->add_option_to_table("count", std::stoi(val));
+
+ else if (!(keyword.compare("seconds")))
+ tmpval = ld->add_option_to_table("seconds", std::stoi(val));
+
+ else if (!(keyword.compare("type")))
+ tmpval = ld->add_option_to_table("type", val);
+
+ else if (!(keyword.compare("track")))
+ tmpval = ld->add_option_to_table("track", val);
+
+ else
+ retval = false;
+
+ if (retval && !tmpval)
+ retval = false;
+ }
+
+ // save the current position
+ const std::streamoff curr_pos = data_stream.tellg();
+
+ if (curr_pos == -1)
+ data_stream.clear();
+
+ bool found_gid = false, found_sid = false;
+ std::string rule_keyword;
+
+ data_stream.seekg(0);
+ std::getline(data_stream, rule_keyword, '(');
+ std::streamoff tmp_pos = data_stream.tellg();
+
+ while(std::getline(data_stream, rule_keyword, ':'))
+ {
+ std::size_t semi_colon_pos = rule_keyword.find(';');
+ if (semi_colon_pos != std::string::npos)
+ {
+ // found an option without a colon, so set stream
+ // to semi-colon
+ std::streamoff off = 1 + (std::streamoff)(tmp_pos) +
+ (std::streamoff)(semi_colon_pos);
+ data_stream.seekg(off);
+ rule_keyword = rule_keyword.substr(0, semi_colon_pos);
+ }
+
+ // now, lets get the next option.
+ util::trim(rule_keyword);
+
+ if (!rule_keyword.compare("sid"))
+ {
+ std::string val = util::get_rule_option_args(data_stream);
+ ld->add_option_to_table("sid", val);
+ found_sid = true;
+ }
+ else if (!rule_keyword.compare("gid"))
+ {
+ std::string val = util::get_rule_option_args(data_stream);
+ ld->add_option_to_table("gid", val);
+ found_gid = true;
+ }
+ else if (semi_colon_pos == std::string::npos)
+ std::getline(data_stream, rule_keyword, ';');
+
+ // short circuit in case we already found the gid/sid
+ if (found_gid && found_sid)
+ break;
+
+ tmp_pos = data_stream.tellg();
+ }
+
+
+ ld->close_table();
+ ld->close_table();
+ if (curr_pos != -1)
+ data_stream.clear();
+
+ data_stream.seekg(curr_pos);
+ return set_next_rule_state(data_stream) && retval;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+
+static ConversionState* ctor(Converter* cv, LuaData* ld)
+{
+ return new Threshold(cv, ld);
+}
+
+static const ConvertMap rule_threshold =
+{
+ "threshold",
+ ctor,
+};
+
+const ConvertMap* threshold_map = &rule_threshold;
+
+} // namespace rules
const ConvertMap* detection_filter_map = &rule_detection_filter;
-/************************************
- *********** THRESHOLD ************
- ************************************/
-
-static const std::string threshold = "threshold";
-static const ConvertMap rule_threshold =
-{
- threshold,
- unchanged_rule_ctor<&threshold>,
-};
-
-const ConvertMap* threshold_map = &rule_threshold;
-
/************************************
*********** BYTE_TEST ************
************************************/
}
else
{
- int pos = 0;
+ std::streamoff pos = 0;
option = std::string();
// we don't want an empty string
projects / thirdparty / snort3.git / commitdiff
