From: Josh Date: Fri, 13 Jun 2014 19:22:04 +0000 (-0400) Subject: updating file names and superficial snort2lua structure X-Git-Tag: 3.0.0-233~1481^2~2^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=71dc4a7c4e4a4f84b801c59f7032dd1fd5442ccc;p=thirdparty%2Fsnort3.git updating file names and superficial snort2lua structure --- diff --git a/tools/snort2lua/CMakeLists.txt b/tools/snort2lua/CMakeLists.txt index 59deba8e7..6de08dc00 100644 --- a/tools/snort2lua/CMakeLists.txt +++ b/tools/snort2lua/CMakeLists.txt @@ -3,9 +3,9 @@ include_directories("${CMAKE_CURRENT_SOURCE_DIR}") add_subdirectory(data) -add_subdirectory(keywords) -add_subdirectory(preprocessor) -add_subdirectory(output) +add_subdirectory(keyword_states) +add_subdirectory(preprocessor_states) +add_subdirectory(output_states) add_executable(snort2lua snort2lua.cc @@ -18,10 +18,10 @@ add_executable(snort2lua ) target_link_libraries( snort2lua - data - keywords - output - preprocessor + converrsion_data + keyword_states + output_states + preprocessor_states ) diff --git a/tools/snort2lua/converter.h b/tools/snort2lua/converter.h index 7edc36bfc..0af3e149b 100644 --- a/tools/snort2lua/converter.h +++ b/tools/snort2lua/converter.h @@ -27,8 +27,8 @@ #include #include -#include "data/conv_data.h" -#include "data/conv_var.h" +#include "data/cv_data.h" +#include "data/cv_var.h" class ConversionState; @@ -38,12 +38,17 @@ class Converter public: Converter(); virtual ~Converter() {}; - void reset_state(); + // convert the following line from a snort.conf into a lua.conf bool convert_line(std::stringstream& data); + // set the next parsing state. void set_state(ConversionState* c); + // reset the current parsing state + void reset_state(); + // prints the entire lua configuration to the output file. + friend std::ostream &operator<<( std::ostream& out, const Converter &cv) { return out << cv.data; } + // add a variable to the new lua configuration. For example, --> HOME_NET = 'any' bool inline add_variable(std::string name, std::string v){ return data.add_variable(name, v); }; - friend std::ostream &operator<<( std::ostream& out, const Converter &cv) { return out << cv.data; } // open a table that does not contain a name --> NOT 'name = {...}' ONLY {...}) bool open_table(); @@ -53,26 +58,33 @@ public: bool close_table(); // add a string option to the table --> table = { name = 'val', } + // corresponds to Parameter::PT_STRING, Parameter::PT_SELECT bool add_option_to_table(std::string name, std::string val); // add an int option to the table --> table = { name = val, } + // corresponds to Parameter::PT_INT, Parametere::PT_PORT, Parametere::PT_REAL, etc bool add_option_to_table(std::string name, int val); // add a bool option to the table --> table = { name = true|false, } + // corresponds to Parameter::PT_BOOL bool add_option_to_table(std::string name, bool val); // add an option with a list of variables --> table = { name = 'elem1 elem2 ...' } + // corresponds to Parameter::PT_MULTI bool add_list_to_table(std::string list_name, std::string next_elem); // add a commment to be printed in the table --> table = { -- comment \n ... } void add_comment_to_table(std::string comment); + // comment will appear immediately below the lua configuration void add_comment_to_file(std::string comment); + // add the entire stream as a comment in the new lua file void add_comment_to_file(std::string comment, std::stringstream& stream); // attach a comment about a deprecated option to a file or table void add_deprecated_comment(std::string dep_var); - // deprecated option ... use the new option instead + // add a comment with the formate 'deprecated option ... use the new option instead' void add_deprecated_comment(std::string dep_var, std::string new_var); + // log an error in the new lua file void log_error(std::string); void print_line(std::stringstream& in); @@ -80,11 +92,12 @@ public: void print_line(std::string& in); private: + // the current parsing state. ConversionState* state; + // the data which will be printed into the new lua file ConversionData data; + // keeps track of the current tables std::stack open_tables; - - }; diff --git a/tools/snort2lua/data/CMakeLists.txt b/tools/snort2lua/data/CMakeLists.txt index c63d9125e..41137f194 100644 --- a/tools/snort2lua/data/CMakeLists.txt +++ b/tools/snort2lua/data/CMakeLists.txt @@ -1,11 +1,11 @@ -add_library(data - conv_data.h - conv_data.cc - conv_var.h - conv_var.cc - conv_table.h - conv_table.cc - conv_option.h - conv_option.cc +add_library(converrsion_data + cv_data.h + cv_data.cc + cv_var.h + cv_var.cc + cv_table.h + cv_table.cc + cv_option.h + cv_option.cc ) diff --git a/tools/snort2lua/data/conv_data.cc b/tools/snort2lua/data/cv_data.cc similarity index 97% rename from tools/snort2lua/data/conv_data.cc rename to tools/snort2lua/data/cv_data.cc index 1c0a27e82..0123bb89a 100644 --- a/tools/snort2lua/data/conv_data.cc +++ b/tools/snort2lua/data/cv_data.cc @@ -17,9 +17,9 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_data.cc author Josh Rosenbaum +// cv_data.cc author Josh Rosenbaum -#include "conv_data.h" +#include "cv_data.h" #include "snort2lua_util.h" #if 0 diff --git a/tools/snort2lua/data/conv_data.h b/tools/snort2lua/data/cv_data.h similarity index 93% rename from tools/snort2lua/data/conv_data.h rename to tools/snort2lua/data/cv_data.h index 6c220d673..5328ce47e 100644 --- a/tools/snort2lua/data/conv_data.h +++ b/tools/snort2lua/data/cv_data.h @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conversion_data.h author Josh Rosenbaum +// cv_data.h author Josh Rosenbaum #ifndef CONV_DATA_H #define CONV_DATA_H @@ -26,8 +26,8 @@ #include #include -#include "data/conv_table.h" -#include "data/conv_var.h" +#include "data/cv_table.h" +#include "data/cv_var.h" class ConversionData { diff --git a/tools/snort2lua/data/conv_option.cc b/tools/snort2lua/data/cv_option.cc similarity index 96% rename from tools/snort2lua/data/conv_option.cc rename to tools/snort2lua/data/cv_option.cc index 90cbb5160..bcbe88a4f 100644 --- a/tools/snort2lua/data/conv_option.cc +++ b/tools/snort2lua/data/cv_option.cc @@ -17,9 +17,9 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_option.cc author Josh Rosenbaum +// cv_option.cc author Josh Rosenbaum -#include "data/conv_option.h" +#include "data/cv_option.h" Option::Option(std::string name, int val, int depth) diff --git a/tools/snort2lua/data/conv_option.h b/tools/snort2lua/data/cv_option.h similarity index 96% rename from tools/snort2lua/data/conv_option.h rename to tools/snort2lua/data/cv_option.h index bcc004cbe..18bd671ad 100644 --- a/tools/snort2lua/data/conv_option.h +++ b/tools/snort2lua/data/cv_option.h @@ -17,12 +17,11 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_var.h author Josh Rosenbaum +// cv_option.h author Josh Rosenbaum #ifndef CONV_OPTIONS_H #define CONV_OPTIONS_H - #include #include #include diff --git a/tools/snort2lua/data/conv_table.cc b/tools/snort2lua/data/cv_table.cc similarity index 96% rename from tools/snort2lua/data/conv_table.cc rename to tools/snort2lua/data/cv_table.cc index 63788588a..6a7b837a3 100644 --- a/tools/snort2lua/data/conv_table.cc +++ b/tools/snort2lua/data/cv_table.cc @@ -17,9 +17,9 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_table.cc author Josh Rosenbaum +// cv_table.cc author Josh Rosenbaum -#include "data/conv_table.h" +#include "data/cv_table.h" static inline Table* find_table(std::vector vec, std::string name) { @@ -171,8 +171,8 @@ std::ostream &operator<<( std::ostream& out, const Table &t) for (Variable* v : t.lists) out << (*v) << ',' << std::endl; - for (Table* t : t.tables) - out << (*t) << ',' << std::endl; + for (Table* sub_t : t.tables) + out << (*sub_t) << ',' << std::endl; // don't add a comma if the depth is zero if(t.depth == 0) diff --git a/tools/snort2lua/data/conv_table.h b/tools/snort2lua/data/cv_table.h similarity index 94% rename from tools/snort2lua/data/conv_table.h rename to tools/snort2lua/data/cv_table.h index 0c9dd93a7..b258457d5 100644 --- a/tools/snort2lua/data/conv_table.h +++ b/tools/snort2lua/data/cv_table.h @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_var.h author Josh Rosenbaum +// cv_table.h author Josh Rosenbaum #ifndef CONV_TABLE_H #define CONV_TABLE_H @@ -27,8 +27,8 @@ #include #include -#include "conv_option.h" -#include "conv_var.h" +#include "cv_option.h" +#include "cv_var.h" class Table { diff --git a/tools/snort2lua/data/conv_var.cc b/tools/snort2lua/data/cv_var.cc similarity index 97% rename from tools/snort2lua/data/conv_var.cc rename to tools/snort2lua/data/cv_var.cc index 46509c8e8..394da5def 100644 --- a/tools/snort2lua/data/conv_var.cc +++ b/tools/snort2lua/data/cv_var.cc @@ -17,11 +17,12 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_var.cc author Josh Rosenbaum +// cv_var.cc author Josh Rosenbaum -#include "data/conv_var.h" +#include "data/cv_var.h" +#if 0 static inline bool var_exists(std::vector vec, std::string name) { for( auto str : vec) @@ -30,6 +31,7 @@ static inline bool var_exists(std::vector vec, std::string name) return true; } +#endif Variable::Variable(std::string name, int depth) { diff --git a/tools/snort2lua/data/conv_var.h b/tools/snort2lua/data/cv_var.h similarity index 96% rename from tools/snort2lua/data/conv_var.h rename to tools/snort2lua/data/cv_var.h index 72255b86e..353eec6ff 100644 --- a/tools/snort2lua/data/conv_var.h +++ b/tools/snort2lua/data/cv_var.h @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// conv_var.h author Josh Rosenbaum +// cv_var.h author Josh Rosenbaum #include #include diff --git a/tools/snort2lua/init_state.cc b/tools/snort2lua/init_state.cc index b5e05b728..74c337caf 100644 --- a/tools/snort2lua/init_state.cc +++ b/tools/snort2lua/init_state.cc @@ -25,7 +25,7 @@ #include #include "init_state.h" #include "snort2lua_util.h" -#include "keywords/keywords_api.h" +#include "keyword_states/keywords_api.h" InitState::InitState(Converter* cv) : ConversionState(cv) {} @@ -40,10 +40,8 @@ bool InitState::convert(std::stringstream& data_stream) if( keyword.front() == '#') { + std::cout << "THIS SHOULD NEVER OCCUR" << std::endl; keyword.erase(keyword.begin()); -// std::ostringstream oss; -// oss << data_stream.rdbuf(); -// out << "--" << keyword << oss.str() << std::endl; converter->add_comment_to_file(keyword, data_stream); data_stream.setstate(std::basic_ios::eofbit); return true; diff --git a/tools/snort2lua/keyword_states/CMakeLists.txt b/tools/snort2lua/keyword_states/CMakeLists.txt new file mode 100644 index 000000000..65b7c9332 --- /dev/null +++ b/tools/snort2lua/keyword_states/CMakeLists.txt @@ -0,0 +1,15 @@ + +add_library( keyword_states + kws_config.cc + kws_output.cc + kws_var.cc + kws_preprocessor.cc + kws_include.cc + keywords_api.h + keywords_api.cc +) + +target_link_libraries( keyword_states + output_states + preprocessor_states +) \ No newline at end of file diff --git a/tools/snort2lua/keywords/keywords_api.cc b/tools/snort2lua/keyword_states/keywords_api.cc similarity index 97% rename from tools/snort2lua/keywords/keywords_api.cc rename to tools/snort2lua/keyword_states/keywords_api.cc index a22ae0aa8..833ac2fad 100644 --- a/tools/snort2lua/keywords/keywords_api.cc +++ b/tools/snort2lua/keyword_states/keywords_api.cc @@ -19,7 +19,7 @@ */ // keywords_api.cc author Josh Rosenbaum -#include "keywords/keywords_api.h" +#include "keyword_states/keywords_api.h" extern const ConvertMap *portvar_map; diff --git a/tools/snort2lua/keywords/keywords_api.h b/tools/snort2lua/keyword_states/keywords_api.h similarity index 100% rename from tools/snort2lua/keywords/keywords_api.h rename to tools/snort2lua/keyword_states/keywords_api.h diff --git a/tools/snort2lua/keywords/config.cc b/tools/snort2lua/keyword_states/kws_config.cc similarity index 98% rename from tools/snort2lua/keywords/config.cc rename to tools/snort2lua/keyword_states/kws_config.cc index 8dcebf937..7babe5ff0 100644 --- a/tools/snort2lua/keywords/config.cc +++ b/tools/snort2lua/keyword_states/kws_config.cc @@ -26,8 +26,6 @@ #include "conversion_state.h" #include "converter.h" #include "snort2lua_util.h" -#include "output/output_api.h" - namespace { diff --git a/tools/snort2lua/keywords/include.cc b/tools/snort2lua/keyword_states/kws_include.cc similarity index 100% rename from tools/snort2lua/keywords/include.cc rename to tools/snort2lua/keyword_states/kws_include.cc diff --git a/tools/snort2lua/keywords/output.cc b/tools/snort2lua/keyword_states/kws_output.cc similarity index 98% rename from tools/snort2lua/keywords/output.cc rename to tools/snort2lua/keyword_states/kws_output.cc index af672d524..d60ae751d 100644 --- a/tools/snort2lua/keywords/output.cc +++ b/tools/snort2lua/keyword_states/kws_output.cc @@ -25,7 +25,7 @@ #include "conversion_state.h" #include "converter.h" #include "snort2lua_util.h" -#include "output/output_api.h" +#include "output_states/output_api.h" diff --git a/tools/snort2lua/keywords/preprocessor.cc b/tools/snort2lua/keyword_states/kws_preprocessor.cc similarity index 97% rename from tools/snort2lua/keywords/preprocessor.cc rename to tools/snort2lua/keyword_states/kws_preprocessor.cc index 36426defb..203bdf475 100644 --- a/tools/snort2lua/keywords/preprocessor.cc +++ b/tools/snort2lua/keyword_states/kws_preprocessor.cc @@ -26,7 +26,7 @@ #include "conversion_state.h" #include "converter.h" #include "snort2lua_util.h" -#include "preprocessor/preprocessor_api.h" +#include "preprocessor_states/preprocessor_api.h" namespace { diff --git a/tools/snort2lua/keywords/suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc similarity index 95% rename from tools/snort2lua/keywords/suppress.cc rename to tools/snort2lua/keyword_states/kws_suppress.cc index acaee91a4..043463fa0 100644 --- a/tools/snort2lua/keywords/suppress.cc +++ b/tools/snort2lua/keyword_states/kws_suppress.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// config.cc author Josh Rosenbaum +// suppress.cc author Josh Rosenbaum #include #include @@ -26,6 +26,7 @@ #include "conversion_state.h" #include "converter.h" #include "snort2lua_util.h" +//#include "suppress_states/suppress_api.h" namespace { diff --git a/tools/snort2lua/keywords/var.cc b/tools/snort2lua/keyword_states/kws_var.cc similarity index 100% rename from tools/snort2lua/keywords/var.cc rename to tools/snort2lua/keyword_states/kws_var.cc diff --git a/tools/snort2lua/keywords/CMakeLists.txt b/tools/snort2lua/keywords/CMakeLists.txt deleted file mode 100644 index e530b1695..000000000 --- a/tools/snort2lua/keywords/CMakeLists.txt +++ /dev/null @@ -1,15 +0,0 @@ - -add_library( keywords - config.cc - output.cc - var.cc - preprocessor.cc - include.cc - keywords_api.h - keywords_api.cc -) - -target_link_libraries( keywords - output - preprocessor -) \ No newline at end of file diff --git a/tools/snort2lua/output/CMakeLists.txt b/tools/snort2lua/output_states/CMakeLists.txt similarity index 59% rename from tools/snort2lua/output/CMakeLists.txt rename to tools/snort2lua/output_states/CMakeLists.txt index 5998ea0d0..c12bb65dc 100644 --- a/tools/snort2lua/output/CMakeLists.txt +++ b/tools/snort2lua/output_states/CMakeLists.txt @@ -1,6 +1,6 @@ -add_library(output +add_library(output_states output_api.h output_api.cc ) \ No newline at end of file diff --git a/tools/snort2lua/output/output_api.cc b/tools/snort2lua/output_states/output_api.cc similarity index 80% rename from tools/snort2lua/output/output_api.cc rename to tools/snort2lua/output_states/output_api.cc index c3637005e..f96b55552 100644 --- a/tools/snort2lua/output/output_api.cc +++ b/tools/snort2lua/output_states/output_api.cc @@ -19,19 +19,9 @@ */ // output_api.cc author Josh Rosenbaum -#include "output/output_api.h" - - -extern const ConvertMap *portvar_map; -extern const ConvertMap *ipvar_map; -extern const ConvertMap *var_map; -extern const ConvertMap *output_map; +#include "output_states/output_api.h" const std::vector output_api = { - portvar_map, - ipvar_map, - var_map, - output_map, -// nullptr, + nullptr, }; diff --git a/tools/snort2lua/output/output_api.h b/tools/snort2lua/output_states/output_api.h similarity index 100% rename from tools/snort2lua/output/output_api.h rename to tools/snort2lua/output_states/output_api.h diff --git a/tools/snort2lua/preprocessor/CMakeLists.txt b/tools/snort2lua/preprocessor/CMakeLists.txt deleted file mode 100644 index 57a12292d..000000000 --- a/tools/snort2lua/preprocessor/CMakeLists.txt +++ /dev/null @@ -1,10 +0,0 @@ - -add_library(preprocessor - arpspoof.cc - http_inspect.cc - smtp.cc - normalizers.cc - sfportscan.cc - preprocessor_api.h - preprocessor_api.cc -) \ No newline at end of file diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt new file mode 100644 index 000000000..0fa357db4 --- /dev/null +++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt @@ -0,0 +1,11 @@ + +add_library(preprocessor_states + pps_arpspoof.cc + pps_http_inspect.cc + pps_smtp.cc + pps_normalizers.cc + pps_sfportscan.cc + pps_ftp_telnet.cc + preprocessor_api.h + preprocessor_api.cc +) diff --git a/tools/snort2lua/preprocessor/arpspoof.cc b/tools/snort2lua/preprocessor_states/pps_arpspoof.cc similarity index 100% rename from tools/snort2lua/preprocessor/arpspoof.cc rename to tools/snort2lua/preprocessor_states/pps_arpspoof.cc diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc new file mode 100644 index 000000000..f1c633522 --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc @@ -0,0 +1,115 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// config.cc author Josh Rosenbaum + +#include +#include +#include + +#include "conversion_state.h" +#include "converter.h" +#include "snort2lua_util.h" + +namespace { + +class FtpTelnet : public ConversionState +{ +public: + FtpTelnet(Converter* cv) : ConversionState(cv) {}; + virtual ~FtpTelnet() {}; + virtual bool convert(std::stringstream& data_stream); +}; + +} // namespace + + +bool FtpTelnet::convert(std::stringstream& data_stream) +{ +#if 0 +# FTP / Telnet normalization and anomaly detection. For more information, see README.ftptelnet +preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted +preprocessor ftp_telnet_protocol: telnet \ + ayt_attack_thresh 20 \ + normalize ports { 23 } \ + detect_anomalies +preprocessor ftp_telnet_protocol: ftp server default \ + def_max_param_len 100 \ + ports { 21 2100 3535 } \ + telnet_cmds yes \ + ignore_telnet_erase_cmds yes \ + ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \ + ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \ + ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \ + ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \ + ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \ + ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \ + ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \ + ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \ + ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \ + ftp_cmds { XSEN XSHA1 XSHA256 } \ + alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \ + alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \ + alt_max_param_len 256 { CWD RNTO } \ + alt_max_param_len 400 { PORT } \ + alt_max_param_len 512 { SIZE } \ + chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \ + chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \ + chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \ + chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \ + chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \ + chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \ + chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ + chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \ + cmd_validity ALLO < int [ char R int ] > \ + cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \ + cmd_validity MACB < string > \ + cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \ + cmd_validity MODE < char ASBCZ > \ + cmd_validity PORT < host_port > \ + cmd_validity PROT < char CSEP > \ + cmd_validity STRU < char FRPO [ string ] > \ + cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > +preprocessor ftp_telnet_protocol: ftp client default \ + max_resp_len 256 \ + bounce yes \ + ignore_telnet_erase_cmds yes \ + telnet_cmds yes +#endif + + data_stream.setstate(std::basic_ios::eofbit); + return true; +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter* cv) +{ + return new FtpTelnet(cv); +} + +static const ConvertMap keyword_preprocessor = +{ + "ftp_telnet", + ctor, +}; + +const ConvertMap* preprocessor_map = &keyword_preprocessor; diff --git a/tools/snort2lua/preprocessor/http_inspect.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc similarity index 100% rename from tools/snort2lua/preprocessor/http_inspect.cc rename to tools/snort2lua/preprocessor_states/pps_http_inspect.cc diff --git a/tools/snort2lua/preprocessor/http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc similarity index 100% rename from tools/snort2lua/preprocessor/http_inspect_server.cc rename to tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc diff --git a/tools/snort2lua/preprocessor/normalizers.cc b/tools/snort2lua/preprocessor_states/pps_normalizers.cc similarity index 100% rename from tools/snort2lua/preprocessor/normalizers.cc rename to tools/snort2lua/preprocessor_states/pps_normalizers.cc diff --git a/tools/snort2lua/preprocessor/sfportscan.cc b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc similarity index 99% rename from tools/snort2lua/preprocessor/sfportscan.cc rename to tools/snort2lua/preprocessor_states/pps_sfportscan.cc index 56fa31987..4ca07758c 100644 --- a/tools/snort2lua/preprocessor/sfportscan.cc +++ b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc @@ -49,7 +49,6 @@ private: bool PortScan::parse_ip_list(std::string list_name, std::stringstream& data_stream) { - bool retval; std::string prev; std::string elem; diff --git a/tools/snort2lua/preprocessor/smtp.cc b/tools/snort2lua/preprocessor_states/pps_smtp.cc similarity index 100% rename from tools/snort2lua/preprocessor/smtp.cc rename to tools/snort2lua/preprocessor_states/pps_smtp.cc diff --git a/tools/snort2lua/preprocessor/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc similarity index 93% rename from tools/snort2lua/preprocessor/preprocessor_api.cc rename to tools/snort2lua/preprocessor_states/preprocessor_api.cc index 1c9c91bff..78ea8c46a 100644 --- a/tools/snort2lua/preprocessor/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc @@ -17,9 +17,9 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// keywords_api.cc author Josh Rosenbaum +// preprocessor_api.cc author Josh Rosenbaum -#include "preprocessor/preprocessor_api.h" +#include "preprocessor_states/preprocessor_api.h" extern const ConvertMap *arpspoof_map; diff --git a/tools/snort2lua/preprocessor/preprocessor_api.h b/tools/snort2lua/preprocessor_states/preprocessor_api.h similarity index 100% rename from tools/snort2lua/preprocessor/preprocessor_api.h rename to tools/snort2lua/preprocessor_states/preprocessor_api.h diff --git a/tools/snort2lua/snort2lua.cc b/tools/snort2lua/snort2lua.cc index fba1364be..5eb76b577 100644 --- a/tools/snort2lua/snort2lua.cc +++ b/tools/snort2lua/snort2lua.cc @@ -38,7 +38,7 @@ static bool convert(std::ifstream& in, std::ofstream& out) std::getline(in, tmp); util::ltrim(tmp); orig_text += ' ' + tmp; - util::rtrim(orig_text); + util::trim(orig_text); if (orig_text.empty()) { @@ -48,6 +48,7 @@ static bool convert(std::ifstream& in, std::ofstream& out) { orig_text.erase(orig_text.begin()); cv.add_comment_to_file(orig_text); + orig_text.clear(); } else if ( orig_text.back() == '\\') { diff --git a/tools/snort2lua/state_template.cc b/tools/snort2lua/state_template.cc index 573eb00b5..715f3b54d 100644 --- a/tools/snort2lua/state_template.cc +++ b/tools/snort2lua/state_template.cc @@ -43,19 +43,6 @@ public: bool Suppress::convert(std::stringstream& data_stream) { #if 0 - std::string keyword; - - if(data_stream >> keyword) - { - const ConvertMap* map = util::find_map(output_api, keyword); - if (map) - { - converter->set_state(map->ctor(converter)); - return true; - } - } - - return false; #endif data_stream.setstate(std::basic_ios::eofbit);