From: Josh Date: Tue, 29 Jul 2014 16:01:21 +0000 (-0400) Subject: updating snort2lua. config_changes.txt, and minor tweaks X-Git-Tag: 3.0.0-233~1175^2~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=354ad1a9e6ba5290d9ddce2ead4d372b08062c90;p=thirdparty%2Fsnort3.git updating snort2lua. config_changes.txt, and minor tweaks --- diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt index 505513514..b7490aa99 100644 --- a/doc/CMakeLists.txt +++ b/doc/CMakeLists.txt @@ -108,13 +108,15 @@ if (MAKE_PDF_DOC OR MAKE_HTML_DOC) # If ruby is present, built the configuration differences if (RUBY_EXECUTABLE) + set (input ${CMAKE_CURRENT_LIST_DIR}/config_changes.txt) set (output ${CMAKE_CURRENT_BINARY_DIR}/config_changes.txt) add_custom_command( OUTPUT ${output} COMMAND ${RUBY_EXECUTABLE} - ${CMAKE_CURRENT_SOURCE_DIR}/get_differences.rb + ${CMAKE_CURRENT_LIST_DIR}/get_differences.rb ${CMAKE_SOURCE_DIR}/tools/snort2lua - > ${output} + > ${input} + COMMAND ${CMAKE_COMMAND} -E copy ${input} ${output} DEPENDS snort2lua COMMENT "Documents: building config_changes.txt" ) diff --git a/doc/config_changes.txt b/doc/config_changes.txt index dc49e74bc..c199523df 100644 --- a/doc/config_changes.txt +++ b/doc/config_changes.txt @@ -75,6 +75,7 @@ change: icmpseq ==> icmp_seq change: icmptype ==> icmp_type change: intel-cpm ==> intel_cpm change: iplen ==> ip_len +change: ips_option: threshold ==> event_filter change: log_alert ==> level = alert change: log_auth ==> facility = auth change: log_authpriv ==> facility = authpriv @@ -121,15 +122,18 @@ change: non_rfc_char ==> non_rfc_chars change: nopcre ==> pcre_enable change: overlap_limit ==> max_overlaps change: pad ==> base +change: paf_max [0:63780] ==> paf_max [1460:63780] change: pkt-log ==> pkt_log change: pkt_count ==> limit change: pktcnt ==> packets +change: policy bsd-right ==> policy = bsd_right change: policy_mode ==> mode change: ports ==> bindings change: ports ==> gtp_ports change: ports both ==> both_ports change: ports client ==> client_ports change: ports server ==> server_ports +change: post_depth [-1:65495] ==> post_depth [-1:65535] change: preprocessor normalize_icmp4 ==> icmp4 == change: preprocessor normalize_icmp6 ==> icmp6 == change: preprocessor normalize_ip6 ==> ip6 == diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index 857920212..511dad399 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -105,6 +105,7 @@ const char* peg_names[] = "gzip packets", "compressed bytes", "decompressed bytes", + nullptr, }; THREAD_LOCAL int hiDetectCalled = 0; diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc index a9778ab9b..1f8cb2e2c 100644 --- a/src/stream/ip/ip_module.cc +++ b/src/stream/ip/ip_module.cc @@ -78,7 +78,7 @@ FragEngine::FragEngine() //------------------------------------------------------------------------- static const char* policies = - "first | linux | bsd | bsd_right |last | windows | solaris"; + "first | linux | bsd | bsd_right | last | windows | solaris"; static const RuleMap stream_ip_rules[] = { diff --git a/tools/snort2lua/config_states/CMakeLists.txt b/tools/snort2lua/config_states/CMakeLists.txt index 3bdd641c2..7657ee351 100644 --- a/tools/snort2lua/config_states/CMakeLists.txt +++ b/tools/snort2lua/config_states/CMakeLists.txt @@ -19,6 +19,7 @@ add_library( config_states config_one_int_option.cc config_one_string_option.cc config_order.cc + config_paf_max.cc config_ppm.cc config_profile.cc config_reference.cc diff --git a/tools/snort2lua/config_states/Makefile.am b/tools/snort2lua/config_states/Makefile.am index e031fd078..ea5794cf3 100644 --- a/tools/snort2lua/config_states/Makefile.am +++ b/tools/snort2lua/config_states/Makefile.am @@ -22,6 +22,7 @@ config_no_option.cc \ config_one_int_option.cc \ config_one_string_option.cc \ config_order.cc \ +config_paf_max.cc \ config_ppm.cc \ config_profile.cc \ config_reference.cc \ diff --git a/tools/snort2lua/config_states/config_one_int_option.cc b/tools/snort2lua/config_states/config_one_int_option.cc index 63d43bddd..a4cd367ae 100644 --- a/tools/snort2lua/config_states/config_one_int_option.cc +++ b/tools/snort2lua/config_states/config_one_int_option.cc @@ -207,19 +207,6 @@ static const ConvertMap new_ttl_api = const ConvertMap* new_ttl_map = &new_ttl_api; -/************************************************* - ****************** paf_max ******************* - *************************************************/ - -static const std::string paf_max = "paf_max"; -static const ConvertMap paf_max_api = -{ - paf_max, - config_int_ctor<&paf_max, &stream_tcp>, -}; - -const ConvertMap* paf_max_map = &paf_max_api; - /************************************************* ************** pcre_match_limit ************** *************************************************/ diff --git a/tools/snort2lua/config_states/config_paf_max.cc b/tools/snort2lua/config_states/config_paf_max.cc new file mode 100644 index 000000000..65f1379f0 --- /dev/null +++ b/tools/snort2lua/config_states/config_paf_max.cc @@ -0,0 +1,82 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// config_paf_max.cc author Josh Rosenbaum + +#include +#include + +#include "conversion_state.h" +#include "utils/converter.h" +#include "utils/snort2lua_util.h" + +namespace config +{ + +namespace { + +class PafMax : public ConversionState +{ +public: + PafMax(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {}; + virtual ~PafMax() {}; + virtual bool convert(std::istringstream& data_stream); +}; + +} // namespace + +bool PafMax::convert(std::istringstream& data_stream) +{ + bool retval = true; + int val; + + ld->open_table("stream_tcp"); + + if (data_stream >> val) + { + if (val < 1460) + retval = ld->add_diff_option_comment("paf_max [0:63780]", "paf_max [1460:63780]"); + else + retval = ld->add_option_to_table("paf_max", val); + } + else + retval = false; + + ld->close_table(); + return retval; +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter* cv, LuaData* ld) +{ + return new PafMax(cv, ld); +} + +static const ConvertMap paf_max_api = +{ + "paf_max", + ctor, +}; + +const ConvertMap* paf_max_map = &paf_max_api; + +} // namespace config diff --git a/tools/snort2lua/data/dt_data.cc b/tools/snort2lua/data/dt_data.cc index cc17e7dd3..b1199ce33 100644 --- a/tools/snort2lua/data/dt_data.cc +++ b/tools/snort2lua/data/dt_data.cc @@ -97,7 +97,8 @@ std::string LuaData::expand_vars(std::string string) char rawvarname[128], varname[128], varaux[128], varbuffer[128]; char varmodifier; const char* varcontents; - int varname_completed, c, i, j, iv, jv, l_string, name_only; + std::size_t varname_completed, i, j, iv, jv, l_string, name_only; + char c; int quote_toggle = 0; if(string.empty() || string.rfind('$') == std::string::npos) @@ -168,7 +169,7 @@ std::string LuaData::expand_vars(std::string string) p = strchr(rawvarname, ':'); if (p) { - std::strncpy(varname, rawvarname, p - rawvarname); + std::strncpy(varname, rawvarname, (std::size_t)(p - rawvarname)); if(strlen(p) >= 2) { @@ -205,7 +206,7 @@ std::string LuaData::expand_vars(std::string string) if(varcontents) { - int l_varcontents = strlen(varcontents); + std::size_t l_varcontents = strlen(varcontents); iv = 0; @@ -319,22 +320,6 @@ void LuaData::open_table(std::string table_name) open_tables.push(t); } -void LuaData::open_new_top_level_table(std::string table_name) -{ - Table *t = new Table(table_name, 0); - - if (t != nullptr) - { - tables.push_back(t); - open_tables.push(t); - } - else - { - std::cout << "OUT OF MEMORY!!" << std::endl; - } - -} - void LuaData::open_table() { // if no open tables, create a top-level table diff --git a/tools/snort2lua/data/dt_data.h b/tools/snort2lua/data/dt_data.h index 8dcb62045..9ff2a05db 100644 --- a/tools/snort2lua/data/dt_data.h +++ b/tools/snort2lua/data/dt_data.h @@ -97,8 +97,6 @@ public: void open_top_level_table(std::string name); // open a nested named table --> 'name = {...}') void open_table(std::string name); - // create a new table with this name...even if a table with the same name already exists - void open_new_top_level_table(std::string name); // open a nested table that does not contain a name --> {...}) void open_table(); // close the nested table. go to previous table level diff --git a/tools/snort2lua/data/dt_table.cc b/tools/snort2lua/data/dt_table.cc index 113d3719d..a8e89b679 100644 --- a/tools/snort2lua/data/dt_table.cc +++ b/tools/snort2lua/data/dt_table.cc @@ -175,7 +175,7 @@ std::ostream &operator<<( std::ostream& out, const Table &t) whitespace += " "; if(!t.name.empty()) - out << whitespace << t.name << " = " << std::endl; + out << whitespace << t.name << " =" << std::endl; out << whitespace << '{' << std::endl; if (!t.comments->empty() && !LuaData::is_quiet_mode()) diff --git a/tools/snort2lua/keyword_states/kws_event_filter.cc b/tools/snort2lua/keyword_states/kws_event_filter.cc index bb9a1ac34..6a7155660 100644 --- a/tools/snort2lua/keyword_states/kws_event_filter.cc +++ b/tools/snort2lua/keyword_states/kws_event_filter.cc @@ -46,7 +46,8 @@ bool EventFilter::convert(std::istringstream& data_stream) std::string args; bool retval = true; - ld->open_new_top_level_table("event_filter"); + ld->open_table("event_filter"); + ld->open_table(); while (std::getline(data_stream, args, ',')) { @@ -94,6 +95,8 @@ bool EventFilter::convert(std::istringstream& data_stream) } + ld->close_table(); + ld->close_table(); return retval; } diff --git a/tools/snort2lua/keyword_states/kws_rule_state.cc b/tools/snort2lua/keyword_states/kws_rule_state.cc index e6a765353..a6f535c6a 100644 --- a/tools/snort2lua/keyword_states/kws_rule_state.cc +++ b/tools/snort2lua/keyword_states/kws_rule_state.cc @@ -47,7 +47,8 @@ bool RuleState::convert(std::istringstream& data_stream) bool retval = true; int count = 0; - ld->open_new_top_level_table("rule_state"); + ld->open_table("rule_state"); + ld->open_table(); while (util::get_string(data_stream, arg, ", ")) { @@ -95,6 +96,8 @@ bool RuleState::convert(std::istringstream& data_stream) retval = false; } + ld->close_table(); + ld->close_table(); return retval; } diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc index 9f61fe5f6..51a085a4b 100644 --- a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc +++ b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc @@ -89,21 +89,12 @@ bool Frag3Engine::convert(std::istringstream& data_stream) if(!keyword.compare("min_ttl")) tmpval = parse_int_option("min_ttl", data_stream); - else if(!keyword.compare("policy")) - tmpval = parse_string_option("policy", data_stream); - else if(!keyword.compare("detect_anomalies")) ld->add_deleted_comment("detect_anomalies"); else if(!keyword.compare("bind_to")) parse_ip_list("bind_to", data_stream); - else if(!keyword.compare("timeout")) - { - tmpval = parse_int_option("session_timeout", data_stream); - ld->add_diff_option_comment("timeout", "session_timeout"); - } - else if(!keyword.compare("overlap_limit")) { tmpval = parse_int_option("max_overlaps", data_stream); @@ -116,6 +107,65 @@ bool Frag3Engine::convert(std::istringstream& data_stream) ld->add_diff_option_comment("min_fragment_length", "min_frag_length"); } + else if(!keyword.compare("timeout")) + { + std::string val; + ld->add_diff_option_comment("timeout", "session_timeout"); + + if (data_stream >> val) + { + int seconds = std::stoi(val); + if (seconds == 0) + { + tmpval = ld->add_option_to_table("session_timeout", 256); + ld->add_comment_to_table("preprocessor frag3_engine: " + "timeout 0 ==> session_timeout 256"); + } + else + { + tmpval = ld->add_option_to_table("session_timeout", seconds); + } + } + } + + + else if(!keyword.compare("policy")) + { + std::string policy; + + if (!(data_stream >> policy)) + tmpval = false; + + else if (!policy.compare("first")) + tmpval = ld->add_option_to_table("policy", "first"); + + else if (!policy.compare("bsd")) + tmpval = ld->add_option_to_table("policy", "bsd"); + + else if (!policy.compare("last")) + tmpval = ld->add_option_to_table("policy", "last"); + + else if (!policy.compare("windows")) + tmpval = ld->add_option_to_table("policy", "windows"); + + else if (!policy.compare("linux")) + tmpval = ld->add_option_to_table("policy", "linux"); + + else if (!policy.compare("solaris")) + tmpval = ld->add_option_to_table("policy", "solaris"); + + else if (!policy.compare("bsd-right")) + { + ld->add_diff_option_comment("policy bsd-right", "policy = bsd_right"); + tmpval = ld->add_option_to_table("policy", "bsd_right"); + } + + else + { + tmpval = false; + } + } + else tmpval = false; diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc index 7e9592e8e..6fc345078 100644 --- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc +++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc @@ -195,9 +195,6 @@ bool HttpInspectServer::convert(std::istringstream& data_stream) else if (!keyword.compare("client_flow_depth")) tmpval = parse_int_option("client_flow_depth", data_stream); - else if (!keyword.compare("post_depth")) - tmpval = parse_int_option("post_depth", data_stream); - else if (!keyword.compare("chunk_length")) tmpval = parse_int_option("chunk_length", data_stream); @@ -231,6 +228,12 @@ bool HttpInspectServer::convert(std::istringstream& data_stream) else if (!keyword.compare("base36")) tmpval = eat_option(data_stream); + else if (!keyword.compare("post_depth")) + { + tmpval = parse_int_option("post_depth", data_stream); + ld->add_diff_option_comment("post_depth [-1:65495]", "post_depth [-1:65535]"); + } + else if (!keyword.compare("non_rfc_char")) { ld->add_diff_option_comment("non_rfc_char", "non_rfc_chars"); diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt index f0c97c323..b5c4e68d7 100644 --- a/tools/snort2lua/rule_states/CMakeLists.txt +++ b/tools/snort2lua/rule_states/CMakeLists.txt @@ -6,6 +6,7 @@ add_library( rule_states rule_http_encode.cc rule_metadata.cc rule_pcre.cc + rule_threshold.cc rule_unchanged.cc rule_urilen.cc rule_api.cc diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am index b675de337..db2fc2d74 100644 --- a/tools/snort2lua/rule_states/Makefile.am +++ b/tools/snort2lua/rule_states/Makefile.am @@ -10,6 +10,7 @@ rule_file_data.cc \ rule_http_encode.cc \ rule_metadata.cc \ rule_pcre.cc \ +rule_threshold.cc \ rule_unchanged.cc \ rule_urilen.cc \ rule_api.cc \ diff --git a/tools/snort2lua/rule_states/rule_threshold.cc b/tools/snort2lua/rule_states/rule_threshold.cc new file mode 100644 index 000000000..dcce5a062 --- /dev/null +++ b/tools/snort2lua/rule_states/rule_threshold.cc @@ -0,0 +1,168 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// rule_threshold.cc author Josh Rosenbaum + +#include +#include + +#include "conversion_state.h" +#include "utils/converter.h" +#include "rule_states/rule_api.h" +#include "utils/snort2lua_util.h" + +namespace rules +{ + +namespace { + + +class Threshold : public ConversionState +{ +public: + Threshold(Converter* cv, LuaData* ld) : ConversionState(cv, ld) {}; + virtual ~Threshold() {}; + virtual bool convert(std::istringstream& data); +}; + +} // namespace + +bool Threshold::convert(std::istringstream& data_stream) +{ + std::string args; + std::string value; + bool retval = true; + + args = util::get_rule_option_args(data_stream); + std::istringstream arg_stream(args); + + + ld->open_table("event_filter"); + ld->add_diff_option_comment("ips_option: threshold", "event_filter"); + ld->open_table(); + + while (util::get_string(arg_stream, value, ",")) + { + std::string keyword; + std::string val; + bool tmpval = true; + std::istringstream subopt_stream(value); + + if (!(subopt_stream >> keyword) || !(subopt_stream >> val)) + tmpval = false; + + else if (!(keyword.compare("count"))) + tmpval = ld->add_option_to_table("count", std::stoi(val)); + + else if (!(keyword.compare("seconds"))) + tmpval = ld->add_option_to_table("seconds", std::stoi(val)); + + else if (!(keyword.compare("type"))) + tmpval = ld->add_option_to_table("type", val); + + else if (!(keyword.compare("track"))) + tmpval = ld->add_option_to_table("track", val); + + else + retval = false; + + if (retval && !tmpval) + retval = false; + } + + // save the current position + const std::streamoff curr_pos = data_stream.tellg(); + + if (curr_pos == -1) + data_stream.clear(); + + bool found_gid = false, found_sid = false; + std::string rule_keyword; + + data_stream.seekg(0); + std::getline(data_stream, rule_keyword, '('); + std::streamoff tmp_pos = data_stream.tellg(); + + while(std::getline(data_stream, rule_keyword, ':')) + { + std::size_t semi_colon_pos = rule_keyword.find(';'); + if (semi_colon_pos != std::string::npos) + { + // found an option without a colon, so set stream + // to semi-colon + std::streamoff off = 1 + (std::streamoff)(tmp_pos) + + (std::streamoff)(semi_colon_pos); + data_stream.seekg(off); + rule_keyword = rule_keyword.substr(0, semi_colon_pos); + } + + // now, lets get the next option. + util::trim(rule_keyword); + + if (!rule_keyword.compare("sid")) + { + std::string val = util::get_rule_option_args(data_stream); + ld->add_option_to_table("sid", val); + found_sid = true; + } + else if (!rule_keyword.compare("gid")) + { + std::string val = util::get_rule_option_args(data_stream); + ld->add_option_to_table("gid", val); + found_gid = true; + } + else if (semi_colon_pos == std::string::npos) + std::getline(data_stream, rule_keyword, ';'); + + // short circuit in case we already found the gid/sid + if (found_gid && found_sid) + break; + + tmp_pos = data_stream.tellg(); + } + + + ld->close_table(); + ld->close_table(); + if (curr_pos != -1) + data_stream.clear(); + + data_stream.seekg(curr_pos); + return set_next_rule_state(data_stream) && retval; +} + +/************************** + ******* A P I *********** + **************************/ + + +static ConversionState* ctor(Converter* cv, LuaData* ld) +{ + return new Threshold(cv, ld); +} + +static const ConvertMap rule_threshold = +{ + "threshold", + ctor, +}; + +const ConvertMap* threshold_map = &rule_threshold; + +} // namespace rules diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc index 9be9e6a78..c6257f25a 100644 --- a/tools/snort2lua/rule_states/rule_unchanged.cc +++ b/tools/snort2lua/rule_states/rule_unchanged.cc @@ -535,19 +535,6 @@ static const ConvertMap rule_detection_filter = const ConvertMap* detection_filter_map = &rule_detection_filter; -/************************************ - *********** THRESHOLD ************ - ************************************/ - -static const std::string threshold = "threshold"; -static const ConvertMap rule_threshold = -{ - threshold, - unchanged_rule_ctor<&threshold>, -}; - -const ConvertMap* threshold_map = &rule_threshold; - /************************************ *********** BYTE_TEST ************ ************************************/ diff --git a/tools/snort2lua/utils/snort2lua_util.cc b/tools/snort2lua/utils/snort2lua_util.cc index 132f6cf41..fbed3f74b 100644 --- a/tools/snort2lua/utils/snort2lua_util.cc +++ b/tools/snort2lua/utils/snort2lua_util.cc @@ -116,7 +116,7 @@ bool get_string(std::istringstream& stream, } else { - int pos = 0; + std::streamoff pos = 0; option = std::string(); // we don't want an empty string