From: Josh <jrosenba@cisco.com>
Date: Tue, 17 Jun 2014 22:15:53 +0000 (-0400)
Subject: adding suppress support and stream5_* support
X-Git-Tag: 3.0.0-233~1476^2~1^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ca1234dc2e2a7358e3fcabb0e81e2e65504e4a5;p=thirdparty%2Fsnort3.git

adding suppress support and stream5_* support
---

diff --git a/src/framework/codec.h b/src/framework/codec.h
index 1244664a1..c10dea0be 100644
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -75,7 +75,7 @@ struct EncState{
 // * base+end is start of current layer
 // * base+size-1 is last byte of packet (in) / buffer (out)
 struct Buffer {
-    uint8_t *base;          /* start of data */
+    uint8_t* base;          /* start of data */
     int off;           /* offset into data */
     int end;           /* end of data */
     int size;          /* size of allocation */
diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h
index 104b32aba..ebff711f7 100644
--- a/tools/snort2lua/conversion_state.h
+++ b/tools/snort2lua/conversion_state.h
@@ -40,6 +40,23 @@ public:
 protected:
     Converter* converter;
 
+    inline bool parse_string_option(std::string opt_name, std::stringstream& stream)
+    {
+        std::string val;
+
+        if(stream >> val)
+        {
+            if(val.back() == ',')
+                val.pop_back();
+
+            converter->add_option_to_table(opt_name, val);
+            return true;
+        }
+
+        converter->add_comment_to_table("snort.conf missing argument for: " + opt_name + " <int>");
+        return false;
+    }
+
     inline bool parse_int_option(std::string opt_name, std::stringstream& stream)
     {
         int val;
@@ -54,7 +71,7 @@ protected:
         return false;
     }
 
-    // parse adn add a curly bracketed list to the table
+    // parse and add a curly bracketed list to the table
     inline bool parse_curly_bracket_list(std::string list_name, std::stringstream& stream)
     {
         std::string elem;
@@ -87,7 +104,7 @@ protected:
         return false;
     }
 
-    // parse adn add a curly bracketed list to the table
+    // parse a curly bracketed bit and add it to the table
     inline bool parse_bracketed_byte_list(std::string list_name, std::stringstream& stream)
     {
         std::string elem;
@@ -125,6 +142,33 @@ protected:
         return retval;
     }
 
+    // parse and add a curly bracket list '{...}' which is currently unsupported in Snort++
+    inline bool parse_bracketed_unsupported_list(std::string list_name, std::stringstream& stream)
+    {
+        std::string tmp = "";
+        std::string elem;
+
+        if(!(stream >> elem) || (elem != "{"))
+            return false;
+
+        while (stream >> elem && elem != "}")
+            tmp += " " + elem;
+
+        // remove the extra space at the beginig of the string
+        if(tmp.size() > 0)
+            tmp.erase(tmp.begin());
+
+        return converter->add_option_to_table("--" + list_name, tmp );
+    }
+
+    inline bool pen_table_add_option(std::string table_name, std::string opt_name, std::string val)
+    {
+        bool tmpval = converter->open_table(table_name);
+        tmpval = converter->add_option_to_table(opt_name, val) && tmpval;
+        converter->close_table();
+        return tmpval;
+    }
+
 
 private:
 
diff --git a/tools/snort2lua/converter.cc b/tools/snort2lua/converter.cc
index de54c7c18..d7548f54a 100644
--- a/tools/snort2lua/converter.cc
+++ b/tools/snort2lua/converter.cc
@@ -92,6 +92,13 @@ bool Converter::open_table(std::string table_name)
     return true;
 }
 
+bool Converter::open_top_level_table(std::string table_name)
+{
+    Table *t = data.add_table(table_name);
+    open_tables.push(t);
+    return true;
+}
+
 bool Converter::close_table()
 {
     open_tables.pop();
@@ -103,7 +110,8 @@ bool Converter::add_option_to_table(std::string option_name, std::string val)
 {
     if(open_tables.size() == 0)
     {
-        log_error("Must open table before adding an option!!");
+        log_error("Must open table before adding an option!!: " +
+            option_name + " = " + val);
         return false;
     }
 
@@ -117,7 +125,9 @@ bool Converter::add_option_to_table(std::string option_name, int val)
 {
     if(open_tables.size() == 0)
     {
-        log_error("Must open table before adding an option!!");
+
+        log_error("Must open table before adding an option!!: " +
+            option_name + " = " + std::to_string(val));
         return false;
     }
 
@@ -130,7 +140,8 @@ bool Converter::add_option_to_table(std::string option_name, bool val)
 {
     if(open_tables.size() == 0)
     {
-        log_error("Must open table before adding an option!!");
+        log_error("Must open table before adding an option!!: " +
+            option_name + " = " + std::to_string(val));
         return false;
     }
 
@@ -142,6 +153,13 @@ bool Converter::add_option_to_table(std::string option_name, bool val)
 
 bool Converter::add_list_to_table(std::string list_name, std::string next_elem)
 {
+    if(open_tables.size() == 0)
+    {
+        log_error("Must open table before adding an option!!: " +
+            list_name + " = " + next_elem);
+        return false;
+    }
+
     Table *t = open_tables.top();
 
     if(t)
@@ -151,7 +169,8 @@ bool Converter::add_list_to_table(std::string list_name, std::string next_elem)
     }
     else
     {
-        log_error("Must open table before adding a list!!");
+        log_error("Must open table before adding an list!!: " +
+            list_name + " += " + next_elem);
         return false;
     }
 }
@@ -181,7 +200,7 @@ void Converter::add_comment_to_file(std::string comment, std::stringstream& stre
 
 void Converter::add_deprecated_comment(std::string dep_var)
 {
-    std::string error_string = "option " + dep_var + " has been deprecated.";
+    std::string error_string = "option '" + dep_var + "' deprecated.";
 
     if (open_tables.size() > 0)
         add_comment_to_table(error_string);
@@ -191,8 +210,8 @@ void Converter::add_deprecated_comment(std::string dep_var)
 
 void Converter::add_deprecated_comment(std::string dep_var, std::string new_var)
 {
-    std::string error_string = "option " + dep_var + " has been deprecated" 
-            + " ... using " + new_var + " instead";
+    std::string error_string = "option '" + dep_var + "' deprecated"
+            + " ... using '" + new_var + "' instead";
 
     if (open_tables.size() > 0)
         add_comment_to_table(error_string);
diff --git a/tools/snort2lua/converter.h b/tools/snort2lua/converter.h
index 0af3e149b..3f2a2104e 100644
--- a/tools/snort2lua/converter.h
+++ b/tools/snort2lua/converter.h
@@ -54,6 +54,8 @@ public:
     bool open_table();
     // open a  named tabled --> 'name = {...}')
     bool open_table(std::string name);
+    // open a table at the topmost layer. i.e., the table will not be nested inside any other table.
+    bool open_top_level_table(std::string name);
     // close the current table.  go to previous table level
     bool close_table();
 
diff --git a/tools/snort2lua/data/cv_data.cc b/tools/snort2lua/data/cv_data.cc
index 0123bb89a..568732cc8 100644
--- a/tools/snort2lua/data/cv_data.cc
+++ b/tools/snort2lua/data/cv_data.cc
@@ -21,13 +21,7 @@
 
 #include "cv_data.h"
 #include "snort2lua_util.h"
-
-#if 0
-    std::vector<Variable> vars;
-    std::vector<Table> tables;
-    Table curr_table;
-#endif
-
+#include <iostream>
 
 static inline Table* find_table(std::vector<Table*> vec, std::string name)
 {
@@ -72,9 +66,19 @@ Table* ConversionData::add_table(std::string name)
     if(t)
         return t;
 
-    t = new Table(name, 0);
-    tables.push_back(t);
-    return t;
+
+    try
+    {
+        t = new Table(name, 0);
+        tables.push_back(t);
+        return t;
+    }
+    catch (std::bad_alloc& ba)
+    {
+        std::cout << "Failed to allocate memory for a new Table!!" << std::endl;
+        exit (EXIT_FAILURE);
+        return nullptr;
+    }
 }
 
 void ConversionData::add_comment(std::string str)
diff --git a/tools/snort2lua/data/cv_var.cc b/tools/snort2lua/data/cv_var.cc
index d96979dd4..2bc4aaec2 100644
--- a/tools/snort2lua/data/cv_var.cc
+++ b/tools/snort2lua/data/cv_var.cc
@@ -95,13 +95,14 @@ std::ostream& operator<<( std::ostream& out, const Variable &var)
     else if(var.count < var.max_line_length || var.strs.size() == 1)
     {
         std::string tmp_str = "";
+        length = whitespace.size();
 
         for (auto s : var.strs)
         {
             if ( 0 < length && length + s.size() > var.max_line_length )
                 tmp_str += "\n" + whitespace + "    ";
 
-            length += s.size();
+            length += s.size() ;
             tmp_str += s + ' ';
         }
         util::trim(tmp_str);
@@ -114,14 +115,14 @@ std::ostream& operator<<( std::ostream& out, const Variable &var)
 
         for (auto s : var.strs)
         {
-            if ( 0 < length && length + s.size() > var.max_line_length )
+            if ( length + s.size() > var.max_line_length )
             {
                 util::rtrim(tmp_str);
                 tmp_str += "\n" + whitespace + "    ";
                 length = 4 + whitespace.size();
             }
 
-            length += s.size();
+            length += s.size() + 1;
             tmp_str += s + " ";
         }
 
diff --git a/tools/snort2lua/data/cv_var.h b/tools/snort2lua/data/cv_var.h
index 353eec6ff..d9e065289 100644
--- a/tools/snort2lua/data/cv_var.h
+++ b/tools/snort2lua/data/cv_var.h
@@ -43,7 +43,7 @@ private:
     std::vector<std::string> vars;
     std::vector<std::string> strs;
     int count;
-    const int max_line_length = 70; // leave room for additional text
+    const int max_line_length = 74; // leave room for additional text
     int depth;
 };
 
diff --git a/tools/snort2lua/keyword_states/CMakeLists.txt b/tools/snort2lua/keyword_states/CMakeLists.txt
index 65b7c9332..7b32236a4 100644
--- a/tools/snort2lua/keyword_states/CMakeLists.txt
+++ b/tools/snort2lua/keyword_states/CMakeLists.txt
@@ -5,6 +5,7 @@ add_library( keyword_states
     kws_var.cc
     kws_preprocessor.cc
     kws_include.cc
+    kws_suppress.cc
     keywords_api.h
     keywords_api.cc
 )
diff --git a/tools/snort2lua/keyword_states/keywords_api.cc b/tools/snort2lua/keyword_states/keywords_api.cc
index 833ac2fad..6398b4054 100644
--- a/tools/snort2lua/keyword_states/keywords_api.cc
+++ b/tools/snort2lua/keyword_states/keywords_api.cc
@@ -29,6 +29,7 @@ extern const ConvertMap *output_map;
 extern const ConvertMap *config_map;
 extern const ConvertMap *preprocessor_map;
 extern const ConvertMap *include_map;
+extern const ConvertMap *supress_map;
 
 
 
@@ -41,5 +42,6 @@ const std::vector<const ConvertMap*> keyword_api =
     config_map,
     preprocessor_map,
     include_map,
+    supress_map
 //    nullptr,
 };
diff --git a/tools/snort2lua/keyword_states/kws_config.cc b/tools/snort2lua/keyword_states/kws_config.cc
index 9c1d5f6db..4d95e6f43 100644
--- a/tools/snort2lua/keyword_states/kws_config.cc
+++ b/tools/snort2lua/keyword_states/kws_config.cc
@@ -58,8 +58,7 @@ bool Config::convert(std::stringstream& data_stream)
     return false;    
 #endif
 
-    data_stream.setstate(std::basic_ios<char>::eofbit);
-    return true;
+    return false;
 }
 
 /**************************
diff --git a/tools/snort2lua/keyword_states/kws_include.cc b/tools/snort2lua/keyword_states/kws_include.cc
index 8181eff03..c0fffc59f 100644
--- a/tools/snort2lua/keyword_states/kws_include.cc
+++ b/tools/snort2lua/keyword_states/kws_include.cc
@@ -58,8 +58,7 @@ bool Include::convert(std::stringstream& data_stream)
     return false;    
 #endif
 
-    data_stream.setstate(std::basic_ios<char>::eofbit);
-    return true;
+    return false;
 }
 
 /**************************
diff --git a/tools/snort2lua/keyword_states/kws_output.cc b/tools/snort2lua/keyword_states/kws_output.cc
index d60ae751d..76dccd99d 100644
--- a/tools/snort2lua/keyword_states/kws_output.cc
+++ b/tools/snort2lua/keyword_states/kws_output.cc
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// output.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// kws_output.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
diff --git a/tools/snort2lua/keyword_states/kws_suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc
index 420a51735..eda365699 100644
--- a/tools/snort2lua/keyword_states/kws_suppress.cc
+++ b/tools/snort2lua/keyword_states/kws_suppress.cc
@@ -42,24 +42,45 @@ public:
 
 bool Suppress::convert(std::stringstream& data_stream)
 {
-#if 0
+    bool retval = true;
     std::string keyword;
 
-    if(data >> keyword)
+    converter->open_table("suppress");
+    converter->open_table();
+
+    while(data_stream >> keyword)
     {
-        const ConvertMap* map = util::find_map(output_api, keyword);
-        if (map)
+        bool tmpval = true;
+
+        if(keyword.back() == ',')
+            keyword.pop_back();
+
+        if(keyword.empty())
+            continue;
+
+        if (!keyword.compare("track"))
+            tmpval = parse_string_option("track", data_stream);
+
+        else if (!keyword.compare("ip"))
+            tmpval = parse_string_option("ip", data_stream);
+
+        else if(!keyword.compare("gen_id"))
         {
-            converter->set_state(map->ctor(converter));
-            return true;
+            converter->add_deprecated_comment("gen_id", "gid");
+            tmpval = parse_int_option("gid", data_stream);
         }
-    }
 
-    return false;    
-#endif
+        else if (!keyword.compare("sig_id"))
+        {
+            converter->add_deprecated_comment("sig_id", "sid");
+            tmpval = parse_int_option("sid", data_stream);
+        }
+
+        if (retval)
+            retval = tmpval;
+    }
 
-    data_stream.setstate(std::basic_ios<char>::eofbit);
-    return true;    
+    return retval;
 }
 
 /**************************
@@ -71,10 +92,10 @@ static ConversionState* ctor(Converter* cv)
     return new Suppress(cv);
 }
 
-static const ConvertMap keyword_preprocessor = 
+static const ConvertMap keyword_supress =
 {
     "suppress",
     ctor,
 };
 
-const ConvertMap* preprocessor_map = &keyword_preprocessor;
+const ConvertMap* supress_map = &keyword_supress;
diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt
index a35c842f3..aa56655c8 100644
--- a/tools/snort2lua/preprocessor_states/CMakeLists.txt
+++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt
@@ -6,6 +6,9 @@ add_library(preprocessor_states
     pps_smtp.cc
     pps_normalizers.cc
     pps_sfportscan.cc
+    pps_stream_global.cc
+    pps_stream_tcp.cc
+    pps_stream_udp.cc
     pps_ftp_telnet.cc
     pps_ftp_telnet_protocol.cc
     pps_bo.cc
diff --git a/tools/snort2lua/preprocessor_states/pps_arpspoof.cc b/tools/snort2lua/preprocessor_states/pps_arpspoof.cc
index b6d90a0d4..e513e283f 100644
--- a/tools/snort2lua/preprocessor_states/pps_arpspoof.cc
+++ b/tools/snort2lua/preprocessor_states/pps_arpspoof.cc
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// arp_spoof.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_arp_spoof.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
index 7756e094f..b2951c48f 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// http_inspect.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_http_inspect.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
@@ -87,7 +87,7 @@ bool HttpInspect::convert(std::stringstream& data_stream)
             retval = parse_int_option("memcap", data_stream) && retval;
         
         else if(!keyword.compare("disabled"))
-            converter->add_comment_to_table("'disabled' is deprecated");
+            converter->add_deprecated_comment("disabled");
 
         else if(!keyword.compare("b64_decode_depth"))
             retval = add_decode_option("b64_decode_depth", data_stream) && retval;
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index db8283d51..cb2e06c3e 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -194,6 +194,12 @@ bool HttpInspectServer::convert(std::stringstream& data_stream)
         else if (!keyword.compare("no_alerts"))
             converter->add_deprecated_comment("no_alerts");
 
+        else if (!keyword.compare("decompress_swf"))
+            tmpval = parse_bracketed_unsupported_list("decompress_swf", data_stream);
+
+        else if (!keyword.compare("decompress_pdf"))
+            tmpval = parse_bracketed_unsupported_list("decompress_pdf", data_stream);
+
         else if (!keyword.compare("http_methods"))
             tmpval = parse_curly_bracket_list("http_methods", data_stream);
 
@@ -218,6 +224,13 @@ bool HttpInspectServer::convert(std::stringstream& data_stream)
             tmpval = parse_int_option("server_flow_depth", data_stream);
         }
 
+        else if (!keyword.compare("ports"))
+        {
+            converter->add_deprecated_comment("ports", "bindings");
+            converter->add_comment_to_table("check bindings table for port information");
+            tmpval = parse_bracketed_unsupported_list("ports", data_stream);
+        }
+
         else if (!keyword.compare("small_chunk_length"))
         {
             std::string bracket;
@@ -274,17 +287,6 @@ bool HttpInspectServer::convert(std::stringstream& data_stream)
             }
         }
 
-        else if (!keyword.compare("ports"))
-        {
-            converter->add_deprecated_comment("ports", "bindings");
-            converter->add_comment_to_table("check bindings table for port information");
-            // add commented list for now
-            std::string tmp = "";
-            while (data_stream >> keyword && keyword != "}")
-                tmp += " " + keyword;
-            tmpval = converter->add_option_to_table("--ports", tmp + "}");
-        }
-
         else
           tmpval = false;
 
diff --git a/tools/snort2lua/preprocessor_states/pps_normalizers.cc b/tools/snort2lua/preprocessor_states/pps_normalizers.cc
index 1e1a3ef8a..ba11dbda9 100644
--- a/tools/snort2lua/preprocessor_states/pps_normalizers.cc
+++ b/tools/snort2lua/preprocessor_states/pps_normalizers.cc
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// normalizers.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_normalizers.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
diff --git a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
index a8cf3eaaa..df366fc47 100644
--- a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
+++ b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
@@ -127,33 +127,22 @@ bool PortScan::convert(std::stringstream& data_stream)
 
     while(data_stream >> keyword)
     {
-        if(!keyword.compare("proto"))
-        {
-            converter->add_deprecated_comment("proto", "protos");
-            // defined in ConversionState vvvv
-            retval = parse_curly_bracket_list("protos", data_stream) && retval;
-        }
+        bool tmpval = true;
 
-        if(!keyword.compare("scan_type"))
-        {
-            converter->add_deprecated_comment("scan_type", "scan_types");
-            // defined in ConversionState vvvv
-            retval = parse_curly_bracket_list("scan_types", data_stream) && retval;
-        }
-        else if(!keyword.compare("sense_level"))
-            retval = parse_option("sense_level", data_stream) && retval;
+        if(!keyword.compare("sense_level"))
+            tmpval = parse_option("sense_level", data_stream);
 
         else if(!keyword.compare("watch_ip"))
-            retval = parse_ip_list("watch_ip", data_stream) && retval;
+            tmpval = parse_ip_list("watch_ip", data_stream);
 
         else if(!keyword.compare("ignore_scanned"))
-            retval = parse_ip_list("ignore_scanners", data_stream) && retval;
+            tmpval = parse_ip_list("ignore_scanners", data_stream);
 
         else if(!keyword.compare("ignore_scanners"))
-            retval = parse_ip_list("ignore_scanned", data_stream) && retval;
+            tmpval = parse_ip_list("ignore_scanned", data_stream);
 
         else if(!keyword.compare("include_midstream"))
-            retval = converter->add_option_to_table("include_midstream", true) && retval;
+            tmpval = converter->add_option_to_table("include_midstream", true);
 
         else if(!keyword.compare("disabled"))
             converter->add_deprecated_comment("disabled");
@@ -165,15 +154,29 @@ bool PortScan::convert(std::stringstream& data_stream)
             converter->add_deprecated_comment("logfile");
 
         else if(!keyword.compare("memcap"))
-            retval = add_portscan_global_option("memcap", data_stream) && retval;
+            tmpval = add_portscan_global_option("memcap", data_stream);
+
+        else if(!keyword.compare("proto"))
+        {
+            converter->add_deprecated_comment("proto", "protos");
+            retval = parse_curly_bracket_list("protos", data_stream) && retval;
+        }
+
+        else if(!keyword.compare("scan_type"))
+        {
+            converter->add_deprecated_comment("scan_type", "scan_types");
+            tmpval = parse_curly_bracket_list("scan_types", data_stream) && retval;
+        }
 
         else
-            retval = false;
+            tmpval = false;
+
+        tmpval = retval && tmpval;
     }
 
 
-    converter->close_table();
-    return retval;    
+    converter->close_table(); // unecessary since the state will be reset
+    return retval;
 }
 
 
diff --git a/tools/snort2lua/preprocessor_states/pps_stream_global.cc b/tools/snort2lua/preprocessor_states/pps_stream_global.cc
new file mode 100644
index 000000000..5f2a8b0be
--- /dev/null
+++ b/tools/snort2lua/preprocessor_states/pps_stream_global.cc
@@ -0,0 +1,172 @@
+
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// pps_stream_global.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class StreamGlobal : public ConversionState
+{
+public:
+    StreamGlobal(Converter* cv)  : ConversionState(cv) {};
+    virtual ~StreamGlobal() {};
+    virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+bool StreamGlobal::convert(std::stringstream& data_stream)
+{
+    std::string keyword;
+    bool retval = true;
+
+    converter->open_table("stream");
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
+
+        if(keyword.back() == ',')
+            keyword.pop_back();
+        
+        if(keyword.empty())
+            continue;
+
+
+
+        if(!keyword.compare("flush_on_alert"))
+            converter->add_deprecated_comment("flush_on_alert");
+
+        else if(!keyword.compare("disabled"))
+            converter->add_deprecated_comment("disabled");
+
+        else if(!keyword.compare("track_tcp"))
+        {
+            converter->add_deprecated_comment("track_tcp");
+            if(!(data_stream >> keyword)) // eat the yes/no option
+                tmpval = false;
+        }
+
+        else if(!keyword.compare("track_udp"))
+        {
+            converter->add_deprecated_comment("track_udp");
+            if(!(data_stream >> keyword)) // eat the yes/no option
+                tmpval = false;
+        }
+
+        else if(!keyword.compare("track_icmp"))
+        {
+            converter->add_deprecated_comment("track_icmp");
+            if(!(data_stream >> keyword)) // eat the yes/no option
+                tmpval = false;
+        }
+
+        else if(!keyword.compare("prune_log_max"))
+        {
+            converter->add_deprecated_comment("prune_log_max", "histogram");
+            if(!(data_stream >> keyword)) // eat the number of bytes
+                tmpval = false;
+        }
+
+        else if(!keyword.compare("max_tcp"))
+        {
+            converter->open_table("tcp_cache");
+            tmpval = parse_int_option("max_sessions", data_stream);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("memcap"))
+        {
+            converter->open_table("tcp_cache");
+            tmpval = parse_int_option("memcap", data_stream);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("max_udp"))
+        {
+            converter->open_table("udp_cache");
+            tmpval = parse_int_option("max_sessions", data_stream);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("max_icmp"))
+        {
+            converter->open_table("icmp_cache");
+            tmpval = parse_int_option("max_sessions", data_stream);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("show_rebuilt_packets"))
+        {
+            converter->open_top_level_table("stream_tcp");
+            converter->add_option_to_table("show_rebuilt_packets", true);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("min_response_seconds"))
+        {
+            converter->open_top_level_table("active");
+            tmpval = parse_int_option("min_interval", data_stream);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("max_active_responses"))
+        {
+            converter->open_top_level_table("active");
+            tmpval = parse_int_option("max_responses", data_stream);
+            converter->close_table();
+        }
+
+
+
+        else
+            tmpval = false;
+
+        if (retval)
+            retval = tmpval;
+    }
+
+    return retval;    
+}
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+    return new StreamGlobal(cv);
+}
+
+static const ConvertMap preprocessor_stream_global = 
+{
+    "stream5_global",
+    ctor,
+};
+
+const ConvertMap* stream_global_map = &preprocessor_stream_global;
diff --git a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc
new file mode 100644
index 000000000..c52861771
--- /dev/null
+++ b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc
@@ -0,0 +1,254 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class StreamTcp : public ConversionState
+{
+public:
+    StreamTcp(Converter* cv)  : ConversionState(cv) {};
+    virtual ~StreamTcp() {};
+    virtual bool convert(std::stringstream& data_stream);
+
+private:
+    bool parse_small_segments(std::stringstream& data_stream);
+    bool parse_ports(std::stringstream& data_stream);
+};
+
+} // namespace
+
+bool StreamTcp::parse_small_segments(std::stringstream& data_stream)
+{
+    std::string s_val;
+    int i_val;
+
+    if (!(data_stream >> i_val))
+        return false;
+
+    converter->open_table("small_segments");
+    converter->add_option_to_table("count", i_val);
+    converter->close_table();
+
+    if (!(data_stream >> s_val))
+        return false;
+
+    if (!s_val.compare(",") || s_val.compare("bytes"))
+        return false;
+
+    if(!(data_stream >> i_val))
+        return false;
+
+    converter->open_table("small_segments");
+    converter->add_option_to_table("maximum_size", i_val);
+    converter->close_table();
+
+
+    if (!(data_stream >> s_val))
+        return false;
+
+    // if the next string is either a comma, end of command
+    if (!s_val.compare(","))
+        return true;
+
+    // otherwise the next argument MUST be ignore_ports
+    if (s_val.compare("ignore_ports"))
+        return false;
+
+
+    converter->open_table("small_segments");
+
+    while(data_stream >> s_val && (s_val.back() != ','))
+        converter->add_list_to_table("ignore_ports", s_val);
+
+    if (!s_val.empty())
+    {
+        s_val.pop_back();
+        converter->add_list_to_table("ignore_ports", s_val);
+    }
+
+    converter->close_table();
+    return true;
+}
+
+
+bool StreamTcp::parse_ports(std::stringstream& data_stream)
+{
+    int i_val;
+    std::string s_val;
+    std::string opt_name;
+    bool retval = true;
+
+    if(!(data_stream >> opt_name))
+        return false;
+
+    if( !opt_name.compare("client"))
+    {
+        converter->add_deprecated_comment("port client", "client_ports");
+        opt_name = "client_ports";
+    }
+    else if( !opt_name.compare("server"))
+    {
+        converter->add_deprecated_comment("port server", "server_ports");
+        opt_name = "server_ports";
+    }
+    else if( !opt_name.compare("both"))
+    {
+        converter->add_deprecated_comment("port both", "both_ports");
+        opt_name = "both_ports";
+    }
+
+    else
+        return false;
+
+    while(data_stream >> s_val && (s_val.back() != ','))
+        retval = converter->add_list_to_table(opt_name, s_val) && retval;
+
+    if (!s_val.empty())
+    {
+        s_val.pop_back();
+        converter->add_list_to_table(opt_name, s_val);
+    }
+
+    return retval;
+}
+
+
+bool StreamTcp::convert(std::stringstream& data_stream)
+{
+    std::string keyword;
+    bool retval = true;
+
+    converter->open_table("stream_tcp");
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
+
+        if(keyword.back() == ',')
+            keyword.pop_back();
+        
+        if(keyword.empty())
+            continue;
+
+        if(!keyword.compare("policy"))
+            tmpval = parse_string_option("policy", data_stream);
+
+        else if(!keyword.compare("overlap_limit"))
+            tmpval = parse_int_option("overlap_limit", data_stream);
+
+        else if(!keyword.compare("max_window"))
+            tmpval = parse_int_option("max_window", data_stream);
+
+        else if(!keyword.compare("require_3whs"))
+            tmpval = parse_int_option("require_3whs", data_stream);
+
+        else if(!keyword.compare("small_segments"))
+            tmpval = parse_small_segments(data_stream);
+
+        else if(!keyword.compare("ignore_any_rules"))
+            tmpval = converter->add_option_to_table("ignore_any_rules", true);
+
+        else if(!keyword.compare("ports"))
+            tmpval = parse_ports(data_stream);
+
+        else if(!keyword.compare("detect_anomalies"))
+            converter->add_deprecated_comment("detect_anomalies");
+
+        else if(!keyword.compare("dont_store_large_packets"))
+            converter->add_deprecated_comment("dont_store_large_packets");
+
+        else if(!keyword.compare("check_session_hijacking"))
+            converter->add_deprecated_comment("check_session_hijacking");
+
+        else if(!keyword.compare("dont_reassemble_async"))
+        {
+            converter->add_deprecated_comment("dont_reassemble_async", "reassemble_async");
+            tmpval = converter->add_option_to_table("reassemble_async", false);
+        }
+
+        else if(!keyword.compare("use_static_footprint_sizes"))
+        {
+            converter->add_deprecated_comment("footprint", "use_static_footprint_sizes");
+            tmpval = converter->add_option_to_table("footprint", true);
+        }
+
+        else if(!keyword.compare("timeout"))
+        {
+            converter->add_deprecated_comment("timeout", "session_timeout");
+            tmpval = parse_int_option("session_timeout", data_stream);
+        }
+
+        else if(!keyword.compare("max_queued_segs"))
+        {
+            converter->add_deprecated_comment("max_queued_segs", "queue_limit.max_segments");
+            converter->open_table("queue_limit");
+            tmpval = parse_int_option("max_segments", data_stream);
+            converter->close_table();
+        }
+
+        else if(!keyword.compare("max_queued_bytes"))
+        {
+            converter->add_deprecated_comment("max_queued_bytes", "queue_limit.max_bytes");
+            converter->open_table("queue_limit");
+            tmpval = parse_int_option("max_bytes", data_stream);
+            converter->close_table();
+        }
+
+        else
+            tmpval = false;
+
+        if (retval)
+            retval = tmpval;
+    }
+
+    return retval;    
+}
+#if 0
+
+#    bind_to <ip_addr>       - IP address for this policy.  The default is set
+    
+    ports <client|server|both> [all|space separated port list] 
+]
+#endif
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+    return new StreamTcp(cv);
+}
+
+static const ConvertMap preprocessor_stream_tcp = 
+{
+    "stream5_tcp",
+    ctor,
+};
+
+const ConvertMap* stream_tcp_map = &preprocessor_stream_tcp;
diff --git a/tools/snort2lua/preprocessor_states/pps_stream_udp.cc b/tools/snort2lua/preprocessor_states/pps_stream_udp.cc
new file mode 100644
index 000000000..4d370bc5d
--- /dev/null
+++ b/tools/snort2lua/preprocessor_states/pps_stream_udp.cc
@@ -0,0 +1,93 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// pps_stream_udp.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class StreamUdp : public ConversionState
+{
+public:
+    StreamUdp(Converter* cv)  : ConversionState(cv) {};
+    virtual ~StreamUdp() {};
+    virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+bool StreamUdp::convert(std::stringstream& data_stream)
+{
+
+    bool retval = true;
+    std::string keyword;
+
+    converter->open_table("stream_udp");
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
+
+        if(keyword.back() == ',')
+            keyword.pop_back();
+        
+        if(keyword.empty())
+            continue;
+        
+        if(!keyword.compare("ignore_any_rules"))
+            tmpval = converter->add_option_to_table("ignore_any_rules", true);
+
+        else if(!keyword.compare("timeout"))
+        {
+            converter->add_deprecated_comment("timeout", "session_timeout");
+            tmpval = parse_int_option("session_timeout", data_stream);
+        }
+
+        else
+            tmpval = false;
+
+        if (retval)
+            retval = tmpval;
+    }
+
+    return retval;    
+}
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+    return new StreamUdp(cv);
+}
+
+static const ConvertMap preprocessor_stream_udp = 
+{
+    "stream5_udp",
+    ctor,
+};
+
+const ConvertMap* stream_udp_map = &preprocessor_stream_udp;
diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
index 39cf71b97..2bd24e238 100644
--- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc
+++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
@@ -36,6 +36,9 @@ extern const ConvertMap *normalizer_ip6_map;
 extern const ConvertMap *normalizer_tcp_map;
 extern const ConvertMap *sfportscan_map;
 extern const ConvertMap *smtp_map;
+extern const ConvertMap *stream_global_map;
+extern const ConvertMap *stream_tcp_map;
+extern const ConvertMap *stream_udp_map;
 
 const std::vector<const ConvertMap*> preprocessor_api = 
 {
@@ -53,5 +56,8 @@ const std::vector<const ConvertMap*> preprocessor_api =
     normalizer_tcp_map,
     sfportscan_map,
     smtp_map,
+    stream_global_map,
+    stream_tcp_map,
+    stream_udp_map,
 //    nullptr,
 };