From: Russ Combs (rucombs) Date: Thu, 28 Jan 2016 19:59:53 +0000 (-0500) Subject: Merge pull request #220 in SNORT/snort3 from dce_snort2lua to master X-Git-Tag: 3.0.0-233~650 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b28c19e322fcd83a289e4cdfa96afe64690eee54;p=thirdparty%2Fsnort3.git Merge pull request #220 in SNORT/snort3 from dce_snort2lua to master Squashed commit of the following: commit 91c9808c316135ae9aa714f83b19faef505e98a4 Author: mdagon Date: Thu Jan 28 14:19:18 2016 -0500 dcerpc rule options snort2lua --- diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt index 3b22a3861..a93656062 100644 --- a/tools/snort2lua/rule_states/CMakeLists.txt +++ b/tools/snort2lua/rule_states/CMakeLists.txt @@ -3,6 +3,7 @@ add_library( rule_states rule_base64_decode.cc rule_content.cc rule_convert_comma_list.cc + rule_dce_iface.cc rule_dnp3_obj.cc rule_file_data.cc rule_http_encode.cc diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am index 7614a1775..c24cdec50 100644 --- a/tools/snort2lua/rule_states/Makefile.am +++ b/tools/snort2lua/rule_states/Makefile.am @@ -5,6 +5,7 @@ librule_states_a_SOURCES = \ rule_base64_decode.cc \ rule_content.cc \ rule_convert_comma_list.cc \ +rule_dce_iface.cc \ rule_dnp3_obj.cc \ rule_file_data.cc \ rule_http_encode.cc \ diff --git a/tools/snort2lua/rule_states/rule_api.cc b/tools/snort2lua/rule_states/rule_api.cc index 7d3b4e75b..4f40eac97 100644 --- a/tools/snort2lua/rule_states/rule_api.cc +++ b/tools/snort2lua/rule_states/rule_api.cc @@ -34,6 +34,9 @@ extern const ConvertMap* byte_test_map; extern const ConvertMap* classtype_map; extern const ConvertMap* content_map; extern const ConvertMap* cvs_map; +extern const ConvertMap* dce_iface_map; +extern const ConvertMap* dce_opnum_map; +extern const ConvertMap* dce_stub_data_map; extern const ConvertMap* detection_filter_map; extern const ConvertMap* dnp3_data_map; extern const ConvertMap* dnp3_func_map; @@ -107,6 +110,9 @@ const std::vector rule_options_api = classtype_map, content_map, cvs_map, + dce_iface_map, + dce_opnum_map, + dce_stub_data_map, detection_filter_map, dnp3_data_map, dnp3_func_map, diff --git a/tools/snort2lua/rule_states/rule_convert_comma_list.cc b/tools/snort2lua/rule_states/rule_convert_comma_list.cc index cb067a935..ce0e23fd1 100644 --- a/tools/snort2lua/rule_states/rule_convert_comma_list.cc +++ b/tools/snort2lua/rule_states/rule_convert_comma_list.cc @@ -73,5 +73,18 @@ static const ConvertMap dnp3_ind_api = }; const ConvertMap* dnp3_ind_map = &dnp3_ind_api; + +/************************************ + ********* DCE OPNUM ************** + ************************************/ +static const std::string dce_opnum = "dce_opnum"; +static const ConvertMap dce_opnum_api = +{ + dce_opnum, + comma_list_conversion_ctor<& dce_opnum>, +}; + +const ConvertMap* dce_opnum_map = &dce_opnum_api; + } // namespace rules diff --git a/tools/snort2lua/rule_states/rule_dce_iface.cc b/tools/snort2lua/rule_states/rule_dce_iface.cc new file mode 100644 index 000000000..2a88eaa5e --- /dev/null +++ b/tools/snort2lua/rule_states/rule_dce_iface.cc @@ -0,0 +1,90 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2016-2016 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// rule_dce_iface.cc author Maya Dagon + +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "rule_states/rule_api.h" +#include "helpers/s2l_util.h" + +namespace rules +{ +namespace +{ +class DCEIface : public ConversionState +{ +public: + DCEIface(Converter& c) : ConversionState(c) { } + virtual ~DCEIface() { } + virtual bool convert(std::istringstream& data); +}; +} // namespace + +bool DCEIface::convert(std::istringstream& data) +{ + std::string val = util::get_rule_option_args(data); + + /* convert from dce_iface: [, ] [, any_frag] to + * dce_iface: uuid [, version ] [, any_frag] + */ + val.insert(0, "uuid "); + size_t start_pos = val.find(','); + while (start_pos != std::string::npos) + { + size_t next_pos = val.find(',', start_pos+1); + std::string substring; + + if (next_pos != std::string::npos) + substring = val.substr(start_pos+1, next_pos-start_pos); + else + substring = val.substr(start_pos+1); + + if (substring.find("any_frag") == std::string::npos) + { + val.insert(start_pos+1, "version "); + break; + } + + start_pos = next_pos; + } + + rule_api.add_option("dce_iface", val); + return set_next_rule_state(data); +} + +/************************** + ******* A P I *********** + **************************/ + +static ConversionState* ctor(Converter& cv) +{ + return new DCEIface(cv); +} + +static const std::string dce_iface = "dce_iface"; +static const ConvertMap dce_iface_api = +{ + dce_iface, + ctor, +}; + +const ConvertMap* dce_iface_map = &dce_iface_api; +} // namespace rules + diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc index d04752e99..9550c080a 100644 --- a/tools/snort2lua/rule_states/rule_unchanged.cc +++ b/tools/snort2lua/rule_states/rule_unchanged.cc @@ -729,5 +729,18 @@ static const ConvertMap rule_dnp3_func = }; const ConvertMap* dnp3_func_map = &rule_dnp3_func; + +/************************************ + ********* DCE STUB DATA ********** + ************************************/ + +static const std::string dce_stub_data = "dce_stub_data"; +static const ConvertMap rule_dce_stub_data = +{ + dce_stub_data, + unchanged_rule_ctor<& dce_stub_data, false>, +}; + +const ConvertMap* dce_stub_data_map = &rule_dce_stub_data; } // namespace rule