From: Josh <jrosenba@cisco.com>
Date: Tue, 21 Oct 2014 18:25:54 +0000 (-0500)
Subject: adding a missing file
X-Git-Tag: 3.0.0-233~1344^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d10942ecc71b12f3fa977375715d4e86bf0704e4;p=thirdparty%2Fsnort3.git

adding a missing file
---

diff --git a/tools/snort2lua/rule_states/rule_stream_reassemble.cc b/tools/snort2lua/rule_states/rule_stream_reassemble.cc
new file mode 100644
index 000000000..a7f90417b
--- /dev/null
+++ b/tools/snort2lua/rule_states/rule_stream_reassemble.cc
@@ -0,0 +1,123 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation.  You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+*/
+// rule_isdataat.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "utils/converter.h"
+#include "rule_states/rule_api.h"
+#include "utils/s2l_util.h"
+
+namespace rules
+{
+
+namespace {
+
+
+class StreamReassemble : public ConversionState
+{
+public:
+    StreamReassemble(Converter& c) : ConversionState(c) {};
+    virtual ~StreamReassemble() {};
+    virtual bool convert(std::istringstream& data);
+};
+
+} // namespace
+
+bool StreamReassemble::convert(std::istringstream& data_stream)
+{
+    std::string args;
+    std::string action;
+    std::string direction;
+
+    args = util::get_rule_option_args(data_stream);
+    std::istringstream arg_stream(args);
+
+    // if there are no arguments, the option had a colon before a semicolon.
+    // we are therefore done with this rule.
+    if (args.empty() ||
+        !util::get_string(arg_stream, action, ",") ||
+        !util::get_string(arg_stream, direction, ","))
+    {
+        rule_api.bad_rule(data_stream, "stream_reassemble requires two arguments!");
+        return set_next_rule_state(data_stream);
+    }
+
+    if ( action.compare("enable") && action.compare("disable") )
+    {
+        rule_api.bad_rule(data_stream, "stream_reassemble: " +
+            action + " must be either 'enable' or 'disable'");
+    }
+
+    if (direction.compare("client") &&
+        direction.compare("server") &&
+        direction.compare("both") )
+    {
+        rule_api.bad_rule(data_stream, "stream_reassemble: " +
+            direction + " must be either 'client', 'server', or 'both'");
+    }
+
+
+    rule_api.add_rule_option("stream_reassemble");
+    rule_api.select_option("stream_reassemble");
+    rule_api.add_suboption("action", action);
+    rule_api.add_suboption("direction", direction);
+
+    int cnt = 0;
+    std::string keyword;
+    while ( util::get_string(arg_stream, keyword, ",") )
+    {
+        if (!keyword.compare("noalert"))
+            rule_api.add_suboption("noalert");
+
+        else if (!keyword.compare("fastpath"))
+            rule_api.add_suboption("fastpath");
+
+        else
+            rule_api.bad_rule(data_stream, "stream_reassemble: " + keyword);
+
+        if (++cnt > 2)
+            rule_api.bad_rule(data_stream, "stream_reassemble: "
+                "only four options allowed.");
+    }
+
+    rule_api.unselect_option();
+    return set_next_rule_state(data_stream);
+}
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+
+static ConversionState* ctor(Converter& cv)
+{ return new StreamReassemble(cv); }
+
+static const ConvertMap stream_reassemble_api =
+{
+    "stream_reassemble",
+    ctor,
+};
+
+const ConvertMap* stream_reassemble_map = &stream_reassemble_api;
+
+
+} // namespace rules