From: rrp Date: Tue, 22 Sep 2015 16:35:01 +0000 (-0400) Subject: snort2lua tool wasn't taking into account some changed/deleted configuration and... X-Git-Tag: 3.0.0-233~825^2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b6a5200735f699e43fc1a7e22a157eca3f23ec4e;p=thirdparty%2Fsnort3.git snort2lua tool wasn't taking into account some changed/deleted configuration and hence producing incorrect output which failed validation when supplied to snort. This was one of the reasons for the test in tests/snort2lua/large_conf/one_file failing. Needs a counterpart fix in test repo to get the test to run successfully --- diff --git a/tools/snort2lua/config_states/config_deleted.cc b/tools/snort2lua/config_states/config_deleted.cc index f6b9395d5..772498c04 100644 --- a/tools/snort2lua/config_states/config_deleted.cc +++ b/tools/snort2lua/config_states/config_deleted.cc @@ -382,6 +382,20 @@ static const ConvertMap enable_ttcp_drops_api = const ConvertMap* enable_ttcp_drops_map = &enable_ttcp_drops_api; +/************************************************* + *********** nolog*********** + *************************************************/ + +static const std::string nolog = "nolog"; +static const ConvertMap nolog_api = +{ + nolog, + deleted_ctor<& nolog>, +}; + +const ConvertMap* nolog_map = &nolog_api; + + /************************************************* ************** flexresp2_attempts ************* *************************************************/ diff --git a/tools/snort2lua/config_states/config_detection.cc b/tools/snort2lua/config_states/config_detection.cc index 335e06e3c..02a913630 100644 --- a/tools/snort2lua/config_states/config_detection.cc +++ b/tools/snort2lua/config_states/config_detection.cc @@ -55,7 +55,10 @@ bool Detection::convert(std::istringstream& data_stream) tmpval = false; else if (!keyword.compare("no_stream_inserts")) - tmpval = table_api.add_option("no_stream_inserts", true); + { + table_api.add_diff_option_comment("no_stream_inserts", "inspect_stream_inserts"); + tmpval = table_api.add_option("inspect_stream_inserts", false); + } else if (!keyword.compare("debug")) tmpval = table_api.add_option("debug", true); diff --git a/tools/snort2lua/config_states/config_event_trace.cc b/tools/snort2lua/config_states/config_event_trace.cc index 878ea50bd..d7175a408 100644 --- a/tools/snort2lua/config_states/config_event_trace.cc +++ b/tools/snort2lua/config_states/config_event_trace.cc @@ -52,7 +52,7 @@ bool EventTrace::convert(std::istringstream& data_stream) bool tmpval = true; if (!keyword.compare("file")) - tmpval = table_api.add_option("file", arg); + table_api.add_deleted_comment("file"); else if (!keyword.compare("max_data")) tmpval = table_api.add_option("max_data", std::stoi(arg)); diff --git a/tools/snort2lua/config_states/config_no_option.cc b/tools/snort2lua/config_states/config_no_option.cc index 993b43ef8..14419122e 100644 --- a/tools/snort2lua/config_states/config_no_option.cc +++ b/tools/snort2lua/config_states/config_no_option.cc @@ -313,18 +313,6 @@ static const ConvertMap log_ipv6_extra_data_api = const ConvertMap* log_ipv6_extra_data_map = &log_ipv6_extra_data_api; -/************************************************* - ******************** nolog ******************** - *************************************************/ - -static const std::string nolog = "nolog"; -static const ConvertMap nolog_api = -{ - nolog, - config_true_no_opt_ctor<& nolog, & output> -}; - -const ConvertMap* nolog_map = &nolog_api; /************************************************* ******************** nopcre ******************* diff --git a/tools/snort2lua/config_states/config_one_string_option.cc b/tools/snort2lua/config_states/config_one_string_option.cc index cc38c9a2f..89a0f520a 100644 --- a/tools/snort2lua/config_states/config_one_string_option.cc +++ b/tools/snort2lua/config_states/config_one_string_option.cc @@ -184,7 +184,7 @@ const ConvertMap* daq_mode_map = &daq_mode_api; *************************************************/ static const std::string daq_var = "daq_var"; -static const std::string var = "var"; +static const std::string var = "vars"; static const ConvertMap daq_var_api = { daq_var, diff --git a/tools/snort2lua/output_states/out_csv.cc b/tools/snort2lua/output_states/out_csv.cc index 4a71d35a3..cc85fc1c1 100644 --- a/tools/snort2lua/output_states/out_csv.cc +++ b/tools/snort2lua/output_states/out_csv.cc @@ -56,6 +56,7 @@ bool AlertCsv::convert(std::istringstream& data_stream) if (!(data_stream >> keyword)) return retval; + table_api.add_diff_option_comment("csv", "fields"); // parsing the format list. std::istringstream format(keyword); while (std::getline(format, val, ',')) @@ -66,22 +67,19 @@ bool AlertCsv::convert(std::istringstream& data_stream) table_api.add_deleted_comment("default"); else if (!val.compare("timestamp")) - tmpval = table_api.add_list("csv", "timestamp"); + tmpval = table_api.add_list("fields", "timestamp"); else if (!val.compare("msg")) - tmpval = table_api.add_list("csv", "msg"); + tmpval = table_api.add_list("fields", "msg"); else if (!val.compare("proto")) - tmpval = table_api.add_list("csv", "proto"); + tmpval = table_api.add_list("fields", "proto"); else if (!val.compare("ttl")) - tmpval = table_api.add_list("csv", "ttl"); - - else if (!val.compare("id")) - tmpval = table_api.add_list("csv", "id"); + tmpval = table_api.add_list("fields", "ttl"); else if (!val.compare("tos")) - tmpval = table_api.add_list("csv", "tos"); + tmpval = table_api.add_list("fields", "tos"); else if (!val.compare("trheader")) tmpval = table_api.add_deleted_comment("trheader"); @@ -89,117 +87,123 @@ bool AlertCsv::convert(std::istringstream& data_stream) else if (!val.compare("dst")) { table_api.add_diff_option_comment("dst", "dst_addr"); - tmpval = table_api.add_list("csv", "dst_addr"); + tmpval = table_api.add_list("fields", "dst_addr"); } else if (!val.compare("src")) { table_api.add_diff_option_comment("src", "src_addr"); - tmpval = table_api.add_list("csv", "src_addr"); + tmpval = table_api.add_list("fields", "src_addr"); } else if (!val.compare("sig_generator")) { table_api.add_diff_option_comment("sig_generator", "gid"); - tmpval = table_api.add_list("csv", "gid"); + tmpval = table_api.add_list("fields", "gid"); } else if (!val.compare("sig_id")) { table_api.add_diff_option_comment("sig_id", "sid"); - tmpval = table_api.add_list("csv", "sid"); + tmpval = table_api.add_list("fields", "sid"); } else if (!val.compare("sig_rev")) { table_api.add_diff_option_comment("sig_rev", "rev"); - tmpval = table_api.add_list("csv", "rev"); + tmpval = table_api.add_list("fields", "rev"); } else if (!val.compare("srcport")) { table_api.add_diff_option_comment("srcport", "src_port"); - tmpval = table_api.add_list("csv", "src_port"); + tmpval = table_api.add_list("fields", "src_port"); } else if (!val.compare("dstport")) { table_api.add_diff_option_comment("dstport", "dst_port"); - tmpval = table_api.add_list("csv", "dst_port"); + tmpval = table_api.add_list("fields", "dst_port"); } else if (!val.compare("ethsrc")) { table_api.add_diff_option_comment("ethsrc", "eth_src"); - tmpval = table_api.add_list("csv", "eth_src"); + tmpval = table_api.add_list("fields", "eth_src"); } else if (!val.compare("ethdst")) { table_api.add_diff_option_comment("ethdst", "eth_dst"); - tmpval = table_api.add_list("csv", "eth_dst"); + tmpval = table_api.add_list("fields", "eth_dst"); } else if (!val.compare("ethlen")) { table_api.add_diff_option_comment("ethlen", "eth_len"); - tmpval = table_api.add_list("csv", "eth_len"); + tmpval = table_api.add_list("fields", "eth_len"); } else if (!val.compare("ethtype")) { table_api.add_diff_option_comment("ethtype", "eth_type"); - tmpval = table_api.add_list("csv", "eth_type"); + tmpval = table_api.add_list("fields", "eth_type"); } else if (!val.compare("tcpflags")) { table_api.add_diff_option_comment("tcpflags", "tcp_flags"); - tmpval = table_api.add_list("csv", "tcp_flags"); + tmpval = table_api.add_list("fields", "tcp_flags"); } else if (!val.compare("tcpseq")) { table_api.add_diff_option_comment("tcpseq", "tcp_seq"); - tmpval = table_api.add_list("csv", "tcp_seq"); + tmpval = table_api.add_list("fields", "tcp_seq"); } else if (!val.compare("tcpack")) { table_api.add_diff_option_comment("tcpack", "tcp_ack"); - tmpval = table_api.add_list("csv", "tcp_ack"); + tmpval = table_api.add_list("fields", "tcp_ack"); } else if (!val.compare("tcplen")) { table_api.add_diff_option_comment("tcplen", "tcp_len"); - tmpval = table_api.add_list("csv", "tcp_len"); + tmpval = table_api.add_list("fields", "tcp_len"); } else if (!val.compare("tcpwindow")) { table_api.add_diff_option_comment("tcpwindow", "tcp_win"); - tmpval = table_api.add_list("csv", "tcp_win"); + tmpval = table_api.add_list("fields", "tcp_win"); } else if (!val.compare("dgmlen")) { table_api.add_diff_option_comment("dgmlen", "dgm_len"); - tmpval = table_api.add_list("csv", "dgm_len"); + tmpval = table_api.add_list("fields", "dgm_len"); + } + + else if (!val.compare("id")) + { + table_api.add_diff_option_comment("id", "ip_id"); + tmpval = table_api.add_list("fields", "ip_id"); } else if (!val.compare("iplen")) { table_api.add_diff_option_comment("iplen", "ip_len"); - tmpval = table_api.add_list("csv", "ip_len"); + tmpval = table_api.add_list("fields", "ip_len"); } else if (!val.compare("icmptype")) { table_api.add_diff_option_comment("icmptype", "icmp_type"); - tmpval = table_api.add_list("csv", "icmp_type"); + tmpval = table_api.add_list("fields", "icmp_type"); } else if (!val.compare("icmpcode")) { table_api.add_diff_option_comment("icmpcode", "icmp_code"); - tmpval = table_api.add_list("csv", "icmp_code"); + tmpval = table_api.add_list("fields", "icmp_code"); } else if (!val.compare("icmpid")) { table_api.add_diff_option_comment("icmpid", "icmp_id"); - tmpval = table_api.add_list("csv", "icmp_id"); + tmpval = table_api.add_list("fields", "icmp_id"); } else if (!val.compare("icmpseq")) { table_api.add_diff_option_comment("icmpseq", "icmp_seq"); - tmpval = table_api.add_list("csv", "icmp_seq"); + tmpval = table_api.add_list("fields", "icmp_seq"); } else if (!val.compare("udplength")) { table_api.add_diff_option_comment("udplength", "udp_len"); - tmpval = table_api.add_list("csv", "udp_len"); + tmpval = table_api.add_list("fields", "udp_len"); } else { diff --git a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc index a0f0593d2..d9e8de48c 100644 --- a/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc +++ b/tools/snort2lua/preprocessor_states/pps_stream5_tcp.cc @@ -92,20 +92,9 @@ bool StreamTcp::parse_small_segments(std::istringstream& stream) table_api.close_table(); if (!(stream >> ignore_ports)) + table_api.add_deleted_comment("ignore_ports"); return true; - // otherwise the next argument MUST be ignore_ports - if (ignore_ports.compare("ignore_ports")) - return false; - - table_api.open_table("small_segments"); - long long port; - - // extracting into an int since thats what they should be! - while (stream >> port) - table_api.add_list("ignore_ports", std::to_string(port)); - - table_api.close_table(); if (!stream.eof()) return false;