From: Josh <jrosenba@cisco.com>
Date: Fri, 27 Jun 2014 19:11:26 +0000 (-0400)
Subject: parse content, sids, gids, revs, msg.  Adding template support for config and unchang... 
X-Git-Tag: 3.0.0-233~1175^2~25^2^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=095911588dde2e95640cf56989647843b9eefdee;p=thirdparty%2Fsnort3.git

parse content, sids, gids, revs, msg.  Adding template support for config and unchanged rules. parses config ppm"
---

diff --git a/tools/snort2lua/CMakeLists.txt b/tools/snort2lua/CMakeLists.txt
index 3b89ae0f0..3271d6baf 100644
--- a/tools/snort2lua/CMakeLists.txt
+++ b/tools/snort2lua/CMakeLists.txt
@@ -25,6 +25,7 @@ target_link_libraries( snort2lua
     keyword_states
     output_states
     preprocessor_states
+    rule_states
 )
 
 
diff --git a/tools/snort2lua/config_states/CMakeLists.txt b/tools/snort2lua/config_states/CMakeLists.txt
index 807603d6b..9fcfd1d1e 100644
--- a/tools/snort2lua/config_states/CMakeLists.txt
+++ b/tools/snort2lua/config_states/CMakeLists.txt
@@ -2,6 +2,7 @@
 
 add_library( config_states
     config_options.cc
+    config_ppm.cc
     config_api.h
     config_api.cc
 )
diff --git a/tools/snort2lua/config_states/config_api.cc b/tools/snort2lua/config_states/config_api.cc
index 66de51949..2a9db4d97 100644
--- a/tools/snort2lua/config_states/config_api.cc
+++ b/tools/snort2lua/config_states/config_api.cc
@@ -29,6 +29,7 @@ extern const ConvertMap* enable_gtp_map;
 extern const ConvertMap* paf_max_map;
 extern const ConvertMap* pcre_match_limit_map;
 extern const ConvertMap* pcre_match_limit_recursion_map;
+extern const ConvertMap* ppm_map;
 
 
 const std::vector<const ConvertMap*> config_api = 
@@ -40,4 +41,5 @@ const std::vector<const ConvertMap*> config_api =
     paf_max_map,
     pcre_match_limit_map,
     pcre_match_limit_recursion_map,
+    ppm_map,
 };
diff --git a/tools/snort2lua/config_states/config_options.cc b/tools/snort2lua/config_states/config_options.cc
index 37ed180f5..484338827 100644
--- a/tools/snort2lua/config_states/config_options.cc
+++ b/tools/snort2lua/config_states/config_options.cc
@@ -143,6 +143,21 @@ const ConvertMap* pcre_match_limit_recursion_map = &config_pcre_match_limit_recu
  ****************** FLOWBIT_SIZE ***************************
  ***********************************************************/
 
+//template<const std::string *snort_option, const std::string *lua_name>
+//config_int_ctor2<snort_option, lua_name, snort_option>
+
+static const std::string alerts = "alerts";
+static const std::string flowbits_size = "flowbits_size";
+
+static const ConvertMap config_flowbit_size =
+{
+    flowbits_size,
+    config_int_ctor<&flowbits_size, &alerts>,
+};
+
+const ConvertMap* flowbit_size_map = &config_flowbit_size;
+
+#if 0
 static ConversionState* flowbit_size_ctor(Converter* cv, LuaData* ld)
 {
     return new ConfigIntOption(cv, ld, "alerts", "flowbits_size");
@@ -156,6 +171,8 @@ static const ConvertMap config_flowbit_size =
 
 const ConvertMap* flowbit_size_map = &config_flowbit_size;
 
+#endif
+
 /*********************************************
  *******  Enable GTP *********
  *********************************************/
diff --git a/tools/snort2lua/config_states/config_options.h b/tools/snort2lua/config_states/config_options.h
index 88d0bc2f4..32ea3c811 100644
--- a/tools/snort2lua/config_states/config_options.h
+++ b/tools/snort2lua/config_states/config_options.h
@@ -43,7 +43,7 @@ public:
     };
 
     virtual ~ConfigIntOption() {};
-    virtual bool convert(std::stringstream& stream)
+    virtual bool convert(std::istringstream& stream)
     {
         ld->open_table(table_name);
         return parse_int_option(opt_name, stream);
@@ -69,7 +69,7 @@ public:
     };
 
     virtual ~ConfigStringOption() {};
-    virtual bool convert(std::stringstream& stream)
+    virtual bool convert(std::istringstream& stream)
     {
         ld->open_table(table_name);
         return parse_string_option(opt_name, stream);
@@ -81,4 +81,68 @@ private:
 };
 
 
+/**********************************
+ ********  TEMPLATES!!   **********
+ **********************************/
+
+template<const std::string *snort_option,
+        const std::string *lua_table_name,
+        const std::string* lua_option_name,
+        bool (*parse_func)(std::string table_name, std::istringstream& stream)>
+class ParseConfigOption : public ConversionState
+{
+public:
+    ParseConfigOption( Converter* cv, LuaData* ld)
+                            : ConversionState(cv, ld)
+    {
+    };
+
+    virtual ~ParseConfigOption() {};
+    virtual bool convert(std::istringstream& stream)
+    {
+        // if the two names are not equal ...
+        if((*snort_option).compare((*lua_option_name)))
+            ld->add_diff_option_comment(*snort_option, *lua_option_name);
+
+        ld->open_table((*lua_table_name));
+        return parse_func((*lua_option_name), stream);
+    }
+};
+
+
+template<const std::string *snort_option,
+        const std::string *lua_table_name,
+        const std::string* lua_option_name>
+class ConfigIntTempOption : public ConversionState
+{
+public:
+    ConfigIntTempOption( Converter* cv, LuaData* ld)
+                            : ConversionState(cv, ld)
+    {
+    };
+
+    virtual ~ConfigIntTempOption() {};
+    virtual bool convert(std::istringstream& stream)
+    {
+        // if the two names are not equal ...
+        if((*snort_option).compare((*lua_option_name)))
+            ld->add_diff_option_comment(*snort_option, *lua_option_name);
+
+        ld->open_table((*lua_table_name));
+        return parse_int_option(*lua_option_name, stream);
+    }
+};
+
+
+template<const std::string *snort_option, const std::string *lua_name, const std::string *lua_option_name = nullptr>
+static ConversionState* config_int_ctor(Converter* cv, LuaData* ld)
+{
+    if (lua_option_name)
+        return new ConfigIntTempOption<snort_option, lua_name, lua_option_name>(cv, ld);
+    else
+        return new ConfigIntTempOption<snort_option, lua_name, snort_option>(cv, ld);
+}
+
+
+
 #endif
diff --git a/tools/snort2lua/config_states/config_ppm.cc b/tools/snort2lua/config_states/config_ppm.cc
new file mode 100644
index 000000000..085dfa8b0
--- /dev/null
+++ b/tools/snort2lua/config_states/config_ppm.cc
@@ -0,0 +1,185 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// pps_frag3_global.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "util/converter.h"
+#include "util/util.h"
+
+namespace {
+
+class Ppm : public ConversionState
+{
+public:
+    Ppm(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
+    virtual ~Ppm() {};
+    virtual bool convert(std::istringstream& data_stream);
+};
+
+} // namespace
+
+bool Ppm::convert(std::istringstream& data_stream)
+{
+
+    bool retval = true;
+    std::string keyword;
+    bool test;
+
+    ld->open_table("ppm");
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
+        bool popped_comma;
+
+        if(keyword.back() == ',')
+        {
+            keyword.pop_back();
+            popped_comma = true;
+        }
+        else
+        {
+            popped_comma = false;
+        }
+
+        if(keyword.empty())
+            continue;
+        
+        if(!keyword.compare("threshold"))
+            tmpval = parse_int_option("threshold", data_stream);
+
+        else if(!keyword.compare("fastpath-expensive-packets"))
+        {
+            ld->add_diff_option_comment("fastpath-expensive-packets", "fastpath_expensive_packets");
+            tmpval = ld->add_option_to_table("fastpath_expensive_packets", true);
+        }
+        
+        else if(!keyword.compare("max-pkt-time"))
+        {
+            ld->add_diff_option_comment("max-pkt-time", "max_pkt_time");
+            tmpval = parse_int_option("max_pkt_time", data_stream);
+        }
+        
+        else if(!keyword.compare("debug-pkts"))
+        {
+            ld->add_diff_option_comment("debug-pkts", "debug_pkts");
+            tmpval = ld->add_option_to_table("debug_pkts", true);
+        }
+        
+        else if(!keyword.compare("max-rule-time"))
+        {
+            ld->add_diff_option_comment("max-rule-time", "max_rule_time");
+            tmpval = parse_int_option("max_rule_time", data_stream);
+        }
+        
+        else if(!keyword.compare("suspend-expensive-rules"))
+        {
+            ld->add_diff_option_comment("suspend-expensive-rules", "suspend_expensive_rules");
+            tmpval = ld->add_option_to_table("suspend_expensive_rules", true);
+        }
+        
+        else if(!keyword.compare("suspend-timeout"))
+        {
+            ld->add_diff_option_comment("suspend-timeout", "suspend_timeout");
+            tmpval = parse_int_option("suspend_timeout", data_stream);
+        }
+        
+        else if(!keyword.compare("pkt-log"))
+        {
+            ld->add_diff_option_comment("pkt-log ", "pkt_log");
+            std::string opt1;
+            std::string opt2;
+
+            if(popped_comma)
+                ld->add_option_to_table("pkt_log", "log");
+
+            else if (!(data_stream >> opt1))
+                ld->add_option_to_table("pkt_log", "log");
+
+            else if (opt1.back() == ',')
+            {
+                opt1.pop_back();
+                tmpval = ld->add_option_to_table("pkt_log", opt1);
+            }
+
+            else if (!(data_stream >> opt2))
+                tmpval = ld->add_option_to_table("pkt_log", opt1);
+
+            else
+                 tmpval = ld->add_option_to_table("pkt_log", "both");
+        }
+        
+        else if(!keyword.compare("rule-log"))
+        {
+            std::string opt1;
+            std::string opt2;
+            popped_comma = false;
+            ld->add_diff_option_comment("rule-log", "rule_log");
+
+            if (!(data_stream >> opt1))
+                tmpval = false;
+
+            else if (opt1.back() == ',')
+            {
+                opt1.pop_back();
+                tmpval = ld->add_option_to_table("rule_log", opt1);
+            }
+
+            else if (!(data_stream >> opt2))
+                tmpval = ld->add_option_to_table("rule_log", opt1);
+
+            else
+                tmpval = ld->add_option_to_table("rule_log", "both");
+        }
+        
+        else
+            tmpval = false;
+
+        if (retval)
+            retval = tmpval;
+    }
+#if 0
+
+pkt-log [log] [alert]
+
+#endif
+
+    return retval;    
+}
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv, LuaData* ld)
+{
+    return new Ppm(cv, ld);
+}
+
+static const ConvertMap config_ppm_api =
+{
+    "ppm",
+    ctor,
+};
+
+const ConvertMap* ppm_map = &config_ppm_api;
diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h
index ae835db74..7898aa047 100644
--- a/tools/snort2lua/conversion_state.h
+++ b/tools/snort2lua/conversion_state.h
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// converter.h author Josh Rosenbaum <jorosenba@cisco.com>
+// conversion_state.h author Josh Rosenbaum <jorosenba@cisco.com>
 
 #ifndef CONVERSION_STATE_H
 #define CONVERSION_STATE_H
@@ -29,20 +29,40 @@
 
 #include "data/dt_data.h"
 
+// the following three files are for the function 'set_next_rule_state'
+#include "util/util.h"
+#include "rule_states/rule_api.h"
+#include "util/converter.h"
+
 class Converter;
+class ConversionState;
+typedef ConversionState* (*conv_new_f)(Converter*, LuaData* ld);
+
+struct ConvertMap
+{
+    std::string keyword;
+    conv_new_f ctor;
+};
+
+// yes, forward declaring.  Without some improvements to design, this needs to stay here.
+namespace rules
+{
+    extern const std::vector<const ConvertMap*> rule_api;
+} // namespace rules.
+
 
 class ConversionState
 {
 
 public:
-    explicit ConversionState(Converter* cv, LuaData* ld)
+    ConversionState(Converter* cv, LuaData* ld)
     {
         this->cv = cv;
         this->ld = ld;
     }
 
     virtual ~ConversionState() {};
-    virtual bool convert(std::stringstream& data)=0;
+    virtual bool convert(std::istringstream& data)=0;
 
 protected:
     Converter* cv;
@@ -52,29 +72,33 @@ protected:
     List of forward parsing methods. Placing these here so you don't need to
     search through the file
 
-    inline bool eat_option(std::stringstream& stream);
+    inline bool eat_option(std::istringstream& stream);
     inline bool parse_string_option(std::string opt_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
     inline bool parse_int_option(std::string opt_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
     inline bool parse_curly_bracket_list(std::string list_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
     inline bool parse_yn_bool_option(std::string opt_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
     inline bool parse_bracketed_byte_list(std::string list_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
     inline bool parse_bracketed_unsupported_list(std::string list_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
     inline bool open_table_add_option(std::string table_name,
                                         std::string opt_name,
                                         std::string val);
     inline bool parse_deprecation_option(std::string table_name,
-                                        std::stringstream& stream);
+                                        std::istringstream& stream);
+
+    //  explicitly defined due quantity of times called and errors if
+    //  not placed here.
+    inline bool set_next_rule_state(std::istringstream& stream)
 
 #endif
 
 
-    inline bool eat_option(std::stringstream& stream)
+    inline bool eat_option(std::istringstream& stream)
     {
         std::string val;
 
@@ -83,7 +107,7 @@ protected:
         return false;
     }
 
-    inline bool parse_string_option(std::string opt_name, std::stringstream& stream)
+    inline bool parse_string_option(std::string opt_name, std::istringstream& stream)
     {
         std::string val;
 
@@ -100,7 +124,7 @@ protected:
         return false;
     }
 
-    inline bool parse_int_option(std::string opt_name, std::stringstream& stream)
+    inline bool parse_int_option(std::string opt_name, std::istringstream& stream)
     {
         int val;
 
@@ -115,7 +139,7 @@ protected:
     }
 
     // parse and add a curly bracketed list to the table
-    inline bool parse_curly_bracket_list(std::string list_name, std::stringstream& stream)
+    inline bool parse_curly_bracket_list(std::string list_name, std::istringstream& stream)
     {
         std::string elem;
         bool retval = true;
@@ -130,7 +154,7 @@ protected:
     }
 
     // parse and add a yes/no boolean option.
-    inline bool parse_yn_bool_option(std::string opt_name, std::stringstream& stream)
+    inline bool parse_yn_bool_option(std::string opt_name, std::istringstream& stream)
     {
         std::string val;
 
@@ -148,7 +172,7 @@ protected:
     }
 
     // parse a curly bracketed bit and add it to the table
-    inline bool parse_bracketed_byte_list(std::string list_name, std::stringstream& stream)
+    inline bool parse_bracketed_byte_list(std::string list_name, std::istringstream& stream)
     {
         std::string elem;
         bool retval = true;
@@ -169,7 +193,7 @@ protected:
 
             if (0 <= dig && dig <= 255)
             {
-                std::stringstream tmp;
+                std::ostringstream tmp;
                 tmp << "0x" << std::hex << dig;
                 retval = ld->add_list_to_table(list_name, tmp.str()) && retval;
 
@@ -186,7 +210,7 @@ protected:
     }
 
     // parse and add a curly bracket list '{...}' which is currently unsupported in Snort++
-    inline bool parse_bracketed_unsupported_list(std::string list_name, std::stringstream& stream)
+    inline bool parse_bracketed_unsupported_list(std::string list_name, std::istringstream& stream)
     {
         std::string tmp = "";
         std::string elem;
@@ -204,17 +228,9 @@ protected:
         return ld->add_option_to_table("--" + list_name, tmp );
     }
 
-    inline bool open_table_add_option(std::string table_name, std::string opt_name, std::string val)
-    {
-        ld->open_table(table_name);
-        bool tmpval = ld->add_option_to_table(opt_name, val) && tmpval;
-        ld->close_table();
-        return tmpval;
-    }
-
 
     inline bool parse_deprecation_option(std::string opt_name,
-                                        std::stringstream& stream)
+                                        std::istringstream& stream)
     {
 
         std::string val;
@@ -227,20 +243,31 @@ protected:
     }
 
 
-private:
+    inline bool set_next_rule_state(std::istringstream& stream)
+    {
+        std::string keyword;
 
-};
+        std::getline(stream, keyword, ':');
+        util::trim(keyword);
 
+        if (keyword.empty())
+            return true;
 
-typedef ConversionState* (*conv_new_f)(Converter*, LuaData* ld);
+        // now, lets get the next option.
+        const ConvertMap* map = util::find_map(rules::rule_api, keyword);
+        if (map)
+        {
+            cv->set_state(map->ctor(cv, ld));
+            return true;
+        }
+
+        return false;
+    }
 
-struct ConvertMap
-{
-    std::string keyword;
-    conv_new_f ctor;
-};
 
+private:
 
+};
 
 
 #endif
diff --git a/tools/snort2lua/data/CMakeLists.txt b/tools/snort2lua/data/CMakeLists.txt
index 36a3bc844..77c71ec58 100644
--- a/tools/snort2lua/data/CMakeLists.txt
+++ b/tools/snort2lua/data/CMakeLists.txt
@@ -1,5 +1,7 @@
 
-add_library(conversion_data
+add_subdirectory(rule)
+
+add_library( conversion_data
     dt_data.h
     dt_data.cc
     dt_var.h
@@ -13,3 +15,7 @@ add_library(conversion_data
     dt_rule.h
     dt_rule.cc
 )
+
+target_link_libraries( conversion_data
+    rule_data
+)
diff --git a/tools/snort2lua/data/dt_data.cc b/tools/snort2lua/data/dt_data.cc
index 43522effe..2dbd7b3b3 100644
--- a/tools/snort2lua/data/dt_data.cc
+++ b/tools/snort2lua/data/dt_data.cc
@@ -46,6 +46,8 @@ static inline Table* find_table(std::vector<Table*> vec, std::string name)
 }
 
 LuaData::LuaData()
+    :   curr_rule(nullptr),
+        curr_rule_opt(nullptr)
 {
     comments = new Comments(start_comments, 0,
                     Comments::CommentType::MULTI_LINE);
@@ -92,6 +94,7 @@ void LuaData::reset_state()
     std::stack<Table*> empty;
     open_tables.swap(empty );
     curr_rule = nullptr;
+    curr_rule_opt = nullptr;
 }
 
 void LuaData::open_top_level_table(std::string table_name)
@@ -202,6 +205,13 @@ bool LuaData::add_option_to_table(const std::string option_name, const bool val)
     return true;
 }
 
+// compilers are fickle and dangerous creatures.  Ensure a literal gets
+// sent here rather to become a bool
+bool LuaData::add_option_to_table(const std::string name, const char* v)
+{
+    return add_option_to_table(name, std::string(v));
+}
+
 bool LuaData::add_list_to_table(std::string list_name, std::string next_elem)
 {
     if(open_tables.size() == 0)
@@ -262,7 +272,7 @@ bool LuaData::add_deprecated_comment(std::string dep_var)
 
     if (open_tables.size() == 0)
     {
-        add_error_comment("Must open table before adding an option!!: " +
+        add_error_comment("Must open table before adding deprecated comment!!: " +
             dep_var);
         return false;
     }
@@ -275,25 +285,117 @@ bool LuaData::add_deprecated_comment(std::string dep_var)
 
 void LuaData::begin_rule()
 {
-    curr_rule = new Rule();
-    rules.push_back(curr_rule);
+    if (curr_rule != nullptr)
+    {
+        add_error_comment("Attempted to add a nested rules!!");
+    }
+    else
+    {
+        curr_rule = new Rule();
+        rules.push_back(curr_rule);
+    }
 }
 
 bool LuaData::add_hdr_data(std::string data)
 {
-    return curr_rule->add_hdr_data(data);
+    if (curr_rule)
+        return curr_rule->add_hdr_data(data);
+
+    add_error_comment("Must begin a rule before adding a header!");
+    return false;
 }
 
+bool LuaData::add_rule_option(std::string opt_name)
+{
+    if (curr_rule)
+        return curr_rule->add_option(opt_name);
+
+    add_error_comment("Must begin a rule before adding an option!");
+    return false;
+}
+
+bool LuaData::add_rule_option(std::string opt_name, std::string val)
+{
+    if (curr_rule)
+        return curr_rule->add_option(opt_name, val);
+
+    add_error_comment("Must begin a rule before adding an option!");
+    return false;
+}
+
+
+bool LuaData::add_rule_option_before_selected(std::string keyword,
+                                            std::string val)
+{
+    if (!curr_rule_opt)
+    {
+        comments->add_text("Select an option before placing a "
+                "new option before selected option");
+        return false;
+    }
+
+    return curr_rule->add_option_before_selected(curr_rule_opt, keyword, val);
+}
+
+bool LuaData::add_suboption(std::string keyword)
+{
+    if (curr_rule_opt)
+        return curr_rule_opt->add_suboption(keyword);
+
+    add_error_comment("Select an option before adding a suboption!!");
+    return false;
+}
+
+bool LuaData::add_suboption(std::string keyword, std::string val)
+{
+    if (curr_rule_opt)
+        return curr_rule_opt->add_suboption(keyword, val);
+
+    add_error_comment("Select an option before adding a suboption!!");
+    return false;
+}
+
+bool LuaData::select_option(std::string opt_name)
+{
+    // using add_comment here so this error is right above the failed rule
+
+    if (curr_rule)
+    {
+        curr_rule_opt = curr_rule->select_option(opt_name);
+        if (curr_rule_opt != nullptr)
+            return true;
+        else
+            comments->add_text("Option " + opt_name + "never created for following rule:");
+    }
+    else
+    {
+        comments->add_text("Must begin a rule before selecting an option!");
+    }
+
+    return false;
+}
+
+void LuaData::unselect_option()
+{
+    curr_rule_opt = nullptr;
+}
 
 std::ostream& operator<<( std::ostream &out, const LuaData &data)
 {
     out << (*data.errors) << std::endl << std::endl;
 
-    for (Variable *v : data.vars)
-        out << (*v) << std::endl << std::endl;
+    for (Variable* v : data.vars)
+        out << (*v) << "\n\n";
+
+    out << "default_rules =\n[[\n";
+
+    for (Rule* r : data.rules)
+        out << (*r) << "\n";
+
+    out << "]]\n";
 
-    for (Table *t : data.tables)
-        out << (*t) << std::endl << std::endl;
+    for (Table* t : data.tables)
+        out << (*t) << "\n\n";
 
     out << (*data.comments) << std::endl;
 
diff --git a/tools/snort2lua/data/dt_data.h b/tools/snort2lua/data/dt_data.h
index 062ccac56..b492b5e5f 100644
--- a/tools/snort2lua/data/dt_data.h
+++ b/tools/snort2lua/data/dt_data.h
@@ -69,6 +69,7 @@ public:
     bool add_option_to_table(const std::string name, const std::string val);
     bool add_option_to_table(const std::string name, const int val);
     bool add_option_to_table(const std::string name, const bool val);
+    bool add_option_to_table(const std::string name, const char* v);
     // add an option with a list of variables -->  table = { name = 'elem1 elem2 ...' }
     // corresponds to Parameter::PT_MULTI
     bool add_list_to_table(std::string list_name, std::string next_elem);
@@ -81,9 +82,24 @@ public:
 
 
     // RULE PARSING
+    // Create a new rule object.
     void begin_rule();
     // add a new peice of header_data to the current rule
     bool add_hdr_data(std::string data);
+    // add a rule option (keyword and suboption)
+    bool add_rule_option(std::string keyword);
+    // add a rule option (keyword and suboption)
+    bool add_rule_option(std::string keyword, std::string val);
+    // add a rule option (keyword and suboption)
+    bool add_rule_option_before_selected(std::string keyword, std::string val = std::string());
+    // selects the rule option with the given name.  MUST BE CALLED BEFORE ADDING A SUBOPTION.
+    bool select_option(std::string keyword);
+    // clear the selected option.
+    void unselect_option();
+    // add a rule option (keyword and suboption)
+    bool add_suboption(std::string keyword);
+    // add a rule option (keyword and suboption)
+    bool add_suboption(std::string keyword, std::string val);
 
 private:
     std::vector<Variable*> vars;
@@ -93,6 +109,7 @@ private:
     Comments* errors;
     std::stack<Table*> open_tables;
     Rule* curr_rule;
+    RuleOption* curr_rule_opt;
 
 };
 
diff --git a/tools/snort2lua/data/dt_option.cc b/tools/snort2lua/data/dt_option.cc
index 07346f94a..7584510ed 100644
--- a/tools/snort2lua/data/dt_option.cc
+++ b/tools/snort2lua/data/dt_option.cc
@@ -33,7 +33,7 @@ Option::Option(std::string name, int val, int depth)
 Option::Option(std::string name, bool val, int depth)
 {
     this->name = name;
-    this->value = (val) ? "true" : "false";
+    this->value = (val) ? "true" : "ealse";
     this->depth = depth;
     this->type = OptionType::BOOL;
 }
diff --git a/tools/snort2lua/data/dt_rule.cc b/tools/snort2lua/data/dt_rule.cc
index 60766888b..6e9c7b48a 100644
--- a/tools/snort2lua/data/dt_rule.cc
+++ b/tools/snort2lua/data/dt_rule.cc
@@ -23,10 +23,8 @@
 #include "data/dt_rule.h"
 
 
-Rule::Rule()
+Rule::Rule() :  num_hdr_data(0), bad_rule(false)
 {
-    bad_rule = false;
-    num_hdr_data = 0;
 }
 
 Rule::~Rule(){};
@@ -47,18 +45,73 @@ bool Rule::add_hdr_data(std::string data)
     }
 }
 
+bool Rule::add_option(std::string keyword)
+{
+    RuleOption* r = new RuleOption(keyword);
+    options.push_back(r);
+    return true;
+}
+
+bool Rule::add_option(std::string keyword, std::string data)
+{
+    RuleOption* r = new RuleOption(keyword, data);
+    options.push_back(r);
+    return true;
+}
+
+bool Rule::add_option_before_selected(RuleOption* selected_opt,
+                                        std::string keyword,
+                                        std::string val)
+{
+    for (auto r = options.begin(); r != options.end(); ++r)
+    {
+        if ((*r) == selected_opt)
+        {
+            RuleOption* new_opt = new RuleOption(keyword, val);
+            options.insert(r, new_opt);
+            return true;
+        }
+    }
+
+    // impossible to occur.  Since a rule is already selected, we found this rule once.
+    return false;
+}
+
+RuleOption* Rule::select_option(std::string opt_name)
+{
+    for (auto r = options.rbegin(); r != options.rend(); ++r)
+        if (!opt_name.compare((*r)->get_name()))
+            return (*r);
+    return nullptr;
+}
 
 std::ostream &operator<<( std::ostream& out, const Rule &r)
 {
-    std::string built_string = "";
+    bool first_line = true;
 
     for(int i = 0; i < r.num_hdr_data; i++)
     {
-        if (!r.hdr_data.empty())
-            built_string += r.hdr_data[i];
+        if (first_line)
+            first_line = false;
+        else
+            out << " ";
+
+        out << r.hdr_data[i];
     }
 
+    out << " (";
+    first_line = true;
+
+    for (auto* r : r.options)
+    {
+        if (first_line)
+            first_line = false;
+        else
+            out << ";";
+        out << " " << (*r);
+    }
 
+    out << " )";
 
     return out;
 }
diff --git a/tools/snort2lua/data/dt_rule.h b/tools/snort2lua/data/dt_rule.h
index 4f473272a..db786db88 100644
--- a/tools/snort2lua/data/dt_rule.h
+++ b/tools/snort2lua/data/dt_rule.h
@@ -28,6 +28,8 @@
 #include <iostream>
 #include <array>
 
+#include "data/rule/rd_option.h"
+
 class Rule
 {
 public:
@@ -35,11 +37,18 @@ public:
     virtual ~Rule();
 
     bool add_hdr_data(std::string data);
+    bool add_option(std::string keyword);
+    bool add_option(std::string keyword, std::string data);
+    RuleOption* select_option(std::string opt_name);
+    bool add_option_before_selected(RuleOption* selected_opt,
+                                    std::string keyword,
+                                    std::string val);
 
     friend std::ostream &operator<<( std::ostream&, const Rule &);
 
 private:
     std::array<std::string, 7> hdr_data;
+    std::vector<RuleOption*> options;
     int num_hdr_data;
     bool bad_rule;
 };
diff --git a/tools/snort2lua/data/rule/CMakeLists.txt b/tools/snort2lua/data/rule/CMakeLists.txt
new file mode 100644
index 000000000..e38b19775
--- /dev/null
+++ b/tools/snort2lua/data/rule/CMakeLists.txt
@@ -0,0 +1,7 @@
+
+add_library( rule_data
+    rd_option.h
+    rd_option.cc
+    rd_suboption.h
+    rd_suboption.cc
+)
diff --git a/tools/snort2lua/data/rule/rd_option.cc b/tools/snort2lua/data/rule/rd_option.cc
new file mode 100644
index 000000000..d05ce9d36
--- /dev/null
+++ b/tools/snort2lua/data/rule/rd_option.cc
@@ -0,0 +1,65 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// rd_option.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include "data/rule/rd_option.h"
+
+
+
+RuleOption::RuleOption(std::string name) :
+        name(name), 
+        value(std::string())
+{}
+
+RuleOption::RuleOption(std::string name, std::string value) :
+        name(name), 
+        value(value)
+{}
+
+RuleOption::~RuleOption()
+{
+}
+
+bool RuleOption::add_suboption(std::string name)
+{
+    RuleSubOption* subopt = new RuleSubOption(name);
+    sub_options.push_back(subopt);
+    return true;
+}
+
+bool RuleOption::add_suboption(std::string name, std::string val)
+{
+    RuleSubOption* subopt = new RuleSubOption(name, val);
+    sub_options.push_back(subopt);
+    return true;
+}
+
+std::ostream &operator<<( std::ostream& out, const RuleOption &opt)
+{
+    out << opt.name;
+
+    if (!opt.value.empty())
+        out << ":" << opt.value;
+
+    for (RuleSubOption* rso : opt.sub_options)
+        out << ", " << (*rso);
+
+    return out;
+}
diff --git a/tools/snort2lua/data/rule/rd_option.h b/tools/snort2lua/data/rule/rd_option.h
new file mode 100644
index 000000000..2a4ba3e17
--- /dev/null
+++ b/tools/snort2lua/data/rule/rd_option.h
@@ -0,0 +1,56 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// dt_option.h author Josh Rosenbaum <jorosenba@cisco.com>
+
+#ifndef RD_OPTION_H
+#define RD_OPTION_H
+
+#include <string>
+#include <vector>
+#include <iostream>
+
+#include "data/rule/rd_suboption.h"
+
+class RuleOption
+{
+public:
+    RuleOption(std::string name);
+    RuleOption(std::string name, std::string val);
+    virtual ~RuleOption();
+
+    inline std::string get_name(){ return name; };
+
+    bool add_suboption(std::string name);
+    bool add_suboption(std::string name, std::string val);
+ 
+    // overloading operators
+    friend std::ostream &operator<<( std::ostream&, const RuleOption &);
+
+private:
+
+    std::string name;
+    std::string value;
+    std::vector<RuleSubOption*> sub_options;
+
+
+};
+
+
+#endif
diff --git a/tools/snort2lua/data/rule/rd_string.cc b/tools/snort2lua/data/rule/rd_string.cc
new file mode 100644
index 000000000..e69de29bb
diff --git a/tools/snort2lua/data/rule/rd_suboption.cc b/tools/snort2lua/data/rule/rd_suboption.cc
new file mode 100644
index 000000000..08f334d8f
--- /dev/null
+++ b/tools/snort2lua/data/rule/rd_suboption.cc
@@ -0,0 +1,52 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// rd_suboption.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <string>
+
+#include "data/rule/rd_suboption.h"
+
+
+RuleSubOption::RuleSubOption(std::string name)
+    :   name(name), 
+        value(std::string())
+{
+}
+
+RuleSubOption::RuleSubOption(std::string name, std::string value)
+    :   name(name), 
+        value(value)
+{
+}
+
+RuleSubOption::~RuleSubOption()
+{
+}
+
+// overloading operators
+std::ostream &operator<<( std::ostream& out, const RuleSubOption& subopt)
+{
+    out << subopt.name;
+
+    if (!subopt.value.empty())
+        out << ":" << subopt.value;
+
+    return out;
+}
diff --git a/tools/snort2lua/data/rule/rd_suboption.h b/tools/snort2lua/data/rule/rd_suboption.h
new file mode 100644
index 000000000..a58b9eba7
--- /dev/null
+++ b/tools/snort2lua/data/rule/rd_suboption.h
@@ -0,0 +1,48 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// dt_option.h author Josh Rosenbaum <jorosenba@cisco.com>
+
+#ifndef RD_SUBOPTION_H
+#define RD_SUBOPTION_H
+
+#include <string>
+#include <vector>
+#include <iostream>
+
+class RuleSubOption
+{
+public:
+    RuleSubOption(std::string name);
+    RuleSubOption(std::string name, std::string val);
+    virtual ~RuleSubOption();
+ 
+    // overloading operators
+    friend std::ostream &operator<<( std::ostream&, const RuleSubOption &);
+
+private:
+//    enum class OptionType{ STRING, VAR, BOOL, INT};
+
+    std::string name;
+    std::string value;
+//    OptionType type;
+};
+
+
+#endif
diff --git a/tools/snort2lua/init_state.cc b/tools/snort2lua/init_state.cc
index de1f34be8..4f661f856 100644
--- a/tools/snort2lua/init_state.cc
+++ b/tools/snort2lua/init_state.cc
@@ -31,7 +31,7 @@
 
 InitState::InitState(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {}
 
-bool InitState::convert(std::stringstream& data_stream)
+bool InitState::convert(std::istringstream& data_stream)
 {
     std::string keyword;
 
diff --git a/tools/snort2lua/init_state.h b/tools/snort2lua/init_state.h
index 14a84ccbe..5bd859733 100644
--- a/tools/snort2lua/init_state.h
+++ b/tools/snort2lua/init_state.h
@@ -32,12 +32,12 @@ class InitState : public ConversionState
 public:
     InitState(Converter* cv, LuaData* ld);
     virtual ~InitState() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 
 };
 
 
-static ConversionState* init_state_ctor(Converter* cv, LuaData* ld)
+static inline ConversionState* init_state_ctor(Converter* cv, LuaData* ld)
 {
     return new InitState(cv, ld);
 }
diff --git a/tools/snort2lua/keyword_states/keywords_api.cc b/tools/snort2lua/keyword_states/keywords_api.cc
index 5cd0c6aa2..e2b2105f1 100644
--- a/tools/snort2lua/keyword_states/keywords_api.cc
+++ b/tools/snort2lua/keyword_states/keywords_api.cc
@@ -60,3 +60,20 @@ const std::vector<const ConvertMap*> keyword_api =
     dynamic_map,
 //    nullptr,
 };
+
+#if 0
+
+namespace keywords
+{
+
+void add_new_rule_keyword(std::string keyword_name)
+{
+    struct Convertmap* new_ruletype = new ConvertMap;
+
+    new_ruletype.keyword = keywords.name;
+
+}
+
+} // namespace keywords
+
+#endif
diff --git a/tools/snort2lua/keyword_states/keywords_api.h b/tools/snort2lua/keyword_states/keywords_api.h
index 8f4c5a2c2..30191a6cd 100644
--- a/tools/snort2lua/keyword_states/keywords_api.h
+++ b/tools/snort2lua/keyword_states/keywords_api.h
@@ -23,8 +23,18 @@
 #define KEYWORDS_API_H
 
 #include <vector>
+#include <string>
 #include "../conversion_state.h"
 
 extern const std::vector<const ConvertMap*> keyword_api;
 
+#if 0
+namespace keywords
+{
+
+void add_new_rule_keyword(std::string);
+
+}  // namespace keywords
+#endif
+
 #endif
diff --git a/tools/snort2lua/keyword_states/kws_config.cc b/tools/snort2lua/keyword_states/kws_config.cc
index 8715d4a68..0456fefe9 100644
--- a/tools/snort2lua/keyword_states/kws_config.cc
+++ b/tools/snort2lua/keyword_states/kws_config.cc
@@ -35,13 +35,13 @@ class Config : public ConversionState
 public:
     Config(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Config() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool Config::convert(std::stringstream& data_stream)
+bool Config::convert(std::istringstream& data_stream)
 {
     std::string keyword;
 
diff --git a/tools/snort2lua/keyword_states/kws_include.cc b/tools/snort2lua/keyword_states/kws_include.cc
index f2bccfc28..5cf919e60 100644
--- a/tools/snort2lua/keyword_states/kws_include.cc
+++ b/tools/snort2lua/keyword_states/kws_include.cc
@@ -34,13 +34,13 @@ class Include : public ConversionState
 public:
     Include(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Include() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool Include::convert(std::stringstream& data_stream)
+bool Include::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool includ_test;
diff --git a/tools/snort2lua/keyword_states/kws_output.cc b/tools/snort2lua/keyword_states/kws_output.cc
index 4c9e0f78f..5f435d251 100644
--- a/tools/snort2lua/keyword_states/kws_output.cc
+++ b/tools/snort2lua/keyword_states/kws_output.cc
@@ -36,13 +36,13 @@ class Output : public ConversionState
 public:
     Output(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Output() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool Output::convert(std::stringstream& data_stream)
+bool Output::convert(std::istringstream& data_stream)
 {
     std::string keyword;
 
diff --git a/tools/snort2lua/keyword_states/kws_preprocessor.cc b/tools/snort2lua/keyword_states/kws_preprocessor.cc
index 4aeb55113..99d7921fe 100644
--- a/tools/snort2lua/keyword_states/kws_preprocessor.cc
+++ b/tools/snort2lua/keyword_states/kws_preprocessor.cc
@@ -34,13 +34,13 @@ class Preprocessor : public ConversionState
 public:
     Preprocessor(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Preprocessor() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool Preprocessor::convert(std::stringstream& data_stream)
+bool Preprocessor::convert(std::istringstream& data_stream)
 {
     std::string keyword;
 
diff --git a/tools/snort2lua/keyword_states/kws_rule.cc b/tools/snort2lua/keyword_states/kws_rule.cc
index b951a9883..92b5d8d14 100644
--- a/tools/snort2lua/keyword_states/kws_rule.cc
+++ b/tools/snort2lua/keyword_states/kws_rule.cc
@@ -36,73 +36,77 @@ class RuleHeader : public ConversionState
 public:
     explicit RuleHeader(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~RuleHeader() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
-bool RuleHeader::convert(std::stringstream& data_stream)
+bool RuleHeader::convert(std::istringstream& data_stream)
 {
     std::string hdr_data;
-    bool rule_test;
-
-    ld->begin_rule();
 
     // should technically be either one or seven options, but I'm
     // not doing error checking here.
-    while (data_stream >> hdr_data && hdr_data.front() != ('('))
+    std::getline(data_stream, hdr_data, '(');
+    std::istringstream in(hdr_data);
+
+    while (in >> hdr_data)
     {
         ld->add_hdr_data(hdr_data);
     }
 
-    if (!hdr_data.compare("("))
-    {
-        if(!(data_stream >> hdr_data))
-            return false;
-    }
-    else
-    {
-        hdr_data.erase(hdr_data.begin());
-    }
 
-    if(hdr_data.back() == ':')
-        hdr_data.pop_back();
+    // Now, remove the last ')' and anything beyond. We will automatically
+    // add that part back when printing each rule.
+    int curr_pos = data_stream.tellg();
+    std::string rule_string = data_stream.str();
+    int end_pos = rule_string.rfind(')');
+    rule_string = rule_string.substr(0, end_pos);
+    data_stream.str(rule_string);
+    data_stream.seekg(curr_pos);  // position was reset. so find curr position
 
-    // now, lets get the next option and start parsing!
-    const ConvertMap* map = util::find_map(rules::rule_api, hdr_data);
-    if (map)
-    {
-        cv->set_state(map->ctor(cv, ld));
-        return true;
-    }
-
-    return false;
+    // and call the first keywords
+    return set_next_rule_state(data_stream);
 }
 
 /********************************
  *******  GENERAL API ***********
  ********************************/
 
-
-static ConversionState* deprecate_rule_ctor(Converter* cv, LuaData* ld)
+template<const std::string *name>
+static ConversionState* rule_ctor(Converter* cv, LuaData* ld)
 {
+    ld->begin_rule();
+    ld->add_hdr_data(*name);
     return new RuleHeader(cv, ld);
 }
 
-
-static ConversionState* rule_ctor(Converter* cv, LuaData* ld)
+template<const std::string *name>
+static ConversionState* dep_rule_ctor(Converter* cv, LuaData* ld)
 {
+    ld->begin_rule();
+    ld->add_hdr_data(*name);
     return new RuleHeader(cv, ld);
 }
 
-static const ConvertMap alert_api = {"alert", rule_ctor};
-static const ConvertMap log_api = {"log", rule_ctor};
-static const ConvertMap pass_api = {"pass", rule_ctor};
-static const ConvertMap drop_api = {"drop", rule_ctor};
-static const ConvertMap reject_api = {"reject", rule_ctor};
-static const ConvertMap sdrop_api = {"sdrop", rule_ctor};
-static const ConvertMap activate_api = {"activate", deprecate_rule_ctor};
-static const ConvertMap dynamic_api = {"dynamic", deprecate_rule_ctor};
+
+static const std::string alert = "alert";
+static const std::string log = "log";
+static const std::string pass = "pass";
+static const std::string drop = "drop";
+static const std::string reject = "reject";
+static const std::string sdrop = "sdrop";
+static const std::string activate = "activate";
+static const std::string dynamic = "dynamic";
+
+static const ConvertMap alert_api = {alert, rule_ctor<&alert>};
+static const ConvertMap log_api = {log, rule_ctor<&log>};
+static const ConvertMap pass_api = {pass, rule_ctor<&pass>};
+static const ConvertMap drop_api = {drop, rule_ctor<&drop>};
+static const ConvertMap reject_api = {reject, rule_ctor<&reject>};
+static const ConvertMap sdrop_api = {sdrop, rule_ctor<&sdrop>};
+static const ConvertMap activate_api = {activate, dep_rule_ctor<&activate>};
+static const ConvertMap dynamic_api = {dynamic, dep_rule_ctor<&dynamic>};
 
 
 const ConvertMap* alert_map = &alert_api;
diff --git a/tools/snort2lua/keyword_states/kws_ruletype.cc b/tools/snort2lua/keyword_states/kws_ruletype.cc
index 31630c2a2..1c935e1ac 100644
--- a/tools/snort2lua/keyword_states/kws_ruletype.cc
+++ b/tools/snort2lua/keyword_states/kws_ruletype.cc
@@ -34,13 +34,13 @@ class RuleType : public ConversionState
 public:
     RuleType(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~RuleType() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool RuleType::convert(std::stringstream& data_stream)
+bool RuleType::convert(std::istringstream& data_stream)
 {
     std::string keyword;
 #if 0
diff --git a/tools/snort2lua/keyword_states/kws_suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc
index 76383502b..f9a5316bc 100644
--- a/tools/snort2lua/keyword_states/kws_suppress.cc
+++ b/tools/snort2lua/keyword_states/kws_suppress.cc
@@ -34,13 +34,13 @@ class Suppress : public ConversionState
 public:
     Suppress(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Suppress() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool Suppress::convert(std::stringstream& data_stream)
+bool Suppress::convert(std::istringstream& data_stream)
 {
     bool retval = true;
     std::string keyword;
diff --git a/tools/snort2lua/keyword_states/kws_var.cc b/tools/snort2lua/keyword_states/kws_var.cc
index 502fa71f1..34aeee59b 100644
--- a/tools/snort2lua/keyword_states/kws_var.cc
+++ b/tools/snort2lua/keyword_states/kws_var.cc
@@ -34,7 +34,7 @@ class Var : public ConversionState
 public:
     Var(Converter* cv, LuaData* ld);
     virtual ~Var() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 
 private:
     bool first_line;
@@ -51,7 +51,7 @@ Var::Var(Converter* cv, LuaData* ld) : ConversionState(cv, ld)
     is_port_list = false;
 }
 
-bool Var::convert(std::stringstream& data_stream)
+bool Var::convert(std::istringstream& data_stream)
 {
     std::string ports;//    cv->print_line(data_stream);
 
diff --git a/tools/snort2lua/preprocessor_states/pps_arpspoof.cc b/tools/snort2lua/preprocessor_states/pps_arpspoof.cc
index bd0255699..5d2923cfe 100644
--- a/tools/snort2lua/preprocessor_states/pps_arpspoof.cc
+++ b/tools/snort2lua/preprocessor_states/pps_arpspoof.cc
@@ -32,13 +32,13 @@ class ArpSpoof : public ConversionState
 public:
     ArpSpoof(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~ArpSpoof() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
 
-bool ArpSpoof::convert(std::stringstream& data_stream)
+bool ArpSpoof::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
@@ -86,13 +86,13 @@ class ArpSpoofHost : public ConversionState
 public:
     ArpSpoofHost(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~ArpSpoofHost() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
 
-bool ArpSpoofHost::convert(std::stringstream& data_stream)
+bool ArpSpoofHost::convert(std::istringstream& data_stream)
 {
     std::string ip, mac;
 
diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc
index 056d376c7..045f3f1bd 100644
--- a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc
+++ b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc
@@ -33,17 +33,17 @@ class Frag3Engine : public ConversionState
 public:
     explicit Frag3Engine(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Frag3Engine() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 
 private:
-    bool parse_ip_list(std::string, std::stringstream& data_stream);
+    bool parse_ip_list(std::string, std::istringstream& data_stream);
 };
 
 } // namespace
 
 
 bool Frag3Engine::parse_ip_list(std::string list_name, 
-                                std::stringstream& data_stream)
+                                std::istringstream& data_stream)
 {
     std::string prev;
     std::string elem;
@@ -65,7 +65,7 @@ bool Frag3Engine::parse_ip_list(std::string list_name,
 
 }
 
-bool Frag3Engine::convert(std::stringstream& data_stream)
+bool Frag3Engine::convert(std::istringstream& data_stream)
 {
 
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_global.cc b/tools/snort2lua/preprocessor_states/pps_frag3_global.cc
index 6141ada6a..28850b68e 100644
--- a/tools/snort2lua/preprocessor_states/pps_frag3_global.cc
+++ b/tools/snort2lua/preprocessor_states/pps_frag3_global.cc
@@ -33,12 +33,12 @@ class Frag3Global : public ConversionState
 public:
     Frag3Global(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Frag3Global() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
-bool Frag3Global::convert(std::stringstream& data_stream)
+bool Frag3Global::convert(std::istringstream& data_stream)
 {
 
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc
index 41836a5b7..3e16faafa 100644
--- a/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc
+++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc
@@ -33,7 +33,7 @@ class FtpTelnet : public ConversionState
 public:
     FtpTelnet(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~FtpTelnet() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 private:
     bool add_ftp_n_telnet_option(std::string opt_name, bool val);
     void add_ftp_n_telnet_deprecated(std::string opt_name);
@@ -64,7 +64,7 @@ void FtpTelnet::add_ftp_n_telnet_deprecated(std::string opt_name)
     ld->close_table();
 }
 
-bool FtpTelnet::convert(std::stringstream& data_stream)
+bool FtpTelnet::convert(std::istringstream& data_stream)
 {
 
     std::string keyword;
diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
index f077e0b3c..4b42cfffc 100644
--- a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
+++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
@@ -33,10 +33,10 @@ class FtpServer : public ConversionState
 public:
     FtpServer(Converter* cv, LuaData* ld);
     virtual ~FtpServer() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 private:
-    bool parse_alt_max_cmd(std::stringstream& data_stream);
-    bool parse_cmd_validity_cmd(std::stringstream& data_stream);
+    bool parse_alt_max_cmd(std::istringstream& data_stream);
+    bool parse_cmd_validity_cmd(std::istringstream& data_stream);
     static int ftpsever_binding_id;
 };
 
@@ -45,7 +45,7 @@ class FtpClient : public ConversionState
 public:
     FtpClient(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~FtpClient() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 private:
     static int ftpclient_binding_id;
 };
@@ -55,7 +55,7 @@ class Telnet : public ConversionState
 public:
     Telnet(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Telnet() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 class FtpTelnetProtocol : public ConversionState
@@ -63,7 +63,7 @@ class FtpTelnetProtocol : public ConversionState
 public:
     FtpTelnetProtocol(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~FtpTelnetProtocol() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
@@ -79,7 +79,7 @@ int FtpServer::ftpsever_binding_id = 1;
 FtpServer::FtpServer(Converter* cv, LuaData* ld) : ConversionState(cv, ld)
 {}
 
-bool FtpServer::parse_alt_max_cmd(std::stringstream& data_stream)
+bool FtpServer::parse_alt_max_cmd(std::istringstream& data_stream)
 {
     int i_val;
     bool tmpval;
@@ -96,7 +96,7 @@ bool FtpServer::parse_alt_max_cmd(std::stringstream& data_stream)
     return tmpval;
 }
 
-bool FtpServer::parse_cmd_validity_cmd(std::stringstream& data_stream)
+bool FtpServer::parse_cmd_validity_cmd(std::istringstream& data_stream)
 {
     std::string val;
     std::string elem;
@@ -123,7 +123,7 @@ bool FtpServer::parse_cmd_validity_cmd(std::stringstream& data_stream)
     return tmpval;
 }
 
-bool FtpServer::convert(std::stringstream& data_stream)
+bool FtpServer::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
@@ -210,7 +210,7 @@ bool FtpServer::convert(std::stringstream& data_stream)
 
 int FtpClient::ftpclient_binding_id = 1;
 
-bool FtpClient::convert(std::stringstream& data_stream)
+bool FtpClient::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
@@ -274,7 +274,7 @@ bool FtpClient::convert(std::stringstream& data_stream)
  *********  Telnet Protocol  ************
  ****************************************/
 
-bool Telnet::convert(std::stringstream& data_stream)
+bool Telnet::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     int i_val;
@@ -321,7 +321,7 @@ bool Telnet::convert(std::stringstream& data_stream)
  ****************************************/
 
 
-bool FtpTelnetProtocol::convert(std::stringstream& data_stream)
+bool FtpTelnetProtocol::convert(std::istringstream& data_stream)
 {
     std::string protocol;
 
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
index 98a729c11..75438b014 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
@@ -34,10 +34,10 @@ class HttpInspect : public ConversionState
 public:
     HttpInspect(Converter* cv, LuaData* ld);
     virtual ~HttpInspect() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 
 private:
-    bool add_decode_option(std::string opt_name,  std::stringstream& stream);
+    bool add_decode_option(std::string opt_name,  std::istringstream& stream);
 };
 
 } // namespace
@@ -46,7 +46,7 @@ private:
 HttpInspect::HttpInspect(Converter* cv, LuaData* ld) : ConversionState(cv, ld)
 {}
 
-bool HttpInspect::convert(std::stringstream& data_stream)
+bool HttpInspect::convert(std::istringstream& data_stream)
 {
     std::string keyword;
 
@@ -136,7 +136,7 @@ bool HttpInspect::convert(std::stringstream& data_stream)
     return retval;    
 }
 
-bool HttpInspect::add_decode_option(std::string opt_name,  std::stringstream& stream)
+bool HttpInspect::add_decode_option(std::string opt_name,  std::istringstream& stream)
 {
     int val;
 
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index 860e9e7c5..b035cdc99 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -33,7 +33,7 @@ class HttpInspectServer : public ConversionState
 public:
     HttpInspectServer(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~HttpInspectServer() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 
 private:
     static int binding_id;
@@ -51,7 +51,7 @@ private:
 
 int HttpInspectServer::binding_id = 0;
 
-bool HttpInspectServer::convert(std::stringstream& data_stream)
+bool HttpInspectServer::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_normalizers.cc b/tools/snort2lua/preprocessor_states/pps_normalizers.cc
index a8728a256..3b738e9ab 100644
--- a/tools/snort2lua/preprocessor_states/pps_normalizers.cc
+++ b/tools/snort2lua/preprocessor_states/pps_normalizers.cc
@@ -80,13 +80,13 @@ class Ip4Normalizer : public ConversionState
 public:
     Ip4Normalizer(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Ip4Normalizer() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
 
-bool Ip4Normalizer::convert(std::stringstream& data_stream)
+bool Ip4Normalizer::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
@@ -166,7 +166,7 @@ class TcpNormalizer : public ConversionState
 public:
     TcpNormalizer(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~TcpNormalizer() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 private:
     bool set_base_w_comment(std::string);
     bool set_ecn_w_comment(std::string);
@@ -198,7 +198,7 @@ bool TcpNormalizer::set_trim_w_comment(std::string comment)
 }
 
 
-bool TcpNormalizer::convert(std::stringstream& data_stream)
+bool TcpNormalizer::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     std::string value;
diff --git a/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc b/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc
index f538c47a2..2f574286f 100644
--- a/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc
+++ b/tools/snort2lua/preprocessor_states/pps_perfmonitor.cc
@@ -34,9 +34,9 @@ class PerfMonitor : public ConversionState
 public:
     PerfMonitor(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~PerfMonitor() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 private:
-    bool parse_file_option(std::stringstream& data_stream,
+    bool parse_file_option(std::istringstream& data_stream,
                         std::string orig_name,
                         std::string option_name,
                         std::string new_file_name);
@@ -44,7 +44,7 @@ private:
 
 } // namespace
 
-bool PerfMonitor::parse_file_option(std::stringstream& data_stream,
+bool PerfMonitor::parse_file_option(std::istringstream& data_stream,
                                 std::string orig_name,
                                 std::string option_name,
                                 std::string new_file_name)
@@ -61,7 +61,7 @@ bool PerfMonitor::parse_file_option(std::stringstream& data_stream,
     return false;
 }
 
-bool PerfMonitor::convert(std::stringstream& data_stream)
+bool PerfMonitor::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc b/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc
index f839f5dda..780e35690 100644
--- a/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc
+++ b/tools/snort2lua/preprocessor_states/pps_rpc_decode.cc
@@ -34,12 +34,12 @@ class RpcDecode : public ConversionState
 public:
     RpcDecode(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~RpcDecode() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
-bool RpcDecode::convert(std::stringstream& data_stream)
+bool RpcDecode::convert(std::istringstream& data_stream)
 {
 
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
index 91800e8d4..d3715911e 100644
--- a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
+++ b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
@@ -33,20 +33,20 @@ class PortScan : public ConversionState
 public:
     PortScan(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~PortScan() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 
 private:
-    bool parse_list(std::string table_name, std::stringstream& data_stream);
-    bool parse_option(std::string table_name, std::stringstream& data_stream);
-    bool add_portscan_global_option(std::string name, std::stringstream& data_stream);
+    bool parse_list(std::string table_name, std::istringstream& data_stream);
+    bool parse_option(std::string table_name, std::istringstream& data_stream);
+    bool add_portscan_global_option(std::string name, std::istringstream& data_stream);
     // a wrapper for parse_list.  adds an addition '[..]' around the string
-    bool parse_ip_list(std::string table_name, std::stringstream& data_stream);
+    bool parse_ip_list(std::string table_name, std::istringstream& data_stream);
 };
 
 } // namespace
 
 
-bool PortScan::parse_ip_list(std::string list_name, std::stringstream& data_stream)
+bool PortScan::parse_ip_list(std::string list_name, std::istringstream& data_stream)
 {
     std::string prev;
     std::string elem;
@@ -67,7 +67,7 @@ bool PortScan::parse_ip_list(std::string list_name, std::stringstream& data_stre
     return ld->add_option_to_table(list_name, prev);
 }
 
-bool PortScan::parse_list(std::string list_name, std::stringstream& data_stream)
+bool PortScan::parse_list(std::string list_name, std::istringstream& data_stream)
 {
     std::string elem;
     bool retval = true;
@@ -81,7 +81,7 @@ bool PortScan::parse_list(std::string list_name, std::stringstream& data_stream)
     return retval;
 }
 
-bool PortScan::parse_option(std::string list_name, std::stringstream& data_stream)
+bool PortScan::parse_option(std::string list_name, std::istringstream& data_stream)
 {
     std::string elem;
     bool retval = true;
@@ -95,7 +95,7 @@ bool PortScan::parse_option(std::string list_name, std::stringstream& data_strea
     return retval;
 }
 
-bool PortScan::add_portscan_global_option(std::string name, std::stringstream& data_stream)
+bool PortScan::add_portscan_global_option(std::string name, std::istringstream& data_stream)
 {
     int val;
     std::string garbage;
@@ -119,7 +119,7 @@ bool PortScan::add_portscan_global_option(std::string name, std::stringstream& d
 }
 
 
-bool PortScan::convert(std::stringstream& data_stream)
+bool PortScan::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_smtp.cc b/tools/snort2lua/preprocessor_states/pps_smtp.cc
index 7853c2219..f8fcb453b 100644
--- a/tools/snort2lua/preprocessor_states/pps_smtp.cc
+++ b/tools/snort2lua/preprocessor_states/pps_smtp.cc
@@ -33,13 +33,13 @@ class Smtp : public ConversionState
 public:
     Smtp(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Smtp() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
 
-bool Smtp::convert(std::stringstream& data_stream)
+bool Smtp::convert(std::istringstream& data_stream)
 {
 
 #if 0
diff --git a/tools/snort2lua/preprocessor_states/pps_stream_global.cc b/tools/snort2lua/preprocessor_states/pps_stream_global.cc
index eb3a5bedb..5c73744e7 100644
--- a/tools/snort2lua/preprocessor_states/pps_stream_global.cc
+++ b/tools/snort2lua/preprocessor_states/pps_stream_global.cc
@@ -34,13 +34,13 @@ class StreamGlobal : public ConversionState
 public:
     StreamGlobal(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~StreamGlobal() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
 
-bool StreamGlobal::convert(std::stringstream& data_stream)
+bool StreamGlobal::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc
index 39412a04b..0a6aaf39e 100644
--- a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc
+++ b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc
@@ -33,16 +33,16 @@ class StreamTcp : public ConversionState
 public:
     StreamTcp(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~StreamTcp() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 
 private:
-    bool parse_small_segments(std::stringstream& data_stream);
-    bool parse_ports(std::stringstream& data_stream);
+    bool parse_small_segments(std::istringstream& data_stream);
+    bool parse_ports(std::istringstream& data_stream);
 };
 
 } // namespace
 
-bool StreamTcp::parse_small_segments(std::stringstream& data_stream)
+bool StreamTcp::parse_small_segments(std::istringstream& data_stream)
 {
     std::string s_val;
     int i_val;
@@ -96,7 +96,7 @@ bool StreamTcp::parse_small_segments(std::stringstream& data_stream)
 }
 
 
-bool StreamTcp::parse_ports(std::stringstream& data_stream)
+bool StreamTcp::parse_ports(std::istringstream& data_stream)
 {
     std::string s_val;
     std::string opt_name;
@@ -137,7 +137,7 @@ bool StreamTcp::parse_ports(std::stringstream& data_stream)
 }
 
 
-bool StreamTcp::convert(std::stringstream& data_stream)
+bool StreamTcp::convert(std::istringstream& data_stream)
 {
     std::string keyword;
     bool retval = true;
diff --git a/tools/snort2lua/preprocessor_states/pps_stream_udp.cc b/tools/snort2lua/preprocessor_states/pps_stream_udp.cc
index 3198f7933..0bd629116 100644
--- a/tools/snort2lua/preprocessor_states/pps_stream_udp.cc
+++ b/tools/snort2lua/preprocessor_states/pps_stream_udp.cc
@@ -33,12 +33,12 @@ class StreamUdp : public ConversionState
 public:
     StreamUdp(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~StreamUdp() {};
-    virtual bool convert(std::stringstream& data_stream);
+    virtual bool convert(std::istringstream& data_stream);
 };
 
 } // namespace
 
-bool StreamUdp::convert(std::stringstream& data_stream)
+bool StreamUdp::convert(std::istringstream& data_stream)
 {
 
     bool retval = true;
diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt
index 452bb1925..209173461 100644
--- a/tools/snort2lua/rule_states/CMakeLists.txt
+++ b/tools/snort2lua/rule_states/CMakeLists.txt
@@ -1,6 +1,7 @@
 
 add_library( rule_states
     rule_content.cc
+    rule_unchanged.cc
     rule_api.cc
     rule_api.h
 )
diff --git a/tools/snort2lua/rule_states/rule_api.cc b/tools/snort2lua/rule_states/rule_api.cc
index 611b112ca..5f8338574 100644
--- a/tools/snort2lua/rule_states/rule_api.cc
+++ b/tools/snort2lua/rule_states/rule_api.cc
@@ -21,17 +21,30 @@
 
 #include <string>
 #include "rule_states/rule_api.h"
-
+#include "util/util.h"
+#include "util/converter.h"
 
 namespace rules
 {
 
 
 extern const ConvertMap* content_map;
+extern const ConvertMap* gid_map;
+extern const ConvertMap* msg_map;
+extern const ConvertMap* protected_content_map;
+extern const ConvertMap* rev_map;
+extern const ConvertMap* sid_map;
+extern const ConvertMap* uricontent_map;
 
 const std::vector<const ConvertMap*> rule_api =
 {
     content_map,
+    gid_map,
+    msg_map,
+    protected_content_map,
+    rev_map,
+    sid_map,
+    uricontent_map,
 };
 
 } // namespace rules
diff --git a/tools/snort2lua/rule_states/rule_api.h b/tools/snort2lua/rule_states/rule_api.h
index 8a9765500..5a1c5f78c 100644
--- a/tools/snort2lua/rule_states/rule_api.h
+++ b/tools/snort2lua/rule_states/rule_api.h
@@ -19,22 +19,23 @@
  */
 // converter.h author Josh Rosenbaum <jorosenba@cisco.com>
 
-#include <sstream>
-#include "conversion_state.h"
 
 #ifndef RULE_API_H
 #define RULE_API_H
 
-
+#include <sstream>
+#include <istream>
 #include <vector>
+
 #include "conversion_state.h"
 
 namespace rules
 {
 
-// vector containing all of hte rule keywords
+// vector containing all of the rule keywords
 extern const std::vector<const ConvertMap*> rule_api;
 
+//bool set_next_rule_state(std::istringstream, Converter* cv, LuaData* ld);
 
 } // namespace rules
 
diff --git a/tools/snort2lua/rule_states/rule_content.cc b/tools/snort2lua/rule_states/rule_content.cc
index 3cc428b18..2650b41f0 100644
--- a/tools/snort2lua/rule_states/rule_content.cc
+++ b/tools/snort2lua/rule_states/rule_content.cc
@@ -17,66 +17,225 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// kws_ruletype.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// rule_content.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
 
 #include "conversion_state.h"
 #include "util/converter.h"
+#include "rule_states/rule_api.h"
+#include "util/util.h"
 
 namespace rules
 {
 
 namespace {
 
+
+template<const std::string *option_name>
 class Content : public ConversionState
 {
 public:
     Content(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {};
     virtual ~Content() {};
-    virtual bool convert(std::stringstream& data);
+    virtual bool convert(std::istringstream& data);
 };
 
 } // namespace
 
 
-bool Content::convert(std::stringstream& data_stream)
+template<const std::string *option_name>
+bool Content<option_name>::convert(std::istringstream& data_stream)
 {
     std::string keyword;
-#if 0
-    if(data_stream >> keyword)
+    std::string val;
+    bool retval = true;
+
+    std::getline(data_stream, val, ';');
+    retval = ld->add_rule_option(*option_name, val);
+    ld->select_option(*option_name);
+
+    int pos = data_stream.tellg();
+    std::getline(data_stream, val, ';');
+    std::istringstream subopts(val);
+
+    while(subopts >> val)
     {
+        bool tmpval = true;
+        util::trim(val);
+        int keyword_pos = val.find_first_of(':');
+        std::string keyword;
+
+        if (keyword_pos != std::string::npos)
+        {
+            keyword = val.substr(0, keyword_pos);
+            val = val.substr(keyword_pos + 1, std::string::npos);
+//            subopts.str(val);  // reset the subopts buffer for someone else
+        }
+        else
+        {
+            keyword = val;
+            val = std::string();
+        }
+
+        if (!keyword.compare("offset"))
+            tmpval = ld->add_suboption("offset", val);
+
+        else if (!keyword.compare("distance"))
+            tmpval = ld->add_suboption("distance", val);
+
+        else if (!keyword.compare("within"))
+            tmpval = ld->add_suboption("within", val);
+
+        else if (!keyword.compare("depth"))
+            tmpval = ld->add_suboption("depth", val);
+
+        else if (!keyword.compare("nocase"))
+            tmpval = ld->add_suboption("nocase");
+
+        else if (!keyword.compare("rawbytes"))
+            tmpval = ld->add_rule_option_before_selected("pkt_data");
+
+        else if (!keyword.compare("http_client_body"))
+            tmpval = ld->add_rule_option_before_selected("http_client_body");
+
+        else if (!keyword.compare("http_cookie"))
+            tmpval = ld->add_rule_option_before_selected("http_cookie");
+
+        else if (!keyword.compare("http_raw_cookie"))
+            tmpval = ld->add_rule_option_before_selected("http_raw_cookie");
+
+        else if (!keyword.compare("http_header"))
+            tmpval = ld->add_rule_option_before_selected("http_header");
+
+        else if (!keyword.compare("http_raw_header"))
+            tmpval = ld->add_rule_option_before_selected("http_raw_header");
+
+        else if (!keyword.compare("http_method"))
+            tmpval = ld->add_rule_option_before_selected("http_method");
+
+        else if (!keyword.compare("http_uri"))
+            tmpval = ld->add_rule_option_before_selected("http_uri");
+
+        else if (!keyword.compare("http_raw_uri"))
+            tmpval = ld->add_rule_option_before_selected("http_raw_uri");
+
+        else if (!keyword.compare("http_stat_code"))
+            tmpval = ld->add_rule_option_before_selected("http_stat_code");
+
+        else if (!keyword.compare("http_stat_msg"))
+            tmpval = ld->add_rule_option_before_selected("http_stat_msg");
 
-        if(keyword.back() == ':')
-            keyword.pop_back();
+        else if (!keyword.compare("hash"))   // PROTECTED CONTENT
+            tmpval = ld->add_suboption("hash", val);
 
-        const ConvertMap* map = util::find_map(rules::rule_api, keyword);
-        if (map)
+        else if (!keyword.compare("length"))  // PROTECTED CONTENT
+            tmpval = ld->add_suboption("length", val);
+
+        else if (!keyword.compare("fast_pattern"))
+        {
+            if (val.empty())
+                tmpval = ld->add_suboption("fast_pattern");
+
+            else if(!val.compare("only"))
+                tmpval = true;  // deprecated.  ignore.
+
+            else
+            {
+                // don't let the program catch for invalid syntax.
+                try
+                {
+                    std::size_t pos;
+                    int offset = std::stoi(val, &pos);
+                    if (val[pos] == ',')
+                    {
+                        pos++;
+                        int length = std::stoi(val.substr(pos, std::string::npos));
+                        tmpval = ld->add_suboption("fast_pattern");
+                        tmpval = ld->add_suboption("fast_pattern_offset", std::to_string(offset));
+                        tmpval = ld->add_suboption("fast_pattern_length", std::to_string(length));
+                    }
+                    else
+                        tmpval = false;
+                }
+                catch(std::exception&)
+                {
+                    tmpval = false;
+                }
+            }
+        }
+
+        else
         {
-            cv->set_state(map->ctor(cv, ld));
-            return true;
+            // since we don't know this next option, check for any other options
+            ld->unselect_option(); // don't reference this option anymore
+            data_stream.seekg(pos);
+            data_stream.clear();  // Might have already hit end of stream
+            return set_next_rule_state(data_stream) && retval;
         }
-    }
-#endif
-    return false;
+
+        if (retval)
+            retval = tmpval;
+
+        // lets get the next keyword
+        pos = data_stream.tellg();
+        std::getline(data_stream, val, ';');
+        subopts.clear();
+        subopts.str(val);
+    };
+
+    // can only get here if we finish parsing this rule
+    return true;
 }
 
 /**************************
  *******  A P I ***********
  **************************/
 
-static ConversionState* ctor(Converter* cv, LuaData* ld)
+
+template<const std::string *rule_name>
+static ConversionState* content_ctor(Converter* cv, LuaData* ld)
+{
+    return new Content<rule_name>(cv, ld);
+}
+
+static const std::string content = "content";
+static const std::string protected_content = "protected_content";
+static const std::string uricontent = "uricontent";
+
+
+//  Uricontent:"foo" --> http_uti; content:"foo".
+//  So, just add the 'http_uri' option first, then parse as if content
+static ConversionState* uricontent_ctor(Converter* cv, LuaData* ld)
 {
-    return new Content(cv, ld);
+    ld->add_rule_option("http_uri");
+    return new Content<&content>(cv, ld);
 }
 
-static const ConvertMap rule_content_api = 
+
+
+static const ConvertMap rule_content_api =
+{
+    content,
+    content_ctor<&content>,
+};
+
+static const ConvertMap rule_protected_content_api =
+{
+    protected_content,
+    content_ctor<&protected_content>,
+};
+
+static const ConvertMap rule_uricontent_api =
 {
-    "content",
-    ctor,
+    uricontent,
+    uricontent_ctor,
 };
 
+
 const ConvertMap* content_map = &rule_content_api;
+const ConvertMap* protected_content_map = &rule_protected_content_api;
+const ConvertMap* uricontent_map = &rule_uricontent_api;
 
 } // namespace rules
\ No newline at end of file
diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc
new file mode 100644
index 000000000..323466db8
--- /dev/null
+++ b/tools/snort2lua/rule_states/rule_unchanged.cc
@@ -0,0 +1,133 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// rule_content.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "util/converter.h"
+#include "rule_states/rule_api.h"
+#include "util/util.h"
+
+namespace rules
+{
+
+/*
+ *  To use this template, declared an 'unchanged_rule_ctor<rule_name>'
+ *  in the ConvertMap struct.  Everything else will be taken care of and
+ *  all of the data between two semicolons will be placed in the new rule AS IS!!
+ *  Examples are below the line marked 'FINISHED TEMPLATES'.
+ */
+
+template<const std::string *rule_name>
+class UnchangedRuleOption : public ConversionState
+{
+public:
+    UnchangedRuleOption( Converter* cv, LuaData* ld)
+        :   ConversionState(cv, ld) 
+    { };
+    virtual ~UnchangedRuleOption() {};
+    
+    friend bool set_next_rule_state(std::istringstream& stream, Converter* cv, LuaData* ld);
+    virtual bool convert(std::istringstream& stream)
+    {
+        std::string val;
+
+        std::getline(stream, val, ';');
+        bool retval = ld->add_rule_option(*rule_name, val);
+        return retval && set_next_rule_state(stream);
+    }
+};
+
+
+template<const std::string *rule_name>
+static ConversionState* unchange_rule_ctor(Converter* cv, LuaData* ld)
+{
+    return new UnchangedRuleOption<rule_name>(cv, ld);
+}
+
+
+
+/****************************************
+ *******   FINISHED TEMPLATES ***********
+ ****************************************/
+
+/************************************
+ **********  M S G ******************
+ ************************************/
+
+
+static const std::string msg = "msg";
+static const ConvertMap rule_msg =
+{
+    msg,
+    unchange_rule_ctor<&msg>,
+};
+
+const ConvertMap* msg_map = &rule_msg;
+
+
+/************************************
+ **********  G I D ******************
+ ************************************/
+
+
+static const std::string gid = "gid";
+static const ConvertMap rule_gid =
+{
+    gid,
+    unchange_rule_ctor<&gid>,
+};
+
+const ConvertMap* gid_map = &rule_gid;
+
+
+/************************************
+ **********  S I D  *****************
+ ************************************/
+
+
+static const std::string sid = "sid";
+static const ConvertMap rule_sid =
+{
+    sid,
+    unchange_rule_ctor<&sid>,
+};
+
+const ConvertMap* sid_map = &rule_sid;
+
+
+/************************************
+ **********  R E V  *****************
+ ************************************/
+
+
+static const std::string rev = "rev";
+static const ConvertMap rule_rev =
+{
+    rev,
+    unchange_rule_ctor<&rev>,
+};
+
+const ConvertMap* rev_map = &rule_rev;
+
+
+} // namespace rule
diff --git a/tools/snort2lua/util/converter.cc b/tools/snort2lua/util/converter.cc
index f9a8559d7..de31e7eac 100644
--- a/tools/snort2lua/util/converter.cc
+++ b/tools/snort2lua/util/converter.cc
@@ -22,7 +22,6 @@
 #include <iostream>
 #include "util/converter.h"
 #include "conversion_state.h"
-#include "init_state.h"
 #include "util/util.h"
 
 
@@ -46,8 +45,7 @@ bool Converter::initialize(conv_new_f func)
     // without this, "default_rules" is considered a bool for some odd reason.
     std::string s = std::string("$default_rules");
 
-    // create a rules string and point the ips to it
-    ld.add_variable("default_rules", " ");
+    // point the ips to a 'default_rules' variable
     ld.open_table("ips");
     ld.add_option_to_table("rules", s);
     ld.close_table();
@@ -111,7 +109,7 @@ void Converter::convert_file(std::string input_file)
         }
         else
         {
-            std::stringstream data_stream(orig_text);
+            std::istringstream data_stream(orig_text);
             while(data_stream.tellg() != -1)
             {
                 if ((state == nullptr) || !state->convert(data_stream))
@@ -257,10 +255,10 @@ void Converter::add_comment_to_file(std::string comment)
     data.add_comment(comment);
 }
 
-void Converter::add_comment_to_file(std::string comment, std::stringstream& stream)
+void Converter::add_comment_to_file(std::string comment, std::istringstream& stream)
 {
     int pos = stream.tellg();
-    std::ostringstream oss;
+    std::oistringstream oss;
     oss << stream.rdbuf();
     comment += oss.str();
     data.add_comment(comment);
@@ -299,7 +297,7 @@ void Converter::log_error(std::string error_string)
 //    std::cout << "\t\t" << error_string << std::endl << std::endl;
 }
 
-void Converter::print_line(std::stringstream& in)
+void Converter::print_line(std::istringstream& in)
 {
     int pos = in.tellg();
     std::ostringstream oss;
diff --git a/tools/snort2lua/util/converter.h b/tools/snort2lua/util/converter.h
index 453b04dee..292e2261d 100644
--- a/tools/snort2lua/util/converter.h
+++ b/tools/snort2lua/util/converter.h
@@ -27,12 +27,17 @@
 #include <sstream>
 #include <stack>
 #include <iostream>
+#include <istream>
+#include <ostream>
 
 #include "data/dt_data.h"
 #include "data/dt_var.h"
-#include "conversion_state.h"
 
+
+// typedef redefined from 'conversion_state.h'
 class ConversionState;
+class Converter;
+typedef ConversionState* (*conv_new_f)(Converter*, LuaData* ld);
 
 class Converter
 {
@@ -86,7 +91,7 @@ public:
     // comment will appear immediately below the lua configuration
     void add_comment_to_file(std::string comment);
     // add the entire stream as a comment in the new lua file
-    void add_comment_to_file(std::string comment, std::stringstream& stream);
+    void add_comment_to_file(std::string comment, std::istringstream& stream);
     // attach a comment about a deprecated option to a file or table
     void add_deprecated_comment(std::string dep_var);
     // add a comment with telling the user an option has changed
@@ -96,7 +101,7 @@ public:
     // log an error in the new lua file
     void log_error(std::string);
 
-    void print_line(std::stringstream& in);
+    void print_line(std::istringstream& in);
     void print_line(std::ostringstream& in);
     void print_line(std::string& in);
 
diff --git a/tools/snort2lua/util/util.cc b/tools/snort2lua/util/util.cc
index ddf588b31..f77db454b 100644
--- a/tools/snort2lua/util/util.cc
+++ b/tools/snort2lua/util/util.cc
@@ -37,7 +37,7 @@ std::vector<std::string> &split(const std::string &s,
                                 char delim, 
                                 std::vector<std::string> &elems)
 {
-    std::stringstream ss(s);
+    std::istringstream ss(s);
     std::string item;
     while (std::getline(ss, item, delim))
     {