From: Josh <jrosenba@cisco.com>
Date: Mon, 16 Jun 2014 17:23:59 +0000 (-0400)
Subject: adding ftp_telnet converter
X-Git-Tag: 3.0.0-233~1476^2~1^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5d4bab2c47565e612deacb8fd841240c98286ccb;p=thirdparty%2Fsnort3.git

adding ftp_telnet converter
---

diff --git a/tools/snort2lua/CMakeLists.txt b/tools/snort2lua/CMakeLists.txt
index 6de08dc00..2d0d72217 100644
--- a/tools/snort2lua/CMakeLists.txt
+++ b/tools/snort2lua/CMakeLists.txt
@@ -18,7 +18,7 @@ add_executable(snort2lua
 )
 
 target_link_libraries( snort2lua
-    converrsion_data
+    conversion_data
     keyword_states
     output_states
     preprocessor_states
diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h
index 611805d6e..870184899 100644
--- a/tools/snort2lua/conversion_state.h
+++ b/tools/snort2lua/conversion_state.h
@@ -39,17 +39,50 @@ public:
 protected:
     Converter* converter;
 
-    inline bool add_int_option(std::string keyword, std::stringstream& stream)
+    inline bool parse_int_option(std::string opt_name, std::stringstream& stream)
     {
         int val;
 
         if(stream >> val)
         {
-            converter->add_option_to_table(keyword, val);
+            converter->add_option_to_table(opt_name, val);
             return true;
         }
 
-        converter->add_comment_to_table("snort.conf missing argument for: " + keyword + " <int>");
+        converter->add_comment_to_table("snort.conf missing argument for: " + opt_name + " <int>");
+        return false;
+    }
+
+    // parse adn add a curly bracketed list to the table
+    inline bool parse_curly_bracket_list(std::string list_name, std::stringstream& stream)
+    {
+        std::string elem;
+        bool retval = true;
+
+        if(!(stream >> elem) || (elem != "{"))
+            return false;
+
+        while (stream >> elem && elem != "}")
+            retval = converter->add_list_to_table(list_name, elem) && retval;
+
+        return retval;
+    }
+
+    // parse and add a yes/no boolean option.
+    inline bool parse_yn_bool_option(std::string opt_name, std::stringstream& stream)
+    {
+        std::string val;
+
+        if(!(stream >> val))
+            return false;
+
+        else if(!val.compare("yes"))
+            return converter->add_option_to_table(opt_name, true);
+
+        else if (!val.compare("no"))
+            return converter->add_option_to_table(opt_name, false);
+
+        converter->add_comment_to_table("Unable to convert_option: " + opt_name + ' ' + val);
         return false;
     }
 
diff --git a/tools/snort2lua/data/CMakeLists.txt b/tools/snort2lua/data/CMakeLists.txt
index 41137f194..afc01b9d7 100644
--- a/tools/snort2lua/data/CMakeLists.txt
+++ b/tools/snort2lua/data/CMakeLists.txt
@@ -1,5 +1,5 @@
 
-add_library(converrsion_data
+add_library(conversion_data
     cv_data.h
     cv_data.cc
     cv_var.h
diff --git a/tools/snort2lua/data/cv_var.cc b/tools/snort2lua/data/cv_var.cc
index 394da5def..aa623602a 100644
--- a/tools/snort2lua/data/cv_var.cc
+++ b/tools/snort2lua/data/cv_var.cc
@@ -20,7 +20,7 @@
 // cv_var.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include "data/cv_var.h"
-
+#include "snort2lua_util.h"
 
 #if 0
 static inline bool var_exists(std::vector<std::string> vec, std::string name)
@@ -84,45 +84,50 @@ std::ostream& operator<<( std::ostream& out, const Variable &var)
             out << std::endl << whitespace << "    ";
 
         length += v.size();
-        out << " " << v << " ..";
+        out << v << " .. ";
     }
 
     if (var.strs.size() == 0)
-        out << " ''";
+        out << "''";
+
+
 
     else if(var.count < var.max_line_length || var.strs.size() == 1)
     {
-        out << "'";
+        std::string tmp_str = "";
 
         for (auto s : var.strs)
         {
             if ( 0 < length && length + s.size() > var.max_line_length )
-                out << std::endl << whitespace << "    ";
+                tmp_str += "\n" + whitespace + "    ";
 
             length += s.size();
-            out << " " << s;
+            tmp_str += s + ' ';
         }
-        out << "'";
+        util::trim(tmp_str);
+        out << "'" << tmp_str << "'";
     }
     else
     {
-        out << std::endl <<  whitespace << "[[" << std::endl;
-        out << whitespace << "    ";
         length = 4 + whitespace.size();
+        std::string tmp_str = "";
 
         for (auto s : var.strs)
         {
             if ( 0 < length && length + s.size() > var.max_line_length )
             {
-                out << std::endl << whitespace << "    ";
+                tmp_str += "\n" + whitespace + "    ";
                 length = 4 + whitespace.size();
             }
 
             length += s.size();
-            out << " " << s;
+            tmp_str += s + " ";
         }
 
-        out << std::endl << whitespace << "]]";
+        util::trim(tmp_str);
+        out << std::endl <<  whitespace << "[[" << std::endl;
+        out << whitespace << "    " << tmp_str << std::endl;
+        out << whitespace << "]]";
     }
 
     return out;
diff --git a/tools/snort2lua/keyword_states/kws_config.cc b/tools/snort2lua/keyword_states/kws_config.cc
index 7babe5ff0..9c1d5f6db 100644
--- a/tools/snort2lua/keyword_states/kws_config.cc
+++ b/tools/snort2lua/keyword_states/kws_config.cc
@@ -21,7 +21,6 @@
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
diff --git a/tools/snort2lua/keyword_states/kws_include.cc b/tools/snort2lua/keyword_states/kws_include.cc
index 5ddaf799f..8181eff03 100644
--- a/tools/snort2lua/keyword_states/kws_include.cc
+++ b/tools/snort2lua/keyword_states/kws_include.cc
@@ -21,7 +21,6 @@
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
diff --git a/tools/snort2lua/keyword_states/kws_preprocessor.cc b/tools/snort2lua/keyword_states/kws_preprocessor.cc
index 203bdf475..25d04a4af 100644
--- a/tools/snort2lua/keyword_states/kws_preprocessor.cc
+++ b/tools/snort2lua/keyword_states/kws_preprocessor.cc
@@ -21,7 +21,6 @@
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
diff --git a/tools/snort2lua/keyword_states/kws_suppress.cc b/tools/snort2lua/keyword_states/kws_suppress.cc
index 043463fa0..420a51735 100644
--- a/tools/snort2lua/keyword_states/kws_suppress.cc
+++ b/tools/snort2lua/keyword_states/kws_suppress.cc
@@ -17,11 +17,10 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// suppress.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// kws_suppress.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
diff --git a/tools/snort2lua/keyword_states/kws_var.cc b/tools/snort2lua/keyword_states/kws_var.cc
index 91f2941e9..17d9fdd2a 100644
--- a/tools/snort2lua/keyword_states/kws_var.cc
+++ b/tools/snort2lua/keyword_states/kws_var.cc
@@ -21,7 +21,6 @@
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt
index 0fa357db4..5da406723 100644
--- a/tools/snort2lua/preprocessor_states/CMakeLists.txt
+++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt
@@ -6,6 +6,9 @@ add_library(preprocessor_states
     pps_normalizers.cc
     pps_sfportscan.cc
     pps_ftp_telnet.cc
+    pps_ftp_telnet_protocol.cc
+    pps_bo.cc
     preprocessor_api.h
     preprocessor_api.cc
 )
+
diff --git a/tools/snort2lua/preprocessor_states/pps_bo.cc b/tools/snort2lua/preprocessor_states/pps_bo.cc
new file mode 100644
index 000000000..bbf5a776e
--- /dev/null
+++ b/tools/snort2lua/preprocessor_states/pps_bo.cc
@@ -0,0 +1,46 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// pps_bo.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+#include <iomanip>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+
+
+static ConversionState* bo_ctor(Converter* cv)
+{
+    cv->open_table("bo");
+    cv->close_table();
+    return nullptr;
+}
+
+static const ConvertMap preprocessor_bo = 
+{
+    "bo",
+    bo_ctor,
+};
+
+const ConvertMap* bo_map = &preprocessor_bo;
+
diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc
index f1c633522..3ba1a98f9 100644
--- a/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc
+++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet.cc
@@ -17,11 +17,10 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_ftp_telnet.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
@@ -35,66 +34,81 @@ public:
     FtpTelnet(Converter* cv)  : ConversionState(cv) {};
     virtual ~FtpTelnet() {};
     virtual bool convert(std::stringstream& data_stream);
+private:
+    bool add_ftp_n_telnet_option(std::string opt_name, bool val);
+    void add_ftp_n_telnet_deprecated(std::string opt_name);
 };
 
 } // namespace
 
+bool FtpTelnet::add_ftp_n_telnet_option(std::string opt_name, bool val)
+{
+    bool retval;
+
+    converter->open_table("telnet");
+    retval = converter->add_option_to_table(opt_name, val);
+    converter->close_table();
+    converter->open_table("ftp_server");
+    retval = converter->add_option_to_table(opt_name, val) && retval;
+    converter->close_table();
+    return retval;
+}
+
+void FtpTelnet::add_ftp_n_telnet_deprecated(std::string opt_name)
+{
+    converter->open_table("telnet");
+    converter->add_deprecated_comment(opt_name);
+    converter->close_table();
+    converter->open_table("ftp_server");
+    converter->add_deprecated_comment(opt_name);
+    converter->close_table();
+}
 
 bool FtpTelnet::convert(std::stringstream& data_stream)
 {
-#if 0
-# FTP / Telnet normalization and anomaly detection.  For more information, see README.ftptelnet
-preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted
-preprocessor ftp_telnet_protocol: telnet \
-    ayt_attack_thresh 20 \
-    normalize ports { 23 } \
-    detect_anomalies
-preprocessor ftp_telnet_protocol: ftp server default \
-    def_max_param_len 100 \
-    ports { 21 2100 3535 } \
-    telnet_cmds yes \
-    ignore_telnet_erase_cmds yes \
-    ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
-    ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
-    ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
-    ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \
-    ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
-    ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
-    ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
-    ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
-    ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
-    ftp_cmds { XSEN XSHA1 XSHA256 } \
-    alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
-    alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
-    alt_max_param_len 256 { CWD RNTO } \
-    alt_max_param_len 400 { PORT } \
-    alt_max_param_len 512 { SIZE } \
-    chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
-    chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
-    chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
-    chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
-    chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
-    chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
-    chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \
-    chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
-    cmd_validity ALLO < int [ char R int ] > \
-    cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
-    cmd_validity MACB < string > \
-    cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
-    cmd_validity MODE < char ASBCZ > \
-    cmd_validity PORT < host_port > \
-    cmd_validity PROT < char CSEP > \
-    cmd_validity STRU < char FRPO [ string ] > \
-    cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
-preprocessor ftp_telnet_protocol: ftp client default \
-    max_resp_len 256 \
-    bounce yes \
-    ignore_telnet_erase_cmds yes \
-    telnet_cmds yes
-#endif
-
-    data_stream.setstate(std::basic_ios<char>::eofbit);
-    return true;    
+
+    std::string keyword;
+    std::string s_value;
+
+    // using this to keep track of any errors.  I want to convert as much 
+    // as possible while being aware something went wrong
+    bool retval = true;
+
+    if(data_stream >> keyword)
+    {
+        if(keyword.compare("global"))
+        {
+            converter->log_error("preprocessor ftp_telnet: requires the 'global' keyword");
+            return false;
+        }
+    }
+
+    while(data_stream >> keyword)
+    {
+        if(!keyword.compare("check_encrypted"))
+            retval = add_ftp_n_telnet_option("check_encrypted", true);
+
+        else if(!keyword.compare("inspection_type"))
+            add_ftp_n_telnet_deprecated("inspection_type");
+
+        else if(!keyword.compare("encrypted_traffic"))
+        {
+            data_stream >> s_value;
+
+            if(s_value.compare("yes"))
+                retval = add_ftp_n_telnet_option("encrypted_traffic", true) && retval;
+
+            else
+                retval = add_ftp_n_telnet_option("encrypted_traffic", false) && retval;
+            
+        }
+
+        else
+            retval = false;
+
+    }
+
+    return retval;    
 }
 
 /**************************
@@ -106,10 +120,10 @@ static ConversionState* ctor(Converter* cv)
     return new FtpTelnet(cv);
 }
 
-static const ConvertMap keyword_preprocessor = 
+static const ConvertMap preprocessor_ftptelnet = 
 {
     "ftp_telnet",
     ctor,
 };
 
-const ConvertMap* preprocessor_map = &keyword_preprocessor;
+const ConvertMap* ftptelnet_map = &preprocessor_ftptelnet;
diff --git a/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
new file mode 100644
index 000000000..5ba491956
--- /dev/null
+++ b/tools/snort2lua/preprocessor_states/pps_ftp_telnet_protocol.cc
@@ -0,0 +1,372 @@
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2002-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation.  You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// pps_ftp_telnet_protocol.cc author Josh Rosenbaum <jorosenba@cisco.com>
+
+#include <sstream>
+#include <vector>
+
+#include "conversion_state.h"
+#include "converter.h"
+#include "snort2lua_util.h"
+
+namespace {
+
+class FtpServer : public ConversionState
+{
+public:
+    FtpServer(Converter* cv);
+    virtual ~FtpServer() {};
+    virtual bool convert(std::stringstream& data_stream);
+private:
+    bool parse_alt_max_cmd(std::stringstream& data_stream);
+    bool parse_cmd_validity_cmd(std::stringstream& data_stream);
+    static int ftpsever_binding_id;
+};
+
+class FtpClient : public ConversionState
+{
+public:
+    FtpClient(Converter* cv) : ConversionState(cv) {};
+    virtual ~FtpClient() {};
+    virtual bool convert(std::stringstream& data_stream);
+private:
+    static int ftpclient_binding_id;
+};
+
+class Telnet : public ConversionState
+{
+public:
+    Telnet(Converter* cv)  : ConversionState(cv) {};
+    virtual ~Telnet() {};
+    virtual bool convert(std::stringstream& data_stream);
+};
+
+class FtpTelnetProtocol : public ConversionState
+{
+public:
+    FtpTelnetProtocol(Converter* cv)  : ConversionState(cv) {};
+    virtual ~FtpTelnetProtocol() {};
+    virtual bool convert(std::stringstream& data_stream);
+};
+
+} // namespace
+
+
+/****************************************
+ *******  FtpServer Protocol  ***********
+ ****************************************/
+
+int FtpServer::ftpsever_binding_id = 1;
+
+
+FtpServer::FtpServer(Converter* cv)  : ConversionState(cv)
+{}
+
+bool FtpServer::parse_alt_max_cmd(std::stringstream& data_stream)
+{
+    int i_val;
+    bool tmpval;
+
+    if(!(data_stream >> i_val))
+        return false;
+
+    converter->open_table("alt_max_param");
+    converter->open_table();
+    converter->add_option_to_table("length", i_val);
+    tmpval = parse_curly_bracket_list("commands", data_stream);
+    converter->close_table();
+    converter->close_table();
+    return tmpval;
+}
+
+bool FtpServer::parse_cmd_validity_cmd(std::stringstream& data_stream)
+{
+    std::string val;
+    std::string elem;
+    bool tmpval;
+
+    if(!(data_stream >> val))
+        return false;
+
+    if(!(data_stream >> elem) || (elem != "<"))
+        return false;
+
+
+    converter->open_table("cmd_validity");
+    converter->open_table();
+    tmpval = converter->add_option_to_table("command", val);
+    tmpval = converter->add_list_to_table("format", elem) && tmpval;
+
+    while((data_stream >> elem) && (elem != ">"))
+        tmpval = converter->add_list_to_table("format", elem) && tmpval;
+
+    converter->add_list_to_table("format", elem);
+    converter->close_table(); // anonymouse table
+    converter->close_table(); // "cmd_validity" table
+    return tmpval;
+}
+
+bool FtpServer::convert(std::stringstream& data_stream)
+{
+    std::string keyword;
+    bool retval = true;
+
+    if (data_stream >> keyword)
+    {
+        if(!keyword.compare("default"))
+            converter->open_table("ftp_server");
+        else
+        {
+            converter->open_table("ftp_server_target_" + std::to_string(ftpsever_binding_id));
+            ftpsever_binding_id++;
+            converter->add_comment_to_table("Unable to create target based ftp configuration at this time!!!");
+            retval = false;
+        }
+    }
+    else
+    {
+        return false;
+    }
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
+
+
+        if(!keyword.compare("print_cmds"))
+            converter->add_option_to_table("print_cmds", true);
+
+        else if(!keyword.compare("def_max_param_len"))
+            tmpval = parse_int_option("def_max_param_len", data_stream);
+
+        else if(!keyword.compare("telnet_cmds"))
+            tmpval = parse_yn_bool_option("telnet_cmds", data_stream);
+        
+        else if(!keyword.compare("ignore_telnet_erase_cmds"))
+            tmpval = parse_yn_bool_option("ignore_telnet_erase_cmds", data_stream);
+
+        else if(!keyword.compare("ignore_data_chan"))
+            tmpval = parse_yn_bool_option("ignore_data_chan", data_stream);
+
+        else if(!keyword.compare("ftp_cmds"))
+            tmpval = parse_curly_bracket_list("ftp_cmds", data_stream);
+
+        else if(!keyword.compare("chk_str_fmt"))
+            tmpval = parse_curly_bracket_list("chk_str_fmt", data_stream);
+
+        else if(!keyword.compare("alt_max_param_len"))
+            tmpval = parse_alt_max_cmd(data_stream);
+
+        else if(!keyword.compare("cmd_validity"))
+            tmpval = parse_cmd_validity_cmd(data_stream);
+        
+        else if(!keyword.compare("data_chan"))
+        {
+            converter->add_deprecated_comment("data_chan", "ignore_data_chan");
+            tmpval = converter->add_option_to_table("ignore_data_chan", true);
+        }
+
+        else if (!keyword.compare("ports"))
+        {
+            converter->add_deprecated_comment("ports", "bindings");
+            converter->add_comment_to_table("check bindings table for port information");
+            // add commented list for now
+            std::string tmp = "";
+            while (data_stream >> keyword && keyword != "}")
+                tmp += " " + keyword;
+            tmpval = converter->add_option_to_table("--ports", tmp + "}");
+        }
+
+        else
+        {
+            tmpval = false;
+        }
+
+        retval = retval && tmpval;
+    }
+    return retval;
+}
+
+/****************************************
+ *******  FtpClient Protocol  ***********
+ ****************************************/
+
+int FtpClient::ftpclient_binding_id = 1;
+
+bool FtpClient::convert(std::stringstream& data_stream)
+{
+    std::string keyword;
+    bool retval = true;
+
+    if (data_stream >> keyword)
+    {
+        if(!keyword.compare("default"))
+            converter->open_table("ftp_client");
+        else
+        {
+            converter->open_table("ftp_client_target_" + std::to_string(ftpclient_binding_id));
+            ftpclient_binding_id++;
+            converter->add_comment_to_table("Unable to create target based ftp configuration at this time!!!");
+            retval = false;
+        }
+    }
+    else
+    {
+        return false;
+    }
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval = true;
+
+
+        if(!keyword.compare("telnet_cmds"))
+            tmpval = parse_yn_bool_option("telnet_cmds", data_stream);
+
+        else if(!keyword.compare("ignore_telnet_erase_cmds"))
+            tmpval = parse_yn_bool_option("ignore_telnet_erase_cmds", data_stream);
+
+        else if(!keyword.compare("max_resp_len"))
+            tmpval = parse_int_option("max_resp_len", data_stream);
+
+        else if(!keyword.compare("bounce"))
+            tmpval = parse_yn_bool_option("bounce", data_stream);
+
+        // add bounce_to as a commented list
+        else if(!keyword.compare("bounce_to"))
+        {
+            std::string tmp = "";
+            while (data_stream >> keyword && keyword != "}")
+                tmp += " " + keyword;
+            tmpval = converter->add_option_to_table("--bounce_to", tmp + "}");
+        }
+
+        else
+        {
+            tmpval = false;
+        }
+
+        retval = retval && tmpval;
+    }
+
+
+    return retval;
+}
+
+/****************************************
+ *********  Telnet Protocol  ************
+ ****************************************/
+
+bool Telnet::convert(std::stringstream& data_stream)
+{
+    std::string keyword;
+    int i_val;
+    bool retval = true;
+
+    converter->open_table("telnet");
+
+    while(data_stream >> keyword)
+    {
+        bool tmpval;
+        if(!keyword.compare("ayt_attack_thresh"))
+        {
+            if(data_stream >> i_val)
+                tmpval = converter->add_option_to_table("ayt_attack_thresh", i_val);
+            else
+                tmpval = false;
+        }
+
+        else  if(!keyword.compare("normalize"))
+            tmpval = converter->add_option_to_table("normalize", true);
+
+        else  if(!keyword.compare("ports"))
+        {
+            converter->add_deprecated_comment("ports", "bindings");
+            converter->add_comment_to_table("check bindings table for port information");
+            // vvvv defined in ConversionState vvvv
+            parse_curly_bracket_list("--ports", data_stream); // create a commented list of the ports
+        }
+
+        else  if(!keyword.compare("detect_anomalies"))
+            tmpval = converter->add_option_to_table("detect_anomalies", true);
+
+        else
+            tmpval = false;
+
+        retval = tmpval && retval;
+    }
+
+
+    converter->close_table(); // not necessary but 
+    return retval;
+}
+
+/****************************************
+ *******  FtpTelnetProtocol  ************
+ ****************************************/
+
+
+bool FtpTelnetProtocol::convert(std::stringstream& data_stream)
+{
+    std::string protocol;
+
+    if(data_stream >> protocol)
+    {
+        if(!protocol.compare("telnet"))
+        {
+            converter->set_state(new Telnet(converter));
+        }
+        else if (!protocol.compare("ftp"))
+        {
+            if(data_stream >> protocol)
+            {
+                if(!protocol.compare("client"))
+                    converter->set_state(new FtpClient(converter));
+
+                else if (!protocol.compare("server"))
+                    converter->set_state(new FtpServer(converter));
+
+                else
+                    return false;
+            }
+        }
+        else
+            return false;
+
+        return true;
+    }
+
+    return false;
+}
+
+/*******  PUBLIC API ************/
+
+static ConversionState* ctor(Converter* cv)
+{
+    return new FtpTelnetProtocol(cv);
+}
+
+static const ConvertMap ftptelnet_protocol_preprocessor = 
+{
+    "ftp_telnet_protocol",
+    ctor,
+};
+
+const ConvertMap* ftptelnet_protocol_map = &ftptelnet_protocol_preprocessor;
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
index a928eeb64..5ab10bc05 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect.cc
@@ -78,10 +78,10 @@ bool HttpInspect::convert(std::stringstream& data_stream)
     while(data_stream >> keyword)
     {
         if(!keyword.compare("compress_depth"))
-            retval = add_int_option("compress_depth", data_stream) && retval;
+            retval = parse_int_option("compress_depth", data_stream) && retval;
 
         else if(!keyword.compare("decompress_depth")) 
-            retval = add_int_option("decompress_depth", data_stream) && retval;
+            retval = parse_int_option("decompress_depth", data_stream) && retval;
 
         else if(!keyword.compare("detect_anomalous_servers"))
             converter->add_option_to_table("detect_anomalous_servers", true);
@@ -90,10 +90,10 @@ bool HttpInspect::convert(std::stringstream& data_stream)
             converter->add_option_to_table("proxy_alert", true);
 
         else if(!keyword.compare("max_gzip_mem"))
-            retval = add_int_option("max_gzip_mem", data_stream) && retval;
+            retval = parse_int_option("max_gzip_mem", data_stream) && retval;
         
         else if(!keyword.compare("memcap"))
-            retval = add_int_option("memcap", data_stream) && retval;
+            retval = parse_int_option("memcap", data_stream) && retval;
         
         else if(!keyword.compare("disabled"))
             converter->add_comment_to_table("'disabled' is deprecated");
diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
index b034406ab..c2af23f56 100644
--- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
+++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc
@@ -17,11 +17,10 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// config.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_http_inspect_server.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
diff --git a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
index 4ca07758c..a8cf3eaaa 100644
--- a/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
+++ b/tools/snort2lua/preprocessor_states/pps_sfportscan.cc
@@ -17,11 +17,10 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
-// portscan.cc author Josh Rosenbaum <jorosenba@cisco.com>
+// pps_sfportscan.cc author Josh Rosenbaum <jorosenba@cisco.com>
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"
@@ -131,13 +130,15 @@ bool PortScan::convert(std::stringstream& data_stream)
         if(!keyword.compare("proto"))
         {
             converter->add_deprecated_comment("proto", "protos");
-            retval = parse_list("protos", data_stream) && retval;
+            // defined in ConversionState vvvv
+            retval = parse_curly_bracket_list("protos", data_stream) && retval;
         }
 
         if(!keyword.compare("scan_type"))
         {
             converter->add_deprecated_comment("scan_type", "scan_types");
-            retval = parse_list("scan_types", data_stream) && retval;
+            // defined in ConversionState vvvv
+            retval = parse_curly_bracket_list("scan_types", data_stream) && retval;
         }
         else if(!keyword.compare("sense_level"))
             retval = parse_option("sense_level", data_stream) && retval;
diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
index 78ea8c46a..9db516654 100644
--- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc
+++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc
@@ -24,6 +24,9 @@
 
 extern const ConvertMap *arpspoof_map;
 extern const ConvertMap *arpspoof_host_map;
+extern const ConvertMap *bo_map;
+extern const ConvertMap *ftptelnet_map;
+extern const ConvertMap *ftptelnet_protocol_map;
 extern const ConvertMap *httpinspect_map;
 extern const ConvertMap *normalizer_icmp4_map;
 extern const ConvertMap *normalizer_icmp6_map;
@@ -37,7 +40,10 @@ const std::vector<const ConvertMap*> preprocessor_api =
 {
     arpspoof_map,
     arpspoof_host_map,
+    bo_map,
+    ftptelnet_map,
     httpinspect_map,
+    ftptelnet_protocol_map,
     normalizer_icmp4_map,
     normalizer_icmp6_map,
     normalizer_ip4_map,
diff --git a/tools/snort2lua/snort2lua.cc b/tools/snort2lua/snort2lua.cc
index 5eb76b577..c7279c041 100644
--- a/tools/snort2lua/snort2lua.cc
+++ b/tools/snort2lua/snort2lua.cc
@@ -82,7 +82,7 @@ static bool convert(std::ifstream& in, std::ofstream& out)
 
 static void show_usage()
 {
-    std::cout << "usage:  snort2lua <input_conf_file> <output_lua_file" << std::endl;
+    std::cout << "usage:  snort2lua <input_conf_file> <output_lua_file>" << std::endl;
 }
 
 int main (int argc, char* argv[])
diff --git a/tools/snort2lua/snort2lua_util.cc b/tools/snort2lua/snort2lua_util.cc
index 802423444..b441c8483 100644
--- a/tools/snort2lua/snort2lua_util.cc
+++ b/tools/snort2lua/snort2lua_util.cc
@@ -31,22 +31,6 @@ namespace util
 {
 
 
-// trim from start
-std::string &ltrim(std::string &s) {
-        s.erase(s.begin(), std::find_if(s.begin(), s.end(), std::not1(std::ptr_fun<int, int>(std::isspace))));
-        return s;
-}
-
-// trim from end
-std::string &rtrim(std::string &s) {
-        s.erase(std::find_if(s.rbegin(), s.rend(), std::not1(std::ptr_fun<int, int>(std::isspace))).base(), s.end());
-        return s;
-}
-
-// trim from both ends
-std::string &trim(std::string &s) {
-        return ltrim(rtrim(s));
-}
 
 
 std::vector<std::string> &split(const std::string &s, 
diff --git a/tools/snort2lua/snort2lua_util.h b/tools/snort2lua/snort2lua_util.h
index bcefae1cf..85a199bf9 100644
--- a/tools/snort2lua/snort2lua_util.h
+++ b/tools/snort2lua/snort2lua_util.h
@@ -25,6 +25,10 @@
 
 #include <string>
 #include <vector>
+#include <algorithm> 
+#include <functional> 
+#include <cctype>
+#include <locale>
 
 struct ConvertMap;
 
@@ -40,6 +44,25 @@ std::string &ltrim(std::string &s);
 std::string &rtrim(std::string &s);
 // trim from both ends
 std::string &trim(std::string &s);
+
+
+// trim from start
+inline std::string &ltrim(std::string &s) {
+        s.erase(s.begin(), std::find_if(s.begin(), s.end(), std::not1(std::ptr_fun<int, int>(std::isspace))));
+        return s;
+}
+
+// trim from end
+inline std::string &rtrim(std::string &s) {
+        s.erase(std::find_if(s.rbegin(), s.rend(), std::not1(std::ptr_fun<int, int>(std::isspace))).base(), s.end());
+        return s;
+}
+
+// trim from both ends
+inline std::string &trim(std::string &s) {
+        return ltrim(rtrim(s));
+}
+
 } // namespace util
 
 #endif
diff --git a/tools/snort2lua/state_template.cc b/tools/snort2lua/state_template.cc
index 715f3b54d..a795624f8 100644
--- a/tools/snort2lua/state_template.cc
+++ b/tools/snort2lua/state_template.cc
@@ -21,7 +21,6 @@
 
 #include <sstream>
 #include <vector>
-#include <iomanip>
 
 #include "conversion_state.h"
 #include "converter.h"