// * base+end is start of current layer
// * base+size-1 is last byte of packet (in) / buffer (out)
struct Buffer {
- uint8_t *base; /* start of data */
+ uint8_t* base; /* start of data */
int off; /* offset into data */
int end; /* end of data */
int size; /* size of allocation */
protected:
Converter* converter;
+ inline bool parse_string_option(std::string opt_name, std::stringstream& stream)
+ {
+ std::string val;
+
+ if(stream >> val)
+ {
+ if(val.back() == ',')
+ val.pop_back();
+
+ converter->add_option_to_table(opt_name, val);
+ return true;
+ }
+
+ converter->add_comment_to_table("snort.conf missing argument for: " + opt_name + " <int>");
+ return false;
+ }
+
inline bool parse_int_option(std::string opt_name, std::stringstream& stream)
{
int val;
return false;
}
- // parse adn add a curly bracketed list to the table
+ // parse and add a curly bracketed list to the table
inline bool parse_curly_bracket_list(std::string list_name, std::stringstream& stream)
{
std::string elem;
return false;
}
- // parse adn add a curly bracketed list to the table
+ // parse a curly bracketed bit and add it to the table
inline bool parse_bracketed_byte_list(std::string list_name, std::stringstream& stream)
{
std::string elem;
return retval;
}
+ // parse and add a curly bracket list '{...}' which is currently unsupported in Snort++
+ inline bool parse_bracketed_unsupported_list(std::string list_name, std::stringstream& stream)
+ {
+ std::string tmp = "";
+ std::string elem;
+
+ if(!(stream >> elem) || (elem != "{"))
+ return false;
+
+ while (stream >> elem && elem != "}")
+ tmp += " " + elem;
+
+ // remove the extra space at the beginig of the string
+ if(tmp.size() > 0)
+ tmp.erase(tmp.begin());
+
+ return converter->add_option_to_table("--" + list_name, tmp );
+ }
+
+ inline bool pen_table_add_option(std::string table_name, std::string opt_name, std::string val)
+ {
+ bool tmpval = converter->open_table(table_name);
+ tmpval = converter->add_option_to_table(opt_name, val) && tmpval;
+ converter->close_table();
+ return tmpval;
+ }
+
private:
return true;
}
+bool Converter::open_top_level_table(std::string table_name)
+{
+ Table *t = data.add_table(table_name);
+ open_tables.push(t);
+ return true;
+}
+
bool Converter::close_table()
{
open_tables.pop();
{
if(open_tables.size() == 0)
{
- log_error("Must open table before adding an option!!");
+ log_error("Must open table before adding an option!!: " +
+ option_name + " = " + val);
return false;
}
{
if(open_tables.size() == 0)
{
- log_error("Must open table before adding an option!!");
+
+ log_error("Must open table before adding an option!!: " +
+ option_name + " = " + std::to_string(val));
return false;
}
{
if(open_tables.size() == 0)
{
- log_error("Must open table before adding an option!!");
+ log_error("Must open table before adding an option!!: " +
+ option_name + " = " + std::to_string(val));
return false;
}
bool Converter::add_list_to_table(std::string list_name, std::string next_elem)
{
+ if(open_tables.size() == 0)
+ {
+ log_error("Must open table before adding an option!!: " +
+ list_name + " = " + next_elem);
+ return false;
+ }
+
Table *t = open_tables.top();
if(t)
}
else
{
- log_error("Must open table before adding a list!!");
+ log_error("Must open table before adding an list!!: " +
+ list_name + " += " + next_elem);
return false;
}
}
void Converter::add_deprecated_comment(std::string dep_var)
{
- std::string error_string = "option " + dep_var + " has been deprecated.";
+ std::string error_string = "option '" + dep_var + "' deprecated.";
if (open_tables.size() > 0)
add_comment_to_table(error_string);
void Converter::add_deprecated_comment(std::string dep_var, std::string new_var)
{
- std::string error_string = "option " + dep_var + " has been deprecated"
- + " ... using " + new_var + " instead";
+ std::string error_string = "option '" + dep_var + "' deprecated"
+ + " ... using '" + new_var + "' instead";
if (open_tables.size() > 0)
add_comment_to_table(error_string);
bool open_table();
// open a named tabled --> 'name = {...}')
bool open_table(std::string name);
+ // open a table at the topmost layer. i.e., the table will not be nested inside any other table.
+ bool open_top_level_table(std::string name);
// close the current table. go to previous table level
bool close_table();
#include "cv_data.h"
#include "snort2lua_util.h"
-
-#if 0
- std::vector<Variable> vars;
- std::vector<Table> tables;
- Table curr_table;
-#endif
-
+#include <iostream>
static inline Table* find_table(std::vector<Table*> vec, std::string name)
{
if(t)
return t;
- t = new Table(name, 0);
- tables.push_back(t);
- return t;
+
+ try
+ {
+ t = new Table(name, 0);
+ tables.push_back(t);
+ return t;
+ }
+ catch (std::bad_alloc& ba)
+ {
+ std::cout << "Failed to allocate memory for a new Table!!" << std::endl;
+ exit (EXIT_FAILURE);
+ return nullptr;
+ }
}
void ConversionData::add_comment(std::string str)
else if(var.count < var.max_line_length || var.strs.size() == 1)
{
std::string tmp_str = "";
+ length = whitespace.size();
for (auto s : var.strs)
{
if ( 0 < length && length + s.size() > var.max_line_length )
tmp_str += "\n" + whitespace + " ";
- length += s.size();
+ length += s.size() ;
tmp_str += s + ' ';
}
util::trim(tmp_str);
for (auto s : var.strs)
{
- if ( 0 < length && length + s.size() > var.max_line_length )
+ if ( length + s.size() > var.max_line_length )
{
util::rtrim(tmp_str);
tmp_str += "\n" + whitespace + " ";
length = 4 + whitespace.size();
}
- length += s.size();
+ length += s.size() + 1;
tmp_str += s + " ";
}
std::vector<std::string> vars;
std::vector<std::string> strs;
int count;
- const int max_line_length = 70; // leave room for additional text
+ const int max_line_length = 74; // leave room for additional text
int depth;
};
kws_var.cc
kws_preprocessor.cc
kws_include.cc
+ kws_suppress.cc
keywords_api.h
keywords_api.cc
)
extern const ConvertMap *config_map;
extern const ConvertMap *preprocessor_map;
extern const ConvertMap *include_map;
+extern const ConvertMap *supress_map;
config_map,
preprocessor_map,
include_map,
+ supress_map
// nullptr,
};
return false;
#endif
- data_stream.setstate(std::basic_ios<char>::eofbit);
- return true;
+ return false;
}
/**************************
return false;
#endif
- data_stream.setstate(std::basic_ios<char>::eofbit);
- return true;
+ return false;
}
/**************************
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// output.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// kws_output.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
bool Suppress::convert(std::stringstream& data_stream)
{
-#if 0
+ bool retval = true;
std::string keyword;
- if(data >> keyword)
+ converter->open_table("suppress");
+ converter->open_table();
+
+ while(data_stream >> keyword)
{
- const ConvertMap* map = util::find_map(output_api, keyword);
- if (map)
+ bool tmpval = true;
+
+ if(keyword.back() == ',')
+ keyword.pop_back();
+
+ if(keyword.empty())
+ continue;
+
+ if (!keyword.compare("track"))
+ tmpval = parse_string_option("track", data_stream);
+
+ else if (!keyword.compare("ip"))
+ tmpval = parse_string_option("ip", data_stream);
+
+ else if(!keyword.compare("gen_id"))
{
- converter->set_state(map->ctor(converter));
- return true;
+ converter->add_deprecated_comment("gen_id", "gid");
+ tmpval = parse_int_option("gid", data_stream);
}
- }
- return false;
-#endif
+ else if (!keyword.compare("sig_id"))
+ {
+ converter->add_deprecated_comment("sig_id", "sid");
+ tmpval = parse_int_option("sid", data_stream);
+ }
+
+ if (retval)
+ retval = tmpval;
+ }
- data_stream.setstate(std::basic_ios<char>::eofbit);
- return true;
+ return retval;
}
/**************************
return new Suppress(cv);
}
-static const ConvertMap keyword_preprocessor =
+static const ConvertMap keyword_supress =
{
"suppress",
ctor,
};
-const ConvertMap* preprocessor_map = &keyword_preprocessor;
+const ConvertMap* supress_map = &keyword_supress;
pps_smtp.cc
pps_normalizers.cc
pps_sfportscan.cc
+ pps_stream_global.cc
+ pps_stream_tcp.cc
+ pps_stream_udp.cc
pps_ftp_telnet.cc
pps_ftp_telnet_protocol.cc
pps_bo.cc
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// arp_spoof.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_arp_spoof.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// http_inspect.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_http_inspect.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
retval = parse_int_option("memcap", data_stream) && retval;
else if(!keyword.compare("disabled"))
- converter->add_comment_to_table("'disabled' is deprecated");
+ converter->add_deprecated_comment("disabled");
else if(!keyword.compare("b64_decode_depth"))
retval = add_decode_option("b64_decode_depth", data_stream) && retval;
else if (!keyword.compare("no_alerts"))
converter->add_deprecated_comment("no_alerts");
+ else if (!keyword.compare("decompress_swf"))
+ tmpval = parse_bracketed_unsupported_list("decompress_swf", data_stream);
+
+ else if (!keyword.compare("decompress_pdf"))
+ tmpval = parse_bracketed_unsupported_list("decompress_pdf", data_stream);
+
else if (!keyword.compare("http_methods"))
tmpval = parse_curly_bracket_list("http_methods", data_stream);
tmpval = parse_int_option("server_flow_depth", data_stream);
}
+ else if (!keyword.compare("ports"))
+ {
+ converter->add_deprecated_comment("ports", "bindings");
+ converter->add_comment_to_table("check bindings table for port information");
+ tmpval = parse_bracketed_unsupported_list("ports", data_stream);
+ }
+
else if (!keyword.compare("small_chunk_length"))
{
std::string bracket;
}
}
- else if (!keyword.compare("ports"))
- {
- converter->add_deprecated_comment("ports", "bindings");
- converter->add_comment_to_table("check bindings table for port information");
- // add commented list for now
- std::string tmp = "";
- while (data_stream >> keyword && keyword != "}")
- tmp += " " + keyword;
- tmpval = converter->add_option_to_table("--ports", tmp + "}");
- }
-
else
tmpval = false;
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
-// normalizers.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_normalizers.cc author Josh Rosenbaum <jorosenba@cisco.com>
#include <sstream>
#include <vector>
while(data_stream >> keyword)
{
- if(!keyword.compare("proto"))
- {
- converter->add_deprecated_comment("proto", "protos");
- // defined in ConversionState vvvv
- retval = parse_curly_bracket_list("protos", data_stream) && retval;
- }
+ bool tmpval = true;
- if(!keyword.compare("scan_type"))
- {
- converter->add_deprecated_comment("scan_type", "scan_types");
- // defined in ConversionState vvvv
- retval = parse_curly_bracket_list("scan_types", data_stream) && retval;
- }
- else if(!keyword.compare("sense_level"))
- retval = parse_option("sense_level", data_stream) && retval;
+ if(!keyword.compare("sense_level"))
+ tmpval = parse_option("sense_level", data_stream);
else if(!keyword.compare("watch_ip"))
- retval = parse_ip_list("watch_ip", data_stream) && retval;
+ tmpval = parse_ip_list("watch_ip", data_stream);
else if(!keyword.compare("ignore_scanned"))
- retval = parse_ip_list("ignore_scanners", data_stream) && retval;
+ tmpval = parse_ip_list("ignore_scanners", data_stream);
else if(!keyword.compare("ignore_scanners"))
- retval = parse_ip_list("ignore_scanned", data_stream) && retval;
+ tmpval = parse_ip_list("ignore_scanned", data_stream);
else if(!keyword.compare("include_midstream"))
- retval = converter->add_option_to_table("include_midstream", true) && retval;
+ tmpval = converter->add_option_to_table("include_midstream", true);
else if(!keyword.compare("disabled"))
converter->add_deprecated_comment("disabled");
converter->add_deprecated_comment("logfile");
else if(!keyword.compare("memcap"))
- retval = add_portscan_global_option("memcap", data_stream) && retval;
+ tmpval = add_portscan_global_option("memcap", data_stream);
+
+ else if(!keyword.compare("proto"))
+ {
+ converter->add_deprecated_comment("proto", "protos");
+ retval = parse_curly_bracket_list("protos", data_stream) && retval;
+ }
+
+ else if(!keyword.compare("scan_type"))
+ {
+ converter->add_deprecated_comment("scan_type", "scan_types");
+ tmpval = parse_curly_bracket_list("scan_types", data_stream) && retval;
+ }
else
- retval = false;
+ tmpval = false;
+
+ tmpval = retval && tmpval;
}
- converter->close_table();
- return retval;
+ converter->close_table(); // unecessary since the state will be reset
+ return retval;
}
--- /dev/null
+
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// pps_stream_global.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class StreamGlobal : public ConversionState
+{
+public:
+ StreamGlobal(Converter* cv) : ConversionState(cv) {};
+ virtual ~StreamGlobal() {};
+ virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+bool StreamGlobal::convert(std::stringstream& data_stream)
+{
+ std::string keyword;
+ bool retval = true;
+
+ converter->open_table("stream");
+
+ while(data_stream >> keyword)
+ {
+ bool tmpval = true;
+
+ if(keyword.back() == ',')
+ keyword.pop_back();
+
+ if(keyword.empty())
+ continue;
+
+
+
+ if(!keyword.compare("flush_on_alert"))
+ converter->add_deprecated_comment("flush_on_alert");
+
+ else if(!keyword.compare("disabled"))
+ converter->add_deprecated_comment("disabled");
+
+ else if(!keyword.compare("track_tcp"))
+ {
+ converter->add_deprecated_comment("track_tcp");
+ if(!(data_stream >> keyword)) // eat the yes/no option
+ tmpval = false;
+ }
+
+ else if(!keyword.compare("track_udp"))
+ {
+ converter->add_deprecated_comment("track_udp");
+ if(!(data_stream >> keyword)) // eat the yes/no option
+ tmpval = false;
+ }
+
+ else if(!keyword.compare("track_icmp"))
+ {
+ converter->add_deprecated_comment("track_icmp");
+ if(!(data_stream >> keyword)) // eat the yes/no option
+ tmpval = false;
+ }
+
+ else if(!keyword.compare("prune_log_max"))
+ {
+ converter->add_deprecated_comment("prune_log_max", "histogram");
+ if(!(data_stream >> keyword)) // eat the number of bytes
+ tmpval = false;
+ }
+
+ else if(!keyword.compare("max_tcp"))
+ {
+ converter->open_table("tcp_cache");
+ tmpval = parse_int_option("max_sessions", data_stream);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("memcap"))
+ {
+ converter->open_table("tcp_cache");
+ tmpval = parse_int_option("memcap", data_stream);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("max_udp"))
+ {
+ converter->open_table("udp_cache");
+ tmpval = parse_int_option("max_sessions", data_stream);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("max_icmp"))
+ {
+ converter->open_table("icmp_cache");
+ tmpval = parse_int_option("max_sessions", data_stream);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("show_rebuilt_packets"))
+ {
+ converter->open_top_level_table("stream_tcp");
+ converter->add_option_to_table("show_rebuilt_packets", true);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("min_response_seconds"))
+ {
+ converter->open_top_level_table("active");
+ tmpval = parse_int_option("min_interval", data_stream);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("max_active_responses"))
+ {
+ converter->open_top_level_table("active");
+ tmpval = parse_int_option("max_responses", data_stream);
+ converter->close_table();
+ }
+
+
+
+ else
+ tmpval = false;
+
+ if (retval)
+ retval = tmpval;
+ }
+
+ return retval;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+ return new StreamGlobal(cv);
+}
+
+static const ConvertMap preprocessor_stream_global =
+{
+ "stream5_global",
+ ctor,
+};
+
+const ConvertMap* stream_global_map = &preprocessor_stream_global;
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class StreamTcp : public ConversionState
+{
+public:
+ StreamTcp(Converter* cv) : ConversionState(cv) {};
+ virtual ~StreamTcp() {};
+ virtual bool convert(std::stringstream& data_stream);
+
+private:
+ bool parse_small_segments(std::stringstream& data_stream);
+ bool parse_ports(std::stringstream& data_stream);
+};
+
+} // namespace
+
+bool StreamTcp::parse_small_segments(std::stringstream& data_stream)
+{
+ std::string s_val;
+ int i_val;
+
+ if (!(data_stream >> i_val))
+ return false;
+
+ converter->open_table("small_segments");
+ converter->add_option_to_table("count", i_val);
+ converter->close_table();
+
+ if (!(data_stream >> s_val))
+ return false;
+
+ if (!s_val.compare(",") || s_val.compare("bytes"))
+ return false;
+
+ if(!(data_stream >> i_val))
+ return false;
+
+ converter->open_table("small_segments");
+ converter->add_option_to_table("maximum_size", i_val);
+ converter->close_table();
+
+
+ if (!(data_stream >> s_val))
+ return false;
+
+ // if the next string is either a comma, end of command
+ if (!s_val.compare(","))
+ return true;
+
+ // otherwise the next argument MUST be ignore_ports
+ if (s_val.compare("ignore_ports"))
+ return false;
+
+
+ converter->open_table("small_segments");
+
+ while(data_stream >> s_val && (s_val.back() != ','))
+ converter->add_list_to_table("ignore_ports", s_val);
+
+ if (!s_val.empty())
+ {
+ s_val.pop_back();
+ converter->add_list_to_table("ignore_ports", s_val);
+ }
+
+ converter->close_table();
+ return true;
+}
+
+
+bool StreamTcp::parse_ports(std::stringstream& data_stream)
+{
+ int i_val;
+ std::string s_val;
+ std::string opt_name;
+ bool retval = true;
+
+ if(!(data_stream >> opt_name))
+ return false;
+
+ if( !opt_name.compare("client"))
+ {
+ converter->add_deprecated_comment("port client", "client_ports");
+ opt_name = "client_ports";
+ }
+ else if( !opt_name.compare("server"))
+ {
+ converter->add_deprecated_comment("port server", "server_ports");
+ opt_name = "server_ports";
+ }
+ else if( !opt_name.compare("both"))
+ {
+ converter->add_deprecated_comment("port both", "both_ports");
+ opt_name = "both_ports";
+ }
+
+ else
+ return false;
+
+ while(data_stream >> s_val && (s_val.back() != ','))
+ retval = converter->add_list_to_table(opt_name, s_val) && retval;
+
+ if (!s_val.empty())
+ {
+ s_val.pop_back();
+ converter->add_list_to_table(opt_name, s_val);
+ }
+
+ return retval;
+}
+
+
+bool StreamTcp::convert(std::stringstream& data_stream)
+{
+ std::string keyword;
+ bool retval = true;
+
+ converter->open_table("stream_tcp");
+
+ while(data_stream >> keyword)
+ {
+ bool tmpval = true;
+
+ if(keyword.back() == ',')
+ keyword.pop_back();
+
+ if(keyword.empty())
+ continue;
+
+ if(!keyword.compare("policy"))
+ tmpval = parse_string_option("policy", data_stream);
+
+ else if(!keyword.compare("overlap_limit"))
+ tmpval = parse_int_option("overlap_limit", data_stream);
+
+ else if(!keyword.compare("max_window"))
+ tmpval = parse_int_option("max_window", data_stream);
+
+ else if(!keyword.compare("require_3whs"))
+ tmpval = parse_int_option("require_3whs", data_stream);
+
+ else if(!keyword.compare("small_segments"))
+ tmpval = parse_small_segments(data_stream);
+
+ else if(!keyword.compare("ignore_any_rules"))
+ tmpval = converter->add_option_to_table("ignore_any_rules", true);
+
+ else if(!keyword.compare("ports"))
+ tmpval = parse_ports(data_stream);
+
+ else if(!keyword.compare("detect_anomalies"))
+ converter->add_deprecated_comment("detect_anomalies");
+
+ else if(!keyword.compare("dont_store_large_packets"))
+ converter->add_deprecated_comment("dont_store_large_packets");
+
+ else if(!keyword.compare("check_session_hijacking"))
+ converter->add_deprecated_comment("check_session_hijacking");
+
+ else if(!keyword.compare("dont_reassemble_async"))
+ {
+ converter->add_deprecated_comment("dont_reassemble_async", "reassemble_async");
+ tmpval = converter->add_option_to_table("reassemble_async", false);
+ }
+
+ else if(!keyword.compare("use_static_footprint_sizes"))
+ {
+ converter->add_deprecated_comment("footprint", "use_static_footprint_sizes");
+ tmpval = converter->add_option_to_table("footprint", true);
+ }
+
+ else if(!keyword.compare("timeout"))
+ {
+ converter->add_deprecated_comment("timeout", "session_timeout");
+ tmpval = parse_int_option("session_timeout", data_stream);
+ }
+
+ else if(!keyword.compare("max_queued_segs"))
+ {
+ converter->add_deprecated_comment("max_queued_segs", "queue_limit.max_segments");
+ converter->open_table("queue_limit");
+ tmpval = parse_int_option("max_segments", data_stream);
+ converter->close_table();
+ }
+
+ else if(!keyword.compare("max_queued_bytes"))
+ {
+ converter->add_deprecated_comment("max_queued_bytes", "queue_limit.max_bytes");
+ converter->open_table("queue_limit");
+ tmpval = parse_int_option("max_bytes", data_stream);
+ converter->close_table();
+ }
+
+ else
+ tmpval = false;
+
+ if (retval)
+ retval = tmpval;
+ }
+
+ return retval;
+}
+#if 0
+
+# bind_to <ip_addr> - IP address for this policy. The default is set
+
+ ports <client|server|both> [all|space separated port list]
+]
+#endif
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+ return new StreamTcp(cv);
+}
+
+static const ConvertMap preprocessor_stream_tcp =
+{
+ "stream5_tcp",
+ ctor,
+};
+
+const ConvertMap* stream_tcp_map = &preprocessor_stream_tcp;
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+// pps_stream_udp.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class StreamUdp : public ConversionState
+{
+public:
+ StreamUdp(Converter* cv) : ConversionState(cv) {};
+ virtual ~StreamUdp() {};
+ virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+bool StreamUdp::convert(std::stringstream& data_stream)
+{
+
+ bool retval = true;
+ std::string keyword;
+
+ converter->open_table("stream_udp");
+
+ while(data_stream >> keyword)
+ {
+ bool tmpval = true;
+
+ if(keyword.back() == ',')
+ keyword.pop_back();
+
+ if(keyword.empty())
+ continue;
+
+ if(!keyword.compare("ignore_any_rules"))
+ tmpval = converter->add_option_to_table("ignore_any_rules", true);
+
+ else if(!keyword.compare("timeout"))
+ {
+ converter->add_deprecated_comment("timeout", "session_timeout");
+ tmpval = parse_int_option("session_timeout", data_stream);
+ }
+
+ else
+ tmpval = false;
+
+ if (retval)
+ retval = tmpval;
+ }
+
+ return retval;
+}
+
+/**************************
+ ******* A P I ***********
+ **************************/
+
+static ConversionState* ctor(Converter* cv)
+{
+ return new StreamUdp(cv);
+}
+
+static const ConvertMap preprocessor_stream_udp =
+{
+ "stream5_udp",
+ ctor,
+};
+
+const ConvertMap* stream_udp_map = &preprocessor_stream_udp;
extern const ConvertMap *normalizer_tcp_map;
extern const ConvertMap *sfportscan_map;
extern const ConvertMap *smtp_map;
+extern const ConvertMap *stream_global_map;
+extern const ConvertMap *stream_tcp_map;
+extern const ConvertMap *stream_udp_map;
const std::vector<const ConvertMap*> preprocessor_api =
{
normalizer_tcp_map,
sfportscan_map,
smtp_map,
+ stream_global_map,
+ stream_tcp_map,
+ stream_udp_map,
// nullptr,
};
projects / thirdparty / snort3.git / commitdiff
