From: Josh Date: Mon, 10 Nov 2014 20:22:32 +0000 (-0600) Subject: Snort2Lua: clearing badbit before using seekg(). Fixing frag3_engine bug X-Git-Tag: 3.0.0-233~1241^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9acaa697fc0af5224c295559f5fbd0f2d7e25859;p=thirdparty%2Fsnort3.git Snort2Lua: clearing badbit before using seekg(). Fixing frag3_engine bug --- diff --git a/tools/snort2lua/keyword_states/kws_rule.cc b/tools/snort2lua/keyword_states/kws_rule.cc index 73b6c7f1b..35c510841 100644 --- a/tools/snort2lua/keyword_states/kws_rule.cc +++ b/tools/snort2lua/keyword_states/kws_rule.cc @@ -61,7 +61,7 @@ bool RuleHeader::convert(std::istringstream& data_stream) // Now, remove the last ')' and anything beyond. We will automatically // add that part back when printing each rule. - std::streamoff curr_pos = data_stream.tellg(); + const std::istringstream::off_type curr_pos = data_stream.tellg(); std::string rule_string = data_stream.str(); std::size_t end_pos = rule_string.rfind(')'); rule_string = rule_string.substr(0, end_pos); diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc index b77ef369c..b15a5f0b3 100644 --- a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc +++ b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc @@ -48,21 +48,21 @@ private: std::string Frag3Engine::choose_table_name(std::istringstream& data_stream) { static uint32_t binding_id = 0; - const std::streamoff pos = data_stream.tellg(); + const std::istringstream::off_type pos = data_stream.tellg(); std::string keyword; while (data_stream >> keyword) { if (!keyword.compare("bind_to")) { - data_stream.seekg(pos); data_stream.clear(); + data_stream.seekg(pos); return "stream_ip_" + std::to_string(binding_id++); } } - data_stream.seekg(pos); data_stream.clear(); + data_stream.seekg(pos); return "stream_ip"; } diff --git a/tools/snort2lua/preprocessor_states/pps_normalizers.cc b/tools/snort2lua/preprocessor_states/pps_normalizers.cc index c58df4e42..8f8581e54 100644 --- a/tools/snort2lua/preprocessor_states/pps_normalizers.cc +++ b/tools/snort2lua/preprocessor_states/pps_normalizers.cc @@ -293,6 +293,7 @@ bool TcpNormalizer::convert(std::istringstream& data_stream) else { + data_stream.clear(); data_stream.seekg(pos); break; } diff --git a/tools/snort2lua/rule_states/rule_base64_decode.cc b/tools/snort2lua/rule_states/rule_base64_decode.cc index 92dcfe7cf..5716ed0c9 100644 --- a/tools/snort2lua/rule_states/rule_base64_decode.cc +++ b/tools/snort2lua/rule_states/rule_base64_decode.cc @@ -59,6 +59,7 @@ bool Base64Decode::convert(std::istringstream& data_stream) if (args.find(":") != std::string::npos) { rule_api.add_option("base64_decode"); + data_stream.clear(); data_stream.seekg(pos); } else @@ -76,6 +77,7 @@ bool Base64Decode::convert(std::istringstream& data_stream) } else { + data_stream.clear(); data_stream.seekg(pos); rule_api.add_option("base64_decode"); } diff --git a/tools/snort2lua/rule_states/rule_content.cc b/tools/snort2lua/rule_states/rule_content.cc index 3d65ae2ae..95d262132 100644 --- a/tools/snort2lua/rule_states/rule_content.cc +++ b/tools/snort2lua/rule_states/rule_content.cc @@ -237,8 +237,8 @@ bool Content::convert(std::istringstream& data_stream) // since this option is not an content modifier, // lets coninue parsing the rest of the rule. - data_stream.seekg(pos); data_stream.clear(); + data_stream.seekg(pos); return set_next_rule_state(data_stream); } diff --git a/tools/snort2lua/rule_states/rule_file_data.cc b/tools/snort2lua/rule_states/rule_file_data.cc index 57e62ee9c..e88b5b727 100644 --- a/tools/snort2lua/rule_states/rule_file_data.cc +++ b/tools/snort2lua/rule_states/rule_file_data.cc @@ -59,6 +59,7 @@ bool FileData::convert(std::istringstream& data_stream) // Therefore, if a colon is present, we are in the next rule option. if (args.find(":") != std::string::npos) { + data_stream.clear(); data_stream.seekg(pos); } else @@ -68,9 +69,14 @@ bool FileData::convert(std::istringstream& data_stream) std::istringstream(args) >> tmp; if (!tmp.compare("mime")) + { rule_api.add_comment("file_data's 'mime' option has been deleted"); + } else + { + data_stream.clear(); data_stream.seekg(pos); + } } } return set_next_rule_state(data_stream); diff --git a/tools/snort2lua/rule_states/rule_react.cc b/tools/snort2lua/rule_states/rule_react.cc index d66886759..5ff50882c 100644 --- a/tools/snort2lua/rule_states/rule_react.cc +++ b/tools/snort2lua/rule_states/rule_react.cc @@ -46,7 +46,7 @@ bool React::convert(std::istringstream& data_stream) { std::string args; std::string tmp; - std::streamoff pos = data_stream.tellg(); + std::istringstream::off_type pos = data_stream.tellg(); args = util::get_rule_option_args(data_stream); @@ -58,6 +58,7 @@ bool React::convert(std::istringstream& data_stream) // Therefore, if a colon is present, we are in the next rule option. if (args.find(":") != std::string::npos) { + data_stream.clear(); data_stream.seekg(pos); } else @@ -120,6 +121,7 @@ bool React::convert(std::istringstream& data_stream) } else { + data_stream.clear(); data_stream.seekg(pos); } diff --git a/tools/snort2lua/rule_states/rule_threshold.cc b/tools/snort2lua/rule_states/rule_threshold.cc index be8ab940f..9a8ae501e 100644 --- a/tools/snort2lua/rule_states/rule_threshold.cc +++ b/tools/snort2lua/rule_states/rule_threshold.cc @@ -82,7 +82,7 @@ bool Threshold::convert(std::istringstream& data_stream) } // save the current position - const std::streamoff curr_pos = data_stream.tellg(); + const std::istringstream::off_type curr_pos = data_stream.tellg(); if (curr_pos == -1) data_stream.clear(); diff --git a/tools/snort2lua/utils/s2l_util.cc b/tools/snort2lua/utils/s2l_util.cc index 7597751b0..7a84bc9e1 100644 --- a/tools/snort2lua/utils/s2l_util.cc +++ b/tools/snort2lua/utils/s2l_util.cc @@ -243,8 +243,8 @@ std::string rule_option_find_val(std::istringstream& data_stream, { // found an option without a colon, so set stream // to semi-colon - std::streamoff off = 1 + (std::streamoff)(tmp_pos) + - (std::streamoff)(semi_colon_pos); + std::istringstream::off_type off = 1 + + (std::streamoff)(tmp_pos) + (std::streamoff)(semi_colon_pos); data_stream.seekg(off); rule_keyword = rule_keyword.substr(0, semi_colon_pos); }