From: Josh Date: Tue, 18 Nov 2014 17:34:15 +0000 (-0600) Subject: Snort2Lua: fixing ttl rule option. now converts 'threshold' keyword X-Git-Tag: 3.0.0-233~1202 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d50d463cce898118554b6adcb5b4860aa28bd32d;p=thirdparty%2Fsnort3.git Snort2Lua: fixing ttl rule option. now converts 'threshold' keyword --- diff --git a/tools/snort2lua/keyword_states/keywords_api.cc b/tools/snort2lua/keyword_states/keywords_api.cc index e26773a2d..5111342dc 100644 --- a/tools/snort2lua/keyword_states/keywords_api.cc +++ b/tools/snort2lua/keyword_states/keywords_api.cc @@ -49,7 +49,8 @@ extern const ConvertMap* reject_map; extern const ConvertMap* rule_state_map; extern const ConvertMap* sblock_map; extern const ConvertMap* sdrop_map; -extern const ConvertMap* supress_map; +extern const ConvertMap* suppress_map; +extern const ConvertMap* threshold_map; extern const ConvertMap* var_map; diff --git a/tools/snort2lua/keyword_states/kws_event_filter.cc b/tools/snort2lua/keyword_states/kws_event_filter.cc index 5166fb8ff..3bce59eea 100644 --- a/tools/snort2lua/keyword_states/kws_event_filter.cc +++ b/tools/snort2lua/keyword_states/kws_event_filter.cc @@ -30,24 +30,35 @@ namespace keywords namespace { -class EventFilter : public ConversionState +class Filter : public ConversionState { public: - EventFilter(Converter& c) : ConversionState(c) {}; - virtual ~EventFilter() {}; + Filter(Converter& c, std::string s) : ConversionState(c), type(s) {}; + virtual ~Filter() {}; virtual bool convert(std::istringstream& data_stream); + +private: + std::string type; }; } // namespace -bool EventFilter::convert(std::istringstream& data_stream) +bool Filter::convert(std::istringstream& data_stream) { std::string args; bool retval = true; + static bool warn = true; table_api.open_table("event_filter"); - table_api.open_table(); + if ( warn && !type.compare("threshold")) + { + table_api.add_diff_option_comment("threshold", "event_filter"); + warn = false; + } + + + table_api.open_table(); while (std::getline(data_stream, args, ',')) { std::string keyword; @@ -104,15 +115,26 @@ bool EventFilter::convert(std::istringstream& data_stream) ******* A P I *********** **************************/ -static ConversionState* ctor(Converter& c) -{ return new EventFilter(c); } +static ConversionState* threshold_ctor(Converter& c) +{ return new Filter(c, "threshold"); } + +static ConversionState* event_filter_ctor(Converter& c) +{ return new Filter(c, "event_filter"); } + static const ConvertMap event_filter_api = { "event_filter", - ctor, + event_filter_ctor, +}; + +static const ConvertMap threshold_api = +{ + "threshold", + threshold_ctor, }; const ConvertMap* event_filter_map = &event_filter_api; +const ConvertMap* threshold_map = &threshold_api; } // namespace keywords diff --git a/tools/snort2lua/keyword_states/kws_suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc index 739953924..e128fc516 100644 --- a/tools/snort2lua/keyword_states/kws_suppress.cc +++ b/tools/snort2lua/keyword_states/kws_suppress.cc @@ -134,12 +134,12 @@ bool Suppress::convert(std::istringstream& data_stream) static ConversionState* ctor(Converter& c) { return new Suppress(c); } -static const ConvertMap keyword_supress = +static const ConvertMap keyword_suppress = { "suppress", ctor, }; -const ConvertMap* supress_map = &keyword_supress; +const ConvertMap* suppress_map = &keyword_suppress; } // namespace keywords diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt index 69f433c1a..aab9bbd3a 100644 --- a/tools/snort2lua/rule_states/CMakeLists.txt +++ b/tools/snort2lua/rule_states/CMakeLists.txt @@ -11,6 +11,7 @@ add_library( rule_states rule_resp.cc rule_stream_reassemble.cc rule_tag.cc + rule_ttl.cc rule_threshold.cc rule_unchanged.cc rule_urilen.cc diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am index da30f5b15..3391f3df8 100644 --- a/tools/snort2lua/rule_states/Makefile.am +++ b/tools/snort2lua/rule_states/Makefile.am @@ -15,6 +15,7 @@ rule_react.cc \ rule_resp.cc \ rule_stream_reassemble.cc \ rule_tag.cc \ +rule_ttl.cc \ rule_threshold.cc \ rule_unchanged.cc \ rule_urilen.cc \ diff --git a/tools/snort2lua/rule_states/rule_base64_decode.cc b/tools/snort2lua/rule_states/rule_base64_decode.cc index a16336560..2e6333073 100644 --- a/tools/snort2lua/rule_states/rule_base64_decode.cc +++ b/tools/snort2lua/rule_states/rule_base64_decode.cc @@ -19,7 +19,6 @@ // rule_base64_decode.cc author Josh Rosenbaum #include -#include #include "conversion_state.h" #include "helpers/converter.h" diff --git a/tools/snort2lua/rule_states/rule_tag.cc b/tools/snort2lua/rule_states/rule_tag.cc index 26d47de17..5f06b6bb7 100644 --- a/tools/snort2lua/rule_states/rule_tag.cc +++ b/tools/snort2lua/rule_states/rule_tag.cc @@ -19,7 +19,6 @@ // rule_tag.cc author Josh Rosenbaum #include -#include #include "conversion_state.h" #include "helpers/converter.h" diff --git a/tools/snort2lua/rule_states/rule_threshold.cc b/tools/snort2lua/rule_states/rule_threshold.cc index 231176e25..19c051b02 100644 --- a/tools/snort2lua/rule_states/rule_threshold.cc +++ b/tools/snort2lua/rule_states/rule_threshold.cc @@ -151,9 +151,7 @@ bool Threshold::convert(std::istringstream& data_stream) static ConversionState* ctor(Converter& c) -{ - return new Threshold(c); -} +{ return new Threshold(c); } static const ConvertMap rule_threshold = { diff --git a/tools/snort2lua/rule_states/rule_ttl.cc b/tools/snort2lua/rule_states/rule_ttl.cc new file mode 100644 index 000000000..e787e53df --- /dev/null +++ b/tools/snort2lua/rule_states/rule_ttl.cc @@ -0,0 +1,113 @@ + +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ +// rule_base64_decode.cc author Josh Rosenbaum + +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "rule_states/rule_api.h" +#include "helpers/s2l_util.h" + +namespace rules +{ + +namespace +{ + + +class Ttl : public ConversionState +{ +public: + Ttl(Converter& c) : ConversionState(c) {}; + virtual ~Ttl() {}; + virtual bool convert(std::istringstream&); +}; + +} // namespace + +bool Ttl::convert(std::istringstream& stream) +{ + std::string arg = util::get_rule_option_args(stream); + + + if ( arg.empty() ) + { + rule_api.bad_rule(stream, "ttl "); + } + else + { + std::string new_val; + + if ( arg.find('-') == std::string::npos ) + new_val = arg; + else + { + if ( arg.find('-') != arg.rfind('-') ) + { + new_val = arg; + rule_api.bad_rule(stream, "ttl '" + arg + "'' contains " + "multiple dashes"); + } + else + { + if ( arg.front() == '-' ) + { + arg.erase(0, 1); + new_val = "<=" + arg; + } + else if ( arg.back() == '-' ) + { + arg.pop_back(); + new_val = ">=" + arg; + } + else + { + std::istringstream arg_stream(arg); + int low; + int high; + + arg_stream >> low; + arg_stream.ignore(1); + arg_stream >> high; + new_val = std::to_string(low) + "<=>" + std::to_string(high); + } + } + } + + rule_api.add_option("ttl", new_val); + } + + return set_next_rule_state(stream); +} + + +static ConversionState* ctor(Converter& c) +{ return new Ttl(c); } + +static const ConvertMap rule_ttl = +{ + "ttl", + ctor, +}; + +const ConvertMap* ttl_map = &rule_ttl; + +} // namespace rules diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc index d650ada0c..04d2361e2 100644 --- a/tools/snort2lua/rule_states/rule_unchanged.cc +++ b/tools/snort2lua/rule_states/rule_unchanged.cc @@ -218,7 +218,6 @@ const ConvertMap* flags_map = &rule_flags; ********* FRAGOFFSET ************** ************************************/ - static const std::string fragoffset = "fragoffset"; static const ConvertMap rule_fragoffset = { @@ -228,20 +227,6 @@ static const ConvertMap rule_fragoffset = const ConvertMap* fragoffset_map = &rule_fragoffset; -/************************************ - ************* T T L **************** - ************************************/ - - -static const std::string ttl = "ttl"; -static const ConvertMap rule_ttl = -{ - ttl, - unchanged_rule_ctor<&ttl>, -}; - -const ConvertMap* ttl_map = &rule_ttl; - /************************************ ************* T O S **************** diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in index 80487ee74..cd6b2ba9c 100644 --- a/tools/snort2lua/tests/snort.conf.in +++ b/tools/snort2lua/tests/snort.conf.in @@ -1327,3 +1327,9 @@ alert tcp $EXTERNAL_NET any -> $HOME_NET 135 ( msg:"DELETED NETBIOS DCERPC Remot alert tcp $EXTERNAL_NET any -> any $TEST_PORTS (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:!"m?^Argument\s+/?smi"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2319; rev:4;) alert tcp any any -> any any ( msg:"First Cookie"; content:"OvCgi",http_uri; content:"AcceptLang=en-usaAAAA",http_cookie,nocase; sid:11111111; ) + + +threshold gen_id 1, sig_id 7037, type limit, track by_src, count 1, seconds 60 +alert ip any any -> any any (msg:"TTL RULE OPTION"; ttl:-4; sid:11111112;) +alert ip any any -> any any (msg:"TTL RULE OPTION"; ttl:5-6; sid:11111113;) +alert ip any any -> any any (msg:"TTL RULE OPTION"; ttl:7-; sid:11111114;)