Snort2Lua: add pkt_data sticky buffer for pcre and content if no other buffer is...

diff --git a/tools/snort2lua/rule_states/rule_content.cc b/tools/snort2lua/rule_states/rule_content.cc
index 64a129fca9f8e598a0b60638c367526e65cd3194..40fba1da69d340ec1659eae80a952c653772d5b6 100644 (file)
--- a/tools/snort2lua/rule_states/rule_content.cc
+++ b/tools/snort2lua/rule_states/rule_content.cc
@@ -36,17 +36,32 @@ template<const std::string *option_name>
 class Content : public ConversionState
 {
 public:
-    Content(Converter& c) : ConversionState(c) {};
+    Content(Converter& c) : ConversionState(c), sticky_buffer_set(false) {};
     virtual ~Content() {};
     virtual bool convert(std::istringstream& data);
 
 private:
+    bool sticky_buffer_set;
     bool parse_options(std::istringstream&, std::string, std::string);
+    void add_sticky_buffer(std::istringstream&, std::string buffer);
 
 };
 
 } // namespace
 
+template<const std::string *option_name>
+void Content<option_name>::add_sticky_buffer(std::istringstream& data_stream, std::string buffer)
+{
+    if (sticky_buffer_set)
+    {
+        rule_api.bad_rule(data_stream, "< " + buffer + "> is the second sticky "
+            "buffers set for this 'content' keyword!!");
+    }
+
+    rule_api.add_rule_option_before_selected(buffer);
+    sticky_buffer_set = true;
+}
+
 template<const std::string *option_name>
 bool Content<option_name>::parse_options(
     std::istringstream& data_stream,
@@ -69,44 +84,44 @@ bool Content<option_name>::parse_options(
     else if (!keyword.compare("nocase"))
         rule_api.add_suboption("nocase");
 
+    else if (!keyword.compare("hash"))   // PROTECTED CONTENT
+        rule_api.add_suboption("hash", val);
+
+    else if (!keyword.compare("length"))  // PROTECTED CONTENT
+        rule_api.add_suboption("length", val);
+
     else if (!keyword.compare("rawbytes"))
-        rule_api.add_rule_option_before_selected("pkt_data");
+        add_sticky_buffer(data_stream, "pkt_data");
 
     else if (!keyword.compare("http_client_body"))
-        rule_api.add_rule_option_before_selected("http_client_body");
+        add_sticky_buffer(data_stream, "http_client_body");
 
     else if (!keyword.compare("http_cookie"))
-        rule_api.add_rule_option_before_selected("http_cookie");
+        add_sticky_buffer(data_stream, "http_cookie");
 
     else if (!keyword.compare("http_raw_cookie"))
-        rule_api.add_rule_option_before_selected("http_raw_cookie");
+        add_sticky_buffer(data_stream, "http_raw_cookie");
 
     else if (!keyword.compare("http_header"))
-        rule_api.add_rule_option_before_selected("http_header");
+        add_sticky_buffer(data_stream, "http_header");
 
     else if (!keyword.compare("http_raw_header"))
-        rule_api.add_rule_option_before_selected("http_raw_header");
+        add_sticky_buffer(data_stream, "http_raw_header");
 
     else if (!keyword.compare("http_method"))
-        rule_api.add_rule_option_before_selected("http_method");
+        add_sticky_buffer(data_stream, "http_method");
 
     else if (!keyword.compare("http_uri"))
-        rule_api.add_rule_option_before_selected("http_uri");
+        add_sticky_buffer(data_stream, "http_uri");
 
     else if (!keyword.compare("http_raw_uri"))
-        rule_api.add_rule_option_before_selected("http_raw_uri");
+        add_sticky_buffer(data_stream, "http_raw_uri");
 
     else if (!keyword.compare("http_stat_code"))
-        rule_api.add_rule_option_before_selected("http_stat_code");
+        add_sticky_buffer(data_stream, "http_stat_code");
 
     else if (!keyword.compare("http_stat_msg"))
-        rule_api.add_rule_option_before_selected("http_stat_msg");
-
-    else if (!keyword.compare("hash"))   // PROTECTED CONTENT
-        rule_api.add_suboption("hash", val);
-
-    else if (!keyword.compare("length"))  // PROTECTED CONTENT
-        rule_api.add_suboption("length", val);
+        add_sticky_buffer(data_stream, "http_stat_msg");
 
     else if (!keyword.compare("fast_pattern"))
     {
@@ -217,6 +232,10 @@ bool Content<option_name>::convert(std::istringstream& data_stream)
 
         if (!parse_options(data_stream, keyword, val))
         {
+
+            if (!sticky_buffer_set)
+                add_sticky_buffer(data_stream, "pkt_data");
+
             // since this option is not an content modifier,
             // lets coninue parsing the rest of the rule.
             rule_api.unselect_option();
@@ -233,6 +252,9 @@ bool Content<option_name>::convert(std::istringstream& data_stream)
         subopts.str(val);
     };
 
+    if (!sticky_buffer_set)
+        add_sticky_buffer(data_stream, "pkt_data");
+
     // can only get here if we finish parsing this rule
     return true;
 }

diff --git a/tools/snort2lua/rule_states/rule_pcre.cc b/tools/snort2lua/rule_states/rule_pcre.cc
index ffc685b62e82e9bcc7417ec5e078b2e8ff4db034..d446618c6e545d46ddb90a5848c7c447218ed5a2 100644 (file)
--- a/tools/snort2lua/rule_states/rule_pcre.cc
+++ b/tools/snort2lua/rule_states/rule_pcre.cc
@@ -144,6 +144,9 @@ bool Pcre::convert(std::istringstream& data_stream)
         }
     }
 
+    if (!sticky_buffer_set)
+        rule_api.add_rule_option("pkt_data");
+
     rule_api.add_rule_option("pcre", pattern + new_opts);
     return set_next_rule_state(data_stream);
 }

diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in
index 29b603b4094bf4680683b91342032a9b5a907e52..d09167e05ed302f3759ecf0e71824b75220a0e31 100644 (file)
--- a/tools/snort2lua/tests/snort.conf.in
+++ b/tools/snort2lua/tests/snort.conf.in
@@ -1126,8 +1126,9 @@ alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"BROWSER-IE Microsoft Inter
 # rawbytes
 alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443,8200] (msg:"APP-DETECT GoToMyPC local service running"; \
     content:"jedi request"; nocase; offset:4; depth:20; rawbytes; \
-    content:"jedi request2"; nocase; distance:150; http_cookie; http_header; \
+    content:"jedi request2"; nocase; distance:150; http_header; \
     content:"jedi request3"; within:150; http_client_body; \
+    content:"jedi request4"; http_cookie; \
     sid:1000060; gid:1; rev:6;)