protected:
Converter* cv;
+#if 0
+ List of forward parsing methods. Placing these here so you don't need ot
+ search through the file
+
+ inline bool parse_string_option(std::string opt_name,
+ std::stringstream& stream);
+ inline bool parse_int_option(std::string opt_name,
+ std::stringstream& stream);
+ inline bool parse_curly_bracket_list(std::string list_name,
+ std::stringstream& stream);
+ inline bool parse_yn_bool_option(std::string opt_name,
+ std::stringstream& stream);
+ inline bool parse_bracketed_byte_list(std::string list_name,
+ std::stringstream& stream);
+ inline bool parse_bracketed_unsupported_list(std::string list_name,
+ std::stringstream& stream);
+ inline bool open_table_add_option(std::string table_name,
+ std::string opt_name,
+ std::string val);
+
+ inline bool parse_deprecation_option(std::string table_name,
+ std::stringstream& stream);
+
+#endif
+
+
inline bool parse_string_option(std::string opt_name, std::stringstream& stream)
{
std::string val;
}
+ inline bool parse_deprecation_option(std::string opt_name,
+ std::stringstream& stream)
+ {
+
+ std::string val;
+ cv->add_deprecated_comment(opt_name);
+
+ if(stream >> val)
+ return true;
+
+ return false;
+ }
+
+
private:
};
void Converter::add_deprecated_comment(std::string dep_var)
{
- std::string error_string = "option '" + dep_var + "' deprecated.";
+ std::string error_string = "option deprecated: '" + dep_var + "'";
if (open_tables.size() > 0)
add_comment_to_table(error_string);
add_comment_to_file(error_string);
}
-void Converter::add_deprecated_comment(std::string dep_var, std::string new_var)
+void Converter::add_diff_option_comment(std::string dep_var, std::string new_var)
{
- std::string error_string = "option '" + dep_var + "' deprecated"
- + " ... using '" + new_var + "' instead";
+ std::string error_string = "option change: '" + dep_var + "' --> '"
+ + new_var + "'";
if (open_tables.size() > 0)
add_comment_to_table(error_string);
void add_comment_to_file(std::string comment, std::stringstream& stream);
// attach a comment about a deprecated option to a file or table
void add_deprecated_comment(std::string dep_var);
- // add a comment with the formate 'deprecated option ... use the new option instead'
- void add_deprecated_comment(std::string dep_var, std::string new_var);
+ // add a comment with telling the user an option has changed
+ void add_diff_option_comment(std::string dep_var, std::string new_var);
// log an error in the new lua file
void log_error(std::string);
void ConversionData::add_comment(std::string str)
{
- // leave at most one blank line between comments
-// if ( !(str.empty() && !comments.empty() && comments.back().empty()) )
- comments->add_text(str);
+ comments->add_text(str);
}
void ConversionData::add_error_comment(std::string error_string)
return out;
}
-#if 0
-bool ConversionData::add_option(std::string name, std::string value)
-{
-
-}
-
-bool ConversionData::add_option(std::string name, long long int value)
-{
-
-}
-
-
-void ConversionData::reset()
-{
-
-}
-
-#endif
#include <vector>
#include <sstream>
#include <iostream>
+#include <string>
#include "init_state.h"
#include "snort2lua_util.h"
#include "keyword_states/keywords_api.h"
std::string keyword;
cv->open_table("suppress");
- cv->add_deprecated_comment("gen_id", "gid");
- cv->add_deprecated_comment("sig_id", "sid");
+ cv->add_diff_option_comment("gen_id", "gid");
+ cv->add_diff_option_comment("sig_id", "sid");
cv->open_table();
while(data_stream >> keyword)
add_library(preprocessor_states
pps_arpspoof.cc
+ pps_bo.cc
+ pps_frag3_engine.cc
+ pps_frag3_global.cc
+ pps_ftp_telnet.cc
+ pps_ftp_telnet_protocol.cc
pps_http_inspect.cc
pps_http_inspect_server.cc
- pps_smtp.cc
pps_normalizers.cc
pps_sfportscan.cc
+ pps_smtp.cc
pps_stream_global.cc
pps_stream_tcp.cc
pps_stream_udp.cc
- pps_ftp_telnet.cc
- pps_ftp_telnet_protocol.cc
- pps_bo.cc
preprocessor_api.h
preprocessor_api.cc
)
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// pps_frag3_engine.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class Frag3Engine : public ConversionState
+{
+public:
+ Frag3Engine(Converter* cv) : ConversionState(cv) {};
+ virtual ~Frag3Engine() {};
+ virtual bool convert(std::stringstream& data_stream);
+
+private:
+ bool parse_ip_list(std::string, std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+bool Frag3Engine::parse_ip_list(std::string list_name,
+ std::stringstream& data_stream)
+{
+ std::string prev;
+ std::string elem;
+
+ if(!(data_stream >> elem) || (elem.front() != '['))
+ return false;
+
+ if(!(data_stream >> elem))
+ return false;
+
+ // there can be no spaces between the square bracket and string
+ prev = "[" + elem;
+
+ while (data_stream >> elem && elem.back() != ']')
+ prev = prev + ' ' + elem;
+
+ prev = prev + "]";
+ return cv->add_option_to_table(list_name, prev);
+
+}
+
+bool Frag3Engine::convert(std::stringstream& data_stream)
+{
+
+ bool retval = true;
+ bool val;
+ std::string keyword;
+
+ cv->open_table("stream_ip");
+
+ while(data_stream >> keyword)
+ {
+ bool tmpval = true;
+
+ if(keyword.back() == ',')
+ keyword.pop_back();
+
+ if(keyword.empty())
+ continue;
+
+ if(!keyword.compare("min_ttl"))
+ tmpval = parse_int_option("min_ttl", data_stream);
+
+ else if(!keyword.compare("policy"))
+ tmpval = parse_string_option("policy", data_stream);
+
+ else if(!keyword.compare("detect_anomalies"))
+ cv->add_deprecated_comment("detect_anomalies");
+
+ else if(!keyword.compare("bind_to"))
+ parse_ip_list("bind_to", data_stream);
+
+ else if(!keyword.compare("timeout"))
+ {
+ tmpval = parse_int_option("session_timeout", data_stream);
+ cv->add_diff_option_comment("timeout", "session_timeout");
+ }
+
+ else if(!keyword.compare("overlap_limit"))
+ {
+ tmpval = parse_int_option("max_overlaps", data_stream);
+ cv->add_diff_option_comment("overlap_limit", "max_overlaps");
+ }
+
+ else if(!keyword.compare("min_fragment_length"))
+ {
+ tmpval = parse_int_option("min_frag_length", data_stream);
+ cv->add_diff_option_comment("min_fragment_length", "min_frag_length");
+ }
+
+ else
+ tmpval = false;
+
+ if (retval)
+ retval = tmpval;
+ }
+
+ return retval;
+}
+
+#if 0
+bool alert_test.rebuilt = false: include type:count where type is S for stream and F for frag
+enum hosts[].frag_policy = linux: defragmentation policy { first | linux | bsd | bsd_right |last | windows | solaris }
+bool normalize.ip4.df = false: clear don't frag flag
+bool packets.vlan_agnostic = false: determines whether VLAN info is used to track fragments and connections
+enum stream_ip.policy = linux: fragment reassembly policy { first | linux | bsd | bsd_right |last | windows | solaris }
+
+
+ 192.1.2.7/24
+
+#endif
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+ return new Frag3Engine(cv);
+}
+
+static const ConvertMap preprocessor_frag3_engine =
+{
+ "frag3_engine",
+ ctor,
+};
+
+const ConvertMap* frag3_engine_map = &preprocessor_frag3_engine;
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// pps_frag3_global.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class Frag3Global : public ConversionState
+{
+public:
+ Frag3Global(Converter* cv) : ConversionState(cv) {};
+ virtual ~Frag3Global() {};
+ virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+bool Frag3Global::convert(std::stringstream& data_stream)
+{
+
+ bool retval = true;
+ std::string keyword;
+
+ cv->open_table("stream_ip");
+
+ while(data_stream >> keyword)
+ {
+ bool tmpval = true;
+
+ if(keyword.back() == ',')
+ keyword.pop_back();
+
+ if(keyword.empty())
+ continue;
+
+ if(!keyword.compare("disabled"))
+ cv->add_deprecated_comment("disabled");
+
+ else if(!keyword.compare("max_frags"))
+ tmpval = parse_int_option("max_frags", data_stream);
+
+ else if(!keyword.compare("memcap"))
+ tmpval = parse_deprecation_option("memcap", data_stream);
+
+ else if(!keyword.compare("prealloc_memcap"))
+ tmpval = parse_deprecation_option("prealloc_memcap", data_stream);
+
+ else if(!keyword.compare("prealloc_frags"))
+ tmpval = parse_deprecation_option("prealloc_frags", data_stream);
+
+ else
+ tmpval = false;
+
+ if (retval)
+ retval = tmpval;
+ }
+
+ return retval;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+ return new Frag3Global(cv);
+}
+
+static const ConvertMap preprocessor_frag3_global =
+{
+ "frag3_global",
+ ctor,
+};
+
+const ConvertMap* frag3_global_map = &preprocessor_frag3_global;
else if(!keyword.compare("data_chan"))
{
- cv->add_deprecated_comment("data_chan", "ignore_data_chan");
+ cv->add_diff_option_comment("data_chan", "ignore_data_chan");
tmpval = cv->add_option_to_table("ignore_data_chan", true);
}
else if (!keyword.compare("ports"))
{
- cv->add_deprecated_comment("ports", "bindings");
+ cv->add_diff_option_comment("ports", "bindings");
cv->add_comment_to_table("check bindings table for port information");
// add commented list for now
std::string tmp = "";
else if(!keyword.compare("ports"))
{
- cv->add_deprecated_comment("ports", "bindings");
+ cv->add_diff_option_comment("ports", "bindings");
cv->add_comment_to_table("check bindings table for port information");
// vvvv defined in ConversionState vvvv
parse_curly_bracket_list("--ports", data_stream); // create a commented list of the ports
else if (!keyword.compare("non_rfc_char"))
{
- cv->add_deprecated_comment("non_rfc_char", "non_rfc_chars");
+ cv->add_diff_option_comment("non_rfc_char", "non_rfc_chars");
parse_bracketed_byte_list("non_rfc_chars", data_stream);
}
else if (!keyword.compare("enable_cookie"))
{
tmpval = cv->add_option_to_table("enable_cookies", true);
- cv->add_deprecated_comment("enable_cookie", "enable_cookies");
+ cv->add_diff_option_comment("enable_cookie", "enable_cookies");
}
else if (!keyword.compare("flow_depth"))
{
- cv->add_deprecated_comment("flow_depth", "server_flow_depth");
+ cv->add_diff_option_comment("flow_depth", "server_flow_depth");
tmpval = parse_int_option("server_flow_depth", data_stream);
}
else if (!keyword.compare("ports"))
{
- cv->add_deprecated_comment("ports", "bindings");
+ cv->add_diff_option_comment("ports", "bindings");
cv->add_comment_to_table("check bindings table for port information");
tmpval = parse_bracketed_unsupported_list("ports", data_stream);
}
else if(!keyword.compare("proto"))
{
- cv->add_deprecated_comment("proto", "protos");
+ cv->add_diff_option_comment("proto", "protos");
retval = parse_curly_bracket_list("protos", data_stream) && retval;
}
else if(!keyword.compare("scan_type"))
{
- cv->add_deprecated_comment("scan_type", "scan_types");
+ cv->add_diff_option_comment("scan_type", "scan_types");
tmpval = parse_curly_bracket_list("scan_types", data_stream) && retval;
}
else if(!keyword.compare("prune_log_max"))
{
- cv->add_deprecated_comment("prune_log_max", "histogram");
+ cv->add_diff_option_comment("prune_log_max", "histogram");
if(!(data_stream >> keyword)) // eat the number of bytes
tmpval = false;
}
if( !opt_name.compare("client"))
{
- cv->add_deprecated_comment("port client", "client_ports");
+ cv->add_diff_option_comment("port client", "client_ports");
opt_name = "client_ports";
}
else if( !opt_name.compare("server"))
{
- cv->add_deprecated_comment("port server", "server_ports");
+ cv->add_diff_option_comment("port server", "server_ports");
opt_name = "server_ports";
}
else if( !opt_name.compare("both"))
{
- cv->add_deprecated_comment("port both", "both_ports");
+ cv->add_diff_option_comment("port both", "both_ports");
opt_name = "both_ports";
}
else if(!keyword.compare("bind_to"))
{
- cv->add_deprecated_comment("bind_to", "bindings");
+ cv->add_diff_option_comment("bind_to", "bindings");
if(!(data_stream >> keyword))
tmpval = false;
}
else if(!keyword.compare("dont_reassemble_async"))
{
- cv->add_deprecated_comment("dont_reassemble_async", "reassemble_async");
+ cv->add_diff_option_comment("dont_reassemble_async", "reassemble_async");
tmpval = cv->add_option_to_table("reassemble_async", false);
}
else if(!keyword.compare("use_static_footprint_sizes"))
{
- cv->add_deprecated_comment("footprint", "use_static_footprint_sizes");
+ cv->add_diff_option_comment("footprint", "use_static_footprint_sizes");
tmpval = cv->add_option_to_table("footprint", true);
}
else if(!keyword.compare("timeout"))
{
- cv->add_deprecated_comment("timeout", "session_timeout");
+ cv->add_diff_option_comment("timeout", "session_timeout");
tmpval = parse_int_option("session_timeout", data_stream);
}
else if(!keyword.compare("max_queued_segs"))
{
- cv->add_deprecated_comment("max_queued_segs", "queue_limit.max_segments");
+ cv->add_diff_option_comment("max_queued_segs", "queue_limit.max_segments");
cv->open_table("queue_limit");
tmpval = parse_int_option("max_segments", data_stream);
cv->close_table();
else if(!keyword.compare("max_queued_bytes"))
{
- cv->add_deprecated_comment("max_queued_bytes", "queue_limit.max_bytes");
+ cv->add_diff_option_comment("max_queued_bytes", "queue_limit.max_bytes");
cv->open_table("queue_limit");
tmpval = parse_int_option("max_bytes", data_stream);
cv->close_table();
else if(!keyword.compare("timeout"))
{
- cv->add_deprecated_comment("timeout", "session_timeout");
+ cv->add_diff_option_comment("timeout", "session_timeout");
tmpval = parse_int_option("session_timeout", data_stream);
}
return new StreamUdp(cv);
}
-static const ConvertMap preprocessor_stream_udp =
+static const ConvertMap preprocessor_stream_udp =
{
"stream5_udp",
ctor,
extern const ConvertMap *arpspoof_map;
extern const ConvertMap *arpspoof_host_map;
extern const ConvertMap *bo_map;
+extern const ConvertMap *frag3_engine_map;
+extern const ConvertMap *frag3_global_map;
extern const ConvertMap *ftptelnet_map;
extern const ConvertMap *ftptelnet_protocol_map;
extern const ConvertMap *httpinspect_map;
arpspoof_map,
arpspoof_host_map,
bo_map,
+ frag3_engine_map,
+ frag3_global_map,
ftptelnet_map,
httpinspect_map,
httpinspect_server_map,
}
-static void show_usage()
-{
- std::cout << "usage: snort2lua <input_conf_file> <output_lua_file>" << std::endl;
-}
-
int main (int argc, char* argv[])
{
std::ifstream in;
projects / thirdparty / snort3.git / commitdiff
