From: Josh Date: Thu, 6 Nov 2014 21:19:33 +0000 (-0600) Subject: Snort2Lua fix - correctly parse a variable that does not start with '$' X-Git-Tag: 3.0.0-233~1257^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6bf002173cdcc697260621c2c90286ad3ee578ea;p=thirdparty%2Fsnort3.git Snort2Lua fix - correctly parse a variable that does not start with '$' --- diff --git a/tools/snort2lua/data/data_types/dt_var.cc b/tools/snort2lua/data/data_types/dt_var.cc index 070bbe84d..21fbff7f9 100644 --- a/tools/snort2lua/data/data_types/dt_var.cc +++ b/tools/snort2lua/data/data_types/dt_var.cc @@ -58,13 +58,37 @@ std::string Variable::get_value(DataApi* ld) return variable; } + // does this need a new variable? bool Variable::add_value(std::string elem) { - std::string s(elem); + std::string s; + std::string end; util::trim(elem); - // FIXIT-M J. Variables do not need to start with a '$'/ for instance. !$HOME_NET + + if (elem.size() <= 1) + { + s = elem; + end = ""; + } + else + { + const std::size_t pos = elem.find('$', 1); + if (pos == std::string::npos) + { + s = elem; + end = ""; + } + else + { + s = elem.substr(0, pos); + end = elem.substr(pos, std::string::npos); + } + + } + + if(s.front() == '$') { // add a space between strings @@ -100,6 +124,9 @@ bool Variable::add_value(std::string elem) vars.push_back(vd); } + if (!end.empty()) + return add_value(end); + return true; } diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in index 82e1bff2f..29b603b40 100644 --- a/tools/snort2lua/tests/snort.conf.in +++ b/tools/snort2lua/tests/snort.conf.in @@ -64,6 +64,7 @@ portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143] # List of GTP ports for GTP preprocessor portvar GTP_PORTS [2123,2152,3386] +var TEST_PORTS !$SSH_PORTS # Valid in Snort, not valid in Snort++. will result in an error #var 3DMZ_NETS [[10.1.1.1,10.1.1.2,10.2.0.0/16]] @@ -1292,10 +1293,10 @@ alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS non-relative path a alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:host,0,packets,30,bytes,40,seconds,dst; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2251; rev:18; ) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:host,0,packets,30,bytes,40,seconds,src; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2252; rev:18; ) +alert tcp $EXTERNAL_NET any -> any $TEST_PORTS ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:host,0,packets,30,bytes,40,seconds,src; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2252; rev:18; ) alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|05|",depth 1; content:"|0B|",within 1,distance 1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W",within 16,distance 29; tag:session,5,packets,exclusive; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2253; rev:18; ) -alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:!"m?^Argument\s+/?smi"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2319; rev:4;) +alert tcp $EXTERNAL_NET any -> any $TEST_PORTS (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:!"m?^Argument\s+/?smi"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2319; rev:4;) alert tcp any any -> any any ( msg:"First Cookie"; content:"OvCgi",http_uri; content:"AcceptLang=en-usaAAAA",http_cookie,nocase; sid:11111111; )