--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+// rule_stream_size.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+#include <cstdlib>
+
+#include "conversion_state.h"
+#include "helpers/converter.h"
+#include "rule_states/rule_api.h"
+#include "helpers/s2l_util.h"
+
+namespace rules
+{
+
+namespace {
+
+
+class StreamSize : public ConversionState
+{
+public:
+ StreamSize(Converter& c) : ConversionState(c) {};
+ virtual ~StreamSize() {};
+ virtual bool convert(std::istringstream& data);
+};
+
+} // namespace
+
+bool StreamSize::convert(std::istringstream& data_stream)
+{
+ std::string args;
+
+ args = util::get_rule_option_args(data_stream);
+ std::istringstream arg_stream(args);
+
+ std::string dir = "";
+ std::string op = "";
+ std::string size = "";
+
+ if (!util::get_string(arg_stream, dir, ",") ||
+ !util::get_string(arg_stream, op, ",") ||
+ !util::get_string(arg_stream, size, ","))
+ {
+ rule_api.bad_rule(data_stream, "stream_size requires 3 arguments. '<direction>,<operator>,<size>'");
+ return set_next_rule_state(data_stream);
+ }
+
+
+
+ if (!(!op.compare("=") || !op.compare("<") || !op.compare(">") ||
+ !op.compare("!=") || !op.compare("<=") || !op.compare(">=")))
+ {
+ rule_api.bad_rule(data_stream, "'" + op + "' in an invalid stream_size operator.");
+ }
+
+ try
+ {
+ // checking that this is a valid unsigned integer.
+ char* end;
+ std::strtoul(size.c_str(), &end, 10);
+ }
+ catch (const std::invalid_argument& e)
+ {
+ rule_api.bad_rule(data_stream, "stream_size <size> '" + size + "' is too large.");
+ }
+ catch (const std::out_of_range& e)
+ {
+ rule_api.bad_rule(data_stream, "stream_size <size> '" + size + "' is too large.");
+ }
+
+
+ rule_api.add_option("stream_size", dir);
+ rule_api.add_suboption(op + size);
+ return set_next_rule_state(data_stream);
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* stream_size_ctor(Converter& c)
+{ return new StreamSize(c); }
+
+static const ConvertMap rule_stream_size =
+{
+ "stream_size",
+ stream_size_ctor,
+};
+
+const ConvertMap* stream_size_map = &rule_stream_size;
+
+} // namespace rules
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (content:"fe, fe, fe, fe, fe, fe, fe,"; msg:"BROWSER-FIREFOX Mozilla Firefox Javascript engine function arguments memory corruption attempt"; flow:to_client,established; file_data; content:"|3B|i<25|3B|i++|29| fe += fe|3B|"; fast_pattern:only; content:"fu=new Function|28 0A|"; content:"fe, fe, fe, fe, fe, fe, fe,"; within:30; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:bugtraq,19181; reference:cve,2006-3806; classtype:attempted-user; sid:18262; rev:3;)
+alert tcp any any -> any 20031 (msg:"SERVER-OTHER BakBone NetVault server heap overflow attempt"; flow:to_server,established; stream_size:client,>,32784; byte_test:4,>,32784,0,little; sid:12081; rev:6;)
+
+alert tcp $EXTERNAL_NET [20,1024:] -> $HOME_NET [20,1024:] (msg:"PROTOCOL-FTP Computer Associates eTrust Secure Content Manager LIST stack overflow attempt"; flow:established; stream_size:either,<,12800; content:"4096"; fast_pattern:only; pcre:"/[D\x2D][RWX\x2D]{9}\s+\w+\s+\w+\s+\w+\s+4096/i"; metadata:service ftp; reference:bugtraq,29528; reference:cve,2008-2541; reference:url,osvdb.org/show/osvdb/46012; reference:url,osvdb.org/show/osvdb/46013; sid:18575; rev:4;)
+
+alert tcp any any -> any 20031 (msg:"SERVER-OTHER BakBone NetVault server heap overflow attempt"; flow:to_server,established; stream_size:server,=,32784; byte_test:4,>,32784,0,little; sid:12082; rev:7;)
+
+alert tcp any any -> any 20031 (msg:"SERVER-OTHER BakBone NetVault server heap overflow attempt"; flow:to_server,established; stream_size:both,!=,32784; byte_test:4,>,32784,0,little; sid:12083; rev:8;)
+
+alert tcp any any -> any 20031 (msg:"SERVER-OTHER BakBone NetVault server heap overflow attempt"; flow:to_server,established; stream_size:client,<=,32784; byte_test:4,>,32784,0,little; sid:12084; rev:9;)
+
+alert tcp any any -> any 20031 (msg:"SERVER-OTHER BakBone NetVault server heap overflow attempt"; flow:to_server,established; stream_size:client,>=,32784; byte_test:4,>,32784,0,little; sid:12085; rev:10;)
+
ruletype suspicious
{
type log
projects / thirdparty / snort3.git / commitdiff
