From: Russ Combs Date: Thu, 16 Oct 2014 03:18:36 +0000 (-0400) Subject: added --rule-to-hex and --rule-to-text X-Git-Tag: 3.0.0-233~1376 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=090cc932bf2bc789c4c9e426a71a6799d74b3716;p=thirdparty%2Fsnort3.git added --rule-to-hex and --rule-to-text --- diff --git a/ChangeLog b/ChangeLog index 48a0a30c0..01f14c0a6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,6 +19,8 @@ functionality -- latest snort2lua updates from Josh -- added cursor to so:eval function to match IpsOption::eval() +-- added --rule-to-hex and --rule-to-text to generate protected and + unprotected so rules 124 -- valgrind cleanup diff --git a/extra/src/so_rules/Makefile.am b/extra/src/so_rules/Makefile.am index 890c7e721..1f3e20a75 100644 --- a/extra/src/so_rules/Makefile.am +++ b/extra/src/so_rules/Makefile.am @@ -9,11 +9,11 @@ lib18758_la_SOURCES = sid_18758.cc sid_18758.h BUILT_SOURCES = \ sid_18758.h -%.gz : %.txt - gzip --best --no-name --stdout $< > $@ +%.h : %.txt + snort --rule-to-text < $< > $@ -%.h : %.gz - xxd -i $< > $@ +%.h : %.vrt + snort --rule-to-hex < $< > $@ AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/extra/src/so_rules/lib18758.0.dylib b/extra/src/so_rules/lib18758.0.dylib deleted file mode 100755 index 2237cdbc8..000000000 Binary files a/extra/src/so_rules/lib18758.0.dylib and /dev/null differ diff --git a/extra/src/so_rules/sid_18758.cc b/extra/src/so_rules/sid_18758.cc index db92f0d12..d095fcb37 100644 --- a/extra/src/so_rules/sid_18758.cc +++ b/extra/src/so_rules/sid_18758.cc @@ -1,7 +1,5 @@ /* ** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch ** ** This program is free software; you can redistribute it and/or modify ** it under the terms of the GNU General Public License Version 2 as @@ -64,8 +62,8 @@ static const SoApi so_api = nullptr, nullptr }, - sid_18758_gz, - sid_18758_gz_len, + (uint8_t*)rule_18758, + rule_18758_len, nullptr, // pinit nullptr, // pterm nullptr, // tinit diff --git a/extra/src/so_rules/sid_18758.h b/extra/src/so_rules/sid_18758.h index 772743643..00c9af8b2 100644 --- a/extra/src/so_rules/sid_18758.h +++ b/extra/src/so_rules/sid_18758.h @@ -1,34 +1,46 @@ -unsigned char sid_18758_gz[] = { - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x3d, 0x8f, - 0x6f, 0x6b, 0xdb, 0x30, 0x10, 0xc6, 0xdf, 0xe7, 0x53, 0x1c, 0x5e, 0x5e, - 0xb4, 0x90, 0x3f, 0x6c, 0xa3, 0xb4, 0xa8, 0xb0, 0xb1, 0x31, 0x97, 0x06, - 0xda, 0xb4, 0x74, 0xa6, 0xdb, 0x58, 0x46, 0x38, 0xcb, 0xe7, 0xe4, 0x98, - 0x22, 0x79, 0xba, 0xb3, 0xd3, 0x40, 0x3f, 0xfc, 0xe4, 0x3a, 0xad, 0xde, - 0x9c, 0xee, 0x7e, 0x8f, 0x9e, 0xd3, 0x83, 0x8e, 0xa2, 0x82, 0xda, 0x06, - 0xc6, 0xd7, 0x77, 0xb7, 0xf9, 0x7a, 0x99, 0x17, 0x80, 0xfe, 0x00, 0xd3, - 0x4f, 0x30, 0xce, 0x7f, 0x16, 0xf9, 0xc3, 0xf2, 0xcb, 0xcd, 0xcb, 0x70, - 0x7c, 0x5d, 0x14, 0xf7, 0xeb, 0xfb, 0xbb, 0x87, 0xe2, 0xfb, 0xe8, 0x64, - 0x04, 0xe9, 0xec, 0x64, 0x63, 0xb2, 0xab, 0xc5, 0x4d, 0x3e, 0x5d, 0x7c, - 0xcb, 0x97, 0xc5, 0xe2, 0xea, 0x17, 0xdc, 0xb2, 0x8d, 0x41, 0x42, 0xad, - 0xf0, 0x83, 0x7d, 0x15, 0xf6, 0x02, 0x8f, 0x2c, 0x2d, 0x3a, 0xf8, 0x8a, - 0xc2, 0x16, 0xc4, 0x46, 0x6e, 0x14, 0x6a, 0x76, 0x04, 0x89, 0x7a, 0x17, - 0xb0, 0x82, 0x48, 0xff, 0x5a, 0x12, 0xcd, 0x2e, 0x07, 0x53, 0x52, 0xac, - 0x50, 0xd1, 0x08, 0xc5, 0x8e, 0x2d, 0xc1, 0x56, 0xb5, 0x19, 0x50, 0xa4, - 0x9a, 0x22, 0x79, 0x4b, 0xa6, 0x8d, 0x6e, 0x42, 0x7e, 0xb6, 0xe7, 0xbf, - 0xdc, 0x50, 0xc5, 0x38, 0x0b, 0x71, 0x33, 0xef, 0xbb, 0xf9, 0x63, 0x29, - 0x83, 0xd8, 0x3a, 0x14, 0xd1, 0x43, 0x43, 0x66, 0xc7, 0x62, 0xa7, 0x68, - 0x95, 0x3b, 0xd6, 0xc3, 0x00, 0x85, 0x2b, 0xf3, 0xfe, 0xe2, 0xfc, 0xec, - 0xe2, 0xd5, 0xb8, 0x33, 0xc7, 0xab, 0x84, 0x84, 0x3e, 0x3e, 0x1f, 0xe1, - 0x3b, 0xa0, 0x8e, 0xe2, 0x41, 0xb7, 0xec, 0x37, 0x80, 0x65, 0xe8, 0x08, - 0xb0, 0x69, 0x08, 0xa3, 0x00, 0x7b, 0x10, 0x6d, 0xcb, 0x24, 0xd1, 0x2d, - 0x41, 0x1d, 0x9c, 0x0b, 0xfb, 0x5e, 0x55, 0x91, 0x52, 0xda, 0x15, 0x3c, - 0x84, 0xa6, 0x2f, 0x02, 0x18, 0x09, 0x7c, 0xd0, 0xb7, 0x17, 0xfd, 0x9a, - 0x3a, 0xa9, 0x8d, 0x86, 0x75, 0x1f, 0x92, 0xe2, 0x24, 0xc5, 0xc7, 0xd2, - 0xb1, 0x6c, 0xa9, 0x1a, 0xbe, 0xd1, 0x87, 0x5e, 0xb7, 0x91, 0x8f, 0x59, - 0x82, 0x57, 0xf2, 0x6a, 0xb2, 0x59, 0x57, 0x4a, 0x36, 0x49, 0x6e, 0x16, - 0x85, 0x06, 0xd6, 0xd8, 0x48, 0x26, 0x9b, 0xaf, 0x9e, 0x3e, 0x50, 0x82, - 0x27, 0xbf, 0x57, 0x9f, 0x57, 0x4f, 0x67, 0x36, 0xb5, 0xf5, 0x9f, 0xe7, - 0xf1, 0xe9, 0x5c, 0x76, 0x9c, 0xbd, 0x26, 0x33, 0xd4, 0xa1, 0xbb, 0x1c, - 0x9d, 0x8e, 0xfe, 0x03, 0x51, 0xaa, 0xf2, 0x71, 0xf4, 0x01, 0x00, 0x00 +const uint8_t rule_18758[] = +{ +0x61, 0x6C, 0x65, 0x72, 0x74, 0x20, 0x74, 0x63, 0x70, 0x20, 0x24, 0x48, +0x4F, 0x4D, 0x45, 0x5F, 0x4E, 0x45, 0x54, 0x20, 0x61, 0x6E, 0x79, 0x20, +0x2D, 0x3E, 0x20, 0x24, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4E, 0x41, 0x4C, +0x5F, 0x4E, 0x45, 0x54, 0x20, 0x24, 0x48, 0x54, 0x54, 0x50, 0x5F, 0x50, +0x4F, 0x52, 0x54, 0x53, 0x0A, 0x28, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x6D, +0x73, 0x67, 0x3A, 0x22, 0x46, 0x49, 0x4C, 0x45, 0x2D, 0x49, 0x44, 0x45, +0x4E, 0x54, 0x49, 0x46, 0x59, 0x20, 0x4D, 0x69, 0x63, 0x72, 0x6F, 0x73, +0x6F, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73, 0x20, +0x56, 0x69, 0x73, 0x75, 0x61, 0x6C, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, +0x20, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x20, 0x66, 0x69, 0x6C, 0x65, +0x20, 0x64, 0x6F, 0x77, 0x6E, 0x6C, 0x6F, 0x61, 0x64, 0x20, 0x72, 0x65, +0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, +0x6D, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x3A, 0x73, 0x65, 0x72, +0x76, 0x69, 0x63, 0x65, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3B, 0x0A, 0x20, +0x20, 0x20, 0x20, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6E, 0x63, 0x65, +0x3A, 0x75, 0x72, 0x6C, 0x2C, 0x65, 0x6E, 0x2E, 0x77, 0x69, 0x6B, 0x69, +0x70, 0x65, 0x64, 0x69, 0x61, 0x2E, 0x6F, 0x72, 0x67, 0x2F, 0x77, 0x69, +0x6B, 0x69, 0x2F, 0x56, 0x62, 0x73, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, +0x63, 0x6C, 0x61, 0x73, 0x73, 0x74, 0x79, 0x70, 0x65, 0x3A, 0x6D, 0x69, +0x73, 0x63, 0x2D, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x3B, +0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x69, 0x64, 0x3A, 0x31, 0x38, 0x37, +0x35, 0x38, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x76, 0x3A, +0x38, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x6F, 0x69, 0x64, 0x3A, +0x33, 0x7C, 0x31, 0x38, 0x37, 0x35, 0x38, 0x3B, 0x0A, 0x23, 0x20, 0x65, +0x76, 0x65, 0x72, 0x79, 0x74, 0x68, 0x69, 0x6E, 0x67, 0x20, 0x61, 0x62, +0x6F, 0x76, 0x65, 0x20, 0x61, 0x70, 0x70, 0x65, 0x61, 0x72, 0x73, 0x20, +0x69, 0x6E, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, 0x23, 0x20, 0x74, 0x68, +0x65, 0x20, 0x66, 0x6F, 0x6C, 0x6C, 0x6F, 0x77, 0x69, 0x6E, 0x67, 0x20, +0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x6F, 0x70, +0x74, 0x69, 0x6F, 0x6E, 0x73, 0x20, 0x61, 0x72, 0x65, 0x20, 0x6E, 0x6F, +0x74, 0x20, 0x69, 0x6E, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, 0x20, 0x20, +0x20, 0x20, 0x66, 0x6C, 0x6F, 0x77, 0x3A, 0x74, 0x6F, 0x5F, 0x73, 0x65, +0x72, 0x76, 0x65, 0x72, 0x2C, 0x65, 0x73, 0x74, 0x61, 0x62, 0x6C, 0x69, +0x73, 0x68, 0x65, 0x64, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x68, 0x74, +0x74, 0x70, 0x5F, 0x75, 0x72, 0x69, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, +0x63, 0x6F, 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x3A, 0x22, 0x2E, 0x76, 0x62, +0x73, 0x22, 0x2C, 0x20, 0x6E, 0x6F, 0x63, 0x61, 0x73, 0x65, 0x3B, 0x0A, +0x20, 0x20, 0x20, 0x20, 0x70, 0x63, 0x72, 0x65, 0x3A, 0x22, 0x2F, 0x5C, +0x78, 0x32, 0x65, 0x76, 0x62, 0x73, 0x28, 0x5B, 0x5C, 0x3F, 0x5C, 0x78, +0x35, 0x63, 0x5C, 0x78, 0x32, 0x66, 0x5D, 0x7C, 0x24, 0x29, 0x2F, 0x73, +0x6D, 0x69, 0x22, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x6F, 0x3A, +0x65, 0x76, 0x61, 0x6C, 0x3B, 0x0A, 0x29, 0x0A, }; -unsigned int sid_18758_gz_len = 372; +const unsigned rule_18758_len = 0; diff --git a/extra/src/so_rules/stubs.conf b/extra/src/so_rules/stubs.conf deleted file mode 100644 index 20239af54..000000000 --- a/extra/src/so_rules/stubs.conf +++ /dev/null @@ -1 +0,0 @@ -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;) diff --git a/lua/snort.lua b/lua/snort.lua index 9be5e1cf8..90d6dcfbe 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -61,7 +61,10 @@ dofile(dir .. 'reference.lua') -- experimental: only enable http_* or nhttp_inspect, not both --nhttp_inspect = { } -stream = { } +stream = +{ + icmp_cache = { memcap = 100000 } +} stream_ip = { } stream_icmp = { } stream_tcp = { } diff --git a/src/main/help.cc b/src/main/help.cc index 8e13cb006..3c4f013e3 100644 --- a/src/main/help.cc +++ b/src/main/help.cc @@ -283,6 +283,18 @@ void dump_dynamic_rules(SnortConfig* sc, const char* val) show_help(sc, val, HT_DDR); } +void dump_rule_hex(SnortConfig*, const char* val) +{ + SoManager::rule_to_hex(val); + exit(0); +} + +void dump_rule_text(SnortConfig*, const char* val) +{ + SoManager::rule_to_text(val); + exit(0); +} + void help_version(SnortConfig*, const char*) { DisplayBanner(); diff --git a/src/main/help.h b/src/main/help.h index 19d76b6e2..46686c7f9 100644 --- a/src/main/help.h +++ b/src/main/help.h @@ -48,6 +48,8 @@ void list_daqs(SnortConfig* sc, const char*); void dump_defaults(SnortConfig* sc, const char*); void dump_builtin_rules(SnortConfig* sc, const char*); void dump_dynamic_rules(SnortConfig* sc, const char*); +void dump_rule_hex(SnortConfig* sc, const char*); +void dump_rule_text(SnortConfig* sc, const char*); #endif diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc index 762921fb7..1088decbc 100644 --- a/src/main/snort_module.cc +++ b/src/main/snort_module.cc @@ -344,6 +344,12 @@ static const Parameter s_params[] = { "--rule", Parameter::PT_STRING, nullptr, nullptr, " to be added to configuration; may be repeated" }, + { "--rule-to-hex", Parameter::PT_IMPLIED, nullptr, nullptr, + "output so rule header to stdout for text rule on stdin" }, + + { "--rule-to-text", Parameter::PT_IMPLIED, nullptr, nullptr, + "output plain so rule header to stdout for text rule on stdin" }, + { "--run-prefix", Parameter::PT_STRING, nullptr, nullptr, " prepend this to each output file" }, @@ -570,10 +576,10 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc) ConfigDaqVar(sc, v.get_string()); else if ( v.is("--dump-builtin-rules") ) - dump_builtin_rules(sc, v.get_string()); + dump_builtin_rules(sc, v.get_string()); else if ( v.is("--dump-dynamic-rules") ) - dump_dynamic_rules(sc, v.get_string()); + dump_dynamic_rules(sc, v.get_string()); else if ( v.is("--dirty-pig") ) ConfigDirtyPig(sc, v.get_string()); @@ -681,6 +687,12 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc) else if ( v.is("--rule") ) parser_append_rules(v.get_string()); + else if ( v.is("--rule-to-hex") ) + dump_rule_hex(sc, v.get_string()); + + else if ( v.is("--rule-to-text") ) + dump_rule_text(sc, v.get_string()); + else if ( v.is("--run-prefix") ) sc->run_prefix = SnortStrdup(v.get_string()); diff --git a/src/managers/ips_manager.cc b/src/managers/ips_manager.cc index 77ff824d7..b40714f35 100644 --- a/src/managers/ips_manager.cc +++ b/src/managers/ips_manager.cc @@ -121,7 +121,6 @@ static bool set_arg( Value v(opt); bool ok = true; - if ( p->type == Parameter::PT_IMPLIED ) v.set(true); @@ -138,7 +137,6 @@ static bool set_arg( else v.set(val); - if ( ok && p->validate(v) ) { v.set(p); diff --git a/src/managers/so_manager.cc b/src/managers/so_manager.cc index 80d414579..eb4632fe1 100644 --- a/src/managers/so_manager.cc +++ b/src/managers/so_manager.cc @@ -34,7 +34,9 @@ #include #include +#include #include +#include using namespace std; #include "snort_types.h" @@ -75,21 +77,49 @@ void SoManager::dump_plugins() // so rules //------------------------------------------------------------------------- -#define GZIP_WBITS 31 +// FIXIT-L eliminate this arbitrary limit on rule text size +const unsigned max_rule = 128000; +static uint8_t so_buf[max_rule]; + +static const uint8_t* compress(const string& text, unsigned& len) +{ + const char* s = text.c_str(); + z_stream stream; + + stream.next_in = (Bytef*)s; + stream.avail_in = text.size(); + + stream.next_out = so_buf; + stream.avail_out = max_rule; + + stream.zalloc = nullptr; + stream.zfree = nullptr; + + stream.total_in = 0; + stream.total_out = 0; + + len = 0; + + if ( deflateInit(&stream, Z_DEFAULT_COMPRESSION) != Z_OK ) + return nullptr; + + if ( deflate(&stream, Z_FINISH) == Z_STREAM_END ) + len= stream.total_out; + + deflateEnd(&stream); + return so_buf; +} // FIXIT-L make this into a general utility for one shot decompress // and add class for stream decompress -const char* uncompress(const uint8_t* data, unsigned len) +static const char* expand(const uint8_t* data, unsigned len) { - const unsigned max_rule = 65536; - static char buf[max_rule]; - z_stream stream; stream.next_in = (Bytef*)data; stream.avail_in = (uInt)len; - stream.next_out = (Bytef*)buf; + stream.next_out = (Bytef*)so_buf; stream.avail_out = (uInt)(max_rule - 1); stream.zalloc = nullptr; @@ -98,16 +128,56 @@ const char* uncompress(const uint8_t* data, unsigned len) stream.total_in = 0; stream.total_out = 0; - if ( inflateInit2(&stream, GZIP_WBITS) != Z_OK ) + if ( inflateInit(&stream) != Z_OK ) return nullptr; if ( inflate(&stream, Z_SYNC_FLUSH) != Z_STREAM_END ) return nullptr; assert(stream.total_out < max_rule); - buf[stream.total_out] = '\0'; + so_buf[stream.total_out] = '\0'; - return buf; + return (char*)so_buf; +} + +//------------------------------------------------------------------------- + +static void strvrt(const string& text, string& data) +{ + unsigned len = 0; + const uint8_t* d = compress(text, len); + + // lose the zlib header + assert(len > 2 && d[0] == 0x78 && d[1] == 0x9C); + d += 2; + len -= 2; + + data.assign((char*)d, len); + + // FIXIT-H choose random byte for xor + uint8_t key = 0xA5; + + for ( unsigned i = 0; i < len; i++ ) + data[i] ^= key; + + data.append(1, (char)key); +} + +static const char* revert(const uint8_t* data, unsigned len) +{ + if ( !len ) + return (char*)data; + + uint8_t key = data[--len]; + string s((char*)data, len); + + for ( unsigned i = 0; i < len-1; i++ ) + s[i] ^= key; + + // force the zlib header + s.insert(0, "\x78\x9C"); + + return expand((uint8_t*)s.c_str(), s.size()); } //------------------------------------------------------------------------- @@ -128,7 +198,10 @@ const char* SoManager::get_so_options(const char* soid) if ( !api ) return nullptr; - const char* rule = uncompress(api->rule, api->length); + if ( !api->length ) + return nullptr; + + const char* rule = revert(api->rule, api->length); if ( !rule ) return nullptr; @@ -169,7 +242,7 @@ void SoManager::dump_rule_stubs(const char*) for ( auto* p : s_rules ) { const char* s; - const char* rule = uncompress(p->rule, p->length); + const char* rule = revert(p->rule, p->length); if ( !rule ) continue; @@ -183,11 +256,104 @@ void SoManager::dump_rule_stubs(const char*) continue; // FIXIT-L strip newlines (optional?) - string stub(rule, ++s-rule); - cout << stub << ")" << endl; + if ( !p->length ) + cout << rule << endl; + else + { + string stub(rule, ++s-rule); + cout << stub << ")" << endl; + } ++c; } if ( !c ) cerr << "no rules to dump" << endl; } +static void get_var(const string& s, string& v) +{ + v.clear(); + size_t pos = s.find("soid"); + + if ( pos == string::npos ) + return; + + pos = s.find("|", pos+1); + + if ( pos == string::npos ) + return; + + size_t end = s.find(";", ++pos); + + if ( end == string::npos ) + return; + + v = s.substr(pos, end-pos); +} + +void SoManager::rule_to_hex(const char*) +{ + stringstream buffer; + buffer << cin.rdbuf(); + string text = buffer.str(); + + unsigned idx; + string data; + strvrt(text, data); + + string var; + get_var(text, var); + + cout << "const uint8_t rule_" << var; + cout << "[] =" << endl; + cout << "{" << endl; + cout << hex << uppercase; + + for ( idx = 0; idx < data.size(); idx++ ) + { + if ( idx && !(idx % 12) ) + cout << endl; + + uint8_t u = data[idx]; + cout << "0x" << setfill('0') << setw(2) << hex << (int)u << ", "; + } + if ( idx % 16 ) + cout << endl; + + cout << dec; + cout << "};" << endl; + cout << "const unsigned rule_" << var << "_len = "; + cout << data.size() << ";" << endl; +} + +void SoManager::rule_to_text(const char*) +{ + stringstream buffer; + buffer << cin.rdbuf(); + string text = buffer.str(); + + unsigned len = text.size(), idx; + const uint8_t* data = (uint8_t*)text.c_str(); + + string var; + get_var(text, var); + + cout << "const uint8_t rule_" << var; + cout << "[] =" << endl; + cout << "{" << endl; + cout << hex << uppercase; + + for ( idx = 0; idx < len; idx++ ) + { + if ( idx && !(idx % 12) ) + cout << endl; + cout << "0x" << setfill('0') << setw(2) << (unsigned)data[idx] << ", "; + } + if ( idx % 16 ) + cout << endl; + + cout << dec; + cout << "};" << endl; + cout << "const unsigned rule_" << var; + cout << "_len = 0;" << endl; +} + diff --git a/src/managers/so_manager.h b/src/managers/so_manager.h index 6a84ea939..01554d274 100644 --- a/src/managers/so_manager.h +++ b/src/managers/so_manager.h @@ -48,6 +48,8 @@ public: static SoEvalFunc get_so_eval(const char* soid, const char* so, void** data); static void delete_so_data(const char* soid, void*); + static void rule_to_hex(const char* file); + static void rule_to_text(const char* file); static void dump_rule_stubs(const char*); };