fixing snort2lua isdataat

diff --git a/src/ips_options/ips_isdataat.cc b/src/ips_options/ips_isdataat.cc
index e0728e2a7e9b17c81081bb1472d9390e068f3c14..2109396b53a8d2063de7b48bc4441990f1fcb6b8 100644 (file)
--- a/src/ips_options/ips_isdataat.cc
+++ b/src/ips_options/ips_isdataat.cc
@@ -249,7 +249,7 @@ static const Parameter s_params[] =
       "num | !num" },
 
     { "relative", Parameter::PT_IMPLIED, nullptr, nullptr,
-      "num | !num" },
+      "offset from cursor instead of start of buffer" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };

diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index b8ec94fc58bab11062ec466ce1b7087061b66225..a4f06436a2ed0cae1ecd1e7dd755a25969622bfa 100644 (file)
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -1118,9 +1118,9 @@ void ParseError(const char *format, ...)
     get_parse_location(file_name, file_line);
 
     if (file_line )
-        LogMessage("ERROR: %s:%d %s\n", file_name, file_line, buf);
+        ErrorMessage("ERROR: %s:%d %s\n", file_name, file_line, buf);
     else
-        LogMessage("ERROR: %s\n", buf);
+        ErrorMessage("ERROR: %s\n", buf);
 
     parse_errors++;
 }

diff --git a/tools/snort2lua/data/dt_rule_api.h b/tools/snort2lua/data/dt_rule_api.h
index 3185a96debc3a99805b05492c23e88313539ff5c..744830d25ffe0785d46913b45a8edeab3a62814d 100644 (file)
--- a/tools/snort2lua/data/dt_rule_api.h
+++ b/tools/snort2lua/data/dt_rule_api.h
@@ -92,6 +92,7 @@ public:
     bool add_rule_option(std::string keyword, std::string val);
     // add a rule option (keyword and suboption)
     bool add_rule_option_before_selected(std::string keyword, std::string val = std::string());
+    // FIXIT-L J  this function should definitely be removed
     // selects the rule option with the given name.  MUST BE CALLED BEFORE ADDING A SUBOPTION.
     bool select_option(std::string keyword);
     // clear the selected option.

diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt
index 6d7caae04eaaade4b3c862ce153cbb2549bcfb9d..ae3b0ac53b84eefcac49b9ac004aeea26b0f0a74 100644 (file)
--- a/tools/snort2lua/rule_states/CMakeLists.txt
+++ b/tools/snort2lua/rule_states/CMakeLists.txt
@@ -4,6 +4,7 @@ add_library( rule_states
     rule_content.cc
     rule_file_data.cc
     rule_http_encode.cc
+    rule_isdataat.cc
     rule_metadata.cc
     rule_pcre.cc
     rule_react.cc

diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am
index 27d87c86ae17ead10ca5c0b123b71795f654c505..0a578340e66e2cc7ae8739235c679cf9af5f741c 100644 (file)
--- a/tools/snort2lua/rule_states/Makefile.am
+++ b/tools/snort2lua/rule_states/Makefile.am
@@ -8,6 +8,7 @@ rule_base64_decode.cc \
 rule_content.cc \
 rule_file_data.cc \
 rule_http_encode.cc \
+rule_isdataat.cc \
 rule_metadata.cc \
 rule_pcre.cc \
 rule_react.cc \

diff --git a/tools/snort2lua/rule_states/rule_tag.cc b/tools/snort2lua/rule_states/rule_tag.cc
index d0b19ebed6f7c8d3bd3a023990835ad5c982f334..f4fc254394d4a9f85dea79eea2d0d0ff99b22916 100644 (file)
--- a/tools/snort2lua/rule_states/rule_tag.cc
+++ b/tools/snort2lua/rule_states/rule_tag.cc
@@ -149,20 +149,21 @@ bool Tag::convert(std::istringstream& data_stream)
             rule_api.add_rule_option("tag", type);
             rule_api.select_option("tag");
 
+            if (packets > 0)
+                rule_api.add_suboption("packets", std::to_string(packets));
+
             if (seconds > 0)
                 rule_api.add_suboption("seconds", std::to_string(seconds));
 
             if (bytes > 0)
                 rule_api.add_suboption("bytes", std::to_string(bytes));
 
-            if (packets > 0)
-                rule_api.add_suboption("packets", std::to_string(packets));
-        }
 
+            rule_api.unselect_option();
+        }
     }
 
 
-
     return set_next_rule_state(data_stream);
 }
 

diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc
index accb3306d835b620a5fc0e1b022c1897ed85038a..c246c11380a5aabfd944af1ade79b61fd9cb17e2 100644 (file)
--- a/tools/snort2lua/rule_states/rule_unchanged.cc
+++ b/tools/snort2lua/rule_states/rule_unchanged.cc
@@ -573,19 +573,6 @@ static const ConvertMap rule_base64_data =
 
 const ConvertMap* base64_data_map = &rule_base64_data;
 
-/************************************
- *********** ISDATAAT  **************
- ************************************/
-
-static const std::string isdataat = "isdataat";
-static const ConvertMap rule_isdataat =
-{
-    isdataat,
-    unchanged_rule_ctor<&isdataat>,
-};
-
-const ConvertMap* isdataat_map = &rule_isdataat;
-
 /************************************
  *************  ASN1  ***************
  ************************************/