Skip to content

Commit

Permalink
snort3_demo: build so_rule 3_13 using cmake. The result is more portable
Browse files Browse the repository at this point in the history
  • Loading branch information
wtfbbqhax committed Jul 27, 2023
1 parent f24ca75 commit 7535244
Show file tree
Hide file tree
Showing 6 changed files with 82 additions and 16 deletions.
3 changes: 3 additions & 0 deletions tests/ips_options/so_and_soid/so_rule/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
build/
install/
sid_3_13.h
39 changes: 39 additions & 0 deletions tests/ips_options/so_and_soid/so_rule/CMakeLists.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
cmake_minimum_required ( VERSION 3.4.3 )
project (sorule_id_3_13 C CXX)

set (CMAKE_CXX_STANDARD 14)
set (CMAKE_CXX_STANDARD_REQUIRED ON)
set (CMAKE_CXX_EXTENSIONS OFF)

include ( FindPkgConfig )
pkg_search_module ( SNORT3 REQUIRED snort>=3 )

add_library (
so_rule
MODULE
sid_3_13.cc
sid_3_13.h
)

target_compile_options (
so_rule
PRIVATE
-fno-rtti
)

set_target_properties (
so_rule
PROPERTIES
PREFIX ""
)

target_include_directories (
so_rule PUBLIC
${SNORT3_INCLUDE_DIRS}
)

install (
TARGETS so_rule
LIBRARY
DESTINATION "${CMAKE_SOURCE_DIR}/install"
)
13 changes: 13 additions & 0 deletions tests/ips_options/so_and_soid/so_rule/Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
.PHONY: build install sid_3-13.h

build:
cmake -B build/ -G Ninja .
cmake --build build/

install:
cmake --install build/

sid_3_13.h: sid_3_13.txt
snort --rule-to-text < sid_3_13.txt > sid_3_13.h


File renamed without changes.
17 changes: 17 additions & 0 deletions tests/ips_options/so_and_soid/so_rule/sid_3_13.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
alert http
(
msg:"Too much Cheez Whiz is bad mkay.";
flow:to_server,established;
http_uri; content:"crazy";
http_uri:query; content:"withThe=CheezWhiz";
http_uri:query; content:"cans=";
service:http;
reference:url,http://www.kraftbrands.com/cheezwhiz/;
classtype:misc-activity;
gid:3;
sid:13;
rev:1;
soid:3_13_1;
so:cans 7;
)

26 changes: 10 additions & 16 deletions tests/ips_options/so_and_soid/test.bats
Original file line number Diff line number Diff line change
Expand Up @@ -5,35 +5,29 @@ base=sid_3_13
pcap="cheez.pcap"
cfg="snort.lua"

gcc_opts="-std=c++14 -Wall -g -ggdb -O0"
stub_opts="--warn-all --plugin-path ."
stub_opts="--warn-all --plugin-path so_rule/install"
run_opts="-q -A csv"

setup()
{
CXX=g++

if [[ "$OSTYPE" == "freebsd"* ]]; then
CXX='clang++'
elif [[ "$OSTYPE" == "linux-musl"* ]]; then
gcc_opts="-std=c++14 -Wall -g -ggdb -O0"
fi

local cppflags="$(pkg-config --cflags snort) $(pkg-config --variable=DAQ_CPPFLAGS snort)"

$snort --rule-to-text < $base.txt > $base.h
${CXX} -c $gcc_opts $cppflags -fPIC -o $base.o $base.cc
${CXX} -shared -o $base.so $base.o
pushd so_rule/
make sid_3_13.h build install
popd
ls -alh so_rule/install
}

@test "SO and SOID - 3:13" {
echo $snort $stub_opts --dump-dynamic-rules > stub.rule
$snort $stub_opts --dump-dynamic-rules > stub.rule

echo $snort $stub_opts -c $cfg -R stub.rule -r $pcap $run_opts &> snort.out
$snort $stub_opts -c $cfg -R stub.rule -r $pcap $run_opts &> snort.out

cat snort.out
cat stub.rule snort.out | diff expected -
}

teardown()
{
rm -f snort.out *.z *.o *.so stub.rule *.h
}

0 comments on commit 7535244

Please sign in to comment.