extern const ConvertMap* rule_state_map;
extern const ConvertMap* sblock_map;
extern const ConvertMap* sdrop_map;
-extern const ConvertMap* supress_map;
+extern const ConvertMap* suppress_map;
+extern const ConvertMap* threshold_map;
extern const ConvertMap* var_map;
namespace {
-class EventFilter : public ConversionState
+class Filter : public ConversionState
{
public:
- EventFilter(Converter& c) : ConversionState(c) {};
- virtual ~EventFilter() {};
+ Filter(Converter& c, std::string s) : ConversionState(c), type(s) {};
+ virtual ~Filter() {};
virtual bool convert(std::istringstream& data_stream);
+
+private:
+ std::string type;
};
} // namespace
-bool EventFilter::convert(std::istringstream& data_stream)
+bool Filter::convert(std::istringstream& data_stream)
{
std::string args;
bool retval = true;
+ static bool warn = true;
table_api.open_table("event_filter");
- table_api.open_table();
+ if ( warn && !type.compare("threshold"))
+ {
+ table_api.add_diff_option_comment("threshold", "event_filter");
+ warn = false;
+ }
+
+
+ table_api.open_table();
while (std::getline(data_stream, args, ','))
{
std::string keyword;
******* A P I ***********
**************************/
-static ConversionState* ctor(Converter& c)
-{ return new EventFilter(c); }
+static ConversionState* threshold_ctor(Converter& c)
+{ return new Filter(c, "threshold"); }
+
+static ConversionState* event_filter_ctor(Converter& c)
+{ return new Filter(c, "event_filter"); }
+
static const ConvertMap event_filter_api =
{
"event_filter",
- ctor,
+ event_filter_ctor,
+};
+
+static const ConvertMap threshold_api =
+{
+ "threshold",
+ threshold_ctor,
};
const ConvertMap* event_filter_map = &event_filter_api;
+const ConvertMap* threshold_map = &threshold_api;
} // namespace keywords
static ConversionState* ctor(Converter& c)
{ return new Suppress(c); }
-static const ConvertMap keyword_supress =
+static const ConvertMap keyword_suppress =
{
"suppress",
ctor,
};
-const ConvertMap* supress_map = &keyword_supress;
+const ConvertMap* suppress_map = &keyword_suppress;
} // namespace keywords
rule_resp.cc
rule_stream_reassemble.cc
rule_tag.cc
+ rule_ttl.cc
rule_threshold.cc
rule_unchanged.cc
rule_urilen.cc
rule_resp.cc \
rule_stream_reassemble.cc \
rule_tag.cc \
+rule_ttl.cc \
rule_threshold.cc \
rule_unchanged.cc \
rule_urilen.cc \
// rule_base64_decode.cc author Josh Rosenbaum <jrosenba@cisco.com>
#include <sstream>
-#include <vector>
#include "conversion_state.h"
#include "helpers/converter.h"
// rule_tag.cc author Josh Rosenbaum <jrosenba@cisco.com>
#include <sstream>
-#include <vector>
#include "conversion_state.h"
#include "helpers/converter.h"
static ConversionState* ctor(Converter& c)
-{
- return new Threshold(c);
-}
+{ return new Threshold(c); }
static const ConvertMap rule_threshold =
{
--- /dev/null
+
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+// rule_base64_decode.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include <sstream>
+
+#include "conversion_state.h"
+#include "helpers/converter.h"
+#include "rule_states/rule_api.h"
+#include "helpers/s2l_util.h"
+
+namespace rules
+{
+
+namespace
+{
+
+
+class Ttl : public ConversionState
+{
+public:
+ Ttl(Converter& c) : ConversionState(c) {};
+ virtual ~Ttl() {};
+ virtual bool convert(std::istringstream&);
+};
+
+} // namespace
+
+bool Ttl::convert(std::istringstream& stream)
+{
+ std::string arg = util::get_rule_option_args(stream);
+
+
+ if ( arg.empty() )
+ {
+ rule_api.bad_rule(stream, "ttl <missing_arg>");
+ }
+ else
+ {
+ std::string new_val;
+
+ if ( arg.find('-') == std::string::npos )
+ new_val = arg;
+ else
+ {
+ if ( arg.find('-') != arg.rfind('-') )
+ {
+ new_val = arg;
+ rule_api.bad_rule(stream, "ttl '" + arg + "'' contains "
+ "multiple dashes");
+ }
+ else
+ {
+ if ( arg.front() == '-' )
+ {
+ arg.erase(0, 1);
+ new_val = "<=" + arg;
+ }
+ else if ( arg.back() == '-' )
+ {
+ arg.pop_back();
+ new_val = ">=" + arg;
+ }
+ else
+ {
+ std::istringstream arg_stream(arg);
+ int low;
+ int high;
+
+ arg_stream >> low;
+ arg_stream.ignore(1);
+ arg_stream >> high;
+ new_val = std::to_string(low) + "<=>" + std::to_string(high);
+ }
+ }
+ }
+
+ rule_api.add_option("ttl", new_val);
+ }
+
+ return set_next_rule_state(stream);
+}
+
+
+static ConversionState* ctor(Converter& c)
+{ return new Ttl(c); }
+
+static const ConvertMap rule_ttl =
+{
+ "ttl",
+ ctor,
+};
+
+const ConvertMap* ttl_map = &rule_ttl;
+
+} // namespace rules
********* FRAGOFFSET **************
************************************/
-
static const std::string fragoffset = "fragoffset";
static const ConvertMap rule_fragoffset =
{
const ConvertMap* fragoffset_map = &rule_fragoffset;
-/************************************
- ************* T T L ****************
- ************************************/
-
-
-static const std::string ttl = "ttl";
-static const ConvertMap rule_ttl =
-{
- ttl,
- unchanged_rule_ctor<&ttl>,
-};
-
-const ConvertMap* ttl_map = &rule_ttl;
-
/************************************
************* T O S ****************
alert tcp $EXTERNAL_NET any -> any $TEST_PORTS (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:!"m?^Argument\s+/?smi"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2319; rev:4;)
alert tcp any any -> any any ( msg:"First Cookie"; content:"OvCgi",http_uri; content:"AcceptLang=en-usaAAAA",http_cookie,nocase; sid:11111111; )
+
+
+threshold gen_id 1, sig_id 7037, type limit, track by_src, count 1, seconds 60
+alert ip any any -> any any (msg:"TTL RULE OPTION"; ttl:-4; sid:11111112;)
+alert ip any any -> any any (msg:"TTL RULE OPTION"; ttl:5-6; sid:11111113;)
+alert ip any any -> any any (msg:"TTL RULE OPTION"; ttl:7-; sid:11111114;)
projects / thirdparty / snort3.git / commitdiff
