From: Russ Combs (rucombs) Date: Wed, 13 Jul 2016 21:18:15 +0000 (-0400) Subject: Merge pull request #552 in SNORT/snort3 from nhi_snort2lua to master X-Git-Tag: 3.0.0-233~339 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1e2d31afa9120fb3acc52bbf21462fb3cf4b654a;p=thirdparty%2Fsnort3.git Merge pull request #552 in SNORT/snort3 from nhi_snort2lua to master Squashed commit of the following: commit 9e3da270b428d201e0cad2eb4f774c813420d692 Author: Bhagya Tholpady Date: Mon Jul 11 00:41:52 2016 -0400 snort2lua update for nhi update to the protocol config option of stream5 snort2lua update for nhi snort2lua update for nhi snort2lua update for nhi request and response depths --- diff --git a/tools/snort2lua/helpers/converter.cc b/tools/snort2lua/helpers/converter.cc index 877c6e0bd..9bd4b38a9 100644 --- a/tools/snort2lua/helpers/converter.cc +++ b/tools/snort2lua/helpers/converter.cc @@ -28,6 +28,7 @@ #include "init_state.h" bool Converter::parse_includes = true; +bool Converter::ohi_convert = false; bool Converter::convert_rules_mult_files = true; bool Converter::convert_conf_mult_files = true; diff --git a/tools/snort2lua/helpers/converter.h b/tools/snort2lua/helpers/converter.h index eb5de7aad..7df08db23 100644 --- a/tools/snort2lua/helpers/converter.h +++ b/tools/snort2lua/helpers/converter.h @@ -53,6 +53,12 @@ public: inline static bool include_create_lua() { return convert_conf_mult_files; } + inline static void set_ohi_convert(bool val) + { ohi_convert = val; } + + inline static bool get_ohi_convert() + { return ohi_convert; } + int convert(std::string input, std::string output, std::string rules, // defaults to output_file @@ -88,6 +94,7 @@ public: private: static bool parse_includes; + static bool ohi_convert; static bool convert_rules_mult_files; static bool convert_conf_mult_files; diff --git a/tools/snort2lua/helpers/parse_cmd_line.cc b/tools/snort2lua/helpers/parse_cmd_line.cc index 5bafed40a..1774dafff 100644 --- a/tools/snort2lua/helpers/parse_cmd_line.cc +++ b/tools/snort2lua/helpers/parse_cmd_line.cc @@ -278,6 +278,9 @@ static void sing_conf_files(const char* /*key*/, const char* /*val*/) static void dont_parse_includes(const char* /*key*/, const char* /*val*/) { Converter::set_parse_includes(false); } +static void enable_ohi(const char* /*key*/, const char* /*val*/) +{ Converter::set_ohi_convert(true); } + static void enable_markup(const char* /*key*/, const char* /*val*/) { Markup::enable(true); } @@ -385,6 +388,9 @@ static ConfigFunc basic_opts[] = { "markup", enable_markup, "", "print help in asciidoc compatible format" }, + { "ohi", enable_ohi, "", + "Use Old Http Inspect format" }, + { "output-file", parse_output_file, "", "Same as '-o'. output the new Snort++ lua configuration to " }, diff --git a/tools/snort2lua/keyword_states/kws_preprocessor.cc b/tools/snort2lua/keyword_states/kws_preprocessor.cc index 262efa162..c89f97c27 100644 --- a/tools/snort2lua/keyword_states/kws_preprocessor.cc +++ b/tools/snort2lua/keyword_states/kws_preprocessor.cc @@ -44,7 +44,7 @@ bool Preprocessor::convert(std::istringstream& data_stream) if (util::get_string(data_stream, keyword, ":")) { - const ConvertMap* map = util::find_map(preprocessors::preprocessor_api, keyword, false); + const ConvertMap* map = util::find_map(preprocessors::get_preprocessor_api(cv.get_ohi_convert()), keyword, false); if (map) { cv.set_state(map->ctor(cv)); diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt index ba2830a87..b57571f74 100644 --- a/tools/snort2lua/preprocessor_states/CMakeLists.txt +++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt @@ -14,6 +14,8 @@ add_library(preprocessor_states pps_gtp.cc pps_http_inspect.cc pps_http_inspect_server.cc + pps_nhttp_inspect.cc + pps_nhttp_inspect_server.cc pps_normalizers.cc pps_perfmonitor.cc pps_reputation.cc diff --git a/tools/snort2lua/preprocessor_states/Makefile.am b/tools/snort2lua/preprocessor_states/Makefile.am index c621e55f8..676dbf1c9 100644 --- a/tools/snort2lua/preprocessor_states/Makefile.am +++ b/tools/snort2lua/preprocessor_states/Makefile.am @@ -16,6 +16,8 @@ pps_ftp_telnet_protocol.cc \ pps_gtp.cc \ pps_http_inspect.cc \ pps_http_inspect_server.cc \ +pps_nhttp_inspect.cc \ +pps_nhttp_inspect_server.cc \ pps_normalizers.cc \ pps_perfmonitor.cc \ pps_reputation.cc \ diff --git a/tools/snort2lua/preprocessor_states/pps_nhttp_inspect.cc b/tools/snort2lua/preprocessor_states/pps_nhttp_inspect.cc new file mode 100644 index 000000000..46f53cf12 --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_nhttp_inspect.cc @@ -0,0 +1,171 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2016-2016 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// pps_nhttp_inspect.cc author Bhagya Tholpady + +#include +#include +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "helpers/s2l_util.h" + +namespace preprocessors +{ +namespace +{ +class NHttpInspect : public ConversionState +{ +public: + NHttpInspect(Converter& c) : ConversionState(c) { } + ~NHttpInspect() { } + bool convert(std::istringstream& data) override; + +private: + bool add_decode_option(std::string opt_name, std::istringstream& stream); +}; +} // namespace + +bool NHttpInspect::convert(std::istringstream& data_stream) +{ + std::string keyword; + + // using this to keep track of any errors. I want to convert as much + // as possible while being aware something went wrong + bool retval = true; + + if (data_stream >> keyword) + { + if (keyword.compare("global")) + { + data_api.failed_conversion(data_stream, "'global' keyword required"); + return false; + } + } + table_api.open_table("new_http_inspect"); + table_api.add_diff_option_comment("http_inspect", "new_http_inspect"); + + while (data_stream >> keyword) + { + bool tmpval = true; + + if (!keyword.compare("compress_depth")) + parse_deleted_option("compress_depth", data_stream); + + else if (!keyword.compare("decompress_depth")) + parse_deleted_option("decompress_depth", data_stream); + + else if (!keyword.compare("detect_anomalous_servers")) + table_api.add_deleted_comment("detect_anomalous_servers"); + + else if (!keyword.compare("proxy_alert")) + table_api.add_deleted_comment("proxy_alert"); + + else if (!keyword.compare("max_gzip_mem")) + parse_deleted_option("max_gzip_mem", data_stream); + + else if (!keyword.compare("memcap")) + parse_deleted_option("memcap", data_stream); + + else if (!keyword.compare("disabled")) + table_api.add_deleted_comment("disabled"); + + else if (!keyword.compare("b64_decode_depth")) + parse_deleted_option("b64_decode_depth", data_stream); + + else if (!keyword.compare("bitenc_decode_depth")) + parse_deleted_option("bitenc_decode_depth", data_stream); + + else if (!keyword.compare("max_mime_mem")) + parse_deleted_option("max_mime_mem", data_stream); + + else if (!keyword.compare("qp_decode_depth")) + parse_deleted_option("qp_decode_depth", data_stream); + + else if (!keyword.compare("uu_decode_depth")) + parse_deleted_option("uu_decode_depth", data_stream); + + else if (!keyword.compare("iis_unicode_map")) + { + std::string codemap; + int code_page; + + if ( (data_stream >> codemap) && + (data_stream >> code_page)) + { + tmpval = table_api.add_option("iis_unicode_map_file", codemap); + tmpval = table_api.add_option("iis_unicode_code_page", code_page) && tmpval; + } + else + { + data_api.failed_conversion(data_stream, "iis_unicode_map "); + retval = false; + } + } + else + { + tmpval = false; + } + + if (!tmpval) + { + data_api.failed_conversion(data_stream, keyword); + retval = false; + } + } + + return retval; +} + +bool NHttpInspect::add_decode_option(std::string opt_name, std::istringstream& stream) +{ + int val; + + if (stream >> val) + { + table_api.open_table("decode"); + table_api.add_option(opt_name, val); + table_api.close_table(); + return true; + } + else + { + table_api.add_comment("snort.conf missing argument for " + + opt_name + " "); + return false; + } +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter& c) +{ + return new NHttpInspect(c); +} + +static const ConvertMap preprocessor_nhttpinspect = +{ + "http_inspect", + ctor, +}; + +const ConvertMap* nhttpinspect_map = &preprocessor_nhttpinspect; +} // namespace preprocessors + diff --git a/tools/snort2lua/preprocessor_states/pps_nhttp_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_nhttp_inspect_server.cc new file mode 100644 index 000000000..ebf4abc2c --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_nhttp_inspect_server.cc @@ -0,0 +1,379 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2016-2016 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// pps_nhttp_inspect_server.cc author Bhagya Tholpady + +#include +#include + +#include "conversion_state.h" +#include "helpers/s2l_util.h" +#include "helpers/util_binder.h" + +namespace preprocessors +{ +namespace +{ +class NHttpInspectServer : public ConversionState +{ +public: + NHttpInspectServer(Converter& c) : ConversionState(c) { } + ~NHttpInspectServer() { } + bool convert(std::istringstream& data_stream) override; + bool reverse_depths(std::string opt_name, std::istringstream& stream) + { + int val; + + if (stream >> val) + { + val = !val ? -1 : ( val == -1 ? 0 : val ); + table_api.add_option(opt_name, val); + return true; + } + + table_api.add_comment("snort.conf missing argument for: " + opt_name + " "); + return false; + } + +private: + static int binding_id; + +}; +} // namespace + +int NHttpInspectServer::binding_id = 0; + +bool NHttpInspectServer::convert(std::istringstream& data_stream) +{ + std::string keyword; + bool retval = true; + bool ports_set = false; + bool simplify = false; + bool slash_dir_set = false; + Binder bind(table_api); + + bind.set_when_proto("tcp"); + bind.set_use_type("new_http_inspect"); + + if (!(data_stream >> keyword) || keyword.compare("server")) + { + return false; + } + + if (!(data_stream >> keyword)) + return false; + + if (!keyword.compare("default")) + { + table_api.open_table("new_http_inspect"); + table_api.add_diff_option_comment("http_inspect_server", "new_http_inspect"); + } + else + { + std::string table_name = "new_http_inspect_" + std::to_string(binding_id); + bind.set_use_name(table_name); + table_api.open_table(table_name); + binding_id++; + + if (!keyword.compare("{")) + { + std::string tmp; + + while (data_stream >> tmp && tmp.compare("}")) + bind.add_when_net(tmp); + + if (!data_stream.good()) + return false; + } + else + { + bind.add_when_net(keyword); + } + } + + // parse the file configuration + while (data_stream >> keyword) + { + bool tmpval = true; + + if (!keyword.compare("extended_response_inspection")) + table_api.add_deleted_comment("extended_response_inspection"); + + else if (!keyword.compare("allow_proxy_use")) + table_api.add_deleted_comment("allow_proxy_use"); + + else if (!keyword.compare("inspect_gzip")) + { + table_api.add_diff_option_comment("inspect_gzip", "unzip"); + tmpval = table_api.add_option("unzip", true); + } + + else if (!keyword.compare("unlimited_decompress")) + table_api.add_deleted_comment("unlimited_decompress"); + + else if (!keyword.compare("normalize_javascript")) + table_api.add_deleted_comment("normalize_javascript"); + + else if (!keyword.compare("enable_xff")) + table_api.add_deleted_comment("enable_xff"); + + else if (!keyword.compare("extended_ascii_uri")) + table_api.add_deleted_comment("extended_ascii_uri"); + + else if (!keyword.compare("non_strict")) + table_api.add_deleted_comment("non_strict"); + + else if (!keyword.compare("inspect_uri_only")) + table_api.add_deleted_comment("inspect_uri_only"); + + else if (!keyword.compare("tab_uri_delimiter")) + table_api.add_deleted_comment("tab_uri_delimiter"); + + else if (!keyword.compare("normalize_headers")) + table_api.add_deleted_comment("normalize_headers"); + + else if (!keyword.compare("normalize_utf")) + table_api.add_deleted_comment("normalize_utf"); + + else if (!keyword.compare("log_uri")) + table_api.add_deleted_comment("log_uri"); + + else if (!keyword.compare("normalize_cookies")) + table_api.add_deleted_comment("normalize_cookies"); + + else if (!keyword.compare("log_hostname")) + table_api.add_deleted_comment("log_hostname"); + + else if (!keyword.compare("no_pipeline_req")) + table_api.add_deleted_comment("no_pipeline_req"); + + else if (!keyword.compare("ascii")) + parse_deleted_option("ascii", data_stream); + + else if (!keyword.compare("utf_8")) + { + table_api.add_diff_option_comment("utf_8", "utf8"); + tmpval = parse_yn_bool_option("utf8", data_stream, false); + } + + else if (!keyword.compare("u_encode")) + { + table_api.add_diff_option_comment("u_encode", "percent_u"); + tmpval = parse_yn_bool_option("percent_u", data_stream, false); + } + + else if (!keyword.compare("bare_byte")) + { + table_api.add_diff_option_comment("bare_byte", "utf8_bare_byte"); + tmpval = parse_yn_bool_option("utf8_bare_byte", data_stream, false); + } + + else if (!keyword.compare("iis_unicode")) + { + tmpval = parse_yn_bool_option("iis_unicode", data_stream, false); + } + + else if (!keyword.compare("double_decode")) + { + table_api.add_diff_option_comment("double_decode", "iis_double_decode"); + tmpval = parse_yn_bool_option("iis_double_decode", data_stream, false); + } + + else if (!keyword.compare("multi_slash") || !keyword.compare("directory")) + { + std::string val; + slash_dir_set = true; + + if (!(data_stream >> val)) + tmpval = simplify = false; + else if (!val.compare("yes")) + simplify = true; + else if (!val.compare("no")) + simplify = false; + else + { + table_api.add_comment("Unable to convert_option: " + keyword + ' ' + val); + tmpval = false; + } + + table_api.add_diff_option_comment(keyword, "simplify_path"); + } + + else if (!keyword.compare("iis_backslash")) + { + table_api.add_diff_option_comment("iis_backslash", "backslash_to_slash"); + tmpval = parse_yn_bool_option("backslash_to_slash", data_stream, false); + } + + else if (!keyword.compare("apache_whitespace")) + parse_deleted_option("apache_whitespace", data_stream); + + else if (!keyword.compare("iis_delimiter")) + parse_deleted_option("iis_delimiter", data_stream); + + else if (!keyword.compare("webroot")) + parse_deleted_option("webroot", data_stream); + + else if (!keyword.compare("max_javascript_whitespaces")) + parse_deleted_option("max_javascript_whitespaces", data_stream); + + else if (!keyword.compare("server_flow_depth") || !keyword.compare("flow_depth")) + { + table_api.add_diff_option_comment(keyword, "response_depth"); + tmpval = reverse_depths("response_depth", data_stream); + } + else if (!keyword.compare("client_flow_depth")) + { + table_api.add_diff_option_comment("client_flow_depth", "request_depth"); + tmpval = reverse_depths("request_depth", data_stream); + } + else if (!keyword.compare("chunk_length")) + parse_deleted_option("chunk_length", data_stream); + + else if (!keyword.compare("oversize_dir_length")) + parse_deleted_option("oversize_dir_length", data_stream); + + else if (!keyword.compare("max_header_length")) + parse_deleted_option("max_header_length", data_stream); + + else if (!keyword.compare("max_spaces")) + parse_deleted_option("max_spaces", data_stream); + + else if (!keyword.compare("max_headers")) + parse_deleted_option("max_headers", data_stream); + + else if (!keyword.compare("no_alerts")) + table_api.add_deleted_comment("no_alerts"); + + else if (!keyword.compare("decompress_swf")) + tmpval = parse_bracketed_unsupported_list("decompress_swf", data_stream); + + else if (!keyword.compare("decompress_pdf")) + tmpval = parse_bracketed_unsupported_list("decompress_pdf", data_stream); + + else if (!keyword.compare("http_methods")) + tmpval = parse_bracketed_unsupported_list("http_methods", data_stream); + + else if (!keyword.compare("whitespace_chars")) + tmpval = parse_bracketed_unsupported_list("whitespace_chars", data_stream); + + else if (!keyword.compare("base36")) + parse_deleted_option("base36", data_stream); + + else if (!keyword.compare("post_depth")) + parse_deleted_option("post_depth", data_stream); + + else if (!keyword.compare("non_rfc_char")) + { + table_api.add_diff_option_comment("non_rfc_char", "bad_characters"); + parse_bracketed_byte_list("bad_characters", data_stream); + } + else if (!keyword.compare("enable_cookie")) + table_api.add_deleted_comment("enable_cookie"); + + else if (!keyword.compare("ports")) + { + std::string tmp = ""; + table_api.add_diff_option_comment("ports", "bindings"); + + if ((data_stream >> keyword) && !keyword.compare("{")) + { + while (data_stream >> keyword && keyword.compare("}")) + { + ports_set = true; + bind.add_when_port(keyword); + } + } + else + { + data_api.failed_conversion(data_stream, "ports "); + retval = false; + } + } + else if (!keyword.compare("small_chunk_length")) + { + std::string bracket; + int length; + int consec_chunks; + + if (!(data_stream >> bracket) || bracket.compare("{") || + !(data_stream >> length) || + !(data_stream >> consec_chunks) || + !(data_stream >> bracket) || bracket.compare("}")) + { + tmpval = false; + } + else + { + table_api.add_deleted_comment("small_chunk_length"); + } + } + else if (!keyword.compare("iis_unicode_map")) + { + std::string map_file; + int code_page; + data_stream >> map_file; + data_stream >> code_page; + table_api.add_deleted_comment("iis_unicode_map not allowed in sever"); + } + else if (!keyword.compare("profile")) + parse_deleted_option("profile", data_stream); + else + { + tmpval = false; + } + + if (!tmpval) + { + data_api.failed_conversion(data_stream, keyword); + retval = false; + } + } + + if ( slash_dir_set ) + { + if ( !table_api.add_option("simplify_path", simplify) ) + { + data_api.failed_conversion(data_stream, keyword); + retval = false; + } + } + + if (!ports_set) + bind.add_when_port("80"); + + return retval; +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter& c) +{ + return new NHttpInspectServer(c); +} + +static const ConvertMap preprocessor_nhttpinpect_server = +{ + "http_inspect_server", + ctor, +}; + +const ConvertMap* nhttpinspect_server_map = &preprocessor_nhttpinpect_server; +} + diff --git a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc index 9c4121f03..8ed4c8121 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc @@ -241,7 +241,15 @@ bool StreamTcp::parse_protocol(std::istringstream& arg_stream) // to create and save a new Binder for each protocol, // lets save the different protocols and create new // Binders at the very end of the convert() functions. - protocols->push_back(protocol); + if (!protocol.compare("http_inspect")) + { + if ( !cv.get_ohi_convert() ) + protocols->push_back("new_http_inspect"); + else + protocols->push_back(protocol); + } + else + protocols->push_back(protocol); } while (arg_stream >> protocol); } diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc index 8aae72ce9..400503bf9 100644 --- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc @@ -35,6 +35,8 @@ extern const ConvertMap* ftptelnet_protocol_map; extern const ConvertMap* gtp_map; extern const ConvertMap* httpinspect_map; extern const ConvertMap* httpinspect_server_map; +extern const ConvertMap* nhttpinspect_map; +extern const ConvertMap* nhttpinspect_server_map; extern const ConvertMap* normalizer_icmp4_map; extern const ConvertMap* normalizer_icmp6_map; extern const ConvertMap* normalizer_ip4_map; @@ -58,7 +60,7 @@ extern const ConvertMap* stream_global_map; extern const ConvertMap* stream_tcp_map; extern const ConvertMap* stream_udp_map; -const std::vector preprocessor_api = +std::vector preprocessor_api = { appid_map, arpspoof_map, @@ -73,8 +75,6 @@ const std::vector preprocessor_api = ftptelnet_map, ftptelnet_protocol_map, gtp_map, - httpinspect_map, - httpinspect_server_map, imap_map, modbus_map, normalizer_icmp4_map, @@ -98,5 +98,21 @@ const std::vector preprocessor_api = stream_udp_map, // nullptr, }; + +std::vector get_preprocessor_api(bool ohi_convert) +{ + if( ohi_convert ) + { + preprocessor_api.push_back(httpinspect_map); + preprocessor_api.push_back(httpinspect_server_map); + } + else + { + preprocessor_api.push_back(nhttpinspect_map); + preprocessor_api.push_back(nhttpinspect_server_map); + } + + return preprocessor_api; +} } // namespace preprocessors diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.h b/tools/snort2lua/preprocessor_states/preprocessor_api.h index 7cc73c3a9..810909fcb 100644 --- a/tools/snort2lua/preprocessor_states/preprocessor_api.h +++ b/tools/snort2lua/preprocessor_states/preprocessor_api.h @@ -25,7 +25,9 @@ namespace preprocessors { -extern const std::vector preprocessor_api; +extern std::vector preprocessor_api; + +std::vector get_preprocessor_api(bool ohi_convert); } // namespace preprocessors #endif