From: Josh Date: Fri, 20 Jun 2014 19:11:43 +0000 (-0400) Subject: adding frag3 converters X-Git-Tag: 3.0.0-233~1175^2~25^2~2^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a6d3cf1f6fe92d86afefeee2b4fa259ef9c79212;p=thirdparty%2Fsnort3.git adding frag3 converters --- diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h index 2ce0f4f21..30eebd588 100644 --- a/tools/snort2lua/conversion_state.h +++ b/tools/snort2lua/conversion_state.h @@ -40,6 +40,32 @@ public: protected: Converter* cv; +#if 0 + List of forward parsing methods. Placing these here so you don't need ot + search through the file + + inline bool parse_string_option(std::string opt_name, + std::stringstream& stream); + inline bool parse_int_option(std::string opt_name, + std::stringstream& stream); + inline bool parse_curly_bracket_list(std::string list_name, + std::stringstream& stream); + inline bool parse_yn_bool_option(std::string opt_name, + std::stringstream& stream); + inline bool parse_bracketed_byte_list(std::string list_name, + std::stringstream& stream); + inline bool parse_bracketed_unsupported_list(std::string list_name, + std::stringstream& stream); + inline bool open_table_add_option(std::string table_name, + std::string opt_name, + std::string val); + + inline bool parse_deprecation_option(std::string table_name, + std::stringstream& stream); + +#endif + + inline bool parse_string_option(std::string opt_name, std::stringstream& stream) { std::string val; @@ -170,6 +196,20 @@ protected: } + inline bool parse_deprecation_option(std::string opt_name, + std::stringstream& stream) + { + + std::string val; + cv->add_deprecated_comment(opt_name); + + if(stream >> val) + return true; + + return false; + } + + private: }; diff --git a/tools/snort2lua/converter.cc b/tools/snort2lua/converter.cc index d7548f54a..788bc3ebe 100644 --- a/tools/snort2lua/converter.cc +++ b/tools/snort2lua/converter.cc @@ -200,7 +200,7 @@ void Converter::add_comment_to_file(std::string comment, std::stringstream& stre void Converter::add_deprecated_comment(std::string dep_var) { - std::string error_string = "option '" + dep_var + "' deprecated."; + std::string error_string = "option deprecated: '" + dep_var + "'"; if (open_tables.size() > 0) add_comment_to_table(error_string); @@ -208,10 +208,10 @@ void Converter::add_deprecated_comment(std::string dep_var) add_comment_to_file(error_string); } -void Converter::add_deprecated_comment(std::string dep_var, std::string new_var) +void Converter::add_diff_option_comment(std::string dep_var, std::string new_var) { - std::string error_string = "option '" + dep_var + "' deprecated" - + " ... using '" + new_var + "' instead"; + std::string error_string = "option change: '" + dep_var + "' --> '" + + new_var + "'"; if (open_tables.size() > 0) add_comment_to_table(error_string); diff --git a/tools/snort2lua/converter.h b/tools/snort2lua/converter.h index 4fe61f6ee..c534a1dde 100644 --- a/tools/snort2lua/converter.h +++ b/tools/snort2lua/converter.h @@ -84,8 +84,8 @@ public: void add_comment_to_file(std::string comment, std::stringstream& stream); // attach a comment about a deprecated option to a file or table void add_deprecated_comment(std::string dep_var); - // add a comment with the formate 'deprecated option ... use the new option instead' - void add_deprecated_comment(std::string dep_var, std::string new_var); + // add a comment with telling the user an option has changed + void add_diff_option_comment(std::string dep_var, std::string new_var); // log an error in the new lua file void log_error(std::string); diff --git a/tools/snort2lua/data/dt_data.cc b/tools/snort2lua/data/dt_data.cc index 45242bb73..9d22eb8b2 100644 --- a/tools/snort2lua/data/dt_data.cc +++ b/tools/snort2lua/data/dt_data.cc @@ -94,9 +94,7 @@ Table* ConversionData::add_table(std::string name) void ConversionData::add_comment(std::string str) { - // leave at most one blank line between comments -// if ( !(str.empty() && !comments.empty() && comments.back().empty()) ) - comments->add_text(str); + comments->add_text(str); } void ConversionData::add_error_comment(std::string error_string) @@ -129,21 +127,3 @@ std::ostream& operator<<( std::ostream &out, const ConversionData &data) return out; } -#if 0 -bool ConversionData::add_option(std::string name, std::string value) -{ - -} - -bool ConversionData::add_option(std::string name, long long int value) -{ - -} - - -void ConversionData::reset() -{ - -} - -#endif diff --git a/tools/snort2lua/init_state.cc b/tools/snort2lua/init_state.cc index 4d2539421..0395d423d 100644 --- a/tools/snort2lua/init_state.cc +++ b/tools/snort2lua/init_state.cc @@ -23,6 +23,7 @@ #include #include #include +#include #include "init_state.h" #include "snort2lua_util.h" #include "keyword_states/keywords_api.h" diff --git a/tools/snort2lua/keyword_states/kws_suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc index 0af0587fa..fce093b22 100644 --- a/tools/snort2lua/keyword_states/kws_suppress.cc +++ b/tools/snort2lua/keyword_states/kws_suppress.cc @@ -46,8 +46,8 @@ bool Suppress::convert(std::stringstream& data_stream) std::string keyword; cv->open_table("suppress"); - cv->add_deprecated_comment("gen_id", "gid"); - cv->add_deprecated_comment("sig_id", "sid"); + cv->add_diff_option_comment("gen_id", "gid"); + cv->add_diff_option_comment("sig_id", "sid"); cv->open_table(); while(data_stream >> keyword) diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt index aa56655c8..8f21ed4b0 100644 --- a/tools/snort2lua/preprocessor_states/CMakeLists.txt +++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt @@ -1,17 +1,19 @@ add_library(preprocessor_states pps_arpspoof.cc + pps_bo.cc + pps_frag3_engine.cc + pps_frag3_global.cc + pps_ftp_telnet.cc + pps_ftp_telnet_protocol.cc pps_http_inspect.cc pps_http_inspect_server.cc - pps_smtp.cc pps_normalizers.cc pps_sfportscan.cc + pps_smtp.cc pps_stream_global.cc pps_stream_tcp.cc pps_stream_udp.cc - pps_ftp_telnet.cc - pps_ftp_telnet_protocol.cc - pps_bo.cc preprocessor_api.h preprocessor_api.cc ) diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc new file mode 100644 index 000000000..0bb24684e --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_frag3_engine.cc @@ -0,0 +1,154 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// pps_frag3_engine.cc author Josh Rosenbaum + +#include +#include + +#include "conversion_state.h" +#include "converter.h" +#include "snort2lua_util.h" + +namespace { + +class Frag3Engine : public ConversionState +{ +public: + Frag3Engine(Converter* cv) : ConversionState(cv) {}; + virtual ~Frag3Engine() {}; + virtual bool convert(std::stringstream& data_stream); + +private: + bool parse_ip_list(std::string, std::stringstream& data_stream); +}; + +} // namespace + + +bool Frag3Engine::parse_ip_list(std::string list_name, + std::stringstream& data_stream) +{ + std::string prev; + std::string elem; + + if(!(data_stream >> elem) || (elem.front() != '[')) + return false; + + if(!(data_stream >> elem)) + return false; + + // there can be no spaces between the square bracket and string + prev = "[" + elem; + + while (data_stream >> elem && elem.back() != ']') + prev = prev + ' ' + elem; + + prev = prev + "]"; + return cv->add_option_to_table(list_name, prev); + +} + +bool Frag3Engine::convert(std::stringstream& data_stream) +{ + + bool retval = true; + bool val; + std::string keyword; + + cv->open_table("stream_ip"); + + while(data_stream >> keyword) + { + bool tmpval = true; + + if(keyword.back() == ',') + keyword.pop_back(); + + if(keyword.empty()) + continue; + + if(!keyword.compare("min_ttl")) + tmpval = parse_int_option("min_ttl", data_stream); + + else if(!keyword.compare("policy")) + tmpval = parse_string_option("policy", data_stream); + + else if(!keyword.compare("detect_anomalies")) + cv->add_deprecated_comment("detect_anomalies"); + + else if(!keyword.compare("bind_to")) + parse_ip_list("bind_to", data_stream); + + else if(!keyword.compare("timeout")) + { + tmpval = parse_int_option("session_timeout", data_stream); + cv->add_diff_option_comment("timeout", "session_timeout"); + } + + else if(!keyword.compare("overlap_limit")) + { + tmpval = parse_int_option("max_overlaps", data_stream); + cv->add_diff_option_comment("overlap_limit", "max_overlaps"); + } + + else if(!keyword.compare("min_fragment_length")) + { + tmpval = parse_int_option("min_frag_length", data_stream); + cv->add_diff_option_comment("min_fragment_length", "min_frag_length"); + } + + else + tmpval = false; + + if (retval) + retval = tmpval; + } + + return retval; +} + +#if 0 +bool alert_test.rebuilt = false: include type:count where type is S for stream and F for frag +enum hosts[].frag_policy = linux: defragmentation policy { first | linux | bsd | bsd_right |last | windows | solaris } +bool normalize.ip4.df = false: clear don't frag flag +bool packets.vlan_agnostic = false: determines whether VLAN info is used to track fragments and connections +enum stream_ip.policy = linux: fragment reassembly policy { first | linux | bsd | bsd_right |last | windows | solaris } + + + 192.1.2.7/24 + +#endif + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter* cv) +{ + return new Frag3Engine(cv); +} + +static const ConvertMap preprocessor_frag3_engine = +{ + "frag3_engine", + ctor, +}; + +const ConvertMap* frag3_engine_map = &preprocessor_frag3_engine; diff --git a/tools/snort2lua/preprocessor_states/pps_frag3_global.cc b/tools/snort2lua/preprocessor_states/pps_frag3_global.cc new file mode 100644 index 000000000..540b50324 --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_frag3_global.cc @@ -0,0 +1,99 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// pps_frag3_global.cc author Josh Rosenbaum + +#include +#include + +#include "conversion_state.h" +#include "converter.h" +#include "snort2lua_util.h" + +namespace { + +class Frag3Global : public ConversionState +{ +public: + Frag3Global(Converter* cv) : ConversionState(cv) {}; + virtual ~Frag3Global() {}; + virtual bool convert(std::stringstream& data_stream); +}; + +} // namespace + +bool Frag3Global::convert(std::stringstream& data_stream) +{ + + bool retval = true; + std::string keyword; + + cv->open_table("stream_ip"); + + while(data_stream >> keyword) + { + bool tmpval = true; + + if(keyword.back() == ',') + keyword.pop_back(); + + if(keyword.empty()) + continue; + + if(!keyword.compare("disabled")) + cv->add_deprecated_comment("disabled"); + + else if(!keyword.compare("max_frags")) + tmpval = parse_int_option("max_frags", data_stream); + + else if(!keyword.compare("memcap")) + tmpval = parse_deprecation_option("memcap", data_stream); + + else if(!keyword.compare("prealloc_memcap")) + tmpval = parse_deprecation_option("prealloc_memcap", data_stream); + + else if(!keyword.compare("prealloc_frags")) + tmpval = parse_deprecation_option("prealloc_frags", data_stream); + + else + tmpval = false; + + if (retval) + retval = tmpval; + } + + return retval; +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter* cv) +{ + return new Frag3Global(cv); +} + +static const ConvertMap preprocessor_frag3_global = +{ + "frag3_global", + ctor, +}; + +const ConvertMap* frag3_global_map = &preprocessor_frag3_global; diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc index 06998c928..3eabec20c 100644 --- a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc +++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc @@ -179,13 +179,13 @@ bool FtpServer::convert(std::stringstream& data_stream) else if(!keyword.compare("data_chan")) { - cv->add_deprecated_comment("data_chan", "ignore_data_chan"); + cv->add_diff_option_comment("data_chan", "ignore_data_chan"); tmpval = cv->add_option_to_table("ignore_data_chan", true); } else if (!keyword.compare("ports")) { - cv->add_deprecated_comment("ports", "bindings"); + cv->add_diff_option_comment("ports", "bindings"); cv->add_comment_to_table("check bindings table for port information"); // add commented list for now std::string tmp = ""; @@ -298,7 +298,7 @@ bool Telnet::convert(std::stringstream& data_stream) else if(!keyword.compare("ports")) { - cv->add_deprecated_comment("ports", "bindings"); + cv->add_diff_option_comment("ports", "bindings"); cv->add_comment_to_table("check bindings table for port information"); // vvvv defined in ConversionState vvvv parse_curly_bracket_list("--ports", data_stream); // create a commented list of the ports diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc index 2d0136cc3..dd872f01d 100644 --- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc +++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc @@ -208,25 +208,25 @@ bool HttpInspectServer::convert(std::stringstream& data_stream) else if (!keyword.compare("non_rfc_char")) { - cv->add_deprecated_comment("non_rfc_char", "non_rfc_chars"); + cv->add_diff_option_comment("non_rfc_char", "non_rfc_chars"); parse_bracketed_byte_list("non_rfc_chars", data_stream); } else if (!keyword.compare("enable_cookie")) { tmpval = cv->add_option_to_table("enable_cookies", true); - cv->add_deprecated_comment("enable_cookie", "enable_cookies"); + cv->add_diff_option_comment("enable_cookie", "enable_cookies"); } else if (!keyword.compare("flow_depth")) { - cv->add_deprecated_comment("flow_depth", "server_flow_depth"); + cv->add_diff_option_comment("flow_depth", "server_flow_depth"); tmpval = parse_int_option("server_flow_depth", data_stream); } else if (!keyword.compare("ports")) { - cv->add_deprecated_comment("ports", "bindings"); + cv->add_diff_option_comment("ports", "bindings"); cv->add_comment_to_table("check bindings table for port information"); tmpval = parse_bracketed_unsupported_list("ports", data_stream); } diff --git a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc index 12b6ac34a..d9eb2b99e 100644 --- a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc +++ b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc @@ -158,13 +158,13 @@ bool PortScan::convert(std::stringstream& data_stream) else if(!keyword.compare("proto")) { - cv->add_deprecated_comment("proto", "protos"); + cv->add_diff_option_comment("proto", "protos"); retval = parse_curly_bracket_list("protos", data_stream) && retval; } else if(!keyword.compare("scan_type")) { - cv->add_deprecated_comment("scan_type", "scan_types"); + cv->add_diff_option_comment("scan_type", "scan_types"); tmpval = parse_curly_bracket_list("scan_types", data_stream) && retval; } diff --git a/tools/snort2lua/preprocessor_states/pps_stream_global.cc b/tools/snort2lua/preprocessor_states/pps_stream_global.cc index 13092ce4a..f0fbc0af6 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream_global.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream_global.cc @@ -88,7 +88,7 @@ bool StreamGlobal::convert(std::stringstream& data_stream) else if(!keyword.compare("prune_log_max")) { - cv->add_deprecated_comment("prune_log_max", "histogram"); + cv->add_diff_option_comment("prune_log_max", "histogram"); if(!(data_stream >> keyword)) // eat the number of bytes tmpval = false; } diff --git a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc index ad37077b4..8dc4e34b9 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream_tcp.cc @@ -107,17 +107,17 @@ bool StreamTcp::parse_ports(std::stringstream& data_stream) if( !opt_name.compare("client")) { - cv->add_deprecated_comment("port client", "client_ports"); + cv->add_diff_option_comment("port client", "client_ports"); opt_name = "client_ports"; } else if( !opt_name.compare("server")) { - cv->add_deprecated_comment("port server", "server_ports"); + cv->add_diff_option_comment("port server", "server_ports"); opt_name = "server_ports"; } else if( !opt_name.compare("both")) { - cv->add_deprecated_comment("port both", "both_ports"); + cv->add_diff_option_comment("port both", "both_ports"); opt_name = "both_ports"; } @@ -186,32 +186,32 @@ bool StreamTcp::convert(std::stringstream& data_stream) else if(!keyword.compare("bind_to")) { - cv->add_deprecated_comment("bind_to", "bindings"); + cv->add_diff_option_comment("bind_to", "bindings"); if(!(data_stream >> keyword)) tmpval = false; } else if(!keyword.compare("dont_reassemble_async")) { - cv->add_deprecated_comment("dont_reassemble_async", "reassemble_async"); + cv->add_diff_option_comment("dont_reassemble_async", "reassemble_async"); tmpval = cv->add_option_to_table("reassemble_async", false); } else if(!keyword.compare("use_static_footprint_sizes")) { - cv->add_deprecated_comment("footprint", "use_static_footprint_sizes"); + cv->add_diff_option_comment("footprint", "use_static_footprint_sizes"); tmpval = cv->add_option_to_table("footprint", true); } else if(!keyword.compare("timeout")) { - cv->add_deprecated_comment("timeout", "session_timeout"); + cv->add_diff_option_comment("timeout", "session_timeout"); tmpval = parse_int_option("session_timeout", data_stream); } else if(!keyword.compare("max_queued_segs")) { - cv->add_deprecated_comment("max_queued_segs", "queue_limit.max_segments"); + cv->add_diff_option_comment("max_queued_segs", "queue_limit.max_segments"); cv->open_table("queue_limit"); tmpval = parse_int_option("max_segments", data_stream); cv->close_table(); @@ -219,7 +219,7 @@ bool StreamTcp::convert(std::stringstream& data_stream) else if(!keyword.compare("max_queued_bytes")) { - cv->add_deprecated_comment("max_queued_bytes", "queue_limit.max_bytes"); + cv->add_diff_option_comment("max_queued_bytes", "queue_limit.max_bytes"); cv->open_table("queue_limit"); tmpval = parse_int_option("max_bytes", data_stream); cv->close_table(); diff --git a/tools/snort2lua/preprocessor_states/pps_stream_udp.cc b/tools/snort2lua/preprocessor_states/pps_stream_udp.cc index 5c2606817..a33030442 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream_udp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream_udp.cc @@ -61,7 +61,7 @@ bool StreamUdp::convert(std::stringstream& data_stream) else if(!keyword.compare("timeout")) { - cv->add_deprecated_comment("timeout", "session_timeout"); + cv->add_diff_option_comment("timeout", "session_timeout"); tmpval = parse_int_option("session_timeout", data_stream); } @@ -84,7 +84,7 @@ static ConversionState* ctor(Converter* cv) return new StreamUdp(cv); } -static const ConvertMap preprocessor_stream_udp = +static const ConvertMap preprocessor_stream_udp = { "stream5_udp", ctor, diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc index 2bd24e238..4a814905c 100644 --- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc @@ -25,6 +25,8 @@ extern const ConvertMap *arpspoof_map; extern const ConvertMap *arpspoof_host_map; extern const ConvertMap *bo_map; +extern const ConvertMap *frag3_engine_map; +extern const ConvertMap *frag3_global_map; extern const ConvertMap *ftptelnet_map; extern const ConvertMap *ftptelnet_protocol_map; extern const ConvertMap *httpinspect_map; @@ -45,6 +47,8 @@ const std::vector preprocessor_api = arpspoof_map, arpspoof_host_map, bo_map, + frag3_engine_map, + frag3_global_map, ftptelnet_map, httpinspect_map, httpinspect_server_map, diff --git a/tools/snort2lua/snort2lua.cc b/tools/snort2lua/snort2lua.cc index 6aec6ad1e..2d3a50159 100644 --- a/tools/snort2lua/snort2lua.cc +++ b/tools/snort2lua/snort2lua.cc @@ -168,11 +168,6 @@ void convert(Converter *cv, std::string input_file) } -static void show_usage() -{ - std::cout << "usage: snort2lua " << std::endl; -} - int main (int argc, char* argv[]) { std::ifstream in;