From: Josh Date: Thu, 12 Jun 2014 03:39:17 +0000 (-0400) Subject: adding normalizers X-Git-Tag: 3.0.0-233~1481^2~2^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b4b3fdd08b5b3cc913d572a8ffe7bdd80cd2214b;p=thirdparty%2Fsnort3.git adding normalizers --- diff --git a/tools/snort2lua/data/conv_data.cc b/tools/snort2lua/data/conv_data.cc index 979306af2..788c42ae3 100644 --- a/tools/snort2lua/data/conv_data.cc +++ b/tools/snort2lua/data/conv_data.cc @@ -32,7 +32,7 @@ static inline Table* find_table(std::vector vec, std::string name) { for( auto *t : vec) - if(name.compare(t->get_name())) + if(!name.compare(t->get_name())) return t; return nullptr; diff --git a/tools/snort2lua/data/conv_option.cc b/tools/snort2lua/data/conv_option.cc index 7310ac7e6..be5d7ad71 100644 --- a/tools/snort2lua/data/conv_option.cc +++ b/tools/snort2lua/data/conv_option.cc @@ -75,7 +75,9 @@ std::ostream &operator<<( std::ostream& out, const Option &o) bool operator==(const Option& lhs, const Option& rhs) { - return !(lhs.name.compare(rhs.name)); + return ((!lhs.name.compare(rhs.name)) && + lhs.type == rhs.type && + (!lhs.value.compare(rhs.value))); } bool operator!=(const Option& lhs, const Option& rhs) diff --git a/tools/snort2lua/data/conv_table.cc b/tools/snort2lua/data/conv_table.cc index 36e30ba78..d0e0017ee 100644 --- a/tools/snort2lua/data/conv_table.cc +++ b/tools/snort2lua/data/conv_table.cc @@ -65,6 +65,9 @@ Table* Table::open_table(std::string name) bool Table::add_option(std::string name, int value) { + if (has_option(name, value)) + return true; + Option *o = new Option(name, value, depth + 1); options.push_back(o); return true; @@ -72,6 +75,9 @@ bool Table::add_option(std::string name, int value) bool Table::add_option(std::string name, bool value) { + if (has_option(name, value)) + return true; + Option *o = new Option(name, value, depth + 1); options.push_back(o); return true; @@ -79,36 +85,39 @@ bool Table::add_option(std::string name, bool value) bool Table::add_option(std::string name, std::string value) { + if (has_option(name, value)) + return true; + Option *o = new Option(name, value, depth + 1); options.push_back(o); return true; } -bool Table::has_option(std::string name, int val) +bool Table::has_option(Option opt) { - Option new_opt(name, val, depth + 1); - for (Option* o : options) - if ( *o == new_opt) + if ( (*o) == opt) return true; return false; } +bool Table::has_option(std::string name, int val) +{ + Option opt(name, val, depth + 1); + return has_option(opt); +} + bool Table::has_option(std::string name, bool val) { - return false; + Option opt(name, val, depth + 1); + return has_option(opt); } bool Table::has_option(std::string name, std::string val) { - Option new_opt(name, val, depth+1); - - for (Option* o : options) - if ( *o == new_opt) - return true; - - return false; + Option opt(name, val, depth + 1); + return has_option(opt); } diff --git a/tools/snort2lua/data/conv_table.h b/tools/snort2lua/data/conv_table.h index 2d7b65664..cd34654ea 100644 --- a/tools/snort2lua/data/conv_table.h +++ b/tools/snort2lua/data/conv_table.h @@ -41,9 +41,6 @@ public: bool add_option(std::string, int val); bool add_option(std::string, bool val); bool add_option(std::string, std::string val); - bool has_option(std::string name, int val); - bool has_option(std::string name, bool val); - bool has_option(std::string name, std::string val); void add_comment(std::string comment); friend std::ostream &operator<<( std::ostream&, const Table &); @@ -54,6 +51,12 @@ private: std::vector tables; std::vector options; std::vector comments; + + + bool has_option(std::string name, int val); + bool has_option(std::string name, bool val); + bool has_option(std::string name, std::string val); + bool has_option(Option o); }; #endif diff --git a/tools/snort2lua/preprocessor/CMakeLists.txt b/tools/snort2lua/preprocessor/CMakeLists.txt index 087eefe1e..8f27d4df2 100644 --- a/tools/snort2lua/preprocessor/CMakeLists.txt +++ b/tools/snort2lua/preprocessor/CMakeLists.txt @@ -2,6 +2,7 @@ add_library(preprocessor http_inspect.cc smtp.cc + normalizers.cc preprocessor_api.h preprocessor_api.cc ) \ No newline at end of file diff --git a/tools/snort2lua/preprocessor/normalizers.cc b/tools/snort2lua/preprocessor/normalizers.cc new file mode 100644 index 000000000..94a05b6f6 --- /dev/null +++ b/tools/snort2lua/preprocessor/normalizers.cc @@ -0,0 +1,286 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2002-2013 Sourcefire, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License Version 2 as + * published by the Free Software Foundation. You may not use, modify or + * distribute this program under any other version of the GNU General + * Public License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +// config.cc author Josh Rosenbaum + +#include +#include +#include + +#include "conversion_state.h" +#include "converter.h" +#include "snort2lua_util.h" + + +/**************************** + ******* ICMP4 API ********* + ****************************/ + +static ConversionState* icmp4_ctor(Converter* cv) +{ + cv->open_table("normalize"); + cv->add_option_to_table("icmp4", true); + cv->close_table(); + return nullptr; +} + +static const ConvertMap preprocessor_norm_icmp4 = +{ + "normalize_icmp4", + icmp4_ctor, +}; + +const ConvertMap* normalizer_icmp4_map = &preprocessor_norm_icmp4; + +/**************************** + ******* ICMP6 API ********* + ***************************/ + +static ConversionState* icmp6_ctor(Converter* cv) +{ + cv->open_table("normalize"); + cv->add_option_to_table("icmp6", true); + cv->close_table(); + return nullptr; +} + +static const ConvertMap preprocessor_norm_icmp6 = +{ + "normalize_icmp6", + icmp6_ctor, +}; + +const ConvertMap* normalizer_icmp6_map = &preprocessor_norm_icmp6; + + +/************************** + ******* IP4 API ********* + **************************/ + +namespace { + +class Ip4Normalizer : public ConversionState +{ +public: + Ip4Normalizer(Converter* cv) : ConversionState(cv) {}; + virtual ~Ip4Normalizer() {}; + virtual bool convert(std::stringstream& data_stream); +}; + +} // namespace + + +bool Ip4Normalizer::convert(std::stringstream& data_stream) +{ + std::string keyword; + bool retval = true; + + converter->open_table("normalize"); + converter->open_table("ip4"); + converter->add_option_to_table("base", true); + + while( data_stream >> keyword) + { + + if(!keyword.compare("df")) + retval = converter->add_option_to_table("df", true) && retval; + + else if(!keyword.compare("rf")) + retval = converter->add_option_to_table("rf", true) && retval; + + else if(!keyword.compare("tos")) + retval = converter->add_option_to_table("tos", true) && retval; + + else if(!keyword.compare("trim")) + retval = converter->add_option_to_table("trim", true) && retval; + + else + retval = false; + } + + converter->close_table(); + converter->close_table(); + return retval; +} + +/******* A P I ***********/ + +static ConversionState* ip4_ctor(Converter* cv) +{ + return new Ip4Normalizer(cv); +} + +static const ConvertMap preprocessor_norm_ip4 = +{ + "normalize_ip4", + ip4_ctor, +}; + +const ConvertMap* normalizer_ip4_map = &preprocessor_norm_ip4; + +/************************** + ******* IP6 API ********* + **************************/ + +static ConversionState* ip6_ctor(Converter* cv) +{ + cv->open_table("normalize"); + cv->add_option_to_table("ip6", true); + cv->close_table(); + return nullptr; +} + +static const ConvertMap preprocessor_norm_ip6 = +{ + "normalize_ip6", + ip6_ctor, +}; + +const ConvertMap* normalizer_ip6_map = &preprocessor_norm_ip6; + + +/************************** + ******* TCP API ********* + **************************/ + +namespace { + +class TcpNormalizer : public ConversionState +{ +public: + TcpNormalizer(Converter* cv) : ConversionState(cv) {}; + virtual ~TcpNormalizer() {}; + virtual bool convert(std::stringstream& data_stream); +private: + bool set_base_w_comment(std::string); + bool set_ecn_w_comment(std::string); + bool set_trim_w_comment(std::string); + +}; + +} // namespace + +bool TcpNormalizer::set_ecn_w_comment(std::string comment) +{ + converter->add_comment_to_table("tcp normalizer: '" + + comment + "'' is deprecated. use 'ecn' instead"); + return converter->add_option_to_table("ecn", true); +} + +bool TcpNormalizer::set_base_w_comment(std::string comment) +{ + converter->add_comment_to_table("tcp normalizer: '" + + comment + "'' is deprecated. use 'base' instead"); + return converter->add_option_to_table("base", true); +} + +bool TcpNormalizer::set_trim_w_comment(std::string comment) +{ + converter->add_comment_to_table("tcp normalizer: '" + + comment + "'' is deprecated. use 'trim' instead"); + return converter->add_option_to_table("trim", true); +} + + +bool TcpNormalizer::convert(std::stringstream& data_stream) +{ + std::string keyword; + std::string value; + bool retval = true; + + converter->open_table("normalize"); + converter->open_table("tcp"); + converter->add_option_to_table("base", true); + + while( data_stream >> keyword) + { + + if(!keyword.compare("rsv")) + retval = set_base_w_comment("rsv") && retval; + + else if(!keyword.compare("pad")) + retval = set_base_w_comment("pad") && retval; + + else if(!keyword.compare("block")) + retval = set_base_w_comment("block") && retval; + + else if(!keyword.compare("req_urg")) + retval = set_base_w_comment("req_urg") && retval; + + else if(!keyword.compare("req_pay")) + retval = set_base_w_comment("req_pay") && retval; + + else if(!keyword.compare("req_urp")) + retval = set_base_w_comment("req_urp") && retval; + + else if(!keyword.compare("ips")) + retval = converter->add_option_to_table("ips", true) && retval; + + else if(!keyword.compare("trim_syn")) + retval = set_trim_w_comment("trim_syn") && retval; + + else if(!keyword.compare("trim_rst")) + retval = set_trim_w_comment("trim_rst") && retval; + + else if(!keyword.compare("trim_win")) + retval = set_trim_w_comment("trim_win") && retval; + + else if(!keyword.compare("trim_mss")) + retval = set_trim_w_comment("trim_mss") && retval; + + else if(!keyword.compare("trim")) + retval = converter->add_option_to_table("trim", true) && retval; + + else if(!keyword.compare("opts")) + retval = converter->add_option_to_table("opts", true) && retval; + + else if(!keyword.compare("urp")) + retval = converter->add_option_to_table("urp", true) && retval; + + else if(!keyword.compare("ecn")) + { + if (data_stream >> value) + set_ecn_w_comment("ecn " + value); + else + retval = false; + } + + else + retval = false; + } + + converter->close_table(); + converter->close_table(); + return retval; +} + +/******* A P I ***********/ + +static ConversionState* tcp_ctor(Converter* cv) +{ + return new TcpNormalizer(cv); +} + +static const ConvertMap preprocessor_norm_tcp = +{ + "normalize_tcp", + tcp_ctor, +}; + +const ConvertMap* normalizer_tcp_map = &preprocessor_norm_tcp; diff --git a/tools/snort2lua/preprocessor/preprocessor_api.cc b/tools/snort2lua/preprocessor/preprocessor_api.cc index ff922039d..0f9c47c81 100644 --- a/tools/snort2lua/preprocessor/preprocessor_api.cc +++ b/tools/snort2lua/preprocessor/preprocessor_api.cc @@ -23,13 +23,21 @@ extern const ConvertMap *httpinspect_map; +extern const ConvertMap *normalizer_icmp4_map; +extern const ConvertMap *normalizer_icmp6_map; +extern const ConvertMap *normalizer_ip4_map; +extern const ConvertMap *normalizer_ip6_map; +extern const ConvertMap *normalizer_tcp_map; extern const ConvertMap *smtp_map; - - const std::vector preprocessor_api = { httpinspect_map, + normalizer_icmp4_map, + normalizer_icmp6_map, + normalizer_ip4_map, + normalizer_ip6_map, + normalizer_tcp_map, smtp_map, // nullptr, };