Snort-ModSec-PreProc/parser.c at master · PenTesting/Snort-ModSec-PreProc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Remove anything not necessary in the string */
void removeSubstr (char *string, char *sub) {
    char *match = string;
    int len = strlen(sub);
    while ((match = strstr(match, sub))) {
        *match = '\0';
        strcat(string, match+len);
        match++;
    }
}

int main() {
    int y;
    FILE *data;
    char action;
    char line[100]; 	// output parsed string is limited
    int counter = 0;
    char keyword[] = ""; // no function whatsoever
    int result,index = 0;


    struct rule {
        char keyword1[100];
        char keyword2[100];
    } ruleset[10];

    if((data=fopen("rule", "r")) != NULL) {
        while(fgets(line,sizeof(line),data)) {
            if((strcmp(line,keyword))) {
                char s[10] = "$,";
                char *token = strtok(line, s);

                while(token != NULL) {
                    /* char *end2; */
                    /* char *line2 = token; */
                    /* char *temporaryToken; */
                    /* printf("Token 1: %s\n", token); */
                    /* while(temporaryToken != NULL) { */
                    /*   printf("Token 2: %s\n", temporaryToken); */
                    /* } */
                    /* if(strcmp(token,"XML")==0) { */
                    /*     counter = 0; */
                    /* } */
                    if(counter==1) {
                        strcpy(ruleset[index].keyword1, token);
                    }
                    if(counter==2) {
                        strcpy(ruleset[index].keyword2, token);
                        index++;
                    }
                    counter++;
                    token = strtok(NULL, s);
                }
            }
        }
    }

    /* Skid's code */
    for(y = 0; y < index; y++) {
        //printf("%s ", directory[y].fName);
        /* removeSubstr(directory[y].fName, "RGS_"); */
        /* removeSubstr(directory[y].fName, "NAMES"); */
        /* removeSubstr(directory[y].fName, "ARGS"); */
        /* removeSubstr(directory[y].fName, "XML"); */
        //removeSubstr(ruleset[y].keyword1, "RGS_NAMES|ARGS|XML:/* \"");
        removeSubstr(ruleset[y].keyword1, "ARGS|XML:/* \"");
	removeSubstr(ruleset[y].keyword1, "RGS_NAMES|");
        printf("%s ", ruleset[y].keyword1);
        removeSubstr(ruleset[y].keyword2, "\" \"phase:2");
	//removeSubstr(ruleset[y].keyword2, "\" \"phasrev:\' rev:\'");
        printf("%s", ruleset[y].keyword2);
        printf("\n");
    }

    fclose(data);
    return 1;
}