From: Josh Date: Fri, 7 Nov 2014 16:06:52 +0000 (-0600) Subject: Snort2Lua: add pkt_data sticky buffer for pcre and content if no other buffer is... X-Git-Tag: 3.0.0-233~1255^2~1 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bce497b09498d6f2c466ce02f5913611bb5cc50a;p=thirdparty%2Fsnort3.git Snort2Lua: add pkt_data sticky buffer for pcre and content if no other buffer is specified --- diff --git a/tools/snort2lua/rule_states/rule_content.cc b/tools/snort2lua/rule_states/rule_content.cc index 64a129fca..40fba1da6 100644 --- a/tools/snort2lua/rule_states/rule_content.cc +++ b/tools/snort2lua/rule_states/rule_content.cc @@ -36,17 +36,32 @@ template class Content : public ConversionState { public: - Content(Converter& c) : ConversionState(c) {}; + Content(Converter& c) : ConversionState(c), sticky_buffer_set(false) {}; virtual ~Content() {}; virtual bool convert(std::istringstream& data); private: + bool sticky_buffer_set; bool parse_options(std::istringstream&, std::string, std::string); + void add_sticky_buffer(std::istringstream&, std::string buffer); }; } // namespace +template +void Content::add_sticky_buffer(std::istringstream& data_stream, std::string buffer) +{ + if (sticky_buffer_set) + { + rule_api.bad_rule(data_stream, "< " + buffer + "> is the second sticky " + "buffers set for this 'content' keyword!!"); + } + + rule_api.add_rule_option_before_selected(buffer); + sticky_buffer_set = true; +} + template bool Content::parse_options( std::istringstream& data_stream, @@ -69,44 +84,44 @@ bool Content::parse_options( else if (!keyword.compare("nocase")) rule_api.add_suboption("nocase"); + else if (!keyword.compare("hash")) // PROTECTED CONTENT + rule_api.add_suboption("hash", val); + + else if (!keyword.compare("length")) // PROTECTED CONTENT + rule_api.add_suboption("length", val); + else if (!keyword.compare("rawbytes")) - rule_api.add_rule_option_before_selected("pkt_data"); + add_sticky_buffer(data_stream, "pkt_data"); else if (!keyword.compare("http_client_body")) - rule_api.add_rule_option_before_selected("http_client_body"); + add_sticky_buffer(data_stream, "http_client_body"); else if (!keyword.compare("http_cookie")) - rule_api.add_rule_option_before_selected("http_cookie"); + add_sticky_buffer(data_stream, "http_cookie"); else if (!keyword.compare("http_raw_cookie")) - rule_api.add_rule_option_before_selected("http_raw_cookie"); + add_sticky_buffer(data_stream, "http_raw_cookie"); else if (!keyword.compare("http_header")) - rule_api.add_rule_option_before_selected("http_header"); + add_sticky_buffer(data_stream, "http_header"); else if (!keyword.compare("http_raw_header")) - rule_api.add_rule_option_before_selected("http_raw_header"); + add_sticky_buffer(data_stream, "http_raw_header"); else if (!keyword.compare("http_method")) - rule_api.add_rule_option_before_selected("http_method"); + add_sticky_buffer(data_stream, "http_method"); else if (!keyword.compare("http_uri")) - rule_api.add_rule_option_before_selected("http_uri"); + add_sticky_buffer(data_stream, "http_uri"); else if (!keyword.compare("http_raw_uri")) - rule_api.add_rule_option_before_selected("http_raw_uri"); + add_sticky_buffer(data_stream, "http_raw_uri"); else if (!keyword.compare("http_stat_code")) - rule_api.add_rule_option_before_selected("http_stat_code"); + add_sticky_buffer(data_stream, "http_stat_code"); else if (!keyword.compare("http_stat_msg")) - rule_api.add_rule_option_before_selected("http_stat_msg"); - - else if (!keyword.compare("hash")) // PROTECTED CONTENT - rule_api.add_suboption("hash", val); - - else if (!keyword.compare("length")) // PROTECTED CONTENT - rule_api.add_suboption("length", val); + add_sticky_buffer(data_stream, "http_stat_msg"); else if (!keyword.compare("fast_pattern")) { @@ -217,6 +232,10 @@ bool Content::convert(std::istringstream& data_stream) if (!parse_options(data_stream, keyword, val)) { + + if (!sticky_buffer_set) + add_sticky_buffer(data_stream, "pkt_data"); + // since this option is not an content modifier, // lets coninue parsing the rest of the rule. rule_api.unselect_option(); @@ -233,6 +252,9 @@ bool Content::convert(std::istringstream& data_stream) subopts.str(val); }; + if (!sticky_buffer_set) + add_sticky_buffer(data_stream, "pkt_data"); + // can only get here if we finish parsing this rule return true; } diff --git a/tools/snort2lua/rule_states/rule_pcre.cc b/tools/snort2lua/rule_states/rule_pcre.cc index ffc685b62..d446618c6 100644 --- a/tools/snort2lua/rule_states/rule_pcre.cc +++ b/tools/snort2lua/rule_states/rule_pcre.cc @@ -144,6 +144,9 @@ bool Pcre::convert(std::istringstream& data_stream) } } + if (!sticky_buffer_set) + rule_api.add_rule_option("pkt_data"); + rule_api.add_rule_option("pcre", pattern + new_opts); return set_next_rule_state(data_stream); } diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in index 29b603b40..d09167e05 100644 --- a/tools/snort2lua/tests/snort.conf.in +++ b/tools/snort2lua/tests/snort.conf.in @@ -1126,8 +1126,9 @@ alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"BROWSER-IE Microsoft Inter # rawbytes alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443,8200] (msg:"APP-DETECT GoToMyPC local service running"; \ content:"jedi request"; nocase; offset:4; depth:20; rawbytes; \ - content:"jedi request2"; nocase; distance:150; http_cookie; http_header; \ + content:"jedi request2"; nocase; distance:150; http_header; \ content:"jedi request3"; within:150; http_client_body; \ + content:"jedi request4"; http_cookie; \ sid:1000060; gid:1; rev:6;)