pending - build 134
+-- snort2lua changed to add bindings for default ports if not explicitly
+ configured
-- added md5, sha256, and sha512 rule options based on Snort 2.X
protected_content
bool IgnorePorts::convert(std::istringstream& data_stream)
{
- Binder bind(table_api);
bool retval = true;
std::string keyword;
std::string port;
return false;
}
+ // Only add to the binder once we have validated the configuration.
+ Binder bind(table_api);
bind.set_when_proto(keyword);
while (data_stream >> port)
{
data_api.failed_conversion(data_stream, "can't convert " + port);
retval = false;
+ bind.print_binding(false); // don't print the binding if an error occured
}
catch(std::out_of_range)
{
data_api.failed_conversion(data_stream, "Port" + port + " must be <= 65535");
retval = false;
+ bind.print_binding(false); // don't print the binding if an error occured
}
}
class TableApi;
-// If the user never adds add_to_configuration,
-// the destructor will call the method
+// The Binders destrutor will add the Objects configuration to the
+// table_api.
class Binder
{
public:
Binder(TableApi&);
~Binder();
+ // By calling add_to_configuration(), you are adding this Binder Object
+ // "as is" to the table_api. Additionally, after calling
+ // add_to_configuration(), the destructor will NOT add the object to the
+ // table_api unless 'print_binding(true)' is called.
void add_to_configuration();
void print_binding(bool should_print)
{ printed = !should_print; }
#include "conversion_state.h"
#include "helpers/s2l_util.h"
+#include "helpers/parse_cmd_line.h"
namespace keywords
if (!util::file_exists(file))
{
- table_api.open_table("hosts");
- table_api.add_comment("unable to open the attribute file: " + file);
- table_api.close_table();
- return false;
+ std::string full_file = parser::get_conf_dir() + file;
+
+ if (!util::file_exists(full_file))
+ {
+ table_api.open_table("hosts");
+ table_api.add_comment("unable to open the attribute file: " + file);
+ table_api.close_table();
+
+ std::string error_string = "Can't find file " + file + ". "
+ " Searched locations: " + file + ", " + full_file;
+ data_api.failed_conversion(data_stream, error_string);
+ return false;
+ }
+ file = full_file;
}
table_api.open_table("hosts");
{
std::string keyword;
bool retval = true;
+ bool ports_set = false;
Binder bind(table_api);
bind.set_use_type("ftp_server");
bind.set_when_proto("tcp");
{
table_api.add_diff_option_comment("ports", "bindings");
table_api.add_comment("check bindings table for port information");
- // add commented list for now
- std::string tmp = "";
+
if ((data_stream >> keyword) && !keyword.compare("{"))
{
while (data_stream >> keyword && keyword.compare("}"))
+ {
bind.add_when_port(keyword);
+ ports_set = true;
+ }
}
else
{
table_api.close_table();
}
+ if (!ports_set)
+ bind.add_when_port("21");
+
return retval;
}
{
if(!keyword.compare("default"))
{
+ bind.add_when_service("ftp");
table_api.open_table("ftp_client");
}
else
bool Telnet::convert(std::istringstream& data_stream)
{
std::string keyword;
- int i_val;
+ bool ports_set = false;
bool retval = true;
Binder bind(table_api);
while(data_stream >> keyword)
{
bool tmpval = true;
- if(!keyword.compare("ayt_attack_thresh"))
+
+ if(!keyword.compare("normalize"))
+ tmpval = table_api.add_option("normalize", true);
+
+ else if(!keyword.compare("detect_anomalies"))
+ table_api.add_deleted_comment("detect_anomalies");
+
+ else if(!keyword.compare("ayt_attack_thresh"))
{
+ int i_val;
+
if(data_stream >> i_val)
tmpval = table_api.add_option("ayt_attack_thresh", i_val);
else
tmpval = false;
}
-
- else if(!keyword.compare("normalize"))
- tmpval = table_api.add_option("normalize", true);
-
else if(!keyword.compare("ports"))
{
table_api.add_diff_option_comment("ports", "bindings");
if ((data_stream >> keyword) && !keyword.compare("{"))
{
while (data_stream >> keyword && keyword != "}")
+ {
+ ports_set = true;
bind.add_when_port(keyword);
+ }
}
else
{
- tmpval = false;
+ data_api.failed_conversion(data_stream, "ports - invalid port list");
+ retval = false;
}
}
-
- else if(!keyword.compare("detect_anomalies"))
- table_api.add_deleted_comment("detect_anomalies");
-
else
+ {
tmpval = false;
+ }
- retval = tmpval && retval;
+
+ if (!tmpval)
+ {
+ data_api.failed_conversion(data_stream, keyword);
+ retval = false;
+ }
}
+ // adding the defualt port.
+ if (!ports_set)
+ bind.add_when_port("23");
+
return retval;
}
{
std::string keyword;
bool retval = true;
+ bool ports_set = false;
Binder bind(table_api);
bind.set_when_proto("tcp");
if ((data_stream >> keyword) && !keyword.compare("{"))
{
while (data_stream >> keyword && keyword.compare("}"))
+ {
+ ports_set = true;
bind.add_when_port(keyword);
+ }
}
else
{
}
}
+ if (!ports_set)
+ bind.add_when_port("80");
+
return retval;
}
class RpcDecode : public ConversionState
{
public:
- RpcDecode(Converter& c) : ConversionState(c) {};
- virtual ~RpcDecode() {};
+ RpcDecode(Converter& c);
+ virtual ~RpcDecode();
virtual bool convert(std::istringstream& data_stream);
+
+private:
+ bool converted_args;
};
} // namespace
-bool RpcDecode::convert(std::istringstream& data_stream)
+RpcDecode::RpcDecode(Converter& c) : ConversionState(c)
{
+ converted_args = false;
+}
+RpcDecode::~RpcDecode()
+{
+ if (!converted_args)
+ {
+ Binder bind(table_api);
+ bind.set_when_proto("tcp");
+ bind.add_when_port("111");
+ bind.add_when_port("32271");
+ bind.set_use_type("rpc_decode");
+
+ table_api.open_table("rpc_decode");
+ table_api.close_table();
+ }
+}
+
+bool RpcDecode::convert(std::istringstream& data_stream)
+{
bool retval = true;
+ bool ports_set = false;
std::string keyword;
// adding the binder entry
Binder bind(table_api);
bind.set_when_proto("tcp");
bind.set_use_type("rpc_decode");
- std::string port_list = std::string();
table_api.open_table("rpc_decode");
while(data_stream >> keyword)
{
- bool tmpval = true;
-
if(!keyword.compare("no_alert_multiple_requests"))
table_api.add_deleted_comment("no_alert_multiple_requests");
table_api.add_deleted_comment("no_alert_incomplete");
else if (isdigit(keyword[0]))
+ {
bind.add_when_port(keyword);
-
+ ports_set = true;
+ }
else
- tmpval = false;
-
- if (!tmpval)
{
data_api.failed_conversion(data_stream, keyword);
retval = false;
+
}
}
+ if (!ports_set)
+ {
+ bind.add_when_port("111");
+ bind.add_when_port("32271");
+ }
+
+ converted_args = true;
return retval;
}
**************************/
static ConversionState* ctor(Converter& c)
-{
- return new RpcDecode(c);
-}
+{ return new RpcDecode(c); }
static const ConvertMap preprocessor_rpc_decode =
{
Binder* bind_client;
Binder* bind_server;
Binder* bind_any;
+ Binder* bind_default;
bool binding_chosen;
+ bool ports_set;
+ bool protos_set;
std::vector<std::string> client_protocols;
std::vector<std::string> server_protocols;
std::vector<std::string> any_protocols;
bind_client = nullptr;
bind_server = nullptr;
bind_any = nullptr;
+ bind_default = nullptr;
binding_chosen = false;
+ ports_set = false;
+ protos_set = false;
}
void StreamTcp::add_to_bindings(binder_func func, std::string param)
bind_client->set_when_role("client");
}
bind->print_binding(true);
+ bind_default = bind;
// do nothing if no ports provided
if (arg_stream >> port )
{
- // for all, don't set the ports variable
+ ports_set = true;
+
+ // don't set the ports variable for "all"
if (!port.compare("all"))
void(0);
bind_client->set_when_role("client");
}
bind->print_binding(true);
+ bind_default = bind;
// do nothing if no ports provided
if (arg_stream >> protocol )
{
- // for all, don't set the ports variable
+ protos_set = true;
+
+ // for all, don't set the protos variable
if (!protocol.compare("all"))
void(0);
bind_client = &client;
bind_server = &server;
bind_any = &any;
+ bind_default = bind_client;
add_to_bindings(&Binder::set_when_proto, "tcp");
add_to_bindings(&Binder::set_use_type, "stream_tcp");
}
}
+ if (!ports_set)
+ {
+ const std::vector<std::string> default_ports = {"21", "23", "25", "42",
+ "53", "80", "110", "111", "135", "136", "137", "139", "143", "445",
+ "513", "514", "1433", "1521", "2401", "3306"};
+
+ for (const std::string& s : default_ports)
+ bind_default->add_when_port(s);
+ }
+
+ if (!protos_set)
+ {
+ const std::vector<std::string> default_protos = {"ftp", "telnet",
+ "smtp", "nameserver", "dns", "http", "pop3", "sunrpc", "dcerpc",
+ "netbios-ssn", "imap", "login", "shell", "mssql", "oracle", "cvs",
+ "mysql"};
+
+ for (const std::string& s : default_protos)
+ {
+ Binder b = *bind_default;
+ b.set_when_service(s);
+ }
+ bind_default->print_binding(false); // Binder was added in the for loop
+ }
if (!client_protocols.empty())
{
Binder b = client;
b.set_when_service(s);
- b.add_to_configuration();
}
- client.print_binding(false); // we just printed
+ client.print_binding(false); // Binder was added in the for loop
}
if (!server_protocols.empty())
{
Binder b = server;
b.set_when_service(s);
- b.add_to_configuration();
}
- server.print_binding(false); // we just printed
+ server.print_binding(false); // Binder was added in the for loop
}
if (!any_protocols.empty())
{
Binder b = any;
b.set_when_service(s);
- b.add_to_configuration();
}
- any.print_binding(false); // we just printed
+ any.print_binding(false); // Binder was added in the for loop
}
table_api.close_table(); // "tcp_stream"
projects / thirdparty / snort3.git / commitdiff
