Merge pull request #1937 in SNORT/snort3 from ~OSHUMEIK/snort3:snort2lua_ips_option_r...

Squashed commit of the following:

commit 78fd7e410f877f6850b8e1a43877695e3c9804ac
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Mon Mar 16 11:42:39 2020 +0200

    lua: enable a rewrite plugin in a default config

commit a96c133df889bf8e9261c960053e5fab347f7a6e
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Tue Mar 10 12:09:40 2020 +0200

    build: refactor included headers

    Sort a list of included headers according to the Coding Style.
    For .cc files in `tools/snort2lua/rule_states` directory.

commit e78f54d6fa600155d05b2eac9f5b0528db452116
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Thu Jan 9 11:50:20 2020 +0200

    snort2lua: convert a replace option to a rewrite plugin/action.

    Check if option has empty value.
    Add comment for rules with a replace option.
    Drop/block action takes precedence over a rewrite action.

diff --git a/lua/snort.lua b/lua/snort.lua
index 7c91abdc602eeaa2ed66ec0103e4d7c0c6b94768..f48d1ba4be61bbe7ae91c2075a84d0f5e770f694 100644 (file)
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -171,10 +171,11 @@ ips =
     --include = 'snort3-community.rules'
 }
 
+rewrite = { }
+
 -- use these to configure additional rule actions
 -- react = { }
 -- reject = { }
--- rewrite = { }
 
 ---------------------------------------------------------------------------
 -- 6. configure filters

diff --git a/tools/snort2lua/keyword_states/kws_rule.cc b/tools/snort2lua/keyword_states/kws_rule.cc
index 8d47e49faf7509b2b2e76dbd0617981cb26b0d1d..e50e398e5a3f98526f88106d84326c5f51b54c29 100644 (file)
--- a/tools/snort2lua/keyword_states/kws_rule.cc
+++ b/tools/snort2lua/keyword_states/kws_rule.cc
@@ -66,6 +66,7 @@ bool RuleHeader::convert(std::istringstream& data_stream)
 template<const std::string* name>
 static ConversionState* rule_ctor(Converter& c)
 {
+    c.get_rule_api().set_rule_old_action(*name);
     c.get_rule_api().add_hdr_data(*name);
     return new RuleHeader(c);
 }
@@ -73,6 +74,7 @@ static ConversionState* rule_ctor(Converter& c)
 template<const std::string* name>
 static ConversionState* dep_rule_ctor(Converter& c)
 {
+    c.get_rule_api().set_rule_old_action(*name);
     c.get_rule_api().add_hdr_data(*name);
     c.get_rule_api().make_rule_a_comment();
     c.get_rule_api().add_comment("The '" + *name + "' ruletype is no longer supported");
@@ -82,11 +84,8 @@ static ConversionState* dep_rule_ctor(Converter& c)
 template<const std::string* name, const std::string* old>
 static ConversionState* conv_rule_ctor(Converter& c)
 {
+    c.get_rule_api().set_rule_old_action(*old);
     c.get_rule_api().add_hdr_data(*name);
-
-    if (*old == "sdrop")
-        c.get_rule_api().set_rule_old_action(*old);
-
     c.get_rule_api().add_comment(
         "The '" + *old + "' ruletype is no longer supported, using " + *name);
     return new RuleHeader(c);
@@ -94,6 +93,7 @@ static ConversionState* conv_rule_ctor(Converter& c)
 
 static ConversionState* drop_rule_ctor(Converter& c)
 {
+    c.get_rule_api().set_rule_old_action("drop");
     c.get_rule_api().add_hdr_data("block");
     c.get_rule_api().add_comment(
         "Ruletype 'drop' discards the current packet only; "

diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt
index 3e95975d2442414597d150bdba0b6248598bf026..ab12965b9624434c5911cd33ae840479a15e6fe8 100644 (file)
--- a/tools/snort2lua/rule_states/CMakeLists.txt
+++ b/tools/snort2lua/rule_states/CMakeLists.txt
@@ -14,6 +14,7 @@ add_library( rule_states OBJECT
     rule_metadata.cc
     rule_pcre.cc
     rule_react.cc
+    rule_replace.cc
     rule_resp.cc
     rule_sd_pattern.cc
     rule_stream_reassemble.cc

diff --git a/tools/snort2lua/rule_states/rule_api.cc b/tools/snort2lua/rule_states/rule_api.cc
index 1567e9080637bd2bde12122a020aa207d122bfd8..5d2d14d173ee35abab06769a9f54a8020989e76a 100644 (file)
--- a/tools/snort2lua/rule_states/rule_api.cc
+++ b/tools/snort2lua/rule_states/rule_api.cc
@@ -17,10 +17,10 @@
 //--------------------------------------------------------------------------
 // rule_api.cc author Josh Rosenbaum <jrosenba@cisco.com>
 
+#include "rule_api.h"
 #include <string>
-#include "rule_states/rule_api.h"
-#include "helpers/s2l_util.h"
 #include "helpers/converter.h"
+#include "helpers/s2l_util.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_base64_decode.cc b/tools/snort2lua/rule_states/rule_base64_decode.cc
index 3d5f37ce9b89f91a468f6bd6ca1f91ee36ae5f4d..78da9998499d249bae73c8697ec192336b227dde 100644 (file)
--- a/tools/snort2lua/rule_states/rule_base64_decode.cc
+++ b/tools/snort2lua/rule_states/rule_base64_decode.cc
@@ -21,8 +21,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_content.cc b/tools/snort2lua/rule_states/rule_content.cc
index b6c5dd3a12f5f3a97ef925934ebb6b5d2fce8cdc..041bfb04552a2c097313594134dbe68f207ab3bf 100644 (file)
--- a/tools/snort2lua/rule_states/rule_content.cc
+++ b/tools/snort2lua/rule_states/rule_content.cc
@@ -23,8 +23,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_convert_comma_list.cc b/tools/snort2lua/rule_states/rule_convert_comma_list.cc
index bbce4fe9e6e8d5f084fb93555efef09fb4ff51ee..a3ab3f4ae13766af298e59539e25b51dbb4f467b 100644 (file)
--- a/tools/snort2lua/rule_states/rule_convert_comma_list.cc
+++ b/tools/snort2lua/rule_states/rule_convert_comma_list.cc
@@ -21,8 +21,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_dce_iface.cc b/tools/snort2lua/rule_states/rule_dce_iface.cc
index eafae91a713421da64f6b192e21c210686173516..666d141c0c3a2310c095559c3e2eec00e72c5631 100644 (file)
--- a/tools/snort2lua/rule_states/rule_dce_iface.cc
+++ b/tools/snort2lua/rule_states/rule_dce_iface.cc
@@ -21,8 +21,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_dnp3_obj.cc b/tools/snort2lua/rule_states/rule_dnp3_obj.cc
index 0a1e0274b7f22f50635e727500361e633d37e93e..c0523d076c38dd937a5bdeb26aa88abc33096d17 100644 (file)
--- a/tools/snort2lua/rule_states/rule_dnp3_obj.cc
+++ b/tools/snort2lua/rule_states/rule_dnp3_obj.cc
@@ -21,8 +21,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_dsize.cc b/tools/snort2lua/rule_states/rule_dsize.cc
index 1bd4c3074272c1e9bff9bd6f1ff467f588f99807..d4d06d03fe8e38c724edd4af07f2f7cd1b93ed28 100644 (file)
--- a/tools/snort2lua/rule_states/rule_dsize.cc
+++ b/tools/snort2lua/rule_states/rule_dsize.cc
@@ -23,8 +23,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_file_data.cc b/tools/snort2lua/rule_states/rule_file_data.cc
index 9aff45fbf35f73fac57673b13f284dc2d7b62162..0851cb0bd2f0be212e0ffff8f1b11901f03b883f 100644 (file)
--- a/tools/snort2lua/rule_states/rule_file_data.cc
+++ b/tools/snort2lua/rule_states/rule_file_data.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_file_type.cc b/tools/snort2lua/rule_states/rule_file_type.cc
index 6989307f25b53c63ddc5f2edd8f900310844a308..76c30d89a083def9eb5d9f88ecbcb9426b85e2a9 100644 (file)
--- a/tools/snort2lua/rule_states/rule_file_type.cc
+++ b/tools/snort2lua/rule_states/rule_file_type.cc
@@ -23,8 +23,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_gid_sid.cc b/tools/snort2lua/rule_states/rule_gid_sid.cc
index 61000c8bc256f6a716abd60b810d86878033aafb..854d3ce5ac59289e4e2f2f5223fa7766085645f9 100644 (file)
--- a/tools/snort2lua/rule_states/rule_gid_sid.cc
+++ b/tools/snort2lua/rule_states/rule_gid_sid.cc
@@ -29,8 +29,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_http_encode.cc b/tools/snort2lua/rule_states/rule_http_encode.cc
index a436811169c72200ea1e2dac94528612e84cc367..d38be6d1b988d0d265fac0b1654405f3f77173e4 100644 (file)
--- a/tools/snort2lua/rule_states/rule_http_encode.cc
+++ b/tools/snort2lua/rule_states/rule_http_encode.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_isdataat.cc b/tools/snort2lua/rule_states/rule_isdataat.cc
index 8ee460db65097b18e924ad0aff079945a1b08831..7ff3818b9634b9a1ee983b13e7f872982a300c50 100644 (file)
--- a/tools/snort2lua/rule_states/rule_isdataat.cc
+++ b/tools/snort2lua/rule_states/rule_isdataat.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_metadata.cc b/tools/snort2lua/rule_states/rule_metadata.cc
index 8bb41c6e7d0ae3c30681353d7717ef66d1eb6c39..3c04ec1b6cde6acbb64680d7260b06f6c74d521f 100644 (file)
--- a/tools/snort2lua/rule_states/rule_metadata.cc
+++ b/tools/snort2lua/rule_states/rule_metadata.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_pcre.cc b/tools/snort2lua/rule_states/rule_pcre.cc
index a228fc2ad416d15ed0be4eda191d4168c788817d..fd0cfacd8a3129cbe9a55f17e86d073da41cba42 100644 (file)
--- a/tools/snort2lua/rule_states/rule_pcre.cc
+++ b/tools/snort2lua/rule_states/rule_pcre.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_react.cc b/tools/snort2lua/rule_states/rule_react.cc
index 8be3f15c2bf53b38160aeb287f03ecedf5f4d9a7..b88c6671e7f5fd86d799d9a4a989023b99b97427 100644 (file)
--- a/tools/snort2lua/rule_states/rule_react.cc
+++ b/tools/snort2lua/rule_states/rule_react.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_replace.cc b/tools/snort2lua/rule_states/rule_replace.cc
new file mode 100644 (file)
index 0000000..261f555
--- /dev/null
+++ b/tools/snort2lua/rule_states/rule_replace.cc
@@ -0,0 +1,95 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2020-2020 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+// rule_replace.cc author Oleksii Shumeiko <oshumeik@cisco.com>
+
+#include <sstream>
+
+#include "conversion_state.h"
+#include "helpers/converter.h"
+#include "helpers/s2l_util.h"
+#include "rule_api.h"
+
+namespace rules
+{
+namespace
+{
+class Replace : public ConversionState
+{
+public:
+    Replace(Converter& c) : ConversionState(c) { }
+
+    bool convert(std::istringstream& stream) override
+    {
+        std::string args = util::get_rule_option_args(stream);
+
+        if (args.empty())
+            rule_api.bad_rule(stream, "replace requires an argument");
+        else
+            rule_api.add_option("replace", args);
+
+        return set_next_rule_state(stream);
+    }
+};
+} // namespace
+
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter& c)
+{
+    const std::string& old_action = c.get_rule_api().get_rule_old_action();
+
+    if (old_action == "drop"
+        || old_action == "sdrop"
+        || old_action == "block"
+        || old_action == "sblock"
+        || old_action == "reject"
+        || old_action == "react")
+    {
+        c.get_rule_api().add_comment(
+            "Keeping '" + old_action + "' action, "
+            "'replace' option is ignored.");
+
+        return new Replace(c);
+    }
+
+    c.get_rule_api().add_comment(
+        "Changing ruletype '" + old_action + "' to 'rewrite' "
+        "because the rule has 'replace' option.");
+
+    // include a rewrite plugin
+    c.get_table_api().open_table("rewrite");
+    c.get_table_api().close_table();
+
+    // update the rule type
+    c.get_rule_api().update_rule_action("rewrite");
+
+    return new Replace(c);
+}
+
+static const ConvertMap rule_replace =
+{
+    "replace",
+    ctor,
+};
+
+const ConvertMap* replace_map = &rule_replace;
+} // namespace rules
+

diff --git a/tools/snort2lua/rule_states/rule_resp.cc b/tools/snort2lua/rule_states/rule_resp.cc
index 7a081a0f7b49f4716954004662ca427acf248d26..d74a3c70e3cbe8db5a5b0bc80e599091dcf50730 100644 (file)
--- a/tools/snort2lua/rule_states/rule_resp.cc
+++ b/tools/snort2lua/rule_states/rule_resp.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_sd_pattern.cc b/tools/snort2lua/rule_states/rule_sd_pattern.cc
index c3a485b922b6ba0a42225c955a6a72c7382ead74..8347dbe065693160376d1c5282184d038b155584 100644 (file)
--- a/tools/snort2lua/rule_states/rule_sd_pattern.cc
+++ b/tools/snort2lua/rule_states/rule_sd_pattern.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_stream_reassemble.cc b/tools/snort2lua/rule_states/rule_stream_reassemble.cc
index 4b209e68437bbdcfa830bd2e329657367d3d502b..f8af040185cae05cc5385310608c01755df7720c 100644 (file)
--- a/tools/snort2lua/rule_states/rule_stream_reassemble.cc
+++ b/tools/snort2lua/rule_states/rule_stream_reassemble.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_stream_size.cc b/tools/snort2lua/rule_states/rule_stream_size.cc
index ad538abed1332452ff1aea9d3617f650c9113d45..f1915f590d0f60096c1f6426257e5ceb47ef549f 100644 (file)
--- a/tools/snort2lua/rule_states/rule_stream_size.cc
+++ b/tools/snort2lua/rule_states/rule_stream_size.cc
@@ -23,8 +23,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_tag.cc b/tools/snort2lua/rule_states/rule_tag.cc
index 44ee8a7fe32cfcd77f4aedcd3c05e24c7eb684ec..774a8ba6c7fa341e1b84c9db9dcd73a758584a62 100644 (file)
--- a/tools/snort2lua/rule_states/rule_tag.cc
+++ b/tools/snort2lua/rule_states/rule_tag.cc
@@ -21,8 +21,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_threshold.cc b/tools/snort2lua/rule_states/rule_threshold.cc
index 5f7084bbad19b6adf2e88e88517eb493f3e40b1c..6df198774a870f067ab44785e991c8ad209de260 100644 (file)
--- a/tools/snort2lua/rule_states/rule_threshold.cc
+++ b/tools/snort2lua/rule_states/rule_threshold.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_ttl.cc b/tools/snort2lua/rule_states/rule_ttl.cc
index 5a70332804b62cb7b1672165aa206847a69d7a25..b518fc1cebb25a91178802a39069e7280fd55458 100644 (file)
--- a/tools/snort2lua/rule_states/rule_ttl.cc
+++ b/tools/snort2lua/rule_states/rule_ttl.cc
@@ -21,8 +21,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {

diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc
index 1a4b13423314ce69a7d2235fe8c4d10641fe57cf..aad7bd717059e17cb36561bf12e9437d2b5d3c4e 100644 (file)
--- a/tools/snort2lua/rule_states/rule_unchanged.cc
+++ b/tools/snort2lua/rule_states/rule_unchanged.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {
@@ -355,19 +355,6 @@ static const ConvertMap rule_session =
 
 const ConvertMap* session_map = &rule_session;
 
-/************************************
- ************* REPLACE  *************
- ************************************/
-
-static const std::string replace = "replace";
-static const ConvertMap rule_replace =
-{
-    replace,
-    unchanged_rule_ctor<& replace>,
-};
-
-const ConvertMap* replace_map = &rule_replace;
-
 /************************************
  ******* DETECTION_FILETER  *********
  ************************************/

diff --git a/tools/snort2lua/rule_states/rule_urilen.cc b/tools/snort2lua/rule_states/rule_urilen.cc
index 57c0205236f1ecd7b40f97e77696defe921d7a8a..9e88a6e23872aafa8059163816bf3a783972aff4 100644 (file)
--- a/tools/snort2lua/rule_states/rule_urilen.cc
+++ b/tools/snort2lua/rule_states/rule_urilen.cc
@@ -22,8 +22,8 @@
 
 #include "conversion_state.h"
 #include "helpers/converter.h"
-#include "rule_states/rule_api.h"
 #include "helpers/s2l_util.h"
+#include "rule_api.h"
 
 namespace rules
 {