From: Josh Date: Mon, 25 Aug 2014 21:56:27 +0000 (-0400) Subject: tweaking snort2lua. Rules ending in semi-colon X-Git-Tag: 3.0.0-233~1419^2~5^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f51bc961a8a71b8964bc448fdd9738e977cae29f;p=thirdparty%2Fsnort3.git tweaking snort2lua. Rules ending in semi-colon --- diff --git a/extra/src/codecs/token_ring_module.cc b/extra/src/codecs/token_ring_module.cc deleted file mode 100644 index 51bbe912d..000000000 --- a/extra/src/codecs/token_ring_module.cc +++ /dev/null @@ -1,51 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// token_ring_module.cc author Josh Rosenbaum - -#include "token_ring_module.h" - - -static const Parameter tkr_params[] = -{ - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - - -static const RuleMap tkr_rules[] = -{ - { DECODE_BAD_TRH, "(" TR_NAME ") Bad Token Ring Header" }, - { DECODE_BAD_TR_ETHLLC, "(" TR_NAME ") Bad Token Ring ETHLLC Header" }, - { DECODE_BAD_TR_MR_LEN, "(" TR_NAME ") Bad Token Ring MRLENHeader" }, - { DECODE_BAD_TRHMR, "(" TR_NAME ") Bad Token Ring MR Header" }, - { 0, nullptr } -}; - -//------------------------------------------------------------------------- -// token ring module -//------------------------------------------------------------------------- - -TrCodecModule::TrCodecModule() : DecodeModule(TR_NAME) -{ } - - -bool TrCodecModule::set(const char*, Value&, SnortConfig*) -{ - return true; -} diff --git a/extra/src/codecs/token_ring_module.h b/extra/src/codecs/token_ring_module.h deleted file mode 100644 index 74e146371..000000000 --- a/extra/src/codecs/token_ring_module.h +++ /dev/null @@ -1,40 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -// token_ring_module.h author Josh Rosenbaum - -#ifndef CODECS_TOKEN_RING_MODULE_H -#define CODECS_TOKEN_RING_MODULE_H - -#include "codecs/decode_module.h" - - -#define TR_NAME "token_ring" - -class TrCodecModule : public DecodeModule -{ -public: - TrCodecModule(); - - const RuleMap* get_rules() const; - bool set(const char*, Value&, SnortConfig*); -}; - -#endif - diff --git a/tools/snort2lua/config_states/config_alertfile.cc b/tools/snort2lua/config_states/config_alertfile.cc new file mode 100644 index 000000000..e0583ab96 --- /dev/null +++ b/tools/snort2lua/config_states/config_alertfile.cc @@ -0,0 +1,105 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// config_alertfile.cc author Josh Rosenbaum + +#include +#include + +#include "conversion_state.h" +#include "utils/s2l_util.h" + +namespace config +{ + +namespace { + + +class Alertfile : public ConversionState +{ +public: + Alertfile() : ConversionState() {}; + virtual ~Alertfile() {}; + virtual bool convert(std::istringstream& data_stream); +}; + +} // namespace + + +bool Alertfile::convert(std::istringstream& data_stream) +{ + std::string filename = util::get_remain_data(data_stream); + + if (filename.empty()) + { + data_api.failed_conversion(data_stream, ""); + return false; + } + + /* + * In Snort, config alertfile: is actually only used by full and fast + * outputs. So, keep that functionality here. + */ + + table_api.open_table("alert_full"); + table_api.add_diff_option_comment("config alertfile:", "alert_full.file"); + + if (!table_api.option_exists("file")) + table_api.add_option("file", filename); + else + table_api.add_comment("config alertfile: " + filename + + " not added because a different file already exists"); + + table_api.close_table(); + + + table_api.open_table("alert_fast"); + table_api.add_diff_option_comment("config alertfile:", "alert_fast.file"); + + if (!table_api.option_exists("file")) + table_api.add_option("file", filename); + else + table_api.add_comment("config alertfile: " + filename + + " not added because a different file already exists"); + + table_api.close_table(); + + // stop parsing, even if additional options available + data_stream.setstate(std::ios::eofbit); + return true; +} + +/************************** + ******* A P I *********** + **************************/ + + +static ConversionState* ctor() +{ return new Alertfile(); } + + +static const ConvertMap alertfile_api = +{ + "alertfile", + ctor, +}; + +const ConvertMap* alertfile_map = &alertfile_api; + +} // namespace config diff --git a/tools/snort2lua/data/data_types/dt_rule.cc b/tools/snort2lua/data/data_types/dt_rule.cc index 33b4377d8..83089c9a4 100644 --- a/tools/snort2lua/data/data_types/dt_rule.cc +++ b/tools/snort2lua/data/data_types/dt_rule.cc @@ -150,7 +150,7 @@ std::ostream &operator<<( std::ostream& out, const Rule &rule) out << " " << (*r); } - out << " )"; + out << "; )"; } return out;