+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// token_ring_module.cc author Josh Rosenbaum <jrosenba@cisco.com>
-
-#include "token_ring_module.h"
-
-
-static const Parameter tkr_params[] =
-{
- { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
-};
-
-
-static const RuleMap tkr_rules[] =
-{
- { DECODE_BAD_TRH, "(" TR_NAME ") Bad Token Ring Header" },
- { DECODE_BAD_TR_ETHLLC, "(" TR_NAME ") Bad Token Ring ETHLLC Header" },
- { DECODE_BAD_TR_MR_LEN, "(" TR_NAME ") Bad Token Ring MRLENHeader" },
- { DECODE_BAD_TRHMR, "(" TR_NAME ") Bad Token Ring MR Header" },
- { 0, nullptr }
-};
-
-//-------------------------------------------------------------------------
-// token ring module
-//-------------------------------------------------------------------------
-
-TrCodecModule::TrCodecModule() : DecodeModule(TR_NAME)
-{ }
-
-
-bool TrCodecModule::set(const char*, Value&, SnortConfig*)
-{
- return true;
-}
+++ /dev/null
-/*
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation. You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if not, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-*/
-
-// token_ring_module.h author Josh Rosenbaum <jrosenba@cisco.com>
-
-#ifndef CODECS_TOKEN_RING_MODULE_H
-#define CODECS_TOKEN_RING_MODULE_H
-
-#include "codecs/decode_module.h"
-
-
-#define TR_NAME "token_ring"
-
-class TrCodecModule : public DecodeModule
-{
-public:
- TrCodecModule();
-
- const RuleMap* get_rules() const;
- bool set(const char*, Value&, SnortConfig*);
-};
-
-#endif
-
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// config_alertfile.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "utils/s2l_util.h"
+
+namespace config
+{
+
+namespace {
+
+
+class Alertfile : public ConversionState
+{
+public:
+ Alertfile() : ConversionState() {};
+ virtual ~Alertfile() {};
+ virtual bool convert(std::istringstream& data_stream);
+};
+
+} // namespace
+
+
+bool Alertfile::convert(std::istringstream& data_stream)
+{
+ std::string filename = util::get_remain_data(data_stream);
+
+ if (filename.empty())
+ {
+ data_api.failed_conversion(data_stream, "<missing_filename>");
+ return false;
+ }
+
+ /*
+ * In Snort, config alertfile: is actually only used by full and fast
+ * outputs. So, keep that functionality here.
+ */
+
+ table_api.open_table("alert_full");
+ table_api.add_diff_option_comment("config alertfile:", "alert_full.file");
+
+ if (!table_api.option_exists("file"))
+ table_api.add_option("file", filename);
+ else
+ table_api.add_comment("config alertfile: " + filename +
+ " not added because a different file already exists");
+
+ table_api.close_table();
+
+
+ table_api.open_table("alert_fast");
+ table_api.add_diff_option_comment("config alertfile:", "alert_fast.file");
+
+ if (!table_api.option_exists("file"))
+ table_api.add_option("file", filename);
+ else
+ table_api.add_comment("config alertfile: " + filename +
+ " not added because a different file already exists");
+
+ table_api.close_table();
+
+ // stop parsing, even if additional options available
+ data_stream.setstate(std::ios::eofbit);
+ return true;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+
+static ConversionState* ctor()
+{ return new Alertfile(); }
+
+
+static const ConvertMap alertfile_api =
+{
+ "alertfile",
+ ctor,
+};
+
+const ConvertMap* alertfile_map = &alertfile_api;
+
+} // namespace config
out << " " << (*r);
}
- out << " )";
+ out << "; )";
}
return out;
projects / thirdparty / snort3.git / commitdiff
