Snort2Lua fix - correctly parse a variable that does not start with '$'

diff --git a/tools/snort2lua/data/data_types/dt_var.cc b/tools/snort2lua/data/data_types/dt_var.cc
index 070bbe84d72157c794944f670f28415d2af7c24e..21fbff7f9dd762107cbf59d58757445a2dea8b74 100644 (file)
--- a/tools/snort2lua/data/data_types/dt_var.cc
+++ b/tools/snort2lua/data/data_types/dt_var.cc
@@ -58,13 +58,37 @@ std::string Variable::get_value(DataApi* ld)
     return variable;
 }
 
+
 // does this need a new variable?
 bool Variable::add_value(std::string elem)
 {
-    std::string s(elem);
+    std::string s;
+    std::string end;
     util::trim(elem);
 
-    // FIXIT-M J.  Variables do not need to start with a '$'/  for instance. !$HOME_NET
+
+    if (elem.size() <= 1)
+    {
+        s = elem;
+        end = "";
+    }
+    else
+    {
+        const std::size_t pos = elem.find('$', 1);
+        if (pos == std::string::npos)
+        {
+            s = elem;
+            end = "";
+        }
+        else
+        {
+            s = elem.substr(0, pos);
+            end = elem.substr(pos, std::string::npos);
+        }
+
+    }
+
+
     if(s.front() == '$')
     {
         // add a space between strings
@@ -100,6 +124,9 @@ bool Variable::add_value(std::string elem)
         vars.push_back(vd);
     }
 
+    if (!end.empty())
+        return add_value(end);
+
     return true;
 }
 

diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in
index 82e1bff2fcd38d1ef81ed062f73d316936f4c105..29b603b4094bf4680683b91342032a9b5a907e52 100644 (file)
--- a/tools/snort2lua/tests/snort.conf.in
+++ b/tools/snort2lua/tests/snort.conf.in
@@ -64,6 +64,7 @@ portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
 # List of GTP ports for GTP preprocessor
 portvar GTP_PORTS [2123,2152,3386]
 
+var TEST_PORTS !$SSH_PORTS
 
 # Valid in Snort, not valid in Snort++.  will result in an error
 #var 3DMZ_NETS [[10.1.1.1,10.1.1.2,10.2.0.0/16]]
@@ -1292,10 +1293,10 @@ alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS non-relative path a
 
 alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:host,0,packets,30,bytes,40,seconds,dst; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2251; rev:18; )
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:host,0,packets,30,bytes,40,seconds,src; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2252; rev:18; )
+alert tcp $EXTERNAL_NET any -> any $TEST_PORTS ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:host,0,packets,30,bytes,40,seconds,src; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2252; rev:18; )
 
 alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:session,5,packets,exclusive; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2253; rev:18; )
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:!"m?^Argument\s+/?smi"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2319; rev:4;)
+alert tcp $EXTERNAL_NET any -> any $TEST_PORTS (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:!"m?^Argument\s+/?smi"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2319; rev:4;)
 
 alert tcp any any -> any any ( msg:"First Cookie"; content:"OvCgi",http_uri; content:"AcceptLang=en-usaAAAA",http_cookie,nocase; sid:11111111; )