From: Russ Combs (rucombs)
Date: Mon, 12 Feb 2018 20:55:08 +0000 (-0500)
Subject: Merge pull request #1106 in SNORT/snort3 from 2018 to master
X-Git-Tag: 3.0.0-243
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=013e44b4636f02a484a41d8062aad889fc6f4cfe;p=thirdparty%2Fsnort3.git
Merge pull request #1106 in SNORT/snort3 from 2018 to master
Squashed commit of the following:
commit fb589a8e3289fa64ee274234d0fd06b654c01940
Author: Russ Combs
Date: Mon Feb 12 13:29:28 2018 -0500
build 243
commit 572c45a9ba8442686cccdc47dab4ba9593a180df
Author: Russ Combs
Date: Mon Feb 12 13:16:46 2018 -0500
rules: fix path variable expansion
commit f5ed5b8dbd5d688490eb61420beb2d36dd860f6a
Author: Russ Combs
Date: Sun Feb 11 08:00:56 2018 -0500
doc: update default manuals
commit 9b0a0d075018f1061302fc6bf7259c42ea60ade7
Author: Russ Combs
Date: Sun Feb 11 07:56:40 2018 -0500
copyright: update year to 2018
commit e87ddd2df2b2a3e49e8d25aefb4fbe40eae19422
Author: Russ Combs
Date: Sun Feb 11 07:49:24 2018 -0500
comments: fix 6isco typos
---
diff --git a/ChangeLog b/ChangeLog
index bec505305..c8a1b3d0d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,26 @@
+18/02/12 - build 243
+
+-- build: enable gdb debugging info by default
+-- build: fix cppcheck warnings
+-- build: fix static analysis issue
+-- comments: fix 6isco typos
+-- copyright: update year to 2018
+-- detection: use detection limit (alt_dsize)
+-- detection: trace fast pattern searches with 0x20
+-- detection: do not change search_engine.inspect_stream_inserts configuration
+-- doc: update default manuals
+-- flow: support episodic detection
+-- help: upper case proto acronyms etc.
+-- http_inspect: apply request/response depth to packet data
+-- http_inspect: suppress raw packet inspection beyond request/response depth
+-- main: Export AnalyzerCommand and main_broadcast_command()
+-- rules: fix path variable expansion
+-- search_engine: rename inspect_stream_inserts to detect_raw_tcp for clarity
+ default to true for 2.X rule sets
+-- rules: update fast pattern selection to exclude redundant port groups
+ when service groups are present
+-- wizard: count user scans and hits separate from tcp
+
18/01/29 - build 242
-- build: add STATIC to add_library call of port_scan to build it statically
diff --git a/daqs/daq_file.c b/daqs/daq_file.c
index 1592ef3b2..192236a6b 100644
--- a/daqs/daq_file.c
+++ b/daqs/daq_file.c
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
-// Copyright (C) 2015-2017 Cisco and/or its affiliates. All rights reserved.
+// Copyright (C) 2015-2018 Cisco and/or its affiliates. All rights reserved.
//
// This program is free software; you can redistribute it and/or modify it
// under the terms of the GNU General Public License Version 2 as published
diff --git a/daqs/daq_hext.c b/daqs/daq_hext.c
index f6306bee9..39711c3e4 100644
--- a/daqs/daq_hext.c
+++ b/daqs/daq_hext.c
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
-// Copyright (C) 2015-2017 Cisco and/or its affiliates. All rights reserved.
+// Copyright (C) 2015-2018 Cisco and/or its affiliates. All rights reserved.
//
// This program is free software; you can redistribute it and/or modify it
// under the terms of the GNU General Public License Version 2 as published
diff --git a/daqs/daq_user.h b/daqs/daq_user.h
index 4fdcf955d..3ba776761 100644
--- a/daqs/daq_user.h
+++ b/daqs/daq_user.h
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
-// Copyright (C) 2015-2017 Cisco and/or its affiliates. All rights reserved.
+// Copyright (C) 2015-2018 Cisco and/or its affiliates. All rights reserved.
//
// This program is free software; you can redistribute it and/or modify it
// under the terms of the GNU General Public License Version 2 as published
diff --git a/doc/snort_manual.html b/doc/snort_manual.html
index 05785cf8d..e3a2b5a3d 100644
--- a/doc/snort_manual.html
+++ b/doc/snort_manual.html
@@ -779,7 +779,7 @@ asciidoc.install(2);
,,_ -*> Snort++ <*-
-o" )~ Version 3.0.0 (Build 240) from 2.9.8-383
+o" )~ Version 3.0.0 (Build 242) from 2.9.11
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2017 Cisco and/or its affiliates. All rights reserved.
@@ -5825,7 +5825,7 @@ engine for your network(s). Here are some tuning tips:
Use the watch_ip, ignore_scanners, and ignore_scanned options.
It’s important to correctly set these options. The watch_ip option
is easy to understand. The analyst should set this option to the
-list of Cidr blocks and IPs that they want to watch. If no
+list of CIDR blocks and IPs that they want to watch. If no
watch_ip is defined, Portscan will watch all network traffic.
The ignore_scanners and ignore_scanned options come into play in
weeding out legitimate hosts that are very active on your network.
@@ -6999,7 +6999,7 @@ int host_cache[].size: size of host cache
-
-addr host_tracker[].ip = 0.0.0.0/32: hosts address / cidr
+addr host_tracker[].IP = 0.0.0.0/32: hosts address / cidr
-
@@ -7009,7 +7009,7 @@ enum host_tracker[].frag_policy: defragmentation policy { first
-
-enum host_tracker[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
+enum host_tracker[].tcp_policy: TCP reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
-
@@ -7019,7 +7019,7 @@ string host_tracker[].services[].name: service identifier
-
-enum host_tracker[].services[].proto = tcp: ip protocol { tcp | udp }
+enum host_tracker[].services[].proto = tcp: IP protocol { tcp | udp }
-
@@ -7056,7 +7056,7 @@ port host_tracker[].services[].port: port number
-
-addr hosts[].ip = 0.0.0.0/32: hosts address / cidr
+addr hosts[].ip = 0.0.0.0/32: hosts address / CIDR
-
@@ -7066,7 +7066,7 @@ enum hosts[].frag_policy: defragmentation policy { first | linu
-
-enum hosts[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
+enum hosts[].tcp_policy: TCP reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
-
@@ -7076,7 +7076,7 @@ string hosts[].services[].name: service identifier
-
-enum hosts[].services[].proto = tcp: ip protocol { tcp | udp }
+enum hosts[].services[].proto = tcp: IP protocol { tcp | udp }
-
@@ -7315,7 +7315,7 @@ int network.id = 0: correlate unified2 events with configuratio
-
-int network.min_ttl = 1: alert / normalize packets with lower ttl / hop limit (you must enable rules and / or normalization also) { 1:255 }
+int network.min_ttl = 1: alert / normalize packets with lower TTL / hop limit (you must enable rules and / or normalization also) { 1:255 }
-
@@ -7717,7 +7717,7 @@ int search_engine.max_queue_events = 5: maximum number of match
-
-bool search_engine.inspect_stream_inserts = false: inspect reassembled payload - disabling is good for performance, bad for detection
+bool search_engine.detect_raw_tcp = true: detect on TCP payload before reassembly
-
@@ -7886,7 +7886,7 @@ string snort.-i: <iface>… list of interfaces
-
-port snort.-j: <port> to listen for telnet connections
+port snort.-j: <port> to listen for Telnet connections
-
@@ -9815,12 +9815,12 @@ bool appid.dump_ports = false: enable dump of appid port inform
-
-addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip address in CIDR format
+addr appid.session_log_filter.src_ip = 0.0.0.0/32: source IP address in CIDR format
-
-addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip address in CIDR format
+addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination IP address in CIDR format
-
@@ -9835,7 +9835,7 @@ port appid.session_log_filter.dst_port: destination port { 1: }
-
-string appid.session_log_filter.protocol: ip protocol
+string appid.session_log_filter.protocol: IP protocol
-
@@ -11459,7 +11459,7 @@ bool ftp_client.bounce = false: check for bounces
-
-addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip address in CIDR format
+addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed IP address in CIDR format
-
@@ -11479,12 +11479,12 @@ bool ftp_client.ignore_telnet_erase_cmds = false: ignore erase
-
-int ftp_client.max_resp_len = -1: maximum ftp response accepted by client { -1: }
+int ftp_client.max_resp_len = -1: maximum FTP response accepted by client { -1: }
-
-bool ftp_client.telnet_cmds = false: detect telnet escape sequences on ftp control channel
+bool ftp_client.telnet_cmds = false: detect Telnet escape sequences on FTP control channel
@@ -11587,7 +11587,7 @@ int ftp_server.def_max_param_len = 100: default maximum length
-
-bool ftp_server.encrypted_traffic = false: check for encrypted telnet and ftp
+bool ftp_server.encrypted_traffic = false: check for encrypted Telnet and FTP
-
@@ -11597,7 +11597,7 @@ string ftp_server.ftp_cmds: specify additional commands support
-
-bool ftp_server.ignore_data_chan = false: do not inspect ftp data channels
+bool ftp_server.ignore_data_chan = false: do not inspect FTP data channels
-
@@ -11612,7 +11612,7 @@ bool ftp_server.print_cmds = false: print command configuration
-
-bool ftp_server.telnet_cmds = false: detect telnet escape sequences of ftp control channel
+bool ftp_server.telnet_cmds = false: detect Telnet escape sequences of FTP control channel
@@ -11673,12 +11673,12 @@ bool
ftp_server.telnet_cmds = false: detect telnet escape seque
-ftp_server.concurrent_sessions: total concurrent ftp sessions (now)
+ftp_server.concurrent_sessions: total concurrent FTP sessions (now)
-ftp_server.max_concurrent_sessions: maximum concurrent ftp sessions (max)
+ftp_server.max_concurrent_sessions: maximum concurrent FTP sessions (max)
@@ -11692,7 +11692,7 @@ bool
ftp_server.telnet_cmds = false: detect telnet escape seque
-
-int gtp_inspect[].version = 2: gtp version { 0:2 }
+int gtp_inspect[].version = 2: GTP version { 0:2 }
-
@@ -13678,22 +13678,22 @@ int port_scan.icmp_sweep.ports = 25: number of times port (or p
-
-int port_scan.tcp_window = 0: detection interval for all tcp scans { 0: }
+int port_scan.tcp_window = 0: detection interval for all TCP scans { 0: }
-
-int port_scan.udp_window = 0: detection interval for all udp scans { 0: }
+int port_scan.udp_window = 0: detection interval for all UDP scans { 0: }
-
-int port_scan.ip_window = 0: detection interval for all ip scans { 0: }
+int port_scan.ip_window = 0: detection interval for all IP scans { 0: }
-
-int port_scan.icmp_window = 0: detection interval for all icmp scans { 0: }
+int port_scan.icmp_window = 0: detection interval for all ICMP scans { 0: }
@@ -13885,7 +13885,7 @@ bool
reg_test.test_daq_retry = true: test daq packet retry feat
-
-string reputation.blacklist: blacklist file name with ip lists
+string reputation.blacklist: blacklist file name with IP lists
-
@@ -13895,7 +13895,7 @@ int reputation.memcap = 500: maximum total MB of memory allocat
-
-enum reputation.nested_ip = inner: ip to use when there is IP encapsulation { inner|outer|all }
+enum reputation.nested_ip = inner: IP to use when there is IP encapsulation { inner|outer|all }
-
@@ -13915,7 +13915,7 @@ enum reputation.white = unblack: specify the meaning of whiteli
-
-string reputation.whitelist: whitelist file name with ip lists
+string reputation.whitelist: whitelist file name with IP lists
@@ -14077,7 +14077,7 @@ int
sip.max_via_len = 1024: maximum via field size { 0:65535 }
-string sip.methods = invite cancel ack bye register options: list of methods to check in sip messages
+string sip.methods = invite cancel ack bye register options: list of methods to check in SIP messages
@@ -14228,12 +14228,12 @@ string sip.methods = invite cancel ack bye register options: l
-sip.concurrent_sessions: total concurrent sip sessions (now)
+sip.concurrent_sessions: total concurrent SIP sessions (now)
-sip.max_concurrent_sessions: maximum concurrent sip sessions (max)
+sip.max_concurrent_sessions: maximum concurrent SIP sessions (max)
@@ -14877,7 +14877,7 @@ int ssl.max_heartbeat_length = 0: maximum length of heartbeat r
-
-int stream.footprint = 0: use zero for production, non-zero for testing at given size (for tcp and user) { 0: }
+int stream.footprint = 0: use zero for production, non-zero for testing at given size (for TCP and user) { 0: }
-
@@ -15305,7 +15305,7 @@ int stream_ip.min_frag_length = 0: alert if fragment length is
-
-int stream_ip.min_ttl = 1: discard fragments with ttl below the minimum { 1:255 }
+int stream_ip.min_ttl = 1: discard fragments with TTL below the minimum { 1:255 }
-
@@ -15525,12 +15525,12 @@ int stream_tcp.flush_factor = 0: flush upon seeing a drop in se
-
-bool stream_tcp.ignore_any_rules = false: process tcp content rules w/o ports only if rules with ports are present
+bool stream_tcp.ignore_any_rules = false: process TCP content rules w/o ports only if rules with ports are present
-
-int stream_tcp.max_window = 0: maximum allowed tcp window { 0:1073725440 }
+int stream_tcp.max_window = 0: maximum allowed TCP window { 0:1073725440 }
-
@@ -15895,7 +15895,7 @@ int stream_udp.session_timeout = 30: session tracking timeout {
-
-bool stream_udp.ignore_any_rules = false: process udp content rules w/o ports only if rules with ports are present
+bool stream_udp.ignore_any_rules = false: process UDP content rules w/o ports only if rules with ports are present
@@ -15966,7 +15966,7 @@ int stream_user.trace: mask for enabling debug traces in module
-
-int telnet.ayt_attack_thresh = -1: alert on this number of consecutive telnet AYT commands { -1: }
+int telnet.ayt_attack_thresh = -1: alert on this number of consecutive Telnet AYT commands { -1: }
-
@@ -15976,7 +15976,7 @@ bool telnet.check_encrypted = false: check for end of encryptio
-
-bool telnet.encrypted_traffic = false: check for encrypted telnet and ftp
+bool telnet.encrypted_traffic = false: check for encrypted Telnet and FTP
-
@@ -15989,17 +15989,17 @@ bool telnet.normalize = false: eliminate escape sequences
-
-126:1 (telnet) consecutive telnet AYT commands beyond threshold
+126:1 (telnet) consecutive Telnet AYT commands beyond threshold
-
-126:2 (telnet) telnet traffic encrypted
+126:2 (telnet) Telnet traffic encrypted
-
-126:3 (telnet) telnet subnegotiation begin command without subnegotiation end
+126:3 (telnet) Telnet subnegotiation begin command without subnegotiation end
@@ -16012,12 +16012,12 @@ bool telnet.normalize = false: eliminate escape sequences
-
-telnet.concurrent_sessions: total concurrent telnet sessions (now)
+telnet.concurrent_sessions: total concurrent Telnet sessions (now)
-
-telnet.max_concurrent_sessions: maximum concurrent telnet sessions (max)
+telnet.max_concurrent_sessions: maximum concurrent Telnet sessions (max)
@@ -16158,12 +16158,12 @@ string react.page: file containing HTTP response (headers and b
-
-enum reject.reset: send tcp reset to one or both ends { source|dest|both }
+enum reject.reset: send TCP reset to one or both ends { source|dest|both }
-
-enum reject.control: send icmp unreachable(s) { network|host|port|all }
+enum reject.control: send ICMP unreachable(s) { network|host|port|all }
@@ -16197,7 +16197,7 @@ bool rewrite.disable_replace = false: disable replace of packet
@@ -16752,47 +16752,47 @@ int detection_filter.seconds: length of interval to count hits
dnp3_func
-
What: detection option to check dnp3 function code
+
What: detection option to check DNP3 function code
dnp3_ind
-
What: detection option to check dnp3 indicator flags
+
What: detection option to check DNP3 indicator flags
dnp3_obj
-
What: detection option to check dnp3 object headers
+
What: detection option to check DNP3 object headers
-
-int dnp3_obj.group = 0: match given dnp3 object header group { 0:255 }
+int dnp3_obj.group = 0: match given DNP3 object header group { 0:255 }
-
-int dnp3_obj.var = 0: match given dnp3 object header var { 0:255 }
+int dnp3_obj.var = 0: match given DNP3 object header var { 0:255 }
@@ -17010,7 +17010,7 @@ string
gtp_type.~: list of types to match
gtp_version
-
What: rule option to check gtp version
+
What: rule option to check GTP version
@@ -17433,7 +17433,7 @@ implied
http_version.with_trailer: parts of this rule examine H
@@ -17447,7 +17447,7 @@ interval
icmp_id.~range: check if icmp id is in given range { 0
@@ -17461,7 +17461,7 @@ interval
icmp_seq.~range: check if icmp sequence number is in g
@@ -17475,7 +17475,7 @@ interval
icode.~range: check if icmp code is in given range is
@@ -17536,7 +17536,7 @@ implied
isdataat.relative: offset from cursor instead of start
@@ -17606,14 +17606,14 @@ string
modbus_func.~: function code to match
modbus_unit
-
What: rule option to check modbus unit ID
+
What: rule option to check Modbus unit ID
@@ -17870,7 +17870,7 @@ int
sd_pattern.threshold: number of matches before alerting { 1
@@ -18261,7 +18261,7 @@ enum
target.~: indicate the target of the attack { src_ip | dst
@@ -18275,7 +18275,7 @@ interval
tos.~range: check if ip tos is in given range { 0:255
@@ -18303,7 +18303,7 @@ interval
urg.~range: check if tcp urgent offset is in given ran
@@ -19842,14 +19842,14 @@ value over gid:138 rules and was difficult to interpret the result of.
One of the major differences between Snort 2 and Snort 3 is the
configuration. Snort 2 configuration files are written in Snort-specific
-syntax while Snort 3 configuration files are written in Lua. Snort2Lua is
-a program specifically designed to convert valid Snort 2 configuration files
+syntax while Snort 3 configuration files are written in Lua. Snort2Lua is a
+program specifically designed to convert valid Snort 2 configuration files
into Lua files that Snort 3 can understand.
Snort2Lua reads your legacy Snort conf file(s) and generates Snort 3 Lua
-and rules files. When running this program, the only mandatory option is
-to provide Snort2Lua with a Snort 2 configuration file. The default
-output file file is snort.lua, the default error file will be snort.rej,
-and the default rule file is the output file (default is snort.lua). When
+and rules files. When running this program, the only mandatory option is to
+provide Snort2Lua with a Snort 2 configuration file. The default output
+file file is snort.lua, the default error file will be snort.rej, and the
+default rule file is the output file (default is snort.lua). When
Snort2Lua finishes running, the resulting configuration file can be
successfully run as the Snort3.0 configuration file. The sole exception to
this rule is when Snort2Lua cannot find an included file. If that occurs,
@@ -19857,42 +19857,68 @@ the file will still be included in the output file and you will need to
manually adjust or comment the file name. Additionally, if the exit code is
not zero, some of the information may not be successfully converted. Check
the error file for all of the conversion problems.
-
Those errors can occur for a multitude of reasons and are not
-necessarily bad. Snort2Lua expects a valid Snort 2 configuration.
-Therefore, if the configuration is invalid or has questionable syntax,
-Snort2Lua may fail to parse the configuration file or create an invalid
-Snort 3 configuration file.
+
Those errors can occur for a multitude of reasons and are not necessarily
+bad. Snort2Lua expects a valid Snort 2 configuration. Therefore, if the
+configuration is invalid or has questionable syntax, Snort2Lua may fail to
+parse the configuration file or create an invalid Snort 3 configuration
+file.
There are a also few peculiarities of Snort2Lua that may be confusing to a
-first time user. Specifically, aside from an initial configuration file
-(which is specified from the command line or as the file in âconfig
-bindingâ), every file that is included into Snort 3 must be either a Lua
-file or a rule file; the file cannot contain both rules and Lua syntax.
-Therefore, when parsing a file specified with the âincludeâ command,
-Snort2Lua will output both a Lua file and a rule file. Additionally, any
-line that is a comment in a configuration file will be added in to a
-comments section at the bottom of the main configuration file. Finally,
-rules that contain unsupported options will be converted to the best of
-Snort2Luaâs capability and then printed as a comment in the rule file.
+first time user:
+
+-
+
+Aside from an initial configuration file (which is specified from the
+ command line or as the file in âconfig bindingâ), every file that is
+ included into Snort 3 must be either a Lua file or a rule file; the file
+ cannot contain both rules and Lua syntax. Therefore, when parsing a file
+ specified with the âincludeâ command, Snort2Lua will output both a Lua
+ file and a rule file.
+
+
+-
+
+Any line that is a comment in a configuration file will be added in to a
+ comments section at the bottom of the main configuration file.
+
+
+-
+
+Rules that contain unsupported options will be converted to the best of
+ Snort2Luaâs capability and then printed as a comment in the rule file.
+
+
+-
+
+Files with a .rules suffix are assumed to be Talos 2.X rules files and
+ converted line-by-line. In this case, lines starting with alert are
+ converted as usual but lines starting with # alert are
+ assumed to be commented out rules which are converted to 3.0 format and
+ remain comments in the output file. All other comments are passed
+ through directly. There is no support for other commented rule actions
+ since these do not appear in Talos rules files.
+
+
+
Snort2Lua Command Line
By default, Snort2Lua will attempt to parse every âincludeâ file and every
âbindingâ file. There is an option to change this functionality.
When specifying a rule file with one of the command line options, Snort2Lua
-will output all of the converted rules to that specified rule file.
-This is especially useful when you are only interesting in
-converting rules since there is no Lua syntax in rule files. There is also
-an option that tells Snort2Lua to output every rule for a given
-configuration into a single rule file. Similarly, there is an option
-pull all of the Lua syntax from every âincludeâ file into the output file.
+will output all of the converted rules to that specified rule file. This
+is especially useful when you are only interesting in converting rules
+since there is no Lua syntax in rule files. There is also an option that
+tells Snort2Lua to output every rule for a given configuration into a
+single rule file. Similarly, there is an option pull all of the Lua syntax
+from every âincludeâ file into the output file.
There are currently three output modes: default, quiet, and differences.
As expected, quiet mode produces a Snort configuration. All errors (aside
from Fatal Snort2Lua errors), differences, and comments will omitted from
the final output file. Default mode will print everything. That mean you
-will be able to see exactly what changes have occurred between Snort 2
-and Snort 3 in addition to the new syntax, the original file’s comments,
-and all errors that have occurred. Finally, differences mode will not
-actually output a valid Snort 3 configuration. Instead, you can see the
-exact options from the input configuration that have changed.
+will be able to see exactly what changes have occurred between Snort 2 and
+Snort 3 in addition to the new syntax, the original file’s comments, and
+all errors that have occurred. Finally, differences mode will not actually
+output a valid Snort 3 configuration. Instead, you can see the exact
+options from the input configuration that have changed.
Usage: snort2lua [OPTIONS]… -c <snort_conf> …
Converts the Snort configuration file specified by the -c or --conf-file
@@ -20118,52 +20144,53 @@ A Snort configuration file to convert. Set with either -c or --conf
-
-Any Snort 2 âstringâ which is dependent on a variable will no longer have
-that variable in the Lua string.
+Any Snort 2 âstringâ which is dependent on a variable will no longer
+ have that variable in the Lua string.
-
Snort2Lua currently does not handle variables well. First, that means
-variables will not always be parsed correctly. Second, sometimes a
-variables value will be output in the lua file rather than a variable
-For instance, if Snort2Lua attempted to convert the line
-include $RULE_PATH/example.rule, the output may output
-include /etc/rules/example.rule instead.
+ variables will not always be parsed correctly. Second, sometimes a
+ variables value will be output in the lua file rather than a variable
+ For instance, if Snort2Lua attempted to convert the line include
+ $RULE_PATH/example.rule, the output may output include
+ /etc/rules/example.rule instead.
-
When Snort2Lua parses a âbindingâ configuration file, the rules and
-configuration will automatically be combined into the same file. Also, the
-new files name will automatically become the old fileâs name with a .lua
-extension. There is currently no way to specify or change that files name.
+ configuration will automatically be combined into the same file. Also,
+ the new files name will automatically become the old fileâs name with a
+ .lua extension. There is currently no way to specify or change that
+ files name.
-
-If a rule’s action is a custom ruletype, that rule action will be silently
-converted to the rultype’s type. No warnings or errors are currently
-emitted. Additionally, the custom ruletypes outputs will be silently
-discarded.
+If a rule’s action is a custom ruletype, that rule action will be
+ silently converted to the rultype’s type. No warnings or errors are
+ currently emitted. Additionally, the custom ruletypes outputs will be
+ silently discarded.
-
If the original configuration contains a binding that points to another
-file and the binding file contains an error, Snort2Lua will output the
-number of rejects for the binding file in addition to the number of
-rejects in the main file. The two numbers will eventually be combined into
-one output.
+ file and the binding file contains an error, Snort2Lua will output the
+ number of rejects for the binding file in addition to the number of
+ rejects in the main file. The two numbers will eventually be combined
+ into one output.
Usage
-
Snort2Lua is included in the Snort 3 distribution. The Snort2Lua source code
-is located in the tools/snort2lua directory. The program is automatically built
-and installed.
+
Snort2Lua is included in the Snort 3 distribution. The Snort2Lua source
+code is located in the tools/snort2lua directory. The program is
+automatically built and installed.
Translating your configuration
To run Snort2Lua, the only requirement is a file containing Snort 2 syntax.
Assuming your configuration file is named snort.conf, run the command
@@ -20171,37 +20198,39 @@ Assuming your configuration file is named snort.conf, run the command
snort2lua âc snort.conf
-Snort2Lua will output a file named snort.lua. Assuming your snort.conf file is
-a valid Snort 2 configuration file, than the resulting snort.lua file will
-always be a valid Snort 3 configuration file; any errors that occur are
-because Snort 3 currently does not support all of the Snort 2 options.
-Every keyword from the Snort configuration can be found in the output file. If
-the option or keyword has changed, then a comment containing both the option or
-keywordâs old name and new name will be present in the output file.
+Snort2Lua will output a file named snort.lua. Assuming your snort.conf file
+is a valid Snort 2 configuration file, than the resulting snort.lua file
+will always be a valid Snort 3 configuration file; any errors that occur
+are because Snort 3 currently does not support all of the Snort 2 options.
+Every keyword from the Snort configuration can be found in the output file.
+If the option or keyword has changed, then a comment containing both the
+option or keywordâs old name and new name will be present in the output
+file.
-Snort2Lua can also accommodate translating individual rule files. Assuming the
-Snort 2 rule file is named snort.rules and you want the new rule file to be
-name updated.rules, run the command
+Snort2Lua can also accommodate translating individual rule files. Assuming
+the Snort 2 rule file is named snort.rules and you want the new rule file
+to be name updated.rules, run the command
snort2lua âc snort.rules -r updated.rules
Snort2Lua will output a file named updated.rules. That file, updated.rules,
-will always be a valid Snort 3 rule file. Any rule that contains unsupported
-options will be a comment in the output file.
+will always be a valid Snort 3 rule file. Any rule that contains
+unsupported options will be a comment in the output file.
-Although Snort2Lua outputs very little to the console, there are several things
-that occur when Snort2Lua runs. This is a list of Snort2Lua outputs.
-The console. Every line that Snort2Lua is unable to translate from the Snort
-2.X format to the Snort 3 format is considered an error. Upon exiting,
-Snort2Lua will print the number of errors that occurred. Snort2Lua will also
-print the name of the error file.
-The output file. As previously mentioned, Snort2Lua will create a Lua file
-with valid Snort 3 syntax. The default Lua file is named snort.lua. This
-file is the equivalent of your main Snort 2 configuration file.
+Although Snort2Lua outputs very little to the console, there are several
+things that occur when Snort2Lua runs. This is a list of Snort2Lua
+outputs.
+The console. Every line that Snort2Lua is unable to translate from the
+Snort 2.X format to the Snort 3 format is considered an error. Upon
+exiting, Snort2Lua will print the number of errors that occurred. Snort2Lua
+will also print the name of the error file.
+The output file. As previously mentioned, Snort2Lua will create a Lua
+file with valid Snort 3 syntax. The default Lua file is named snort.lua.
+This file is the equivalent of your main Snort 2 configuration file.
The rule file. By default, all rules will be printed to the Lua file.
-However, if a rule file is specified on the command line, any rules found in
-the Snort 2 configuration will be written to the rule file instead
+However, if a rule file is specified on the command line, any rules found
+in the Snort 2 configuration will be written to the rule file instead
The error file. By default, the error file is snort.rej. It will only be
created if errors exist. Every error referenced on the command line can be
found in this file. There are two reasons an error can occur.
@@ -20225,10 +20254,11 @@ The Snort 2 configuration file contains preprocessors and rule options
-Additional .lua and .rules files. Every time Snort2Lua parses the include or
-binding keyword, the program will attempt to parse the file referenced by the
-keyword. Snort2Lua will then create one or two new files. The new files will
-have a .lua or .rules extension appended to the original filename.
+Additional .lua and .rules files. Every time Snort2Lua parses the include
+or binding keyword, the program will attempt to parse the file referenced
+by the keyword. Snort2Lua will then create one or two new files. The new
+files will have a .lua or .rules extension appended to the original
+filename.
@@ -22431,7 +22461,7 @@ these libraries see the Getting Started section of the manual.
--j <port> to listen for telnet connections
+-j <port> to listen for Telnet connections
@@ -22821,7 +22851,7 @@ these libraries see the Getting Started section of the manual.
-
-interval ack.~range: check if tcp ack value is value | min<>max | <max | >min { 0: }
+interval ack.~range: check if TCP ack value is value | min<>max | <max | >min { 0: }
-
@@ -23056,7 +23086,7 @@ string appids.~: comma separated list of application names
-
-addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip address in CIDR format
+addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination IP address in CIDR format
-
@@ -23071,12 +23101,12 @@ bool appid.session_log_filter.log_all_sessions = false: enable
-
-string appid.session_log_filter.protocol: ip protocol
+string appid.session_log_filter.protocol: IP protocol
-
-addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip address in CIDR format
+addr appid.session_log_filter.src_ip = 0.0.0.0/32: source IP address in CIDR format
-
@@ -23826,22 +23856,22 @@ bool dnp3.check_crc = false: validate checksums in DNP3 link la
-
-string dnp3_func.~: match dnp3 function code or name
+string dnp3_func.~: match DNP3 function code or name
-
-string dnp3_ind.~: match given dnp3 indicator flags
+string dnp3_ind.~: match given DNP3 indicator flags
-
-int dnp3_obj.group = 0: match given dnp3 object header group { 0:255 }
+int dnp3_obj.group = 0: match given DNP3 object header group { 0:255 }
-
-int dnp3_obj.var = 0: match given dnp3 object header var { 0:255 }
+int dnp3_obj.var = 0: match given DNP3 object header var { 0:255 }
-
@@ -24216,7 +24246,7 @@ bool ftp_client.bounce = false: check for bounces
-
-addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip address in CIDR format
+addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed IP address in CIDR format
-
@@ -24236,12 +24266,12 @@ bool ftp_client.ignore_telnet_erase_cmds = false: ignore erase
-
-int ftp_client.max_resp_len = -1: maximum ftp response accepted by client { -1: }
+int ftp_client.max_resp_len = -1: maximum FTP response accepted by client { -1: }
-
-bool ftp_client.telnet_cmds = false: detect telnet escape sequences on ftp control channel
+bool ftp_client.telnet_cmds = false: detect Telnet escape sequences on FTP control channel
-
@@ -24306,7 +24336,7 @@ string ftp_server.encr_cmds: check the formatting of the given
-
-bool ftp_server.encrypted_traffic = false: check for encrypted telnet and ftp
+bool ftp_server.encrypted_traffic = false: check for encrypted Telnet and FTP
-
@@ -24326,7 +24356,7 @@ string ftp_server.ftp_cmds: specify additional commands support
-
-bool ftp_server.ignore_data_chan = false: do not inspect ftp data channels
+bool ftp_server.ignore_data_chan = false: do not inspect FTP data channels
-
@@ -24346,7 +24376,7 @@ bool ftp_server.print_cmds = false: print command configuration
-
-bool ftp_server.telnet_cmds = false: detect telnet escape sequences of ftp control channel
+bool ftp_server.telnet_cmds = false: detect Telnet escape sequences of FTP control channel
-
@@ -24386,7 +24416,7 @@ int gtp_inspect[].messages[].type = 0: message type code { 0:25
-
-int gtp_inspect[].version = 2: gtp version { 0:2 }
+int gtp_inspect[].version = 2: GTP version { 0:2 }
-
@@ -24436,7 +24466,7 @@ enum hosts[].frag_policy: defragmentation policy { first | linu
-
-addr hosts[].ip = 0.0.0.0/32: hosts address / cidr
+addr hosts[].ip = 0.0.0.0/32: hosts address / CIDR
-
@@ -24451,12 +24481,12 @@ port hosts[].services[].port: port number
-
-enum hosts[].services[].proto = tcp: ip protocol { tcp | udp }
+enum hosts[].services[].proto = tcp: IP protocol { tcp | udp }
-
-enum hosts[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
+enum hosts[].tcp_policy: TCP reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
-
@@ -24466,7 +24496,7 @@ enum host_tracker[].frag_policy: defragmentation policy { first
-
-addr host_tracker[].ip = 0.0.0.0/32: hosts address / cidr
+addr host_tracker[].IP = 0.0.0.0/32: hosts address / cidr
-
@@ -24481,12 +24511,12 @@ port host_tracker[].services[].port: port number
-
-enum host_tracker[].services[].proto = tcp: ip protocol { tcp | udp }
+enum host_tracker[].services[].proto = tcp: IP protocol { tcp | udp }
-
-enum host_tracker[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
+enum host_tracker[].tcp_policy: TCP reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }
-
@@ -24881,22 +24911,22 @@ implied http_version.with_trailer: parts of this rule examine H
-
-interval icmp_id.~range: check if icmp id is in given range { 0:65535 }
+interval icmp_id.~range: check if ICMP ID is in given range { 0:65535 }
-
-interval icmp_seq.~range: check if icmp sequence number is in given range { 0:65535 }
+interval icmp_seq.~range: check if ICMP sequence number is in given range { 0:65535 }
-
-interval icode.~range: check if icmp code is in given range is { 0:255 }
+interval icode.~range: check if ICMP code is in given range is { 0:255 }
-
-interval id.~range: check if the ip id is in the given range { 0: }
+interval id.~range: check if the IP ID is in the given range { 0: }
-
@@ -24986,7 +25016,7 @@ implied isdataat.relative: offset from cursor instead of start
-
-interval itype.~range: check if icmp type is in given range { 0:255 }
+interval itype.~range: check if ICMP type is in given range { 0:255 }
-
@@ -25111,7 +25141,7 @@ string modbus_func.~: function code to match
-
-int modbus_unit.~: modbus unit ID { 0:255 }
+int modbus_unit.~: Modbus unit ID { 0:255 }
-
@@ -25181,7 +25211,7 @@ int network.max_ip_layers = 0: the maximum number of IP layers
-
-int network.min_ttl = 1: alert / normalize packets with lower ttl / hop limit (you must enable rules and / or normalization also) { 1:255 }
+int network.min_ttl = 1: alert / normalize packets with lower TTL / hop limit (you must enable rules and / or normalization also) { 1:255 }
-
@@ -25546,7 +25576,7 @@ int port_scan.icmp_sweep.scans = 100: scan attempts { 0: }
-
-int port_scan.icmp_window = 0: detection interval for all icmp scans { 0: }
+int port_scan.icmp_window = 0: detection interval for all ICMP scans { 0: }
-
@@ -25646,7 +25676,7 @@ int port_scan.ip_sweep.scans = 100: scan attempts { 0: }
-
-int port_scan.ip_window = 0: detection interval for all ip scans { 0: }
+int port_scan.ip_window = 0: detection interval for all IP scans { 0: }
-
@@ -25746,7 +25776,7 @@ int port_scan.tcp_sweep.scans = 100: scan attempts { 0: }
-
-int port_scan.tcp_window = 0: detection interval for all tcp scans { 0: }
+int port_scan.tcp_window = 0: detection interval for all TCP scans { 0: }
-
@@ -25831,7 +25861,7 @@ int port_scan.udp_sweep.scans = 100: scan attempts { 0: }
-
-int port_scan.udp_window = 0: detection interval for all udp scans { 0: }
+int port_scan.udp_window = 0: detection interval for all UDP scans { 0: }
-
@@ -26051,12 +26081,12 @@ bool reg_test.test_daq_retry = true: test daq packet retry feat
-
-enum reject.control: send icmp unreachable(s) { network|host|port|all }
+enum reject.control: send ICMP unreachable(s) { network|host|port|all }
-
-enum reject.reset: send tcp reset to one or both ends { source|dest|both }
+enum reject.reset: send TCP reset to one or both ends { source|dest|both }
-
@@ -26071,7 +26101,7 @@ string replace.~: byte code to replace with
-
-string reputation.blacklist: blacklist file name with ip lists
+string reputation.blacklist: blacklist file name with IP lists
-
@@ -26081,7 +26111,7 @@ int reputation.memcap = 500: maximum total MB of memory allocat
-
-enum reputation.nested_ip = inner: ip to use when there is IP encapsulation { inner|outer|all }
+enum reputation.nested_ip = inner: IP to use when there is IP encapsulation { inner|outer|all }
-
@@ -26096,7 +26126,7 @@ bool reputation.scan_local = false: inspect local address defin
-
-string reputation.whitelist: whitelist file name with ip lists
+string reputation.whitelist: whitelist file name with IP lists
-
@@ -26191,12 +26221,12 @@ bool search_engine.debug_print_rule_groups_uncompiled = false:
-
-bool search_engine.enable_single_rule_group = false: put all rules into one group
+bool search_engine.detect_raw_tcp = true: detect on TCP payload before reassembly
-
-bool search_engine.inspect_stream_inserts = false: inspect reassembled payload - disabling is good for performance, bad for detection
+bool search_engine.enable_single_rule_group = false: put all rules into one group
-
@@ -26231,7 +26261,7 @@ bool search_engine.split_any_any = true: evaluate any-any rules
-
-interval seq.~range: check if tcp sequence number is in given range { 0: }
+interval seq.~range: check if TCP sequence number is in given range { 0: }
-
@@ -26361,7 +26391,7 @@ string sip_method.*method: sip method
-
-string sip.methods = invite cancel ack bye register options: list of methods to check in sip messages
+string sip.methods = invite cancel ack bye register options: list of methods to check in SIP messages
-
@@ -26701,7 +26731,7 @@ string snort.-i: <iface>… list of interfaces
-
-port snort.-j: <port> to listen for telnet connections
+port snort.-j: <port> to listen for Telnet connections
-
@@ -27241,7 +27271,7 @@ bool stream_file.upload = false: indicate file transfer directi
-
-int stream.footprint = 0: use zero for production, non-zero for testing at given size (for tcp and user) { 0: }
+int stream.footprint = 0: use zero for production, non-zero for testing at given size (for TCP and user) { 0: }
-
@@ -27301,7 +27331,7 @@ int stream_ip.min_frag_length = 0: alert if fragment length is
-
-int stream_ip.min_ttl = 1: discard fragments with ttl below the minimum { 1:255 }
+int stream_ip.min_ttl = 1: discard fragments with TTL below the minimum { 1:255 }
-
@@ -27371,7 +27401,7 @@ int stream_tcp.flush_factor = 0: flush upon seeing a drop in se
-
-bool stream_tcp.ignore_any_rules = false: process tcp content rules w/o ports only if rules with ports are present
+bool stream_tcp.ignore_any_rules = false: process TCP content rules w/o ports only if rules with ports are present
-
@@ -27381,7 +27411,7 @@ int stream_tcp.max_pdu = 16384: maximum reassembled PDU size {
-
-int stream_tcp.max_window = 0: maximum allowed tcp window { 0:1073725440 }
+int stream_tcp.max_window = 0: maximum allowed TCP window { 0:1073725440 }
-
@@ -27451,7 +27481,7 @@ int stream.udp_cache.pruning_timeout = 30: minimum inactive tim
-
-bool stream_udp.ignore_any_rules = false: process udp content rules w/o ports only if rules with ports are present
+bool stream_udp.ignore_any_rules = false: process UDP content rules w/o ports only if rules with ports are present
-
@@ -27551,7 +27581,7 @@ enum tcp_connector.setup: stream establishment { call | answer
-
-int telnet.ayt_attack_thresh = -1: alert on this number of consecutive telnet AYT commands { -1: }
+int telnet.ayt_attack_thresh = -1: alert on this number of consecutive Telnet AYT commands { -1: }
-
@@ -27561,7 +27591,7 @@ bool telnet.check_encrypted = false: check for end of encryptio
-
-bool telnet.encrypted_traffic = false: check for encrypted telnet and ftp
+bool telnet.encrypted_traffic = false: check for encrypted Telnet and FTP
-
@@ -27571,12 +27601,12 @@ bool telnet.normalize = false: eliminate escape sequences
-
-interval tos.~range: check if ip tos is in given range { 0:255 }
+interval tos.~range: check if IP TOS is in given range { 0:255 }
-
-interval ttl.~range: check if ip ttl is in the given range { 0:255 }
+interval ttl.~range: check if IP TTL is in the given range { 0:255 }
-
@@ -27616,7 +27646,7 @@ interval urg.~range: check if tcp urgent offset is in given ran
-
-interval window.~range: check if tcp window size is in given range { 0:65535 }
+interval window.~range: check if TCP window size is in given range { 0:65535 }
-
@@ -28531,12 +28561,12 @@ interval wscale.~range: check if TCP window scale is in given r
-
-ftp_server.concurrent_sessions: total concurrent ftp sessions (now)
+ftp_server.concurrent_sessions: total concurrent FTP sessions (now)
-
-ftp_server.max_concurrent_sessions: maximum concurrent ftp sessions (max)
+ftp_server.max_concurrent_sessions: maximum concurrent FTP sessions (max)
-
@@ -29426,7 +29456,7 @@ interval wscale.~range: check if TCP window scale is in given r
-
-sip.concurrent_sessions: total concurrent sip sessions (now)
+sip.concurrent_sessions: total concurrent SIP sessions (now)
-
@@ -29466,7 +29496,7 @@ interval wscale.~range: check if TCP window scale is in given r
-
-sip.max_concurrent_sessions: maximum concurrent sip sessions (max)
+sip.max_concurrent_sessions: maximum concurrent SIP sessions (max)
-
@@ -30381,12 +30411,12 @@ interval wscale.~range: check if TCP window scale is in given r
-
-telnet.concurrent_sessions: total concurrent telnet sessions (now)
+telnet.concurrent_sessions: total concurrent Telnet sessions (now)
-
-telnet.max_concurrent_sessions: maximum concurrent telnet sessions (max)
+telnet.max_concurrent_sessions: maximum concurrent Telnet sessions (max)
-
@@ -32371,17 +32401,17 @@ interval wscale.~range: check if TCP window scale is in given r
-
-126:1 (telnet) consecutive telnet AYT commands beyond threshold
+126:1 (telnet) consecutive Telnet AYT commands beyond threshold
-
-126:2 (telnet) telnet traffic encrypted
+126:2 (telnet) Telnet traffic encrypted
-
-126:3 (telnet) telnet subnegotiation begin command without subnegotiation end
+126:3 (telnet) Telnet subnegotiation begin command without subnegotiation end
-
@@ -33772,17 +33802,17 @@ deleted -> unified2: 'filename'
-
-dnp3_func (ips_option): detection option to check dnp3 function code
+dnp3_func (ips_option): detection option to check DNP3 function code
-
-dnp3_ind (ips_option): detection option to check dnp3 indicator flags
+dnp3_ind (ips_option): detection option to check DNP3 indicator flags
-
-dnp3_obj (ips_option): detection option to check dnp3 object headers
+dnp3_obj (ips_option): detection option to check DNP3 object headers
-
@@ -33937,7 +33967,7 @@ deleted -> unified2: 'filename'
-
-gtp_version (ips_option): rule option to check gtp version
+gtp_version (ips_option): rule option to check GTP version
-
@@ -34187,7 +34217,7 @@ deleted -> unified2: 'filename'
-
-modbus_unit (ips_option): rule option to check modbus unit ID
+modbus_unit (ips_option): rule option to check Modbus unit ID
-
@@ -35182,17 +35212,17 @@ deleted -> unified2: 'filename'
-
-ips_option::dnp3_func: detection option to check dnp3 function code
+ips_option::dnp3_func: detection option to check DNP3 function code
-
-ips_option::dnp3_ind: detection option to check dnp3 indicator flags
+ips_option::dnp3_ind: detection option to check DNP3 indicator flags
-
-ips_option::dnp3_obj: detection option to check dnp3 object headers
+ips_option::dnp3_obj: detection option to check DNP3 object headers
-
@@ -35252,7 +35282,7 @@ deleted -> unified2: 'filename'
-
-ips_option::gtp_version: rule option to check gtp version
+ips_option::gtp_version: rule option to check GTP version
-
@@ -35402,7 +35432,7 @@ deleted -> unified2: 'filename'
-
-ips_option::modbus_unit: rule option to check modbus unit ID
+ips_option::modbus_unit: rule option to check Modbus unit ID
-
@@ -36543,7 +36573,7 @@ Note that on OpenBSD, divert sockets don’t work with bridges!