Changeset 1589

Show
Ignore:
Timestamp:
03/06/08 09:03:10 (7 months ago)
Author:
till
Message:

nebula
- write port and protocol info also to snort rules file

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • nebula/trunk/src/sig.c

    r1588 r1589  
    7171 
    7272 
    73 //void build_sig(cluster *cl, stree *t, lcatbl *lca_table, substr_list list, stnode **leaves, ssize_t num_leaves, ssize_t min_len, double min_ent, sigtype stype) { 
    7473void build_sig(signature *sig, stree *t, lcatbl *lca_table, stnode **leaves, ssize_t num_leaves, ssize_t min_len, double min_ent) { 
    7574        int             i, j, printable, printed_chars; 
    …… 
    223222                if (rules_file) { 
    224223                        // append snort signature to rules file 
    225                         if (append_snortsig_to_rulefile(rules_file, t, sig->cl, seglist, num_frags) > 0) { 
     224                        if (append_snortsig_to_rulefile(rules_file, t, sig, seglist, num_frags) > 0) { 
    226225                                if (snort_pid) { 
    227226                                        printf("[#] forcing snort to reload rule set\n"); 
    …… 
    518517                list_substrings(gst, sig.cstr_list.elem[i].n, sig.cstr_list.elem[i].len); 
    519518 
    520 //      build_sig(cl, gst, lca_table, cstr_list, leaves, num_leaves, min_sstr_len, min_sstr_ent, SIG_SNORT); 
    521519        build_sig(&sig, gst, lca_table, leaves, num_leaves, min_sstr_len, min_sstr_ent); 
    522520 
    …… 
    535533 
    536534 
    537 int append_snortsig_to_rulefile(const char *filename, const stree *t, const cluster *cl, const sseg *seglist, const ssize_t num_frags) { 
     535int append_snortsig_to_rulefile(const char *filename, const stree *t, const signature *sig, const sseg *seglist, const ssize_t num_frags) { 
    538536        int     i, j, printable; 
    539537        FILE    *rfile; 
    …… 
    547545        } 
    548546 
    549         fprintf(rfile, "#-------------------------------------------------------------------------------------------------------\n"); 
    550         fprintf(rfile, "\nalert tcp any any -> any any (msg: \"nebula rule %u rev. %u\";", cl->sig_id, cl->sig_rev);  
     547        fprintf(rfile, "#-----------------------------------------------------------------------------------------------------------------------\n"); 
     548 
     549        // protocol info 
     550        if (sig->proto_type == SIGPROTO_UDP) { 
     551                fprintf(rfile, "alert udp "); 
     552        } else { 
     553                fprintf(rfile, "alert tcp "); 
     554        } 
     555 
     556        // port info 
     557        if (sig->port_type == SIGPORT_UNIQ && sig->port) { 
     558                fprintf(rfile, "any any -> $HOME_NET %u (msg: \"nebula rule %u rev. %u\";", sig->port, sig->cl->sig_id, sig->cl->sig_rev);  
     559        } else { 
     560                fprintf(rfile, "any any -> $HOME_NET any (msg: \"nebula rule %u rev. %u\";", sig->cl->sig_id, sig->cl->sig_rev);  
     561        } 
     562 
    551563        if (num_frags) { 
    552564                fprintf(rfile, " \\\n content: \""); 
    …… 
    622634                                (long unsigned int) seglist[i-1].max_off + seglist[i-1].len - seglist[i].min_off); 
    623635                } 
    624                 fprintf(rfile, " \\\n sid: %u; rev: %u;)\n", cl->sig_id, cl->sig_rev); 
     636                fprintf(rfile, " \\\n sid: %u; rev: %u;)\n", sig->cl->sig_id, sig->cl->sig_rev); 
    625637        } 
    626638 

  • nebula/trunk/src/sig.h

    r1588 r1589  
    9393void *pt_siggen(void *cl); 
    9494void build_sig(signature *sig, stree *t, lcatbl *lca_table, stnode **leaves, ssize_t num_leaves, ssize_t min_len, double min_ent); 
    95 int append_snortsig_to_rulefile(const char *filename, const stree *t, const cluster *cl, const sseg *seglist, const ssize_t num_frags); 
     95int append_snortsig_to_rulefile(const char *filename, const stree *t, const signature *sig, const sseg *seglist, const ssize_t num_frags); 
    9696 
    9797#endif