From: Josh Date: Thu, 12 Jun 2014 15:15:47 +0000 (-0400) Subject: adding arp and arpspoof. added a nameless tabled to api X-Git-Tag: 3.0.0-233~1481^2~2^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=931b533b2e6cffe109f3fa38a91c6127898e0838;p=thirdparty%2Fsnort3.git adding arp and arpspoof. added a nameless tabled to api --- diff --git a/tools/snort2lua/converter.cc b/tools/snort2lua/converter.cc index ad0f5d563..6be89d64a 100644 --- a/tools/snort2lua/converter.cc +++ b/tools/snort2lua/converter.cc @@ -62,6 +62,22 @@ bool Converter::convert_line(std::stringstream& data) return false; } +bool Converter::open_table() +{ + // if no open tables, create a top-level table + if (open_tables.size() > 0) + { + Table *t = open_tables.top()->open_table(); + open_tables.push(t); + return true; + } + else + { + log_error("A nameless table must be nested!!"); + return false; + } +} + bool Converter::open_table(std::string table_name) { Table *t; diff --git a/tools/snort2lua/converter.h b/tools/snort2lua/converter.h index 2570ae78b..1c6b04cca 100644 --- a/tools/snort2lua/converter.h +++ b/tools/snort2lua/converter.h @@ -45,11 +45,20 @@ public: bool inline add_variable(std::string name, std::string v){ return data.add_variable(name, v); }; friend std::ostream &operator<<( std::ostream& out, const Converter &cv) { return out << cv.data; } - bool open_table(std::string); + // open a table that does not contain a name --> NOT 'name = {...}' ONLY {...}) + bool open_table(); + // open a named tabled --> 'name = {...}') + bool open_table(std::string name); + // close the current table. go to previous table level bool close_table(); + + // add a string option to the table --> table = { name = 'val', } bool add_option_to_table(std::string name, std::string val); + // add an int option to the table --> table = { name = val, } bool add_option_to_table(std::string name, int val); + // add a bool option to the table --> table = { name = true|false, } bool add_option_to_table(std::string name, bool val); + // add a commment to be printed in the table --> table = { -- comment \n } void add_comment_to_table(std::string comment); void add_comment_to_file(std::string comment); diff --git a/tools/snort2lua/data/conv_data.cc b/tools/snort2lua/data/conv_data.cc index 788c42ae3..56982031d 100644 --- a/tools/snort2lua/data/conv_data.cc +++ b/tools/snort2lua/data/conv_data.cc @@ -31,6 +31,9 @@ static inline Table* find_table(std::vector vec, std::string name) { + if(name.empty()) + return nullptr; + for( auto *t : vec) if(!name.compare(t->get_name())) return t; diff --git a/tools/snort2lua/data/conv_option.cc b/tools/snort2lua/data/conv_option.cc index be5d7ad71..90cbb5160 100644 --- a/tools/snort2lua/data/conv_option.cc +++ b/tools/snort2lua/data/conv_option.cc @@ -62,12 +62,12 @@ std::ostream &operator<<( std::ostream& out, const Option &o) switch(o.type) { case Option::OptionType::STRING: - out << '\'' << o.value << "',"; + out << '\'' << o.value << '\''; break; case Option::OptionType::BOOL: case Option::OptionType::INT: - out << o.value << ','; + out << o.value; break; } return out; diff --git a/tools/snort2lua/data/conv_table.cc b/tools/snort2lua/data/conv_table.cc index d0e0017ee..cdfb86181 100644 --- a/tools/snort2lua/data/conv_table.cc +++ b/tools/snort2lua/data/conv_table.cc @@ -23,6 +23,9 @@ static inline Table* find_table(std::vector vec, std::string name) { + if(name.empty()) + return nullptr; + for( auto *t : vec) if(!name.compare(t->get_name())) return t; @@ -30,10 +33,10 @@ static inline Table* find_table(std::vector vec, std::string name) return nullptr; } -Table::Table(std::string name) +Table::Table(int depth) { - this->name = name; - depth = 0; + this->name = ""; + this->depth = depth; } Table::Table(std::string name, int depth) @@ -51,6 +54,13 @@ Table::~Table() delete o; } +Table* Table::open_table() +{ + Table *t = new Table(depth + 1); + tables.push_back(t); + return t; +} + Table* Table::open_table(std::string name) { Table* t = find_table(tables, name); @@ -133,23 +143,24 @@ std::ostream &operator<<( std::ostream& out, const Table &t) for(int i = 0; i < t.depth; i++) whitespace += " "; - out << whitespace << t.name << " = " << std::endl; + if(!t.name.empty()) + out << whitespace << t.name << " = " << std::endl; out << whitespace << '{' << std::endl; for(std::string s : t.comments) out << whitespace << " --" << s << std::endl; for (Option* o : t.options) - out << (*o) << std::endl; + out << (*o) << ',' << std::endl; for (Table* t : t.tables) - out << (*t) << std::endl; + out << (*t) << ',' << std::endl; // don't add a comma if the depth is zero if(t.depth == 0) out << "}"; else - out << whitespace << "},"; + out << whitespace << "}"; return out; } diff --git a/tools/snort2lua/data/conv_table.h b/tools/snort2lua/data/conv_table.h index cd34654ea..7318a2f9b 100644 --- a/tools/snort2lua/data/conv_table.h +++ b/tools/snort2lua/data/conv_table.h @@ -32,11 +32,12 @@ class Table { public: - Table(std::string name); + Table(int depth); Table(std::string name, int depth); virtual ~Table(); inline std::string get_name(){ return name; }; + Table* open_table(); Table* open_table(std::string); bool add_option(std::string, int val); bool add_option(std::string, bool val); diff --git a/tools/snort2lua/keywords/include.cc b/tools/snort2lua/keywords/include.cc index 19eb2e82f..5ddaf799f 100644 --- a/tools/snort2lua/keywords/include.cc +++ b/tools/snort2lua/keywords/include.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// config.cc author Josh Rosenbaum +// include.cc author Josh Rosenbaum #include #include diff --git a/tools/snort2lua/keywords/preprocessor.cc b/tools/snort2lua/keywords/preprocessor.cc index beba47396..36426defb 100644 --- a/tools/snort2lua/keywords/preprocessor.cc +++ b/tools/snort2lua/keywords/preprocessor.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// config.cc author Josh Rosenbaum +// preprocessor.cc author Josh Rosenbaum #include #include diff --git a/tools/snort2lua/keywords/var.cc b/tools/snort2lua/keywords/var.cc index a797f9eed..91f2941e9 100644 --- a/tools/snort2lua/keywords/var.cc +++ b/tools/snort2lua/keywords/var.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// output.cc author Josh Rosenbaum +// var.cc author Josh Rosenbaum #include #include diff --git a/tools/snort2lua/preprocessor/CMakeLists.txt b/tools/snort2lua/preprocessor/CMakeLists.txt index 8f27d4df2..e7a105725 100644 --- a/tools/snort2lua/preprocessor/CMakeLists.txt +++ b/tools/snort2lua/preprocessor/CMakeLists.txt @@ -1,5 +1,6 @@ add_library(preprocessor + arpspoof.cc http_inspect.cc smtp.cc normalizers.cc diff --git a/tools/snort2lua/preprocessor/arpspoof.cc b/tools/snort2lua/preprocessor/arpspoof.cc new file mode 100644 index 000000000..b6d90a0d4 --- /dev/null +++ b/tools/snort2lua/preprocessor/arpspoof.cc @@ -0,0 +1,134 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// arp_spoof.cc author Josh Rosenbaum + +#include + +#include "conversion_state.h" +#include "converter.h" +#include "snort2lua_util.h" + +namespace { + +class ArpSpoof : public ConversionState +{ +public: + ArpSpoof(Converter* cv) : ConversionState(cv) {}; + virtual ~ArpSpoof() {}; + virtual bool convert(std::stringstream& data_stream); +}; + +} // namespace + + +bool ArpSpoof::convert(std::stringstream& data_stream) +{ + std::string keyword; + bool retval = true; + converter->open_table("arp_spoof"); + + while(data_stream >> keyword) + { + + if(!keyword.compare("-unicast")) + retval = converter->add_option_to_table("unicast", true) && retval; + + else + retval = false; + } + + return retval; +} + +/******* A P I ***********/ + +static ConversionState* arpspoof_ctor(Converter* cv) +{ + return new ArpSpoof(cv); +} + +static const ConvertMap preprocessor_arpspoof = +{ + "arpspoof", + arpspoof_ctor, +}; + +const ConvertMap* arpspoof_map = &preprocessor_arpspoof; + + + +/******************************** + ******* ArpSpoof Host ********* + ********************************/ + + +namespace { + +class ArpSpoofHost : public ConversionState +{ +public: + ArpSpoofHost(Converter* cv) : ConversionState(cv) {}; + virtual ~ArpSpoofHost() {}; + virtual bool convert(std::stringstream& data_stream); +}; + +} // namespace + + +bool ArpSpoofHost::convert(std::stringstream& data_stream) +{ + std::string ip, mac; + + bool retval = true; + converter->open_table("arp_spoof"); + converter->open_table("hosts"); + + while(data_stream >> ip && + data_stream >> mac) + { + converter->open_table(); + converter->add_option_to_table("ip", ip); + converter->add_option_to_table("mac", mac); + converter->close_table(); + + ip.clear(); + mac.clear(); + } + + if (!ip.empty()) + return false; + + return retval; +} + +/******* A P I ***********/ + +static ConversionState* arpspoof_host_ctor(Converter* cv) +{ + return new ArpSpoofHost(cv); +} + +static const ConvertMap preprocessor_arpspoof_host = +{ + "arpspoof_detect_host", + arpspoof_host_ctor, +}; + +const ConvertMap* arpspoof_host_map = &preprocessor_arpspoof_host; diff --git a/tools/snort2lua/preprocessor/http_inspect.cc b/tools/snort2lua/preprocessor/http_inspect.cc index a02d584a5..a928eeb64 100644 --- a/tools/snort2lua/preprocessor/http_inspect.cc +++ b/tools/snort2lua/preprocessor/http_inspect.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// config.cc author Josh Rosenbaum +// http_inspect.cc author Josh Rosenbaum #include #include diff --git a/tools/snort2lua/preprocessor/normalizers.cc b/tools/snort2lua/preprocessor/normalizers.cc index 94a05b6f6..1e1a3ef8a 100644 --- a/tools/snort2lua/preprocessor/normalizers.cc +++ b/tools/snort2lua/preprocessor/normalizers.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// config.cc author Josh Rosenbaum +// normalizers.cc author Josh Rosenbaum #include #include diff --git a/tools/snort2lua/preprocessor/preprocessor_api.cc b/tools/snort2lua/preprocessor/preprocessor_api.cc index 0f9c47c81..7b44e924d 100644 --- a/tools/snort2lua/preprocessor/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor/preprocessor_api.cc @@ -22,6 +22,8 @@ #include "preprocessor/preprocessor_api.h" +extern const ConvertMap *arpspoof_map; +extern const ConvertMap *arpspoof_host_map; extern const ConvertMap *httpinspect_map; extern const ConvertMap *normalizer_icmp4_map; extern const ConvertMap *normalizer_icmp6_map; @@ -32,6 +34,8 @@ extern const ConvertMap *smtp_map; const std::vector preprocessor_api = { + arpspoof_map, + arpspoof_host_map, httpinspect_map, normalizer_icmp4_map, normalizer_icmp6_map, diff --git a/tools/snort2lua/preprocessor/smtp.cc b/tools/snort2lua/preprocessor/smtp.cc index 03efd6825..1b5a141d8 100644 --- a/tools/snort2lua/preprocessor/smtp.cc +++ b/tools/snort2lua/preprocessor/smtp.cc @@ -17,7 +17,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -// config.cc author Josh Rosenbaum +// smtp.cc author Josh Rosenbaum #include #include