From: Russ Combs (rucombs) Date: Wed, 21 Oct 2015 16:27:46 +0000 (-0400) Subject: Merge pull request #91 in SNORT/snort3 from crc/s2l to master X-Git-Tag: 3.0.0-233~775 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=51bf9dd42fa072d087714619adf343adbdf3fd17;p=thirdparty%2Fsnort3.git Merge pull request #91 in SNORT/snort3 from crc/s2l to master Squashed commit of the following: commit b62582b5c659a6a06c59bd2dd78292970f2a4e42 Author: Russ Combs Date: Wed Oct 21 11:12:57 2015 -0400 add missing updates commit 7aedeae04c2d054afcffcdb21f22410e17195214 Author: Russ Combs Date: Wed Oct 21 10:29:23 2015 -0400 updates for gtp and modbus --- diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt index f247c42dc..cbc34b254 100644 --- a/tools/snort2lua/preprocessor_states/CMakeLists.txt +++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt @@ -18,6 +18,7 @@ add_library(preprocessor_states pps_dns.cc pps_pop.cc pps_imap.cc + pps_modbus.cc pps_smtp.cc pps_sfportscan.cc pps_stream5_ip.cc diff --git a/tools/snort2lua/preprocessor_states/Makefile.am b/tools/snort2lua/preprocessor_states/Makefile.am index ba8c3d78f..88608d847 100644 --- a/tools/snort2lua/preprocessor_states/Makefile.am +++ b/tools/snort2lua/preprocessor_states/Makefile.am @@ -20,6 +20,7 @@ pps_ssl.cc \ pps_dns.cc \ pps_pop.cc \ pps_imap.cc \ +pps_modbus.cc \ pps_smtp.cc \ pps_sfportscan.cc \ pps_stream5_ip.cc \ diff --git a/tools/snort2lua/preprocessor_states/pps_gtp.cc b/tools/snort2lua/preprocessor_states/pps_gtp.cc index dae0bb9a0..84c73abcb 100644 --- a/tools/snort2lua/preprocessor_states/pps_gtp.cc +++ b/tools/snort2lua/preprocessor_states/pps_gtp.cc @@ -21,6 +21,7 @@ #include #include "conversion_state.h" +#include "helpers/util_binder.h" #include "helpers/converter.h" #include "helpers/s2l_util.h" @@ -31,41 +32,85 @@ namespace class Gtp : public ConversionState { public: - Gtp(Converter& c) : ConversionState(c) { } - virtual ~Gtp() { } + Gtp(Converter& c) : ConversionState(c) + { converted_args = false; } + + virtual ~Gtp(); virtual bool convert(std::istringstream& data_stream); + +private: + bool converted_args; }; } // namespace +Gtp::~Gtp() +{ + if (converted_args) + return; + + Binder bind(table_api); + bind.set_when_proto("tcp"); + bind.add_when_port("2123"); + bind.add_when_port("3386"); + bind.set_use_type("gtp_inspect"); + + table_api.open_table("gtp_inspect"); + table_api.close_table(); +} + bool Gtp::convert(std::istringstream& data_stream) { - std::string args; + std::string keyword; bool retval = true; + bool ports_set = false; + Binder bind(table_api); - table_api.open_table("udp"); + bind.set_when_proto("tcp"); + bind.set_use_type("gtp_inspect"); - while (util::get_string(data_stream, args, ",;")) + table_api.open_table("gtp_inspect"); + + // parse the file configuration + while (data_stream >> keyword) { - std::string keyword; bool tmpval = true; - std::istringstream arg_stream(args); - if (!(arg_stream >> keyword)) + if (!keyword.compare("ports")) { - tmpval = false; - } - else if (!keyword.compare("ports")) - { - table_api.add_diff_option_comment("ports", "gtp_ports"); - tmpval = parse_curly_bracket_list("gtp_ports", arg_stream); + std::string tmp = ""; + table_api.add_diff_option_comment("ports", "bindings"); + + if ((data_stream >> keyword) && !keyword.compare("{")) + { + while (data_stream >> keyword && keyword.compare("}")) + { + ports_set = true; + bind.add_when_port(keyword); + } + } + else + { + data_api.failed_conversion(data_stream, "ports "); + retval = false; + } } + else { tmpval = false; } - if (retval && !tmpval) + if (!tmpval) + { + data_api.failed_conversion(data_stream, keyword); retval = false; + } + } + + if (!ports_set) + { + bind.add_when_port("2123"); + bind.add_when_port("3386"); } table_api.close_table(); diff --git a/tools/snort2lua/preprocessor_states/pps_modbus.cc b/tools/snort2lua/preprocessor_states/pps_modbus.cc new file mode 100644 index 000000000..4b4e0605d --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_modbus.cc @@ -0,0 +1,132 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// pps_modbus.cc author Russ Combs + +#include +#include + +#include "conversion_state.h" +#include "helpers/s2l_util.h" +#include "helpers/util_binder.h" + +namespace preprocessors +{ +namespace +{ +class Modbus : public ConversionState +{ +public: + Modbus(Converter& c) : ConversionState(c) + { converted_args = false; } + + virtual ~Modbus(); + virtual bool convert(std::istringstream& data_stream); + +private: + bool converted_args; +}; +} // namespace + +Modbus::~Modbus() +{ + if (converted_args) + return; + + Binder bind(table_api); + bind.set_when_proto("tcp"); + bind.add_when_port("502"); + bind.set_use_type("modbus"); + + table_api.open_table("modbus"); + table_api.close_table(); +} + +bool Modbus::convert(std::istringstream& data_stream) +{ + std::string keyword; + bool retval = true; + bool ports_set = false; + Binder bind(table_api); + + bind.set_when_proto("tcp"); + bind.set_use_type("modbus"); + + table_api.open_table("modbus"); + + // parse the file configuration + while (data_stream >> keyword) + { + bool tmpval = true; + + if (!keyword.compare("ports")) + { + std::string tmp = ""; + table_api.add_diff_option_comment("ports", "bindings"); + + if ((data_stream >> keyword) && !keyword.compare("{")) + { + while (data_stream >> keyword && keyword.compare("}")) + { + ports_set = true; + bind.add_when_port(keyword); + } + } + else + { + data_api.failed_conversion(data_stream, "ports "); + retval = false; + } + } + + else + { + tmpval = false; + } + + if (!tmpval) + { + data_api.failed_conversion(data_stream, keyword); + retval = false; + } + } + + if (!ports_set) + bind.add_when_port("502"); + + table_api.close_table(); + return retval; +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter& c) +{ + return new Modbus(c); +} + +static const ConvertMap preprocessor_modbus = +{ + "modbus", + ctor, +}; + +const ConvertMap* modbus_map = &preprocessor_modbus; +} + diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc index 26610f5b0..5ae7f2421 100644 --- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc @@ -44,6 +44,7 @@ extern const ConvertMap* ssl_map; extern const ConvertMap* dns_map; extern const ConvertMap* pop_map; extern const ConvertMap* imap_map; +extern const ConvertMap* modbus_map; extern const ConvertMap* smtp_map; extern const ConvertMap* sfportscan_map; extern const ConvertMap* stream_ip_map; @@ -76,6 +77,7 @@ const std::vector preprocessor_api = dns_map, pop_map, imap_map, + modbus_map, smtp_map, sfportscan_map, stream_ip_map, diff --git a/tools/snort2lua/rule_states/rule_api.cc b/tools/snort2lua/rule_states/rule_api.cc index 29488bc84..9edf24c18 100644 --- a/tools/snort2lua/rule_states/rule_api.cc +++ b/tools/snort2lua/rule_states/rule_api.cc @@ -43,6 +43,9 @@ extern const ConvertMap* flowbits_map; extern const ConvertMap* fragbits_map; extern const ConvertMap* fragoffset_map; extern const ConvertMap* gid_map; +extern const ConvertMap* gtp_info_map; +extern const ConvertMap* gtp_type_map; +extern const ConvertMap* gtp_version_map; extern const ConvertMap* http_encode_map; extern const ConvertMap* icmp_id_map; extern const ConvertMap* icmp_seq_map; @@ -55,6 +58,9 @@ extern const ConvertMap* itype_map; extern const ConvertMap* logto_map; extern const ConvertMap* metadata_map; extern const ConvertMap* msg_map; +extern const ConvertMap* modbus_data_map; +extern const ConvertMap* modbus_func_map; +extern const ConvertMap* modbus_unit_map; extern const ConvertMap* pcre_map; extern const ConvertMap* pkt_data_map; extern const ConvertMap* react_map; @@ -106,6 +112,9 @@ const std::vector rule_options_api = fragbits_map, fragoffset_map, gid_map, + gtp_info_map, + gtp_type_map, + gtp_version_map, http_encode_map, icmp_id_map, icmp_seq_map, @@ -118,6 +127,9 @@ const std::vector rule_options_api = logto_map, metadata_map, msg_map, + modbus_data_map, + modbus_func_map, + modbus_unit_map, pcre_map, pkt_data_map, priority_map, diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc index 9dd9df0d8..af60e727e 100644 --- a/tools/snort2lua/rule_states/rule_unchanged.cc +++ b/tools/snort2lua/rule_states/rule_unchanged.cc @@ -483,6 +483,84 @@ static const ConvertMap rule_byte_extract = const ConvertMap* byte_extract_map = &rule_byte_extract; +/************************************ + ************ GTP_INFO ************ + ************************************/ + +static const std::string gtp_info = "gtp_info"; +static const ConvertMap rule_gtp_info = +{ + gtp_info, + unchanged_rule_ctor<& gtp_info>, +}; + +const ConvertMap* gtp_info_map = &rule_gtp_info; + +/************************************ + ************ GTP_TYPE ************ + ************************************/ + +static const std::string gtp_type = "gtp_type"; +static const ConvertMap rule_gtp_type = +{ + gtp_type, + unchanged_rule_ctor<& gtp_type>, +}; + +const ConvertMap* gtp_type_map = &rule_gtp_type; + +/************************************ + ********** GTP_VERSION *********** + ************************************/ + +static const std::string gtp_version = "gtp_version"; +static const ConvertMap rule_gtp_version = +{ + gtp_version, + unchanged_rule_ctor<& gtp_version>, +}; + +const ConvertMap* gtp_version_map = &rule_gtp_version; + +/************************************ + ********** MODBUS_DATA *********** + ************************************/ + +static const std::string modbus_data = "modbus_data"; +static const ConvertMap rule_modbus_data = +{ + modbus_data, + unchanged_rule_ctor<& modbus_data>, +}; + +const ConvertMap* modbus_data_map = &rule_modbus_data; + +/************************************ + ********** MODBUS_FUNC *********** + ************************************/ + +static const std::string modbus_func = "modbus_func"; +static const ConvertMap rule_modbus_func = +{ + modbus_func, + unchanged_rule_ctor<& modbus_func>, +}; + +const ConvertMap* modbus_func_map = &rule_modbus_func; + +/************************************ + ********** MODBUS_UNIT *********** + ************************************/ + +static const std::string modbus_unit = "modbus_unit"; +static const ConvertMap rule_modbus_unit = +{ + modbus_unit, + unchanged_rule_ctor<& modbus_unit>, +}; + +const ConvertMap* modbus_unit_map = &rule_modbus_unit; + /************************************ ************ PKT_DATA ************ ************************************/