Merge pull request #91 in SNORT/snort3 from crc/s2l to master

Squashed commit of the following:

commit b62582b5c659a6a06c59bd2dd78292970f2a4e42
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Oct 21 11:12:57 2015 -0400

    add missing updates

commit 7aedeae04c2d054afcffcdb21f22410e17195214
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Oct 21 10:29:23 2015 -0400

    updates for gtp and modbus

diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt
index f247c42dc8ac16285fbadb95fd30f7e39f808cfd..cbc34b2542e10b79067e7b90de71664c8326f0b4 100644 (file)
--- a/tools/snort2lua/preprocessor_states/CMakeLists.txt
+++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt
@@ -18,6 +18,7 @@ add_library(preprocessor_states
     pps_dns.cc
     pps_pop.cc
     pps_imap.cc
+    pps_modbus.cc
     pps_smtp.cc
     pps_sfportscan.cc
     pps_stream5_ip.cc

diff --git a/tools/snort2lua/preprocessor_states/Makefile.am b/tools/snort2lua/preprocessor_states/Makefile.am
index ba8c3d78f786718aa9d85fef62d4d7bb510bfa93..88608d8473129cd0c93f1aa504d2e49a5213fdf1 100644 (file)
--- a/tools/snort2lua/preprocessor_states/Makefile.am
+++ b/tools/snort2lua/preprocessor_states/Makefile.am
@@ -20,6 +20,7 @@ pps_ssl.cc \
 pps_dns.cc \
 pps_pop.cc \
 pps_imap.cc \
+pps_modbus.cc \
 pps_smtp.cc \
 pps_sfportscan.cc \
 pps_stream5_ip.cc \

diff --git a/tools/snort2lua/preprocessor_states/pps_gtp.cc b/tools/snort2lua/preprocessor_states/pps_gtp.cc
index dae0bb9a0c49ca1640c96d125c8414d35e4e19e1..84c73abcbc3e87980c0b3966a73f129cb6b5d6c5 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_gtp.cc
+++ b/tools/snort2lua/preprocessor_states/pps_gtp.cc
@@ -21,6 +21,7 @@
 #include <vector>
 
 #include "conversion_state.h"
+#include "helpers/util_binder.h"
 #include "helpers/converter.h"
 #include "helpers/s2l_util.h"
 
@@ -31,41 +32,85 @@ namespace
 class Gtp : public ConversionState
 {
 public:
-    Gtp(Converter& c) : ConversionState(c) { }
-    virtual ~Gtp() { }
+    Gtp(Converter& c) : ConversionState(c)
+    { converted_args = false; }
+
+    virtual ~Gtp();
     virtual bool convert(std::istringstream& data_stream);
+
+private:
+    bool converted_args;
 };
 } // namespace
 
+Gtp::~Gtp()
+{
+    if (converted_args)
+        return;
+
+    Binder bind(table_api);
+    bind.set_when_proto("tcp");
+    bind.add_when_port("2123");
+    bind.add_when_port("3386");
+    bind.set_use_type("gtp_inspect");
+
+    table_api.open_table("gtp_inspect");
+    table_api.close_table();
+}
+
 bool Gtp::convert(std::istringstream& data_stream)
 {
-    std::string args;
+    std::string keyword;
     bool retval = true;
+    bool ports_set = false;
+    Binder bind(table_api);
 
-    table_api.open_table("udp");
+    bind.set_when_proto("tcp");
+    bind.set_use_type("gtp_inspect");
 
-    while (util::get_string(data_stream, args, ",;"))
+    table_api.open_table("gtp_inspect");
+
+    // parse the file configuration
+    while (data_stream >> keyword)
     {
-        std::string keyword;
         bool tmpval = true;
-        std::istringstream arg_stream(args);
 
-        if (!(arg_stream >> keyword))
+        if (!keyword.compare("ports"))
         {
-            tmpval = false;
-        }
-        else if (!keyword.compare("ports"))
-        {
-            table_api.add_diff_option_comment("ports", "gtp_ports");
-            tmpval = parse_curly_bracket_list("gtp_ports", arg_stream);
+            std::string tmp = "";
+            table_api.add_diff_option_comment("ports", "bindings");
+
+            if ((data_stream >> keyword) && !keyword.compare("{"))
+            {
+                while (data_stream >> keyword && keyword.compare("}"))
+                {
+                    ports_set = true;
+                    bind.add_when_port(keyword);
+                }
+            }
+            else
+            {
+                data_api.failed_conversion(data_stream, "ports <bracketed_port_list>");
+                retval = false;
+            }
         }
+
         else
         {
             tmpval = false;
         }
 
-        if (retval && !tmpval)
+        if (!tmpval)
+        {
+            data_api.failed_conversion(data_stream, keyword);
             retval = false;
+        }
+    }
+
+    if (!ports_set)
+    {
+        bind.add_when_port("2123");
+        bind.add_when_port("3386");
     }
 
     table_api.close_table();

diff --git a/tools/snort2lua/preprocessor_states/pps_modbus.cc b/tools/snort2lua/preprocessor_states/pps_modbus.cc
new file mode 100644 (file)
index 0000000..4b4e060
--- /dev/null
+++ b/tools/snort2lua/preprocessor_states/pps_modbus.cc
@@ -0,0 +1,132 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+// pps_modbus.cc author Russ Combs <rucombs@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "helpers/s2l_util.h"
+#include "helpers/util_binder.h"
+
+namespace preprocessors
+{
+namespace
+{
+class Modbus : public ConversionState
+{
+public:
+    Modbus(Converter& c) : ConversionState(c)
+    { converted_args = false; }
+
+    virtual ~Modbus();
+    virtual bool convert(std::istringstream& data_stream);
+
+private:
+    bool converted_args;
+};
+} // namespace
+
+Modbus::~Modbus()
+{
+    if (converted_args)
+        return;
+
+    Binder bind(table_api);
+    bind.set_when_proto("tcp");
+    bind.add_when_port("502");
+    bind.set_use_type("modbus");
+
+    table_api.open_table("modbus");
+    table_api.close_table();
+}
+
+bool Modbus::convert(std::istringstream& data_stream)
+{
+    std::string keyword;
+    bool retval = true;
+    bool ports_set = false;
+    Binder bind(table_api);
+
+    bind.set_when_proto("tcp");
+    bind.set_use_type("modbus");
+
+    table_api.open_table("modbus");
+
+    // parse the file configuration
+    while (data_stream >> keyword)
+    {
+        bool tmpval = true;
+
+        if (!keyword.compare("ports"))
+        {
+            std::string tmp = "";
+            table_api.add_diff_option_comment("ports", "bindings");
+
+            if ((data_stream >> keyword) && !keyword.compare("{"))
+            {
+                while (data_stream >> keyword && keyword.compare("}"))
+                {
+                    ports_set = true;
+                    bind.add_when_port(keyword);
+                }
+            }
+            else
+            {
+                data_api.failed_conversion(data_stream, "ports <bracketed_port_list>");
+                retval = false;
+            }
+        }
+
+        else
+        {
+            tmpval = false;
+        }
+
+        if (!tmpval)
+        {
+            data_api.failed_conversion(data_stream, keyword);
+            retval = false;
+        }
+    }
+
+    if (!ports_set)
+        bind.add_when_port("502");
+
+    table_api.close_table();
+    return retval;
+}
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter& c)
+{
+    return new Modbus(c);
+}
+
+static const ConvertMap preprocessor_modbus =
+{
+    "modbus",
+    ctor,
+};
+
+const ConvertMap* modbus_map = &preprocessor_modbus;
+}
+

diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
index 26610f5b0ac595284904f174ca392da2f65fdb3e..5ae7f2421e4e54dc2655b6d0de1dd43524b68441 100644 (file)
--- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc
+++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
@@ -44,6 +44,7 @@ extern const ConvertMap* ssl_map;
 extern const ConvertMap* dns_map;
 extern const ConvertMap* pop_map;
 extern const ConvertMap* imap_map;
+extern const ConvertMap* modbus_map;
 extern const ConvertMap* smtp_map;
 extern const ConvertMap* sfportscan_map;
 extern const ConvertMap* stream_ip_map;
@@ -76,6 +77,7 @@ const std::vector<const ConvertMap*> preprocessor_api =
     dns_map,
     pop_map,
     imap_map,
+    modbus_map,
     smtp_map,
     sfportscan_map,
     stream_ip_map,

diff --git a/tools/snort2lua/rule_states/rule_api.cc b/tools/snort2lua/rule_states/rule_api.cc
index 29488bc84c3a5bc5443931df84c17d7f786a1d03..9edf24c18be2caefea93b61ebb1403c413c0a9ad 100644 (file)
--- a/tools/snort2lua/rule_states/rule_api.cc
+++ b/tools/snort2lua/rule_states/rule_api.cc
@@ -43,6 +43,9 @@ extern const ConvertMap* flowbits_map;
 extern const ConvertMap* fragbits_map;
 extern const ConvertMap* fragoffset_map;
 extern const ConvertMap* gid_map;
+extern const ConvertMap* gtp_info_map;
+extern const ConvertMap* gtp_type_map;
+extern const ConvertMap* gtp_version_map;
 extern const ConvertMap* http_encode_map;
 extern const ConvertMap* icmp_id_map;
 extern const ConvertMap* icmp_seq_map;
@@ -55,6 +58,9 @@ extern const ConvertMap* itype_map;
 extern const ConvertMap* logto_map;
 extern const ConvertMap* metadata_map;
 extern const ConvertMap* msg_map;
+extern const ConvertMap* modbus_data_map;
+extern const ConvertMap* modbus_func_map;
+extern const ConvertMap* modbus_unit_map;
 extern const ConvertMap* pcre_map;
 extern const ConvertMap* pkt_data_map;
 extern const ConvertMap* react_map;
@@ -106,6 +112,9 @@ const std::vector<const ConvertMap*> rule_options_api =
     fragbits_map,
     fragoffset_map,
     gid_map,
+    gtp_info_map,
+    gtp_type_map,
+    gtp_version_map,
     http_encode_map,
     icmp_id_map,
     icmp_seq_map,
@@ -118,6 +127,9 @@ const std::vector<const ConvertMap*> rule_options_api =
     logto_map,
     metadata_map,
     msg_map,
+    modbus_data_map,
+    modbus_func_map,
+    modbus_unit_map,
     pcre_map,
     pkt_data_map,
     priority_map,

diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc
index 9dd9df0d833ed2a7d1b2efd3c04955f33ccfc59c..af60e727e143b5eeb9e0dd11049f76c81e164732 100644 (file)
--- a/tools/snort2lua/rule_states/rule_unchanged.cc
+++ b/tools/snort2lua/rule_states/rule_unchanged.cc
@@ -483,6 +483,84 @@ static const ConvertMap rule_byte_extract =
 
 const ConvertMap* byte_extract_map = &rule_byte_extract;
 
+/************************************
+ ************  GTP_INFO  ************
+ ************************************/
+
+static const std::string gtp_info = "gtp_info";
+static const ConvertMap rule_gtp_info =
+{
+    gtp_info,
+    unchanged_rule_ctor<& gtp_info>,
+};
+
+const ConvertMap* gtp_info_map = &rule_gtp_info;
+
+/************************************
+ ************  GTP_TYPE  ************
+ ************************************/
+
+static const std::string gtp_type = "gtp_type";
+static const ConvertMap rule_gtp_type =
+{
+    gtp_type,
+    unchanged_rule_ctor<& gtp_type>,
+};
+
+const ConvertMap* gtp_type_map = &rule_gtp_type;
+
+/************************************
+ **********  GTP_VERSION  ***********
+ ************************************/
+
+static const std::string gtp_version = "gtp_version";
+static const ConvertMap rule_gtp_version =
+{
+    gtp_version,
+    unchanged_rule_ctor<& gtp_version>,
+};
+
+const ConvertMap* gtp_version_map = &rule_gtp_version;
+
+/************************************
+ **********  MODBUS_DATA  ***********
+ ************************************/
+
+static const std::string modbus_data = "modbus_data";
+static const ConvertMap rule_modbus_data =
+{
+    modbus_data,
+    unchanged_rule_ctor<& modbus_data>,
+};
+
+const ConvertMap* modbus_data_map = &rule_modbus_data;
+
+/************************************
+ **********  MODBUS_FUNC  ***********
+ ************************************/
+
+static const std::string modbus_func = "modbus_func";
+static const ConvertMap rule_modbus_func =
+{
+    modbus_func,
+    unchanged_rule_ctor<& modbus_func>,
+};
+
+const ConvertMap* modbus_func_map = &rule_modbus_func;
+
+/************************************
+ **********  MODBUS_UNIT  ***********
+ ************************************/
+
+static const std::string modbus_unit = "modbus_unit";
+static const ConvertMap rule_modbus_unit =
+{
+    modbus_unit,
+    unchanged_rule_ctor<& modbus_unit>,
+};
+
+const ConvertMap* modbus_unit_map = &rule_modbus_unit;
+
 /************************************
  ************  PKT_DATA  ************
  ************************************/