return false;
}
+bool Converter::open_table()
+{
+ // if no open tables, create a top-level table
+ if (open_tables.size() > 0)
+ {
+ Table *t = open_tables.top()->open_table();
+ open_tables.push(t);
+ return true;
+ }
+ else
+ {
+ log_error("A nameless table must be nested!!");
+ return false;
+ }
+}
+
bool Converter::open_table(std::string table_name)
{
Table *t;
bool inline add_variable(std::string name, std::string v){ return data.add_variable(name, v); };
friend std::ostream &operator<<( std::ostream& out, const Converter &cv) { return out << cv.data; }
- bool open_table(std::string);
+ // open a table that does not contain a name --> NOT 'name = {...}' ONLY {...})
+ bool open_table();
+ // open a named tabled --> 'name = {...}')
+ bool open_table(std::string name);
+ // close the current table. go to previous table level
bool close_table();
+
+ // add a string option to the table --> table = { name = 'val', }
bool add_option_to_table(std::string name, std::string val);
+ // add an int option to the table --> table = { name = val, }
bool add_option_to_table(std::string name, int val);
+ // add a bool option to the table --> table = { name = true|false, }
bool add_option_to_table(std::string name, bool val);
+ // add a commment to be printed in the table --> table = { -- comment \n }
void add_comment_to_table(std::string comment);
void add_comment_to_file(std::string comment);
static inline Table* find_table(std::vector<Table*> vec, std::string name)
{
+ if(name.empty())
+ return nullptr;
+
for( auto *t : vec)
if(!name.compare(t->get_name()))
return t;
switch(o.type)
{
case Option::OptionType::STRING:
- out << '\'' << o.value << "',";
+ out << '\'' << o.value << '\'';
break;
case Option::OptionType::BOOL:
case Option::OptionType::INT:
- out << o.value << ',';
+ out << o.value;
break;
}
return out;
static inline Table* find_table(std::vector<Table*> vec, std::string name)
{
+ if(name.empty())
+ return nullptr;
+
for( auto *t : vec)
if(!name.compare(t->get_name()))
return t;
return nullptr;
}
-Table::Table(std::string name)
+Table::Table(int depth)
{
- this->name = name;
- depth = 0;
+ this->name = "";
+ this->depth = depth;
}
Table::Table(std::string name, int depth)
delete o;
}
+Table* Table::open_table()
+{
+ Table *t = new Table(depth + 1);
+ tables.push_back(t);
+ return t;
+}
+
Table* Table::open_table(std::string name)
{
Table* t = find_table(tables, name);
for(int i = 0; i < t.depth; i++)
whitespace += " ";
- out << whitespace << t.name << " = " << std::endl;
+ if(!t.name.empty())
+ out << whitespace << t.name << " = " << std::endl;
out << whitespace << '{' << std::endl;
for(std::string s : t.comments)
out << whitespace << " --" << s << std::endl;
for (Option* o : t.options)
- out << (*o) << std::endl;
+ out << (*o) << ',' << std::endl;
for (Table* t : t.tables)
- out << (*t) << std::endl;
+ out << (*t) << ',' << std::endl;
// don't add a comma if the depth is zero
if(t.depth == 0)
out << "}";
else
- out << whitespace << "},";
+ out << whitespace << "}";
return out;
}
class Table
{
public:
- Table(std::string name);
+ Table(int depth);
Table(std::string name, int depth);
virtual ~Table();
inline std::string get_name(){ return name; };
+ Table* open_table();
Table* open_table(std::string);
bool add_option(std::string, int val);
bool add_option(std::string, bool val);
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// include.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// preprocessor.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// output.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// var.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
add_library(preprocessor
+ arpspoof.cc
http_inspect.cc
smtp.cc
normalizers.cc
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// arp_spoof.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class ArpSpoof : public ConversionState
+{
+public:
+ ArpSpoof(Converter* cv) : ConversionState(cv) {};
+ virtual ~ArpSpoof() {};
+ virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+bool ArpSpoof::convert(std::stringstream& data_stream)
+{
+ std::string keyword;
+ bool retval = true;
+ converter->open_table("arp_spoof");
+
+ while(data_stream >> keyword)
+ {
+
+ if(!keyword.compare("-unicast"))
+ retval = converter->add_option_to_table("unicast", true) && retval;
+
+ else
+ retval = false;
+ }
+
+ return retval;
+}
+
+/******* A P I ***********/
+
+static ConversionState* arpspoof_ctor(Converter* cv)
+{
+ return new ArpSpoof(cv);
+}
+
+static const ConvertMap preprocessor_arpspoof =
+{
+ "arpspoof",
+ arpspoof_ctor,
+};
+
+const ConvertMap* arpspoof_map = &preprocessor_arpspoof;
+
+
+
+/********************************
+ ******* ArpSpoof Host *********
+ ********************************/
+
+
+namespace {
+
+class ArpSpoofHost : public ConversionState
+{
+public:
+ ArpSpoofHost(Converter* cv) : ConversionState(cv) {};
+ virtual ~ArpSpoofHost() {};
+ virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+bool ArpSpoofHost::convert(std::stringstream& data_stream)
+{
+ std::string ip, mac;
+
+ bool retval = true;
+ converter->open_table("arp_spoof");
+ converter->open_table("hosts");
+
+ while(data_stream >> ip &&
+ data_stream >> mac)
+ {
+ converter->open_table();
+ converter->add_option_to_table("ip", ip);
+ converter->add_option_to_table("mac", mac);
+ converter->close_table();
+
+ ip.clear();
+ mac.clear();
+ }
+
+ if (!ip.empty())
+ return false;
+
+ return retval;
+}
+
+/******* A P I ***********/
+
+static ConversionState* arpspoof_host_ctor(Converter* cv)
+{
+ return new ArpSpoofHost(cv);
+}
+
+static const ConvertMap preprocessor_arpspoof_host =
+{
+ "arpspoof_detect_host",
+ arpspoof_host_ctor,
+};
+
+const ConvertMap* arpspoof_host_map = &preprocessor_arpspoof_host;
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// http_inspect.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// normalizers.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
#include "preprocessor/preprocessor_api.h"
+extern const ConvertMap *arpspoof_map;
+extern const ConvertMap *arpspoof_host_map;
extern const ConvertMap *httpinspect_map;
extern const ConvertMap *normalizer_icmp4_map;
extern const ConvertMap *normalizer_icmp6_map;
const std::vector<const ConvertMap*> preprocessor_api =
{
+ arpspoof_map,
+ arpspoof_host_map,
httpinspect_map,
normalizer_icmp4_map,
normalizer_icmp6_map,
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// smtp.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
projects / thirdparty / snort3.git / commitdiff
