include_directories("${CMAKE_CURRENT_SOURCE_DIR}")
add_subdirectory(data)
-add_subdirectory(keywords)
-add_subdirectory(preprocessor)
-add_subdirectory(output)
+add_subdirectory(keyword_states)
+add_subdirectory(preprocessor_states)
+add_subdirectory(output_states)
add_executable(snort2lua
snort2lua.cc
)
target_link_libraries( snort2lua
- data
- keywords
- output
- preprocessor
+ converrsion_data
+ keyword_states
+ output_states
+ preprocessor_states
)
#include <sstream>
#include <stack>
-#include "data/conv_data.h"
-#include "data/conv_var.h"
+#include "data/cv_data.h"
+#include "data/cv_var.h"
class ConversionState;
public:
Converter();
virtual ~Converter() {};
- void reset_state();
+ // convert the following line from a snort.conf into a lua.conf
bool convert_line(std::stringstream& data);
+ // set the next parsing state.
void set_state(ConversionState* c);
+ // reset the current parsing state
+ void reset_state();
+ // prints the entire lua configuration to the output file.
+ friend std::ostream &operator<<( std::ostream& out, const Converter &cv) { return out << cv.data; }
+ // add a variable to the new lua configuration. For example, --> HOME_NET = 'any'
bool inline add_variable(std::string name, std::string v){ return data.add_variable(name, v); };
- friend std::ostream &operator<<( std::ostream& out, const Converter &cv) { return out << cv.data; }
// open a table that does not contain a name --> NOT 'name = {...}' ONLY {...})
bool open_table();
bool close_table();
// add a string option to the table --> table = { name = 'val', }
+ // corresponds to Parameter::PT_STRING, Parameter::PT_SELECT
bool add_option_to_table(std::string name, std::string val);
// add an int option to the table --> table = { name = val, }
+ // corresponds to Parameter::PT_INT, Parametere::PT_PORT, Parametere::PT_REAL, etc
bool add_option_to_table(std::string name, int val);
// add a bool option to the table --> table = { name = true|false, }
+ // corresponds to Parameter::PT_BOOL
bool add_option_to_table(std::string name, bool val);
// add an option with a list of variables --> table = { name = 'elem1 elem2 ...' }
+ // corresponds to Parameter::PT_MULTI
bool add_list_to_table(std::string list_name, std::string next_elem);
// add a commment to be printed in the table --> table = { -- comment \n ... }
void add_comment_to_table(std::string comment);
+ // comment will appear immediately below the lua configuration
void add_comment_to_file(std::string comment);
+ // add the entire stream as a comment in the new lua file
void add_comment_to_file(std::string comment, std::stringstream& stream);
// attach a comment about a deprecated option to a file or table
void add_deprecated_comment(std::string dep_var);
- // deprecated option ... use the new option instead
+ // add a comment with the formate 'deprecated option ... use the new option instead'
void add_deprecated_comment(std::string dep_var, std::string new_var);
+ // log an error in the new lua file
void log_error(std::string);
void print_line(std::stringstream& in);
void print_line(std::string& in);
private:
+ // the current parsing state.
ConversionState* state;
+ // the data which will be printed into the new lua file
ConversionData data;
+ // keeps track of the current tables
std::stack<Table*> open_tables;
-
-
};
-add_library(data
- conv_data.h
- conv_data.cc
- conv_var.h
- conv_var.cc
- conv_table.h
- conv_table.cc
- conv_option.h
- conv_option.cc
+add_library(converrsion_data
+ cv_data.h
+ cv_data.cc
+ cv_var.h
+ cv_var.cc
+ cv_table.h
+ cv_table.cc
+ cv_option.h
+ cv_option.cc
)
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_data.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_data.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "conv_data.h"
+#include "cv_data.h"
#include "snort2lua_util.h"
#if 0
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conversion_data.h author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_data.h author Josh Rosenbaum <jorosenba@cisco.com>
#ifndef CONV_DATA_H
#define CONV_DATA_H
#include <iostream>
#include <vector>
-#include "data/conv_table.h"
-#include "data/conv_var.h"
+#include "data/cv_table.h"
+#include "data/cv_var.h"
class ConversionData
{
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_option.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_option.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "data/conv_option.h"
+#include "data/cv_option.h"
Option::Option(std::string name, int val, int depth)
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_var.h author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_option.h author Josh Rosenbaum <jorosenba@cisco.com>
#ifndef CONV_OPTIONS_H
#define CONV_OPTIONS_H
-
#include <string>
#include <vector>
#include <iostream>
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_table.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_table.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "data/conv_table.h"
+#include "data/cv_table.h"
static inline Table* find_table(std::vector<Table*> vec, std::string name)
{
for (Variable* v : t.lists)
out << (*v) << ',' << std::endl;
- for (Table* t : t.tables)
- out << (*t) << ',' << std::endl;
+ for (Table* sub_t : t.tables)
+ out << (*sub_t) << ',' << std::endl;
// don't add a comma if the depth is zero
if(t.depth == 0)
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_var.h author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_table.h author Josh Rosenbaum <jorosenba@cisco.com>
#ifndef CONV_TABLE_H
#define CONV_TABLE_H
#include <vector>
#include <iostream>
-#include "conv_option.h"
-#include "conv_var.h"
+#include "cv_option.h"
+#include "cv_var.h"
class Table
{
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_var.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_var.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "data/conv_var.h"
+#include "data/cv_var.h"
+#if 0
static inline bool var_exists(std::vector<std::string> vec, std::string name)
{
for( auto str : vec)
return true;
}
+#endif
Variable::Variable(std::string name, int depth)
{
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// conv_var.h author Josh Rosenbaum <jorosenba@cisco.com>
+// cv_var.h author Josh Rosenbaum <jorosenba@cisco.com>
#include <string>
#include <vector>
#include <iostream>
#include "init_state.h"
#include "snort2lua_util.h"
-#include "keywords/keywords_api.h"
+#include "keyword_states/keywords_api.h"
InitState::InitState(Converter* cv) : ConversionState(cv) {}
if( keyword.front() == '#')
{
+ std::cout << "THIS SHOULD NEVER OCCUR" << std::endl;
keyword.erase(keyword.begin());
-// std::ostringstream oss;
-// oss << data_stream.rdbuf();
-// out << "--" << keyword << oss.str() << std::endl;
converter->add_comment_to_file(keyword, data_stream);
data_stream.setstate(std::basic_ios<char>::eofbit);
return true;
--- /dev/null
+
+add_library( keyword_states
+ kws_config.cc
+ kws_output.cc
+ kws_var.cc
+ kws_preprocessor.cc
+ kws_include.cc
+ keywords_api.h
+ keywords_api.cc
+)
+
+target_link_libraries( keyword_states
+ output_states
+ preprocessor_states
+)
\ No newline at end of file
*/
// keywords_api.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "keywords/keywords_api.h"
+#include "keyword_states/keywords_api.h"
extern const ConvertMap *portvar_map;
#include "conversion_state.h"
#include "converter.h"
#include "snort2lua_util.h"
-#include "output/output_api.h"
-
namespace {
#include "conversion_state.h"
#include "converter.h"
#include "snort2lua_util.h"
-#include "output/output_api.h"
+#include "output_states/output_api.h"
#include "conversion_state.h"
#include "converter.h"
#include "snort2lua_util.h"
-#include "preprocessor/preprocessor_api.h"
+#include "preprocessor_states/preprocessor_api.h"
namespace {
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// suppress.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
#include "conversion_state.h"
#include "converter.h"
#include "snort2lua_util.h"
+//#include "suppress_states/suppress_api.h"
namespace {
+++ /dev/null
-
-add_library( keywords
- config.cc
- output.cc
- var.cc
- preprocessor.cc
- include.cc
- keywords_api.h
- keywords_api.cc
-)
-
-target_link_libraries( keywords
- output
- preprocessor
-)
\ No newline at end of file
-add_library(output
+add_library(output_states
output_api.h
output_api.cc
)
\ No newline at end of file
*/
// output_api.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "output/output_api.h"
-
-
-extern const ConvertMap *portvar_map;
-extern const ConvertMap *ipvar_map;
-extern const ConvertMap *var_map;
-extern const ConvertMap *output_map;
+#include "output_states/output_api.h"
const std::vector<const ConvertMap*> output_api =
{
- portvar_map,
- ipvar_map,
- var_map,
- output_map,
-// nullptr,
+ nullptr,
};
+++ /dev/null
-
-add_library(preprocessor
- arpspoof.cc
- http_inspect.cc
- smtp.cc
- normalizers.cc
- sfportscan.cc
- preprocessor_api.h
- preprocessor_api.cc
-)
\ No newline at end of file
--- /dev/null
+
+add_library(preprocessor_states
+ pps_arpspoof.cc
+ pps_http_inspect.cc
+ pps_smtp.cc
+ pps_normalizers.cc
+ pps_sfportscan.cc
+ pps_ftp_telnet.cc
+ preprocessor_api.h
+ preprocessor_api.cc
+)
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+#include <iomanip>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class FtpTelnet : public ConversionState
+{
+public:
+ FtpTelnet(Converter* cv) : ConversionState(cv) {};
+ virtual ~FtpTelnet() {};
+ virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+bool FtpTelnet::convert(std::stringstream& data_stream)
+{
+#if 0
+# FTP / Telnet normalization and anomaly detection. For more information, see README.ftptelnet
+preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted
+preprocessor ftp_telnet_protocol: telnet \
+ ayt_attack_thresh 20 \
+ normalize ports { 23 } \
+ detect_anomalies
+preprocessor ftp_telnet_protocol: ftp server default \
+ def_max_param_len 100 \
+ ports { 21 2100 3535 } \
+ telnet_cmds yes \
+ ignore_telnet_erase_cmds yes \
+ ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
+ ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
+ ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
+ ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \
+ ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
+ ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
+ ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
+ ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
+ ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
+ ftp_cmds { XSEN XSHA1 XSHA256 } \
+ alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
+ alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
+ alt_max_param_len 256 { CWD RNTO } \
+ alt_max_param_len 400 { PORT } \
+ alt_max_param_len 512 { SIZE } \
+ chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
+ chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
+ chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
+ chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
+ chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
+ chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
+ chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \
+ chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
+ cmd_validity ALLO < int [ char R int ] > \
+ cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
+ cmd_validity MACB < string > \
+ cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
+ cmd_validity MODE < char ASBCZ > \
+ cmd_validity PORT < host_port > \
+ cmd_validity PROT < char CSEP > \
+ cmd_validity STRU < char FRPO [ string ] > \
+ cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
+preprocessor ftp_telnet_protocol: ftp client default \
+ max_resp_len 256 \
+ bounce yes \
+ ignore_telnet_erase_cmds yes \
+ telnet_cmds yes
+#endif
+
+ data_stream.setstate(std::basic_ios<char>::eofbit);
+ return true;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+ return new FtpTelnet(cv);
+}
+
+static const ConvertMap keyword_preprocessor =
+{
+ "ftp_telnet",
+ ctor,
+};
+
+const ConvertMap* preprocessor_map = &keyword_preprocessor;
bool PortScan::parse_ip_list(std::string list_name, std::stringstream& data_stream)
{
- bool retval;
std::string prev;
std::string elem;
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// keywords_api.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// preprocessor_api.cc author Josh Rosenbaum <jorosenba@cisco.com>
-#include "preprocessor/preprocessor_api.h"
+#include "preprocessor_states/preprocessor_api.h"
extern const ConvertMap *arpspoof_map;
std::getline(in, tmp);
util::ltrim(tmp);
orig_text += ' ' + tmp;
- util::rtrim(orig_text);
+ util::trim(orig_text);
if (orig_text.empty())
{
{
orig_text.erase(orig_text.begin());
cv.add_comment_to_file(orig_text);
+ orig_text.clear();
}
else if ( orig_text.back() == '\\')
{
bool Suppress::convert(std::stringstream& data_stream)
{
#if 0
- std::string keyword;
-
- if(data_stream >> keyword)
- {
- const ConvertMap* map = util::find_map(output_api, keyword);
- if (map)
- {
- converter->set_state(map->ctor(converter));
- return true;
- }
- }
-
- return false;
#endif
data_stream.setstate(std::basic_ios<char>::eofbit);
projects / thirdparty / snort3.git / commitdiff
