Merge pull request #1560 in SNORT/snort3 from ~MIREDDEN/snort3:raw_data_conversion...

Squashed commit of the following:

commit e79c9266e5324907de4d5cd730cc4934331b706e
Author: Mike Redden <miredden@cisco.com>
Date:   Tue Mar 26 15:58:55 2019 -0400

    snort2lua: Convert rawbytes to raw_data sticky buffer

diff --git a/tools/snort2lua/data/data_types/dt_rule.cc b/tools/snort2lua/data/data_types/dt_rule.cc
index b5119ee4dec44d5b3f100480ec4ad89655e574ab..4ca57d101eb5b2fdb0e98f941b459994e9f38e4f 100644 (file)
--- a/tools/snort2lua/data/data_types/dt_rule.cc
+++ b/tools/snort2lua/data/data_types/dt_rule.cc
@@ -271,7 +271,8 @@ void Rule::resolve_pcre_buffer_options()
             name == "http_raw_uri" ||
             name == "http_stat_code" ||
             name == "http_stat_msg" ||
-            name == "http_uri")
+            name == "http_uri" ||
+            name == "raw_data")
         {
             if (curr_sticky_buffer == name)
             {

diff --git a/tools/snort2lua/rule_states/rule_content.cc b/tools/snort2lua/rule_states/rule_content.cc
index 40a87aed027b95180bf24d83725e57b70a09f293..e50694489cebdbd95a5826d88da330faac981120 100644 (file)
--- a/tools/snort2lua/rule_states/rule_content.cc
+++ b/tools/snort2lua/rule_states/rule_content.cc
@@ -87,7 +87,7 @@ bool Content<option_name>::parse_options(
         rule_api.add_suboption("length", val);
 
     else if (keyword == "rawbytes")
-        add_sticky_buffer(data_stream, "pkt_data");
+        add_sticky_buffer(data_stream, "raw_data");
 
     else if (keyword == "http_client_body")
         add_sticky_buffer(data_stream, "http_client_body");