From: Josh Date: Fri, 7 Nov 2014 20:17:36 +0000 (-0600) Subject: Snort2Lua: fixing frag3 binder X-Git-Tag: 3.0.0-233~1252^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2eef7fb564798f4db726275ceede6e6712f1e253;p=thirdparty%2Fsnort3.git Snort2Lua: fixing frag3 binder --- diff --git a/src/framework/codec.h b/src/framework/codec.h index 65fe5c8fb..ddeaaf102 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -285,10 +285,10 @@ public: inline const char* get_name() const {return name; } // Registers this Codec's data link type (as defined by libpcap) - virtual void get_data_link_type(std::vector&) + virtual void get_data_link_type(std::vector&) // FIXIT-M J return a vector == efficient in c++11 { } // Register the code's protocol ID's and Ethertypes - virtual void get_protocol_ids(std::vector&) + virtual void get_protocol_ids(std::vector&) // FIXIT-M J return a vector == efficient in c++11 { } /* diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h index f77e82802..093fe9d00 100644 --- a/tools/snort2lua/conversion_state.h +++ b/tools/snort2lua/conversion_state.h @@ -60,6 +60,7 @@ protected: TableApi& table_api; RuleApi& rule_api; + #if 0 Forward declaration fo parsing methods. Since these are all inline, unable to forward declare in regular code. diff --git a/tools/snort2lua/data/dt_rule_api.h b/tools/snort2lua/data/dt_rule_api.h index 58fb85883..54bfc31d1 100644 --- a/tools/snort2lua/data/dt_rule_api.h +++ b/tools/snort2lua/data/dt_rule_api.h @@ -52,7 +52,7 @@ class RuleApi; // Yes, I need to redo this API. -// FIXIT-L J add_rule_option means select_option(). CHANGE_IT!! +// FIXIT-L J Simplify this API. Several options functions are no longer necessary!! class RuleApi { diff --git a/tools/snort2lua/keyword_states/kws_rate_filter.cc b/tools/snort2lua/keyword_states/kws_rate_filter.cc index bf9064722..fa1d92d8e 100644 --- a/tools/snort2lua/keyword_states/kws_rate_filter.cc +++ b/tools/snort2lua/keyword_states/kws_rate_filter.cc @@ -39,62 +39,52 @@ public: virtual bool convert(std::istringstream& data); private: - bool parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream); + void fix_separators(std::istringstream& stream); }; } // namespace -static inline int check_list(std::string listToCheck) -{ - int brackets = 0; - - for (char& c : listToCheck) - { - if (c == '[') - brackets++; - - else if (c == ']') - brackets--; - } - return brackets; -} - -bool RateFilter::parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream) +void RateFilter::fix_separators(std::istringstream& stream) { - std::string tmp; - int list = 0; - - // will automatically extract entire string since originally delineated on comma - std::getline(arg_stream, tmp, ','); - std::string fullIpList = util::trim(tmp); - list = check_list(tmp); - + const std::streamoff pos = stream.tellg(); + std::size_t curr = pos; + std::string s = stream.str(); + int cnt = 0; - while (list > 0) + while ( (curr = s.find_first_of("[],", curr)) != std::string::npos ) { - fullIpList += ","; - std::getline(data_stream, tmp, ','); - list += check_list(tmp); - fullIpList += tmp; + switch(s[curr]) + { + case '[': + cnt++; + break; + case ']': + cnt--; + break; + case ',': + if (cnt == 0) + s[curr] = ';'; + break; + } + ++curr; } - if (arg_stream.bad() && data_stream.bad()) - return false; - - table_api.add_option("apply_to", fullIpList); - return true; + stream.str(s); + stream.clear(); + stream.seekg(pos); } + bool RateFilter::convert(std::istringstream& data_stream) { bool retval = true; std::string args; - table_api.open_table("rate_filter"); + fix_separators(data_stream); - while(std::getline(data_stream, args, ',')) + while(std::getline(data_stream, args, ';')) { std::string keyword; std::istringstream arg_stream(args); @@ -102,7 +92,6 @@ bool RateFilter::convert(std::istringstream& data_stream) arg_stream >> keyword; - if(keyword.empty()) continue; @@ -122,8 +111,11 @@ bool RateFilter::convert(std::istringstream& data_stream) tmpval = parse_string_option("new_action", arg_stream); else if (!keyword.compare("apply_to")) - tmpval = parse_ip_list(arg_stream, data_stream); - + { + std::getline(arg_stream, keyword); + util::trim(keyword); + table_api.add_option("apply_to", keyword); + } else if(!keyword.compare("gen_id")) { table_api.add_diff_option_comment("gen_id", "gid"); diff --git a/tools/snort2lua/keyword_states/kws_suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc index 8882824b1..421bbf8ad 100644 --- a/tools/snort2lua/keyword_states/kws_suppress.cc +++ b/tools/snort2lua/keyword_states/kws_suppress.cc @@ -39,51 +39,40 @@ public: virtual bool convert(std::istringstream& data); private: - bool parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream); + void fix_separators(std::istringstream& stream); }; } // namespace -static inline int check_list(std::string listToCheck) -{ - int brackets = 0; - - for (char& c : listToCheck) - { - if (c == '[') - brackets++; - - else if (c == ']') - brackets--; - } - - return brackets; -} -bool Suppress::parse_ip_list(std::istringstream& arg_stream, std::istringstream& data_stream) +void Suppress::fix_separators(std::istringstream& stream) { - std::string tmp; - int list = 0; + const std::streamoff pos = stream.tellg(); + std::size_t curr = pos; + std::string s = stream.str(); + int cnt = 0; - // will automatically extract entire string since originally delineated on comma - std::getline(arg_stream, tmp, ','); - std::string fullIpList = util::trim(tmp); - list = check_list(tmp); - - - while (list > 0) + while ( (curr = s.find_first_of("[],", curr)) != std::string::npos ) { - fullIpList += ","; - std::getline(data_stream, tmp, ','); - list += check_list(tmp); - fullIpList += tmp; + switch(s[curr]) + { + case '[': + cnt++; + break; + case ']': + cnt--; + break; + case ',': + if (cnt == 0) + s[curr] = ';'; + break; + } + ++curr; } - if (arg_stream.bad() && data_stream.bad()) - return false; - - table_api.add_option("ip", fullIpList); - return true; + stream.str(s); + stream.clear(); + stream.seekg(pos); } bool Suppress::convert(std::istringstream& data_stream) @@ -96,7 +85,9 @@ bool Suppress::convert(std::istringstream& data_stream) table_api.add_diff_option_comment("sig_id", "sid"); table_api.open_table(); - while(std::getline(data_stream, args, ',')) + fix_separators(data_stream); + + while(std::getline(data_stream, args, ';')) { std::string keyword; std::istringstream arg_stream(args); @@ -111,20 +102,26 @@ bool Suppress::convert(std::istringstream& data_stream) else if (!keyword.compare("track")) tmpval = parse_string_option("track", arg_stream); - else if (!keyword.compare("ip")) - tmpval = parse_ip_list(arg_stream, data_stream); - else if(!keyword.compare("gen_id")) tmpval = parse_int_option("gid", arg_stream); else if (!keyword.compare("sig_id")) tmpval = parse_int_option("sid", arg_stream); + else if (!keyword.compare("ip")) + { + std::getline(arg_stream, keyword); + util::trim(keyword); + table_api.add_option("ip", keyword); + } else tmpval = false; - if (retval) - retval = tmpval; + if (!tmpval) + { + data_api.failed_conversion(data_stream, args); + retval = false; + } } return retval; diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc index 356c50a5f..b77ef369c 100644 --- a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc +++ b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc @@ -24,6 +24,8 @@ #include "conversion_state.h" #include "utils/converter.h" #include "utils/s2l_util.h" +#include "utils/util_binder.h" + namespace preprocessors { @@ -38,42 +40,39 @@ public: virtual bool convert(std::istringstream& data_stream); private: - bool parse_ip_list(std::string, std::istringstream& data_stream); + std::string choose_table_name(std::istringstream& data_stream); }; } // namespace - -bool Frag3Engine::parse_ip_list(std::string list_name, - std::istringstream& data_stream) +std::string Frag3Engine::choose_table_name(std::istringstream& data_stream) { - std::string prev; - std::string elem; - - if(!(data_stream >> elem) || (elem.front() != '[')) - return false; - - if(!(data_stream >> elem)) - return false; - - // there can be no spaces between the square bracket and string - prev = "[" + elem; - - while (data_stream >> elem && elem.back() != ']') - prev = prev + ' ' + elem; + static uint32_t binding_id = 0; + const std::streamoff pos = data_stream.tellg(); + std::string keyword; - prev = prev + "]"; - return table_api.add_option(list_name, prev); + while (data_stream >> keyword) + { + if (!keyword.compare("bind_to")) + { + data_stream.seekg(pos); + data_stream.clear(); + return "stream_ip_" + std::to_string(binding_id++); + } + } + data_stream.seekg(pos); + data_stream.clear(); + return "stream_ip"; } bool Frag3Engine::convert(std::istringstream& data_stream) { - bool retval = true; std::string keyword; - table_api.open_table("stream_ip"); + const std::string table_name = choose_table_name(data_stream); + table_api.open_table(table_name); while(data_stream >> keyword) { @@ -87,8 +86,22 @@ bool Frag3Engine::convert(std::istringstream& data_stream) table_api.add_deleted_comment("detect_anomalies"); else if(!keyword.compare("bind_to")) - parse_ip_list("bind_to", data_stream); + { + std::string ip_list; + if ( !(data_stream >> ip_list) ) + { + data_api.failed_conversion(data_stream, "bind_to "); + } + else + { + Binder b(table_api); + b.set_when_proto("ip"); + b.add_when_net(ip_list); + b.set_use_type("stream_ip"); + b.set_use_name(table_name); + } + } else if(!keyword.compare("min_ttl")) { if (!parse_int_option("min_ttl", data_stream)) diff --git a/tools/snort2lua/preprocessor_states/pps_stream5_ip.cc b/tools/snort2lua/preprocessor_states/pps_stream5_ip.cc index 66ce9306a..6a0b6d12c 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream5_ip.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream5_ip.cc @@ -82,9 +82,7 @@ bool StreamIp::convert(std::istringstream& data_stream) **************************/ static ConversionState* ctor(Converter& c) -{ - return new StreamIp(c); -} +{ return new StreamIp(c); } static const ConvertMap preprocessor_stream_ip = { diff --git a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc index 0d4ffa2d1..0dfe24320 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc @@ -339,30 +339,34 @@ bool StreamTcp::convert(std::istringstream& data_stream) std::string addr; if (arg_stream >> addr) + { + std::string tmp; + while (arg_stream >> tmp) + addr += " " + tmp; + add_to_bindings(&Binder::add_when_net, addr); + } else + { tmpval = false; + } } - else if (!keyword.compare("dont_reassemble_async")) { table_api.add_diff_option_comment("dont_reassemble_async", "reassemble_async"); tmpval = table_api.add_option("reassemble_async", false); } - else if (!keyword.compare("use_static_footprint_sizes")) { table_api.add_diff_option_comment("use_static_footprint_sizes", "footprint"); table_api.add_comment("default footprint == 192"); tmpval = table_api.add_option("footprint", 192); } - else if (!keyword.compare("timeout")) { table_api.add_diff_option_comment("timeout", "session_timeout"); tmpval = parse_int_option("session_timeout", arg_stream); } - else if (!keyword.compare("max_queued_segs")) { table_api.add_diff_option_comment("max_queued_segs", "queue_limit.max_segments"); @@ -370,7 +374,6 @@ bool StreamTcp::convert(std::istringstream& data_stream) tmpval = parse_int_option("max_segments", arg_stream); table_api.close_table(); } - else if (!keyword.compare("max_queued_bytes")) { table_api.add_diff_option_comment("max_queued_bytes", "queue_limit.max_bytes"); @@ -378,7 +381,6 @@ bool StreamTcp::convert(std::istringstream& data_stream) tmpval = parse_int_option("max_bytes", arg_stream); table_api.close_table(); } - else if (!keyword.compare("policy")) { std::string policy; @@ -433,31 +435,26 @@ bool StreamTcp::convert(std::istringstream& data_stream) table_api.add_diff_option_comment("policy win2003", "stream_tcp.policy = win-2003"); table_api.add_option("policy", "win-2003"); } - else if (!policy.compare("win2k3")) { table_api.add_diff_option_comment("policy win2k3", "stream_tcp.policy = win-2003"); table_api.add_option("policy", "win-2003"); } - else if (!policy.compare("hpux11")) { table_api.add_diff_option_comment("policy hpux11", "stream_tcp.policy = hpux"); table_api.add_option("policy", "hpux"); } - else if (!policy.compare("grannysmith")) { table_api.add_diff_option_comment("policy grannysmith", "stream_tcp.policy = macos"); table_api.add_option("policy", "macos"); } - else { data_api.failed_conversion(data_stream, "stream5_tcp: policy " + policy); } } - else { tmpval = false; diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in index d09167e05..3bb9dd90b 100644 --- a/tools/snort2lua/tests/snort.conf.in +++ b/tools/snort2lua/tests/snort.conf.in @@ -431,6 +431,30 @@ preprocessor frag3_engine: \ min_ttl 2 \ bind_to 192.1.2.7/24 +preprocessor frag3_engine: \ + policy last \ + policy bsd \ + policy linux \ + policy solaris \ + detect_anomalies \ + overlap_limit 10 \ + min_fragment_length 100 \ + timeout 0 \ + timeout 180 \ + min_ttl 2 \ + bind_to [10.1.47.0/24,172.16.8.0/24] + +preprocessor frag3_engine: \ + policy last \ + policy bsd \ + policy linux \ + policy solaris \ + detect_anomalies \ + overlap_limit 10 \ + min_fragment_length 100 \ + timeout 0 \ + timeout 180 \ + min_ttl 2 # Target-Based stateful inspection/stream reassembly. For more inforation, see README.stream5 preprocessor stream5_global: track_tcp yes, \