From: Josh <jrosenba@cisco.com>
Date: Tue, 14 Oct 2014 22:05:10 +0000 (-0500)
Subject: fixing snort2lua isdataat
X-Git-Tag: 3.0.0-233~1370^2~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a1a30741ef04435d842b1d2d703acca054dd5faa;p=thirdparty%2Fsnort3.git

fixing snort2lua isdataat
---

diff --git a/src/ips_options/ips_isdataat.cc b/src/ips_options/ips_isdataat.cc
index e0728e2a7..2109396b5 100644
--- a/src/ips_options/ips_isdataat.cc
+++ b/src/ips_options/ips_isdataat.cc
@@ -249,7 +249,7 @@ static const Parameter s_params[] =
       "num | !num" },
 
     { "relative", Parameter::PT_IMPLIED, nullptr, nullptr,
-      "num | !num" },
+      "offset from cursor instead of start of buffer" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index b8ec94fc5..a4f06436a 100644
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -1118,9 +1118,9 @@ void ParseError(const char *format, ...)
     get_parse_location(file_name, file_line);
 
     if (file_line )
-        LogMessage("ERROR: %s:%d %s\n", file_name, file_line, buf);
+        ErrorMessage("ERROR: %s:%d %s\n", file_name, file_line, buf);
     else
-        LogMessage("ERROR: %s\n", buf);
+        ErrorMessage("ERROR: %s\n", buf);
 
     parse_errors++;
 }
diff --git a/tools/snort2lua/data/dt_rule_api.h b/tools/snort2lua/data/dt_rule_api.h
index 3185a96de..744830d25 100644
--- a/tools/snort2lua/data/dt_rule_api.h
+++ b/tools/snort2lua/data/dt_rule_api.h
@@ -92,6 +92,7 @@ public:
     bool add_rule_option(std::string keyword, std::string val);
     // add a rule option (keyword and suboption)
     bool add_rule_option_before_selected(std::string keyword, std::string val = std::string());
+    // FIXIT-L J  this function should definitely be removed
     // selects the rule option with the given name.  MUST BE CALLED BEFORE ADDING A SUBOPTION.
     bool select_option(std::string keyword);
     // clear the selected option.
diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt
index 6d7caae04..ae3b0ac53 100644
--- a/tools/snort2lua/rule_states/CMakeLists.txt
+++ b/tools/snort2lua/rule_states/CMakeLists.txt
@@ -4,6 +4,7 @@ add_library( rule_states
     rule_content.cc
     rule_file_data.cc
     rule_http_encode.cc
+    rule_isdataat.cc
     rule_metadata.cc
     rule_pcre.cc
     rule_react.cc
diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am
index 27d87c86a..0a578340e 100644
--- a/tools/snort2lua/rule_states/Makefile.am
+++ b/tools/snort2lua/rule_states/Makefile.am
@@ -8,6 +8,7 @@ rule_base64_decode.cc \
 rule_content.cc \
 rule_file_data.cc \
 rule_http_encode.cc \
+rule_isdataat.cc \
 rule_metadata.cc \
 rule_pcre.cc \
 rule_react.cc \
diff --git a/tools/snort2lua/rule_states/rule_tag.cc b/tools/snort2lua/rule_states/rule_tag.cc
index d0b19ebed..f4fc25439 100644
--- a/tools/snort2lua/rule_states/rule_tag.cc
+++ b/tools/snort2lua/rule_states/rule_tag.cc
@@ -149,20 +149,21 @@ bool Tag::convert(std::istringstream& data_stream)
             rule_api.add_rule_option("tag", type);
             rule_api.select_option("tag");
 
+            if (packets > 0)
+                rule_api.add_suboption("packets", std::to_string(packets));
+
             if (seconds > 0)
                 rule_api.add_suboption("seconds", std::to_string(seconds));
 
             if (bytes > 0)
                 rule_api.add_suboption("bytes", std::to_string(bytes));
 
-            if (packets > 0)
-                rule_api.add_suboption("packets", std::to_string(packets));
-        }
 
+            rule_api.unselect_option();
+        }
     }
 
 
-
     return set_next_rule_state(data_stream);
 }
 
diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc
index accb3306d..c246c1138 100644
--- a/tools/snort2lua/rule_states/rule_unchanged.cc
+++ b/tools/snort2lua/rule_states/rule_unchanged.cc
@@ -573,19 +573,6 @@ static const ConvertMap rule_base64_data =
 
 const ConvertMap* base64_data_map = &rule_base64_data;
 
-/************************************
- *********** ISDATAAT  **************
- ************************************/
-
-static const std::string isdataat = "isdataat";
-static const ConvertMap rule_isdataat =
-{
-    isdataat,
-    unchanged_rule_ctor<&isdataat>,
-};
-
-const ConvertMap* isdataat_map = &rule_isdataat;
-
 /************************************
  *************  ASN1  ***************
  ************************************/