Ejemplo n.º 1
0
    def __init__(self,rule):
        #We need to flatten the rule here for pcre
        #r = RevRegex(rule)
	if rule.find("pcre") != -1:
		rule = RevRegex2.main(rule)
        #r.flatten()
        #rule = r.rule

	try:
		p = re.compile(r'^(?P<general>[^\(]+)\s*\((?P<rawoptions>.*)\)\s*$')
		m = p.search(rule)
        	general = m.group("general")
        	rawoptions = m.group("rawoptions")
	except:
		#Error parsing rule
		return
    
        if general != None and rawoptions != None:
            pg = re.compile(r'(?P<type>[^\s]+)\s+(?P<proto>[^\s]+)\s+(?P<rawsources>[^\s]+)\s+(?P<rawsrcports>[^\s]+)\s+(?P<direc>[^\s]+)\s+(?P<rawdestinations>[^\s]+)\s+(?P<rawdesports>[^\s]+)\s*')
            m = pg.search(general)

            self.type = m.group('type')
            self.proto = m.group('proto')
            self.rawsources = m.group('rawsources')
            self.rawsrcports = m.group('rawsrcports')
            self.direc = m.group('direc')
            self.rawdestinations = m.group('rawdestinations')
            self.rawdesports = m.group('rawdesports')
            self.rawoptions = rawoptions
            
            po = re.compile(r'\s*([^;]+[^\\])\s*;')
            optlist = po.findall(rawoptions) #there it is 
            self.options = []
            self.contents = []
            self.uricontents = []
            self.flow = None #set to none default
            self.flowbits = [] #set to none default
            self.isHTTP = False
            

	    #here we check if we have any sort of "content" in the rule
	    #if no content option is found - we simply put "None"
	    if not [xcon for xcon in optlist if "content:" in xcon]:
	      print "!!--no content found in the rule--!!"
	      c = RuleContent("None")
	      self.contents.append(c)

            for i in optlist:
                pi = re.compile(r'^(?P<key>[^:]+)(\s*:\s*(?P<value>.*))?\s*$')
                mi = pi.search(i)
                k = mi.group("key")
                v = mi.group("value")
                
                if v == None:
                    v = True
		
		
                if k == "flow":
                    self.flow=Flow(v)
                    continue

                # Add as attributes the options that will not be "duplicated"
                # For options that can be duplicated/repeated do a list, like self.contents
                
                if k == "sid":
                    self.sid = v
                    if self.flowbits:
		      RuleFlowbits(self.flowbits ,self.sid)
                    continue

                if k == "msg":
                    self.msg=v
                    continue

                if k == "uricontent":
                    self.isHTTP = True
                    c = RuleUriContent(v)
                    self.uricontents.append(c)
                    continue

		if k == "content":
		  c = RuleContent(v)
		  self.contents.append(c)
		  continue
		  
		if k == "flowbits":
		  self.flowbits.append(v)
		  continue
		
		if k == "dsize":
		    
		    #it is a global variable, #not content modifier
		    # - hence we get it here
		    self.dsize = v
		    #self.dsize_list = re.split(r'(\D)', self.dsize)
		    self.dsize_list = re.findall(r'\d+|\D+', self.dsize)
		    continue
		
		if k == "rawbytes":
		  continue
		
		#To Do - "tag" has to be supported the proper way - 
		#but not needed at the moment.
		if k == "tag":
		  continue
		
		if k == "reference":
		  continue
		if k == "classtype":
		  continue
		if k == "rev":
		  continue
		
		#this is to make rules with "threshold:...., count 1" ONLY 
		#pass and be made.
		#since it is only 1 count of the alert/pcap needed. 
		#count MORE than one (1) - would not be forged/made
		# TO DO - count >1
		if k == "threshold":
		  if "count 1" in v:
		    print v
		    continue
		

                # modifiers for contents
                #if len(self.contents) > 0:
                #    for clast in self.contents:
                 #       pass
                clast = ""
                if len(self.contents) > 0:
                    clast = self.contents[-1]
                else:
                    continue
                if k == "nocase":
                    clast.nocase = v
                    continue
                if k == "rawbytes":
                    clast.rawbytes = v
                    continue
                if k == "depth":
                    clast.depth = int(v)
                    continue
                if k == "offset":
                    clast.offset = int(v)
                    continue
                if k == "distance":
                    clast.distance = int(v)
                    continue
                if k == "within":
                    clast.within = int(v)
                    continue
                if k == "http_client_body":
                    clast.isHTTP = True
                    clast.http_client_body = v
                    continue
                if k == "http_cookie":
                    clast.isHTTP = True
                    clast.http_cookie = v
                    continue
                if k == "http_header":
                    clast.isHTTP = True
                    clast.http_header = v
                    continue
                if k == "http_method":
                    clast.isHTTP = True
                    clast.http_method = v
                    continue
                if k == "http_uri":
                    clast.isHTTP = True
                    clast.http_uri = v
                    #print [z.content for z in self.contents ][-1] 
                    #- returns the content that http_uri keyword modifies 
                    #as a string
                    
                    #print [z.content for z in self.contents ][-1:] 
                    #- returns the content that http_uri keyword modifies 
                    #as a list
                    
                    #basically content:"BLABLA"; http_uri; 
                    #[EQUALS] uricontent:"BLABLA" !!
                    #so we need to make it uricontnet
                    http_uri_content = [z.content for z in self.contents ][-1]
                    c = RuleUriContent(http_uri_content)
                    self.uricontents.append(c)
                    
                    #then we need to delete/destroy the "content"/"payload"
                    #so that it is only the uricontent left
                    #otherwise we end up with both "content" and "uricontent"
                    for z in self.contents:
		      if z.content == http_uri_content:
			z.content = ''
			z.payload = ''
                    continue
                if k == "fast_pattern":
                    clast.fast_pattern = v
                    continue

                if k == "metadata":
                    continue
                if k == "priority":
                    continue
                if k == "threshold":
                    continue

		else:
		  print "\nUnsupported keyword! Error parsing rule contents\n" +str(rule)
		  print str("KEYWORD ERR: " + k)
		  return 1
		  #break

                self.options.append([k,v])
                
                
        
        else:
            print "Error loading rule " +str(rule)
Ejemplo n.º 2
0
    def __init__(self, rule):
        #We need to flatten the rule here for pcre
        #r = RevRegex(rule)
        if rule.find("pcre") != -1:
            rule = RevRegex2.main(rule)

    #r.flatten()
    #rule = r.rule

        try:
            p = re.compile(
                r'^(?P<general>[^\(]+)\s*\((?P<rawoptions>.*)\)\s*$')
            m = p.search(rule)
            general = m.group("general")
            rawoptions = m.group("rawoptions")
        except:
            #Error parsing rule
            return

        if general != None and rawoptions != None:
            pg = re.compile(
                r'(?P<type>[^\s]+)\s+(?P<proto>[^\s]+)\s+(?P<rawsources>[^\s]+)\s+(?P<rawsrcports>[^\s]+)\s+(?P<direc>[^\s]+)\s+(?P<rawdestinations>[^\s]+)\s+(?P<rawdesports>[^\s]+)\s*'
            )
            m = pg.search(general)

            self.type = m.group('type')
            self.proto = m.group('proto')
            self.rawsources = m.group('rawsources')
            self.rawsrcports = m.group('rawsrcports')
            self.direc = m.group('direc')
            self.rawdestinations = m.group('rawdestinations')
            self.rawdesports = m.group('rawdesports')
            self.rawoptions = rawoptions

            po = re.compile(r'\s*([^;]+[^\\])\s*;')
            optlist = po.findall(rawoptions)
            self.options = []
            self.contents = []
            self.uricontents = []
            self.flow = None
            self.isHTTP = False

            for i in optlist:
                pi = re.compile(r'^(?P<key>[^:]+)(\s*:\s*(?P<value>.*))?\s*$')
                mi = pi.search(i)
                k = mi.group("key")
                v = mi.group("value")
                if v == None:
                    v = True

                if k == "flow":
                    self.flow = Flow(v)
                    continue

                # Add as attributes the options that will not be "duplicated"
                # For options that can be duplicated/repeated do a list, like self.contents
                if k == "sid":
                    self.sid = v
                    continue

                if k == "msg":
                    self.msg = v
                    continue

                if k == "uricontent":
                    self.isHTTP = True
                    c = RuleUriContent(v)
                    self.uricontents.append(c)
                    continue

                if k == "content":
                    c = RuleContent(v)
                    self.contents.append(c)
                    continue

                # modifiers for contents
                #if len(self.contents) > 0:
                #    for clast in self.contents:
                #       pass
                clast = ""
                if len(self.contents) > 0:
                    clast = self.contents[-1]
                else:
                    continue
                if k == "nocase":
                    clast.nocase = v
                    continue
                if k == "rawbytes":
                    clast.rawbytes = v
                    continue
                if k == "depth":
                    clast.depth = int(v)
                    continue
                if k == "offset":
                    clast.offset = int(v)
                    continue
                if k == "distance":
                    clast.distance = int(v)
                    continue
                if k == "within":
                    clast.within = int(v)
                    continue
                if k == "http_client body":
                    clast.isHTTP = True
                    clast.http_client_body = v
                    continue
                if k == "http_cookie":
                    clast.isHTTP = True
                    clast.http_cookie = v
                    continue
                if k == "http_header":
                    clast.isHTTP = True
                    clast.http_header = v
                    continue
                if k == "http_method":
                    clast.isHTTP = True
                    clast.http_method = v
                    continue
                if k == "http_uri":
                    clast.isHTTP = True
                    clast.http_uri = v
                    continue
                if k == "fast_pattern":
                    clast.fast_pattern = v
                    continue

                self.options.append([k, v])

        else:
            print "Error loading rule " + str(rule)
Ejemplo n.º 3
0
    def __init__(self,rule):
        #We need to flatten the rule here for pcre
        #r = RevRegex(rule)
	if rule.find("pcre") != -1:
		rule = RevRegex2.main(rule)
        #r.flatten()
        #rule = r.rule

	try:
		p = re.compile(r'^(?P<general>[^\(]+)\s*\((?P<rawoptions>.*)\)\s*$')
		m = p.search(rule)
        	general = m.group("general")
        	rawoptions = m.group("rawoptions")
	except:
		#Error parsing rule
		return
    
        if general != None and rawoptions != None:
            pg = re.compile(r'(?P<type>[^\s]+)\s+(?P<proto>[^\s]+)\s+(?P<rawsources>[^\s]+)\s+(?P<rawsrcports>[^\s]+)\s+(?P<direc>[^\s]+)\s+(?P<rawdestinations>[^\s]+)\s+(?P<rawdesports>[^\s]+)\s*')
            m = pg.search(general)

            self.type = m.group('type')
            self.proto = m.group('proto')
            self.rawsources = m.group('rawsources')
            self.rawsrcports = m.group('rawsrcports')
            self.direc = m.group('direc')
            self.rawdestinations = m.group('rawdestinations')
            self.rawdesports = m.group('rawdesports')
            self.rawoptions = rawoptions
            
            po = re.compile(r'\s*([^;]+[^\\])\s*;')
            optlist = po.findall(rawoptions)
            self.options = []
            self.contents = []
            self.uricontents = []
            self.flow = None
            self.isHTTP = False

            for i in optlist:
                pi = re.compile(r'^(?P<key>[^:]+)(\s*:\s*(?P<value>.*))?\s*$')
                mi = pi.search(i)
                k = mi.group("key")
                v = mi.group("value")
                if v == None:
                    v = True

                if k == "flow":
                    self.flow=Flow(v)
                    continue

                # Add as attributes the options that will not be "duplicated"
                # For options that can be duplicated/repeated do a list, like self.contents
                if k == "sid":
                    self.sid = v
                    continue

                if k == "msg":
                    self.msg=v
                    continue

                if k == "uricontent":
                    self.isHTTP = True
                    c = RuleUriContent(v)
                    self.uricontents.append(c)
                    continue

                if k == "content":
                    c = RuleContent(v)
                    self.contents.append(c)
                    continue

                # modifiers for contents
                #if len(self.contents) > 0:
                #    for clast in self.contents:
                 #       pass
                clast = ""
                if len(self.contents) > 0:
                    clast = self.contents[-1]
                else:
                    continue
                if k == "nocase":
                    clast.nocase = v
                    continue
                if k == "rawbytes":
                    clast.rawbytes = v
                    continue
                if k == "depth":
                    clast.depth = int(v)
                    continue
                if k == "offset":
                    clast.offset = int(v)
                    continue
                if k == "distance":
                    clast.distance = int(v)
                    continue
                if k == "within":
                    clast.within = int(v)
                    continue
                if k == "http_client body":
                    clast.isHTTP = True
                    clast.http_client_body = v
                    continue
                if k == "http_cookie":
                    clast.isHTTP = True
                    clast.http_cookie = v
                    continue
                if k == "http_header":
                    clast.isHTTP = True
                    clast.http_header = v
                    continue
                if k == "http_method":
                    clast.isHTTP = True
                    clast.http_method = v
                    continue
                if k == "http_uri":
                    clast.isHTTP = True
                    clast.http_uri = v
                    continue
                if k == "fast_pattern":
                    clast.fast_pattern = v
                    continue

                self.options.append([k,v])
            
        else:
            print "Error loading rule " +str(rule)
Ejemplo n.º 4
0
    def __init__(self, rule):
        #We need to flatten the rule here for pcre
        #r = RevRegex(rule)
        if rule.find("pcre") != -1:
            rule = RevRegex2.main(rule)

    #r.flatten()
    #rule = r.rule

        try:
            p = re.compile(
                r'^(?P<general>[^\(]+)\s*\((?P<rawoptions>.*)\)\s*$')
            m = p.search(rule)
            general = m.group("general")
            rawoptions = m.group("rawoptions")
        except:
            #Error parsing rule
            return

        if general != None and rawoptions != None:
            pg = re.compile(
                r'(?P<type>[^\s]+)\s+(?P<proto>[^\s]+)\s+(?P<rawsources>[^\s]+)\s+(?P<rawsrcports>[^\s]+)\s+(?P<direc>[^\s]+)\s+(?P<rawdestinations>[^\s]+)\s+(?P<rawdesports>[^\s]+)\s*'
            )
            m = pg.search(general)

            self.type = m.group('type')
            self.proto = m.group('proto')
            self.rawsources = m.group('rawsources')
            self.rawsrcports = m.group('rawsrcports')
            self.direc = m.group('direc')
            self.rawdestinations = m.group('rawdestinations')
            self.rawdesports = m.group('rawdesports')
            self.rawoptions = rawoptions

            po = re.compile(r'\s*([^;]+[^\\])\s*;')
            optlist = po.findall(rawoptions)  #there it is
            self.options = []
            self.contents = []
            self.uricontents = []
            self.flow = None  #set to none default
            self.flowbits = []  #set to none default
            self.isHTTP = False

            #here we check if we have any sort of "content" in the rule
            #if no content option is found - we simply put "None"
            if not [xcon for xcon in optlist if "content:" in xcon]:
                print "!!--no content found in the rule--!!"
                c = RuleContent("None")
                self.contents.append(c)

            for i in optlist:
                pi = re.compile(r'^(?P<key>[^:]+)(\s*:\s*(?P<value>.*))?\s*$')
                mi = pi.search(i)
                k = mi.group("key")
                v = mi.group("value")

                if v == None:
                    v = True

                if k == "flow":
                    self.flow = Flow(v)
                    continue

                # Add as attributes the options that will not be "duplicated"
                # For options that can be duplicated/repeated do a list, like self.contents

                if k == "sid":
                    self.sid = v
                    if self.flowbits:
                        RuleFlowbits(self.flowbits, self.sid)
                    continue

                if k == "msg":
                    self.msg = v
                    continue

                if k == "uricontent":
                    self.isHTTP = True
                    c = RuleUriContent(v)
                    self.uricontents.append(c)
                    continue

                if k == "content":
                    c = RuleContent(v)
                    self.contents.append(c)
                    continue

                if k == "flowbits":
                    self.flowbits.append(v)
                    continue

                if k == "dsize":

                    #it is a global variable, #not content modifier
                    # - hence we get it here
                    self.dsize = v
                    #self.dsize_list = re.split(r'(\D)', self.dsize)
                    self.dsize_list = re.findall(r'\d+|\D+', self.dsize)
                    continue

                if k == "rawbytes":
                    continue

        #To Do - "tag" has to be supported the proper way -
        #but not needed at the moment.
                if k == "tag":
                    continue

                if k == "reference":
                    continue
                if k == "classtype":
                    continue
                if k == "rev":
                    continue

        #this is to make rules with "threshold:...., count 1" ONLY
        #pass and be made.
        #since it is only 1 count of the alert/pcap needed.
        #count MORE than one (1) - would not be forged/made
        # TO DO - count >1
                if k == "threshold":
                    if "count 1" in v:
                        print v
                        continue

                # modifiers for contents
                #if len(self.contents) > 0:
                #    for clast in self.contents:
                #       pass
                clast = ""
                if len(self.contents) > 0:
                    clast = self.contents[-1]
                else:
                    continue
                if k == "nocase":
                    clast.nocase = v
                    continue
                if k == "rawbytes":
                    clast.rawbytes = v
                    continue
                if k == "depth":
                    clast.depth = int(v)
                    continue
                if k == "offset":
                    clast.offset = int(v)
                    continue
                if k == "distance":
                    clast.distance = int(v)
                    continue
                if k == "within":
                    clast.within = int(v)
                    continue
                if k == "http_client body":
                    clast.isHTTP = True
                    clast.http_client_body = v
                    continue
                if k == "http_cookie":
                    clast.isHTTP = True
                    clast.http_cookie = v
                    continue
                if k == "http_header":
                    clast.isHTTP = True
                    clast.http_header = v
                    continue
                if k == "http_method":
                    clast.isHTTP = True
                    clast.http_method = v
                    continue
                if k == "http_uri":
                    clast.isHTTP = True
                    clast.http_uri = v
                    #print [z.content for z in self.contents ][-1]
                    #- returns the content that http_uri keyword modifies
                    #as a string

                    #print [z.content for z in self.contents ][-1:]
                    #- returns the content that http_uri keyword modifies
                    #as a list

                    #basically content:"BLABLA"; http_uri;
                    #[EQUALS] uricontent:"BLABLA" !!
                    #so we need to make it uricontnet
                    http_uri_content = [z.content for z in self.contents][-1]
                    c = RuleUriContent(http_uri_content)
                    self.uricontents.append(c)

                    #then we need to delete/destroy the "content"/"payload"
                    #so that it is only the uricontent left
                    #otherwise we end up with both "content" and "uricontent"
                    for z in self.contents:
                        if z.content == http_uri_content:
                            z.content = ''
                            z.payload = ''
                    continue
                if k == "fast_pattern":
                    clast.fast_pattern = v
                    continue

                else:
                    print "\nUnsupported keyword! Error parsing rule contents\n" + str(
                        rule)
                    return 1
                    #break

                self.options.append([k, v])

        else:
            print "Error loading rule " + str(rule)