Merge pull request #1038 in SNORT/snort3 from unsupported_rule_opts to master

Squashed commit of the following:

commit 65bf747af341c6deb9ed4ddb3f6b9389bbb4e23f
Author: Michael Altizer <mialtize@cisco.com>
Date:   Mon Oct 9 19:43:24 2017 -0400

    snort2lua: Some header cleanups

commit d783df2741b7e75287432c52a3fc18be7822de59
Author: Michael Altizer <mialtize@cisco.com>
Date:   Mon Oct 9 19:42:24 2017 -0400

    snort2lua: Correctly identify ftpbounce and sameip as unsupported rule options

diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h
index edd2642a5f37108bb91acff5849d784bc67045d6..8b6fa8be1eaa7483f0af98355f4cceb2dcfe9c72 100644 (file)
--- a/tools/snort2lua/conversion_state.h
+++ b/tools/snort2lua/conversion_state.h
@@ -20,21 +20,11 @@
 #ifndef CONVERSION_STATE_H
 #define CONVERSION_STATE_H
 
-#include <string>
-#include <fstream>
 #include <sstream>
-#include <cctype>
-#include <iostream>
 
-#include "data/dt_data.h"
-#include "data/dt_table_api.h"
-#include "data/dt_rule_api.h"
-
-// the following three files are for the function 'set_next_rule_state'
+#include "helpers/converter.h"
 #include "helpers/s2l_util.h"
 #include "rule_states/rule_api.h"
-#include "helpers/converter.h"
-#include "conversion_defines.h"
 
 class DataApi;
 class RuleApi;

diff --git a/tools/snort2lua/helpers/converter.cc b/tools/snort2lua/helpers/converter.cc
index dd7210c49d4086bb15465a59d56d24379fbea507..28c2bea76a6e3981f68d1c53f6f82b45f056b1b7 100644 (file)
--- a/tools/snort2lua/helpers/converter.cc
+++ b/tools/snort2lua/helpers/converter.cc
@@ -17,6 +17,12 @@
 //--------------------------------------------------------------------------
 // converter.cc author Josh Rosenbaum <jrosenba@cisco.com>
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "converter.h"
+
 #include <algorithm>
 #include <memory>
 #include <stdexcept>

diff --git a/tools/snort2lua/helpers/converter.h b/tools/snort2lua/helpers/converter.h
index 14d031da9169cac084eac1484e8b80096b5e5bc4..8e42b5c7c8d792a0d1b6be2ec8845d289a6fd4c7 100644 (file)
--- a/tools/snort2lua/helpers/converter.h
+++ b/tools/snort2lua/helpers/converter.h
@@ -20,13 +20,11 @@
 #ifndef UTILS_CONVERTER_H
 #define UTILS_CONVERTER_H
 
-#include <memory>
-#include <string>
 #include "conversion_defines.h"
 #include "data/dt_data.h"
-#include "data/dt_table_api.h"
 #include "data/dt_rule_api.h"
-#include "util_binder.h"
+#include "data/dt_table_api.h"
+#include "helpers/util_binder.h"
 
 typedef std::pair<unsigned, std::shared_ptr<Binder>> PendingBinder;
 

diff --git a/tools/snort2lua/helpers/parse_cmd_line.cc b/tools/snort2lua/helpers/parse_cmd_line.cc
index 558fc8830c3132d2c908836756d5dd717cb2eae9..662419d6629a1d93dccca4b76085d84288ca5b0a 100644 (file)
--- a/tools/snort2lua/helpers/parse_cmd_line.cc
+++ b/tools/snort2lua/helpers/parse_cmd_line.cc
@@ -20,20 +20,14 @@
 #include "config.h"
 #endif
 
-#include "helpers/parse_cmd_line.h"
-
-#include <syslog.h>
+#include "parse_cmd_line.h"
 
 #include <cstring>
 #include <iomanip>
-#include <iostream>
-#include <string>
-
-#include "data/dt_data.h"
-#include "helpers/converter.h"
-#include "helpers/s2l_util.h"
-#include "helpers/s2l_markup.h"
-#include "helpers/util_binder.h"
+
+#include "converter.h"
+#include "s2l_markup.h"
+#include "s2l_util.h"
 
 namespace parser
 {

diff --git a/tools/snort2lua/helpers/s2l_markup.cc b/tools/snort2lua/helpers/s2l_markup.cc
index 27d5bc96166bc4451fad6c1d175950ec0b5ffc52..dd0ebb325f437b2113d5abf9c9ce3917a97de9d4 100644 (file)
--- a/tools/snort2lua/helpers/s2l_markup.cc
+++ b/tools/snort2lua/helpers/s2l_markup.cc
@@ -15,9 +15,14 @@
 // with this program; if not, write to the Free Software Foundation, Inc.,
 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 //--------------------------------------------------------------------------
-// markup.cc author Russ Combs <rucombs@cisco.com>
+// s2l_markup.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 
 #include "s2l_markup.h"
+
 #include <cstring>
 
 using namespace std;

diff --git a/tools/snort2lua/helpers/s2l_util.cc b/tools/snort2lua/helpers/s2l_util.cc
index a8369d9b9fc7f56565f47bdbf21b1972930e0e1d..c54aef7943849f630639cd6c58bd35fc33a6177f 100644 (file)
--- a/tools/snort2lua/helpers/s2l_util.cc
+++ b/tools/snort2lua/helpers/s2l_util.cc
@@ -17,20 +17,17 @@
 //--------------------------------------------------------------------------
 // s2l_util.cc author Josh Rosenbaum <jrosenba@cisco.com>
 
-#include <sstream>
-#include <algorithm>
-#include <functional>
-#include <cctype>
-#include <locale>
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "s2l_util.h"
+
 #include <sys/stat.h>
-#include <iostream>
-#include <string>
-#include <cstring>
-#include <sstream>
 
-#include "helpers/s2l_util.h"
+#include <algorithm>
+
 #include "conversion_state.h"
-#include "data/dt_data.h"
 #include "data/data_types/dt_table.h"
 
 namespace util

diff --git a/tools/snort2lua/helpers/s2l_util.h b/tools/snort2lua/helpers/s2l_util.h
index b3d023b3235a3033332f4cf960e2bd6f3bf031b6..1cc9ee6348621e5774f12acb56be8d49ae79a754 100644 (file)
--- a/tools/snort2lua/helpers/s2l_util.h
+++ b/tools/snort2lua/helpers/s2l_util.h
@@ -20,14 +20,9 @@
 #ifndef HELPERS_UTIL_H
 #define HELPERS_UTIL_H
 
+#include <memory>
 #include <string>
 #include <vector>
-#include <algorithm>
-#include <functional>
-#include <cctype>
-#include <locale>
-#include <sstream>
-#include <memory>
 
 struct ConvertMap;
 class Table;

diff --git a/tools/snort2lua/helpers/util_binder.cc b/tools/snort2lua/helpers/util_binder.cc
index ee1cf56c050ef937e57d326a7e9ff95c15eab1fe..1e3d8e4305dd3c7fc8054174d9b96f4fc3c3d1bf 100644 (file)
--- a/tools/snort2lua/helpers/util_binder.cc
+++ b/tools/snort2lua/helpers/util_binder.cc
@@ -15,12 +15,17 @@
 // with this program; if not, write to the Free Software Foundation, Inc.,
 // 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 //--------------------------------------------------------------------------
-// pps_binder.cc author Josh Rosenbaum <jrosenba@cisco.com>
+// util_binder.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "util_binder.h"
 
 #include <algorithm>
 #include <cassert>
 
-#include "helpers/util_binder.h"
 #include "data/dt_table_api.h"
 
 using namespace std;

diff --git a/tools/snort2lua/keyword_states/kws_rule.cc b/tools/snort2lua/keyword_states/kws_rule.cc
index 341bf1abc88ff7d6d050111184a38f3170c80ceb..d1230ba1510e66b9a8ba65c43dd18fc7b94a018d 100644 (file)
--- a/tools/snort2lua/keyword_states/kws_rule.cc
+++ b/tools/snort2lua/keyword_states/kws_rule.cc
@@ -17,13 +17,7 @@
 //--------------------------------------------------------------------------
 // kws_rule.cc author Josh Rosenbaum <jrosenba@cisco.com>
 
-#include <sstream>
-#include <vector>
-
 #include "conversion_state.h"
-#include "helpers/converter.h"
-#include "helpers/s2l_util.h"
-#include "rule_states/rule_api.h"
 
 namespace keywords
 {
@@ -113,8 +107,6 @@ static const std::string sblock = "sblock";
 static const std::string sdrop = "sdrop";
 static const std::string activate = "activate";
 static const std::string dynamic = "dynamic";
-static const std::string ftpbounce = "ftpbounce";
-static const std::string sameip = "sameip";
 
 static const ConvertMap alert_api = { alert, rule_ctor<& alert>};
 static const ConvertMap block_api = { block, rule_ctor<& block>};
@@ -126,8 +118,6 @@ static const ConvertMap sblock_api = { sblock, conv_rule_ctor<& block, &sblock>}
 static const ConvertMap sdrop_api = { sdrop, conv_rule_ctor<& block, &sdrop>};
 static const ConvertMap activate_api = { activate, dep_rule_ctor<& activate>};
 static const ConvertMap dynamic_api = { dynamic, dep_rule_ctor<& dynamic>};
-static const ConvertMap ftpbounce_api = { ftpbounce, dep_rule_ctor<& ftpbounce>};
-static const ConvertMap sameip_api = { sameip, dep_rule_ctor<& sameip>};
 
 const ConvertMap* alert_map = &alert_api;
 const ConvertMap* block_map = &block_api;
@@ -139,7 +129,5 @@ const ConvertMap* sblock_map = &sblock_api;
 const ConvertMap* sdrop_map = &sdrop_api;
 const ConvertMap* activate_map = &activate_api;
 const ConvertMap* dynamic_map = &dynamic_api;
-const ConvertMap* ftpbounce_map = &ftpbounce_api;
-const ConvertMap* sameip_map = &sameip_api;
 } // namespace keywords
 

diff --git a/tools/snort2lua/output_states/out_syslog.cc b/tools/snort2lua/output_states/out_syslog.cc
index ad87636e622732a300c955a9f5f045a35138b79e..151bda5ce284cf77c47252e6c049fdc79fc04e46 100644 (file)
--- a/tools/snort2lua/output_states/out_syslog.cc
+++ b/tools/snort2lua/output_states/out_syslog.cc
@@ -17,13 +17,13 @@
 //--------------------------------------------------------------------------
 // out_syslog.cc author Josh Rosenbaum <jrosenba@cisco.com>
 
-#include <sstream>
-#include <vector>
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <algorithm>
 
 #include "conversion_state.h"
-#include "helpers/converter.h"
-#include "rule_states/rule_api.h"
-#include "helpers/s2l_util.h"
 
 namespace output
 {

diff --git a/tools/snort2lua/preprocessor_states/pps_dcerpc_server.cc b/tools/snort2lua/preprocessor_states/pps_dcerpc_server.cc
index ebfcebcd7f955903545c7d080dd768e2e7508579..1d9ae1970144c98ee66ea11eb70f065274d86748 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_dcerpc_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_dcerpc_server.cc
@@ -17,17 +17,15 @@
 //--------------------------------------------------------------------------
 // pps_dcerpc_server.cc author Maya Dagon <mdagon@cisco.com>
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include "pps_dcerpc_server.h"
 
-#include <sstream>
-#include <vector>
-#include <map>
+#include <algorithm>
 #include <cstring>
 
-#include "conversion_state.h"
-#include "helpers/s2l_util.h"
-#include "helpers/util_binder.h"
-
 namespace preprocessors
 {
 namespace dce

diff --git a/tools/snort2lua/preprocessor_states/pps_dcerpc_server.h b/tools/snort2lua/preprocessor_states/pps_dcerpc_server.h
index d8ba361c2d8ad0627e538efda70f4ff41dc85fda..ccf7396fb223b097e93939eb824484ef721d000a 100644 (file)
--- a/tools/snort2lua/preprocessor_states/pps_dcerpc_server.h
+++ b/tools/snort2lua/preprocessor_states/pps_dcerpc_server.h
@@ -23,8 +23,6 @@
 #include <map>
 
 #include "conversion_state.h"
-#include "helpers/s2l_util.h"
-#include "helpers/util_binder.h"
 
 namespace preprocessors
 {

diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt
index f1f295322656d950e6b0c2da0412b4e04fff81cc..cea816c6028777d06a773f298fdceac48df67952 100644 (file)
--- a/tools/snort2lua/rule_states/CMakeLists.txt
+++ b/tools/snort2lua/rule_states/CMakeLists.txt
@@ -20,6 +20,7 @@ add_library( rule_states
     rule_ttl.cc
     rule_threshold.cc
     rule_unchanged.cc
+    rule_unsupported.cc
     rule_urilen.cc
     rule_api.cc
     rule_api.h

diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am
index bf6287d1d1792312a91834251cf0ab15c868916d..4390220e7d262feb13b93cf37b662b40a21979a1 100644 (file)
--- a/tools/snort2lua/rule_states/Makefile.am
+++ b/tools/snort2lua/rule_states/Makefile.am
@@ -22,6 +22,7 @@ rule_tag.cc \
 rule_ttl.cc \
 rule_threshold.cc \
 rule_unchanged.cc \
+rule_unsupported.cc \
 rule_urilen.cc \
 rule_api.cc \
 rule_api.h

diff --git a/tools/snort2lua/rule_states/rule_api.cc b/tools/snort2lua/rule_states/rule_api.cc
index fd85cb8d8da4e6229cac82905700200cadb0701b..9eef851d5aaf5a2e7b82bf23c74496cf66030154 100644 (file)
--- a/tools/snort2lua/rule_states/rule_api.cc
+++ b/tools/snort2lua/rule_states/rule_api.cc
@@ -25,6 +25,8 @@
 namespace rules
 {
 extern const ConvertMap* ack_map;
+extern const ConvertMap* activated_by_map;
+extern const ConvertMap* activates_map;
 extern const ConvertMap* appid_map;
 extern const ConvertMap* asn1_map;
 extern const ConvertMap* base64_data_map;
@@ -35,6 +37,7 @@ extern const ConvertMap* byte_math_map;
 extern const ConvertMap* byte_test_map;
 extern const ConvertMap* classtype_map;
 extern const ConvertMap* content_map;
+extern const ConvertMap* count_map;
 extern const ConvertMap* cvs_map;
 extern const ConvertMap* dce_iface_map;
 extern const ConvertMap* dce_opnum_map;
@@ -51,6 +54,7 @@ extern const ConvertMap* flow_map;
 extern const ConvertMap* flowbits_map;
 extern const ConvertMap* fragbits_map;
 extern const ConvertMap* fragoffset_map;
+extern const ConvertMap* ftpbounce_map;
 extern const ConvertMap* gid_map;
 extern const ConvertMap* gtp_info_map;
 extern const ConvertMap* gtp_type_map;
@@ -80,6 +84,7 @@ extern const ConvertMap* replace_map;
 extern const ConvertMap* resp_map;
 extern const ConvertMap* rev_map;
 extern const ConvertMap* rpc_map;
+extern const ConvertMap* sameip_map;
 extern const ConvertMap* sd_pattern_map;
 extern const ConvertMap* seq_map;
 extern const ConvertMap* session_map;
@@ -103,6 +108,8 @@ extern const ConvertMap* window_map;
 const std::vector<const ConvertMap*> rule_options_api =
 {
     ack_map,
+    activated_by_map,
+    activates_map,
     appid_map,
     asn1_map,
     base64_data_map,
@@ -113,6 +120,7 @@ const std::vector<const ConvertMap*> rule_options_api =
     byte_test_map,
     classtype_map,
     content_map,
+    count_map,
     cvs_map,
     dce_iface_map,
     dce_opnum_map,
@@ -129,6 +137,7 @@ const std::vector<const ConvertMap*> rule_options_api =
     flowbits_map,
     fragbits_map,
     fragoffset_map,
+    ftpbounce_map,
     gid_map,
     gtp_info_map,
     gtp_type_map,
@@ -158,6 +167,7 @@ const std::vector<const ConvertMap*> rule_options_api =
     resp_map,
     rev_map,
     rpc_map,
+    sameip_map,
     sd_pattern_map,
     seq_map,
     session_map,

diff --git a/tools/snort2lua/rule_states/rule_unsupported.cc b/tools/snort2lua/rule_states/rule_unsupported.cc
new file mode 100644 (file)
index 0000000..80adb30
--- /dev/null
+++ b/tools/snort2lua/rule_states/rule_unsupported.cc
@@ -0,0 +1,73 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2017 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+// rule_unsupported.cc author Michael Altizer <mialtize@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "conversion_state.h"
+
+namespace rules
+{
+template<const std::string* rule_opt_name, bool has_suboptions>
+class UnsupportedRuleOption : public ConversionState
+{
+public:
+    UnsupportedRuleOption(Converter& c) : ConversionState(c)
+    {
+        c.get_rule_api().make_rule_a_comment();
+        c.get_rule_api().add_comment("The '" + *rule_opt_name + "' rule option keyword is no longer supported");
+    }
+
+    bool convert(std::istringstream& stream) override
+    {
+        if (has_suboptions)
+            util::get_rule_option_args(stream);
+        return set_next_rule_state(stream);
+    }
+};
+
+/**************************
+ *******  A P I ***********
+ **************************/
+
+template<const std::string* rule_opt_name, bool has_suboptions>
+static ConversionState* unsupported_rule_ctor(Converter& c)
+{
+    return new UnsupportedRuleOption<rule_opt_name, has_suboptions>(c);
+}
+
+static const std::string activated_by = "activated_by";
+static const std::string activates = "activates";
+static const std::string count = "count";
+static const std::string ftpbounce = "ftpbounce";
+static const std::string sameip = "sameip";
+
+static const ConvertMap activated_by_api = { activated_by, unsupported_rule_ctor<&activated_by, true>};
+static const ConvertMap activates_api = { activates, unsupported_rule_ctor<&activates, true>};
+static const ConvertMap count_api = { count, unsupported_rule_ctor<&count, true>};
+static const ConvertMap ftpbounce_api = { ftpbounce, unsupported_rule_ctor<&ftpbounce, false>};
+static const ConvertMap sameip_api = { sameip, unsupported_rule_ctor<&sameip, false>};
+
+const ConvertMap* activated_by_map = &activated_by_api;
+const ConvertMap* activates_map = &activates_api;
+const ConvertMap* count_map = &count_api;
+const ConvertMap* ftpbounce_map = &ftpbounce_api;
+const ConvertMap* sameip_map = &sameip_api;
+} // namespace rules