From: Russ Combs (rucombs) Date: Thu, 3 Aug 2017 22:16:37 +0000 (-0400) Subject: Merge pull request #982 in SNORT/snort3 from snort2lua_tbd to master X-Git-Tag: 3.0.0-240~77 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8095dfa7363caef8f83fdff47734166c57ddfb98;p=thirdparty%2Fsnort3.git Merge pull request #982 in SNORT/snort3 from snort2lua_tbd to master Squashed commit of the following: commit d1fa8d0f7e525c7be5834598f882681e430e1132 Author: Carter Waxman Date: Thu Aug 3 18:12:45 2017 -0400 snort2lua: removed dead comments commit 86f07d1a0038cfb3da576e8bacd8af9868e9a068 Author: Carter Waxman Date: Fri Jul 28 15:24:58 2017 -0400 snort2lua: added dynamicoutput to deleted list commit 523ddfa51f0301c7e106c74b9745b3f35d561a6d Author: Carter Waxman Date: Fri Jul 28 13:59:51 2017 -0400 snort2lua: added firewall to unsupported list commit 1021f6d10712c290986356ffc2127e24d494dd70 Author: Carter Waxman Date: Fri Jul 28 13:36:33 2017 -0400 snort2lua: added nap_selector to unsupported list commit b8b058da7779c802b906813ba108cbaa10a3a11a Author: Carter Waxman Date: Fri Jul 28 13:19:05 2017 -0400 snort2lua: added sf_unified2 to unsupported list and matching log/alert to deleted. commit e54a3faff40023cecc60ec8a58c502a241c94843 Author: Carter Waxman Date: Thu Jul 27 12:44:03 2017 -0400 snort2lua: added config protected_content to deleted list commit e54ec4b55d4dcdcf9d4164151860de2726cc0df7 Author: Carter Waxman Date: Wed Jul 26 12:44:42 2017 -0400 snort2lua: added config_na_policy_mode to unsupported list commit 88dd22b5999a6f673ea747bae36060e916321c52 Author: Carter Waxman Date: Tue Jul 25 10:02:33 2017 -0400 snort2lua: added XFF configuration to unsupported list commit f38d8334ba8de1e964daed54212b8d448d1408bf Author: Carter Waxman Date: Fri Jul 28 09:58:40 2017 -0400 snort2lua: added ability to add top level unsupported comments commit f3a06388660ceb897d37b0d3527f005d1d5936b7 Author: Carter Waxman Date: Mon Jul 24 10:29:23 2017 -0400 snort2lua: condensed failed_conversion to one method --- diff --git a/tools/snort2lua/config_states/CMakeLists.txt b/tools/snort2lua/config_states/CMakeLists.txt index 9f81e2237..d9bb6b2d0 100644 --- a/tools/snort2lua/config_states/CMakeLists.txt +++ b/tools/snort2lua/config_states/CMakeLists.txt @@ -15,6 +15,7 @@ add_library( config_states config_ipv6_frag.cc config_memcaps.cc config_mpls_payload_type.cc + config_na_policy_mode.cc config_no_option.cc config_one_int_option.cc config_one_string_option.cc diff --git a/tools/snort2lua/config_states/Makefile.am b/tools/snort2lua/config_states/Makefile.am index cf2fe6b3d..a5baae0fd 100644 --- a/tools/snort2lua/config_states/Makefile.am +++ b/tools/snort2lua/config_states/Makefile.am @@ -17,6 +17,7 @@ config_ignore_ports.cc \ config_ipv6_frag.cc \ config_memcaps.cc \ config_mpls_payload_type.cc \ +config_na_policy_mode.cc \ config_no_option.cc \ config_one_int_option.cc \ config_one_string_option.cc \ diff --git a/tools/snort2lua/config_states/config_api.cc b/tools/snort2lua/config_states/config_api.cc index 04ab3f4c6..8897c8e8f 100644 --- a/tools/snort2lua/config_states/config_api.cc +++ b/tools/snort2lua/config_states/config_api.cc @@ -103,6 +103,7 @@ extern const ConvertMap* max_metadata_services_map; extern const ConvertMap* max_mpls_labelchain_len_map; extern const ConvertMap* mpls_payload_type_map; extern const ConvertMap* min_ttl_map; +extern const ConvertMap* na_policy_mode_map; extern const ConvertMap* new_ttl_map; extern const ConvertMap* nolog_map; extern const ConvertMap* nopcre_map; @@ -119,6 +120,7 @@ extern const ConvertMap* policy_mode_map; extern const ConvertMap* policy_version_map; extern const ConvertMap* profile_preprocs_map; extern const ConvertMap* profile_rules_map; +extern const ConvertMap* protected_content_map; extern const ConvertMap* quiet_map; extern const ConvertMap* rate_filter_map; extern const ConvertMap* react_map; @@ -220,6 +222,7 @@ const std::vector config_api = max_metadata_services_map, max_mpls_labelchain_len_map, mpls_payload_type_map, + na_policy_mode_map, new_ttl_map, nolog_map, nopcre_map, @@ -236,6 +239,7 @@ const std::vector config_api = policy_version_map, profile_preprocs_map, profile_rules_map, + protected_content_map, quiet_map, rate_filter_map, react_map, diff --git a/tools/snort2lua/config_states/config_deleted.cc b/tools/snort2lua/config_states/config_deleted.cc index e04a0fe7e..97aa426d4 100644 --- a/tools/snort2lua/config_states/config_deleted.cc +++ b/tools/snort2lua/config_states/config_deleted.cc @@ -570,4 +570,17 @@ static const ConvertMap decode_data_link_api = }; const ConvertMap* decode_data_link_map = &decode_data_link_api; + +/************************************************* + ************* protected_content **************** + *************************************************/ + +static const std::string protected_content = "protected_content"; +static const ConvertMap protected_content_api = +{ + protected_content, + deleted_ctor<& protected_content>, +}; + +const ConvertMap* protected_content_map = &protected_content_api; } // namespace config diff --git a/tools/snort2lua/config_states/config_na_policy_mode.cc b/tools/snort2lua/config_states/config_na_policy_mode.cc new file mode 100644 index 000000000..d07a82cc1 --- /dev/null +++ b/tools/snort2lua/config_states/config_na_policy_mode.cc @@ -0,0 +1,44 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2017-2017 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// config_na_policy_mode.cc author Carter Waxman + +#include +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "helpers/s2l_util.h" + +namespace config +{ + +//FIXIT-L add when snort supports separate inline mode and normalization inline mode +static std::string header = "config na_policy_mode: "; + +static ConversionState* ctor(Converter& c) +{ return new UnsupportedState<&header>(c); } + +static const ConvertMap na_policy_mode_api = +{ + "na_policy_mode", + ctor, +}; + +const ConvertMap* na_policy_mode_map = &na_policy_mode_api; +} // namespace config + diff --git a/tools/snort2lua/conversion_state.h b/tools/snort2lua/conversion_state.h index 8f36ecc4a..a0028460a 100644 --- a/tools/snort2lua/conversion_state.h +++ b/tools/snort2lua/conversion_state.h @@ -296,5 +296,20 @@ protected: private: }; +template +class UnsupportedState : public ConversionState +{ +public: + UnsupportedState(Converter& c) : ConversionState(c) {} + virtual ~UnsupportedState() {} + + bool convert(std::istringstream& data_stream) + { + data_api.add_unsupported_comment(*config_header + + std::string(std::istreambuf_iterator(data_stream), {})); + return true; + } +}; + #endif diff --git a/tools/snort2lua/data/data_types/dt_comment.h b/tools/snort2lua/data/data_types/dt_comment.h index baf1668a2..1629d8cee 100644 --- a/tools/snort2lua/data/data_types/dt_comment.h +++ b/tools/snort2lua/data/data_types/dt_comment.h @@ -29,6 +29,10 @@ static const std::string start_comments = " these lines were commented " "in the configuration file.\n\n"; +static const std::string start_unsupported = + "\nUNSUPPORTED:\n" + " these configuration items are not currently supported\n\n"; + static const std::string start_errors = "\nERRORS:\n" " all of these occurred during the attempted conversion:\n\n"; diff --git a/tools/snort2lua/data/dt_data.cc b/tools/snort2lua/data/dt_data.cc index 78a105a2f..098b78808 100644 --- a/tools/snort2lua/data/dt_data.cc +++ b/tools/snort2lua/data/dt_data.cc @@ -39,6 +39,8 @@ DataApi::DataApi() : curr_data_bad(false) Comments::CommentType::MULTI_LINE); errors = new Comments(start_errors, 0, Comments::CommentType::MULTI_LINE); + unsupported = new Comments(start_unsupported, 0, + Comments::CommentType::MULTI_LINE); } DataApi::~DataApi() @@ -51,6 +53,7 @@ DataApi::~DataApi() delete comments; delete errors; + delete unsupported; } std::string DataApi::translate_variable(const std::string& var_name) @@ -238,21 +241,7 @@ std::string DataApi::get_file_line() return error_string; } -void DataApi::failed_conversion(const std::istringstream& stream) -{ - // we only need to go through this once. - if (!curr_data_bad) - { - errors->add_text(std::string()); - errors->add_text(get_file_line()); - errors->add_text(stream.str()); - curr_data_bad = true; - errors_count++; - } -} - -void DataApi::failed_conversion(const std::istringstream& stream, - const std::string unknown_option) +void DataApi::failed_conversion(const std::istringstream& stream, const std::string unknown_option) { // we only need to go through this once. if (!curr_data_bad) @@ -263,7 +252,8 @@ void DataApi::failed_conversion(const std::istringstream& stream, curr_data_bad = true; errors_count++; } - errors->add_text("^^^^ unknown_syntax=" + unknown_option); + if ( unknown_option.size() ) + errors->add_text("^^^^ unknown_syntax=" + unknown_option); } bool DataApi::add_variable(std::string name, std::string value) @@ -304,6 +294,9 @@ void DataApi::developer_error(std::string error_string) void DataApi::add_comment(std::string c) { comments->add_text(c); } +void DataApi::add_unsupported_comment(std::string c) +{ unsupported->add_text(c); } + void DataApi::print_errors(std::ostream& out) { if (is_default_mode() && @@ -328,9 +321,15 @@ void DataApi::print_comments(std::ostream& out) out << (*comments) << "\n"; } +void DataApi::print_unsupported(std::ostream& out) +{ + if (is_default_mode() && !unsupported->empty()) + out << (*unsupported) << "\n"; +} + void DataApi::swap_conf_data(std::vector& new_vars, std::vector& new_includes, - Comments*& new_comments) + Comments*& new_comments, Comments*& new_unsupported) { vars.swap(new_vars); includes.swap(new_includes); @@ -338,5 +337,9 @@ void DataApi::swap_conf_data(std::vector& new_vars, Comments* tmp = new_comments; new_comments = comments; comments = tmp; + + tmp = new_unsupported; + new_unsupported = unsupported; + unsupported = tmp; } diff --git a/tools/snort2lua/data/dt_data.h b/tools/snort2lua/data/dt_data.h index 032b4af8e..0e8538f7f 100644 --- a/tools/snort2lua/data/dt_data.h +++ b/tools/snort2lua/data/dt_data.h @@ -81,6 +81,7 @@ public: void print_errors(std::ostream&); void print_data(std::ostream&); void print_comments(std::ostream& out); + void print_unsupported(std::ostream& out); // have there been any failed conversion? bool failed_conversions() const; @@ -95,7 +96,7 @@ public: // 'print_conf_options()' void swap_conf_data(std::vector&, std::vector&, - Comments*&); + Comments*& comments, Comments*& unsupported); // FILE CREATION AND ADDITIONS @@ -106,12 +107,13 @@ public: // add a 'comment' to the Lua file. should ONLY be used when // adding a comment from the original Snort file. void add_comment(std::string); + // add a lua comment stating that the top-level item does not + // exist yet (i.e. preprocessor X, where X doesn't exist) + void add_unsupported_comment(std::string); // Call when failed to convert a line. // stream == the stringstream object which failed to convert - void failed_conversion(const std::istringstream& stream); - // same as above. unknown_option is the specific option which - // caused the failure. - void failed_conversion(const std::istringstream& stream, const std::string unkown_option); + // unknown_option is the specific option which caused the failure. + void failed_conversion(const std::istringstream& stream, const std::string unkown_option = ""); void set_current_file(std::string& file) { current_file = &file; } @@ -136,6 +138,7 @@ private: std::vector includes; Comments* comments; Comments* errors; + Comments* unsupported; bool curr_data_bad; // keep track whether current 'conversion' is already bad std::string* current_file; diff --git a/tools/snort2lua/helpers/converter.cc b/tools/snort2lua/helpers/converter.cc index ed598cc62..e1ed55ba0 100644 --- a/tools/snort2lua/helpers/converter.cc +++ b/tools/snort2lua/helpers/converter.cc @@ -69,6 +69,8 @@ int Converter::parse_include_file(std::string input_file) std::vector rules; std::vector includes; Comments* comments; + Comments* unsupported; + int rc; if (!parse_includes) @@ -81,7 +83,10 @@ int Converter::parse_include_file(std::string input_file) comments = new Comments(start_comments, 0, Comments::CommentType::MULTI_LINE); - data_api.swap_conf_data(vars, includes, comments); + unsupported = new Comments(start_unsupported, 0, + Comments::CommentType::MULTI_LINE); + + data_api.swap_conf_data(vars, includes, comments, unsupported); table_api.swap_tables(tables); } @@ -101,6 +106,7 @@ int Converter::parse_include_file(std::string input_file) out.open(input_file + ".lua"); data_api.print_data(out); table_api.print_tables(out); + data_api.print_unsupported(out); data_api.print_comments(out); out << std::endl; out.close(); @@ -108,9 +114,10 @@ int Converter::parse_include_file(std::string input_file) include_file = true; } - data_api.swap_conf_data(vars, includes, comments); + data_api.swap_conf_data(vars, includes, comments, unsupported); table_api.swap_tables(tables); delete comments; + delete unsupported; if (include_file) data_api.add_include_file(input_file + ".lua"); @@ -352,6 +359,7 @@ int Converter::convert(std::string input, } table_api.print_tables(out); + data_api.print_unsupported(out); data_api.print_comments(out); if ((failed_conversions()) && !DataApi::is_quiet_mode()) diff --git a/tools/snort2lua/keyword_states/CMakeLists.txt b/tools/snort2lua/keyword_states/CMakeLists.txt index 27c715c83..b34f6ca2a 100644 --- a/tools/snort2lua/keyword_states/CMakeLists.txt +++ b/tools/snort2lua/keyword_states/CMakeLists.txt @@ -2,6 +2,7 @@ add_library( keyword_states kws_attribute_table.cc kws_config.cc + kws_deleted.cc kws_event_filter.cc kws_file.cc kws_include.cc diff --git a/tools/snort2lua/keyword_states/Makefile.am b/tools/snort2lua/keyword_states/Makefile.am index e4160595e..4738b7f51 100644 --- a/tools/snort2lua/keyword_states/Makefile.am +++ b/tools/snort2lua/keyword_states/Makefile.am @@ -4,6 +4,7 @@ noinst_LIBRARIES = libkeyword_states.a libkeyword_states_a_SOURCES = \ kws_attribute_table.cc \ kws_config.cc \ +kws_deleted.cc \ kws_event_filter.cc \ kws_file.cc \ kws_include.cc \ diff --git a/tools/snort2lua/keyword_states/keywords_api.cc b/tools/snort2lua/keyword_states/keywords_api.cc index 1c6168295..38c3abcf5 100644 --- a/tools/snort2lua/keyword_states/keywords_api.cc +++ b/tools/snort2lua/keyword_states/keywords_api.cc @@ -31,6 +31,7 @@ extern const ConvertMap* dynamic_map; extern const ConvertMap* dynamicdetection_map; extern const ConvertMap* dynamicengine_map; extern const ConvertMap* dynamicpreprocessor_map; +extern const ConvertMap* dynamicoutput_map; extern const ConvertMap* dynamicsidechannel_map; extern const ConvertMap* event_filter_map; extern const ConvertMap* file_map; @@ -63,6 +64,7 @@ const std::vector keywords_api = dynamicdetection_map, dynamicengine_map, dynamicpreprocessor_map, + dynamicoutput_map, dynamicsidechannel_map, event_filter_map, file_map, @@ -84,15 +86,3 @@ const std::vector keywords_api = var_map, }; } // namespace keywords - -#if 0 - -Unconverted keyword--- - -#define SNORT_CONF_KEYWORD__DYNAMIC_OUTPUT "dynamicoutput" -#define SNORT_CONF_KEYWORD__RULE_TYPE "ruletype" - -# define SNORT_CONF_KEYWORD__SIDE_CHANNEL "sidechannel" -#define SNORT_CONF_KEYWORD__VERSION "version" -#endif - diff --git a/tools/snort2lua/keyword_states/kws_deleted.cc b/tools/snort2lua/keyword_states/kws_deleted.cc new file mode 100644 index 000000000..6c42d511f --- /dev/null +++ b/tools/snort2lua/keyword_states/kws_deleted.cc @@ -0,0 +1,72 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2017-2017 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// kws_deleted.cc author Carter Waxman + +#include +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "helpers/s2l_util.h" + +namespace keywords +{ +namespace +{ +class Deleted : public ConversionState +{ +public: + Deleted(Converter& c) : ConversionState(c) { } + virtual ~Deleted() { } + virtual bool convert(std::istringstream& data_stream); +}; +} // namespace + +bool Deleted::convert(std::istringstream& data_stream) +{ + data_stream.setstate(std::ios::eofbit); // deleted, not failures + return true; +} + +template +static ConversionState* deleted_ctor(Converter& c) +{ + // set here since not all deleted keywords have options + if (!DataApi::is_quiet_mode()) + { + c.get_table_api().open_table("deleted_snort_keywords"); + c.get_table_api().add_deleted_comment(*snort_option + "[:.*]"); + c.get_table_api().close_table(); + } + + return new Deleted(c); +} + +/************************************************* + ************* dynamicoutput **************** + *************************************************/ + +static const std::string dynamicoutput = "dynamicoutput"; +static const ConvertMap dynamicoutput_api = +{ + dynamicoutput, + deleted_ctor<&dynamicoutput>, +}; + +const ConvertMap* dynamicoutput_map = &dynamicoutput_api; +} // namespace keywords diff --git a/tools/snort2lua/output_states/CMakeLists.txt b/tools/snort2lua/output_states/CMakeLists.txt index f0cf236b9..69634a94e 100644 --- a/tools/snort2lua/output_states/CMakeLists.txt +++ b/tools/snort2lua/output_states/CMakeLists.txt @@ -1,11 +1,13 @@ add_library(output_states out_csv.cc + out_deleted.cc out_fast.cc out_full.cc out_null.cc out_tcpdump.cc out_test.cc + out_sfunified2.cc out_syslog.cc out_unified2.cc out_unixsock.cc diff --git a/tools/snort2lua/output_states/Makefile.am b/tools/snort2lua/output_states/Makefile.am index 57f88e176..6da0fb865 100644 --- a/tools/snort2lua/output_states/Makefile.am +++ b/tools/snort2lua/output_states/Makefile.am @@ -3,12 +3,14 @@ noinst_LIBRARIES = liboutput_states.a liboutput_states_a_SOURCES = \ out_csv.cc \ +out_deleted.cc \ out_fast.cc \ out_full.cc \ out_null.cc \ out_tcpdump.cc \ out_test.cc \ out_syslog.cc \ +out_sfunified2.cc \ out_unified2.cc \ out_unixsock.cc \ output_api.h \ diff --git a/tools/snort2lua/output_states/out_deleted.cc b/tools/snort2lua/output_states/out_deleted.cc new file mode 100644 index 000000000..cb085ff98 --- /dev/null +++ b/tools/snort2lua/output_states/out_deleted.cc @@ -0,0 +1,85 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2017-2017 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// output_deleted.cc author Carter Waxman + +#include +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "helpers/s2l_util.h" + +namespace output +{ +namespace +{ +class Deleted : public ConversionState +{ +public: + Deleted(Converter& c) : ConversionState(c) { } + virtual ~Deleted() { } + virtual bool convert(std::istringstream& data_stream); +}; +} // namespace + +bool Deleted::convert(std::istringstream& data_stream) +{ + data_stream.setstate(std::ios::eofbit); // deleted, not failures + return true; +} + +template +static ConversionState* deleted_ctor(Converter& c) +{ + // set here since not all deleted keywords have options + if (!DataApi::is_quiet_mode()) + { + c.get_table_api().open_table("deleted_snort_outputs"); + c.get_table_api().add_deleted_comment("output " + *snort_option + "[:.*]"); + c.get_table_api().close_table(); + } + + return new Deleted(c); +} + +/************************************************* + ************* sfalert_unified2 **************** + *************************************************/ + +static const std::string sfalert_unified2 = "sfalert_unified2"; +static const ConvertMap sfalert_unified2_api = +{ + sfalert_unified2, + deleted_ctor<&sfalert_unified2>, +}; + +const ConvertMap* sfalert_unified2_map = &sfalert_unified2_api; + +/************************************************* + ************* sflog_unified2 **************** + *************************************************/ + +static const std::string sflog_unified2 = "slog_unified2"; +static const ConvertMap sflog_unified2_api = +{ + sflog_unified2, + deleted_ctor<&sflog_unified2>, +}; + +const ConvertMap* sflog_unified2_map = &sflog_unified2_api; +} // namespace output diff --git a/tools/snort2lua/output_states/out_sfunified2.cc b/tools/snort2lua/output_states/out_sfunified2.cc new file mode 100644 index 000000000..43439a2cf --- /dev/null +++ b/tools/snort2lua/output_states/out_sfunified2.cc @@ -0,0 +1,52 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2017-2017 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// out_sfunified2.cc author Carter Waxman + +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "rule_states/rule_api.h" +#include "helpers/s2l_util.h" + +namespace output +{ + namespace + { + //FIXIT-L add when avaiable + static std::string header = "output sf_unified2: "; + + template + static ConversionState* unified2_ctor(Converter& c) + { return new UnsupportedState(c); } + + } // namespace + + /************************** + ******* A P I *********** + **************************/ + + static const ConvertMap unified2_api = + { + "sf_unified2", + unified2_ctor<&header>, + }; + + const ConvertMap* sfunified2_map = &unified2_api; +} // output namespace + diff --git a/tools/snort2lua/output_states/output_api.cc b/tools/snort2lua/output_states/output_api.cc index fba39cb27..b2476a583 100644 --- a/tools/snort2lua/output_states/output_api.cc +++ b/tools/snort2lua/output_states/output_api.cc @@ -32,6 +32,9 @@ extern const ConvertMap* log_tcpdump_map; extern const ConvertMap* log_unified2_map; extern const ConvertMap* alert_unixsock_map; extern const ConvertMap* unified2_map; +extern const ConvertMap* sfunified2_map; +extern const ConvertMap* sflog_unified2_map; +extern const ConvertMap* sfalert_unified2_map; const std::vector output_api = { @@ -46,6 +49,9 @@ const std::vector output_api = log_unified2_map, alert_unixsock_map, unified2_map, + sfunified2_map, + sflog_unified2_map, + sfalert_unified2_map }; } // namespace output diff --git a/tools/snort2lua/preprocessor_states/CMakeLists.txt b/tools/snort2lua/preprocessor_states/CMakeLists.txt index ba2830a87..9c5cf3b4d 100644 --- a/tools/snort2lua/preprocessor_states/CMakeLists.txt +++ b/tools/snort2lua/preprocessor_states/CMakeLists.txt @@ -7,6 +7,7 @@ add_library(preprocessor_states pps_dcerpc_server.h pps_dcerpc_server.cc pps_dnp3.cc + pps_firewall.cc pps_frag3_engine.cc pps_frag3_global.cc pps_ftp_telnet.cc @@ -14,6 +15,7 @@ add_library(preprocessor_states pps_gtp.cc pps_http_inspect.cc pps_http_inspect_server.cc + pps_nap_selector.cc pps_normalizers.cc pps_perfmonitor.cc pps_reputation.cc diff --git a/tools/snort2lua/preprocessor_states/Makefile.am b/tools/snort2lua/preprocessor_states/Makefile.am index c621e55f8..adae2d083 100644 --- a/tools/snort2lua/preprocessor_states/Makefile.am +++ b/tools/snort2lua/preprocessor_states/Makefile.am @@ -9,6 +9,7 @@ pps_dcerpc.cc \ pps_dcerpc_server.h \ pps_dcerpc_server.cc \ pps_dnp3.cc \ +pps_firewall.cc \ pps_frag3_engine.cc \ pps_frag3_global.cc \ pps_ftp_telnet.cc \ @@ -16,6 +17,7 @@ pps_ftp_telnet_protocol.cc \ pps_gtp.cc \ pps_http_inspect.cc \ pps_http_inspect_server.cc \ +pps_nap_selector.cc \ pps_normalizers.cc \ pps_perfmonitor.cc \ pps_reputation.cc \ diff --git a/tools/snort2lua/preprocessor_states/pps_firewall.cc b/tools/snort2lua/preprocessor_states/pps_firewall.cc new file mode 100644 index 000000000..eebec7ef1 --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_firewall.cc @@ -0,0 +1,44 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2017-2017 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// pps_firewall.cc author Carter Waxman + +#include +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "helpers/s2l_util.h" + +namespace preprocessors +{ + +//FIXIT-L add when supported +static std::string header = "preprocessor firewall: "; + +static ConversionState* ctor(Converter& c) +{ return new UnsupportedState<&header>(c); } + +static const ConvertMap firewall_api = +{ + "firewall", + ctor, +}; + +const ConvertMap* firewall_map = &firewall_api; +} // namespace preprocessors + diff --git a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc index 06150c053..f8456f094 100644 --- a/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc +++ b/tools/snort2lua/preprocessor_states/pps_http_inspect_server.cc @@ -338,6 +338,8 @@ bool HttpInspectServer::convert(std::istringstream& data_stream) } else if (!keyword.compare("profile")) parse_deleted_option("profile", data_stream); + else if ( !keyword.compare("xff_headers") ) + parse_bracketed_unsupported_list("xff_headers", data_stream); else { tmpval = false; diff --git a/tools/snort2lua/preprocessor_states/pps_nap_selector.cc b/tools/snort2lua/preprocessor_states/pps_nap_selector.cc new file mode 100644 index 000000000..f9ad90f18 --- /dev/null +++ b/tools/snort2lua/preprocessor_states/pps_nap_selector.cc @@ -0,0 +1,44 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2017-2017 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// pps_nap_selector.cc author Carter Waxman + +#include +#include + +#include "conversion_state.h" +#include "helpers/converter.h" +#include "helpers/s2l_util.h" + +namespace preprocessors +{ + +//FIXIT-L add when supported +static std::string header = "preprocessor nap_selector: "; + +static ConversionState* ctor(Converter& c) +{ return new UnsupportedState<&header>(c); } + +static const ConvertMap nap_selector_api = +{ + "nap_selector", + ctor, +}; + +const ConvertMap* nap_selector_map = &nap_selector_api; +} // namespace preprocessors + diff --git a/tools/snort2lua/preprocessor_states/preprocessor_api.cc b/tools/snort2lua/preprocessor_states/preprocessor_api.cc index 8091128ac..8cfc4e65f 100644 --- a/tools/snort2lua/preprocessor_states/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor_states/preprocessor_api.cc @@ -28,6 +28,7 @@ extern const ConvertMap* bo_map; extern const ConvertMap* dcerpc_map; extern const ConvertMap* dcerpc_server_map; extern const ConvertMap* dnp3_map; +extern const ConvertMap* firewall_map; extern const ConvertMap* frag3_engine_map; extern const ConvertMap* frag3_global_map; extern const ConvertMap* ftptelnet_map; @@ -35,6 +36,7 @@ extern const ConvertMap* ftptelnet_protocol_map; extern const ConvertMap* gtp_map; extern const ConvertMap* httpinspect_map; extern const ConvertMap* httpinspect_server_map; +extern const ConvertMap* nap_selector_map; extern const ConvertMap* nhttpinspect_map; extern const ConvertMap* nhttpinspect_server_map; extern const ConvertMap* normalizer_icmp4_map; @@ -70,6 +72,7 @@ std::vector preprocessor_api = dcerpc_server_map, dnp3_map, dns_map, + firewall_map, frag3_engine_map, frag3_global_map, ftptelnet_map, @@ -77,6 +80,7 @@ std::vector preprocessor_api = gtp_map, imap_map, modbus_map, + nap_selector_map, nhttpinspect_map, nhttpinspect_server_map, normalizer_icmp4_map,