sf_attribute_table.y

著名的入侵检测系统snort的最新版本的源码

  AttributeValueString
  {
        $$.type = ATTRIBUTE_NAME; 
        $$.confidence = 100;
        SnortStrncpy($$.value.s_value, $1, STD_BUF);
  }
  | AttributeValueString AttributeConfidence
  {
        $$.type = ATTRIBUTE_NAME; 
        $$.confidence = $2;
        SnortStrncpy($$.value.s_value, $1, STD_BUF);
  }
  | AttributeValueNumber AttributeConfidence
  {
        $$.type = ATTRIBUTE_NAME; 
        $$.confidence = $2;
        SnortSnprintf($$.value.s_value, STD_BUF, "%d", $1);
  }
  | AttributeValueNumber
  {
        $$.type = ATTRIBUTE_NAME; 
        $$.confidence = 100;
        SnortSnprintf($$.value.s_value, STD_BUF, "%d", $1);
  }
  | AttributeId AttributeConfidence
  {
        char *mapped_name;
        $$.confidence = $2;
        mapped_name = SFAT_LookupAttributeNameById($1);
        if (!mapped_name)
        {
            $$.type = ATTRIBUTE_ID; 
            $$.value.l_value = $1;
            //FatalError("Unknown/Invalid Attribute ID %d\n", $1);
            sfat_grammar_error = "Unknown/Invalid Attribute ID";
            YY_ABORT;
        }
        else
        {
            /* Copy String */
            $$.type = ATTRIBUTE_NAME; 
            SnortStrncpy($$.value.s_value, mapped_name, STD_BUF);
        }
  }
  | AttributeId 
  {
        char *mapped_name;
        $$.confidence = 100;
        mapped_name = SFAT_LookupAttributeNameById($1);
        if (!mapped_name)
        {
            $$.type = ATTRIBUTE_ID; 
            $$.value.l_value = $1;
            //FatalError("Unknown/Invalid Attribute ID %d\n", $1);
            sfat_grammar_error = "Unknown/Invalid Attribute ID";
            YY_ABORT;
        }
        else
        {
            /* Copy String */
            $$.type = ATTRIBUTE_NAME; 
            SnortStrncpy($$.value.s_value, mapped_name, STD_BUF);
        }
  };

AttributeValueString:
  SF_AT_START_ATTRIBUTE_VALUE SF_AT_STRING SF_AT_END_ATTRIBUTE_VALUE
  {
        SnortStrncpy($$, $2, STD_BUF);
  };

AttributeValueNumber:
  SF_AT_START_ATTRIBUTE_VALUE SF_AT_NUMERIC SF_AT_END_ATTRIBUTE_VALUE
  {
        $$ = $2;
  };
  
AttributeId:
  SF_AT_START_ATTRIBUTE_ID SF_AT_NUMERIC SF_AT_END_ATTRIBUTE_ID
      {
        /* Copy numeric */
        $$ = $2;
      };

AttributeConfidence:
  SF_AT_START_CONFIDENCE SF_AT_NUMERIC SF_AT_END_CONFIDENCE
  {
    /* Copy numeric */
    $$ = $2;
  };

ServiceList:
  ServiceListStart ServiceListData ServiceListEnd 
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "ServiceList (complete)\n"););
  };

ServiceListStart:
  SF_AT_START_SERVICES
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Start ServiceList\n"););
    sfat_client_or_service = ATTRIBUTE_SERVICE;
  };

ServiceListEnd:
  SF_AT_END_SERVICES
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "End ServiceList\n"););
  };
  
ServiceListData:
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "EmptyService\n"););
  }
  | Service ServiceListData
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service ServiceListData\n"););
  };

Service:
  ServiceStart ServiceData ServiceEnd
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Adding Complete\n"););
    SFAT_AddApplicationData();
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Added\n"););
  };

ServiceStart:
  SF_AT_START_SERVICE
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Start\n"););
    SFAT_CreateApplicationEntry();
  };

ServiceEnd:
  SF_AT_END_SERVICE
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service End\n"););
  };

ServiceData:
  ServiceDataRequired
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data (no application)\n"););
  }
  | ServiceDataRequired Application
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data (application)\n"););
  };

ServiceDataRequired:
  IPProtocol Protocol Port
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data Required (IPProto Proto Port)\n"););
  }
  | IPProtocol Port Protocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data Required (IPProto Port Proto)\n"););
  }
  | Protocol IPProtocol Port
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data Required (Proto IPProto Port)\n"););
  }
  | Protocol Port IPProtocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data Required (Proto Port IPProto)\n"););
  }
  | Port Protocol IPProtocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data Required (Port Proto IPProto)\n"););
  }
  | Port IPProtocol Protocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Service Data Required (Port IPProto Proto)\n"););
  };

IPProtocol:
  SF_AT_START_IPPROTO AttributeInfo SF_AT_END_IPPROTO
  {
    /* Store IPProto Info */
    DEBUG_WRAP(PrintAttributeData("IPProto", &$2););
    SFAT_SetApplicationAttribute(&$2, APPLICATION_ENTRY_IPPROTO);
  };

Protocol:
  SF_AT_START_PROTOCOL AttributeInfo SF_AT_END_PROTOCOL
  {
    /* Store Protocol Info */
    DEBUG_WRAP(PrintAttributeData("Protocol", &$2););
    SFAT_SetApplicationAttribute(&$2, APPLICATION_ENTRY_PROTO);
  };

Port:
  SF_AT_START_PORT AttributeInfo SF_AT_END_PORT
  {
    /* Store Port Info */
    DEBUG_WRAP(PrintAttributeData("Port", &$2););
    SFAT_SetApplicationAttribute(&$2, APPLICATION_ENTRY_PORT);
  };

Application:
  SF_AT_START_APPLICATION AttributeInfo SF_AT_END_APPLICATION
  {
    /* Store Application Info */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Application\n"));
    DEBUG_WRAP(PrintAttributeData("Application", &$2););
    SFAT_SetApplicationAttribute(&$2, APPLICATION_ENTRY_APPLICATION);
  }
  | SF_AT_START_APPLICATION AttributeInfo Version SF_AT_END_APPLICATION
  {
    /* Store Application Info */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Application with Version\n"));
    DEBUG_WRAP(PrintAttributeData("Application", &$2););
    SFAT_SetApplicationAttribute(&$2, APPLICATION_ENTRY_APPLICATION);
  };

Version:
  SF_AT_START_VERSION AttributeInfo SF_AT_END_VERSION
  {
    /* Store Version Info */
    DEBUG_WRAP(PrintAttributeData("Version", &$2););
    SFAT_SetApplicationAttribute(&$2, APPLICATION_ENTRY_VERSION);
  };

ClientList:
  ClientListStart ClientListData ClientListEnd
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "ClientList (complete)\n"););
  };

ClientListStart:
  SF_AT_START_CLIENTS
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Start ClientList\n"););
    sfat_client_or_service = ATTRIBUTE_CLIENT;
  };

ClientListEnd:
  SF_AT_END_CLIENTS
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "End ClientList\n"););
  };

ClientListData:
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "EmptyClient\n"););
  }
  | Client ClientListData
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client ClientListData\n"););
  };

Client:
  ClientStart ClientData ClientEnd
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Adding Complete\n"););
    SFAT_AddApplicationData();
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Added\n"););
  };

ClientStart:
  SF_AT_START_CLIENT
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Start\n"););
    SFAT_CreateApplicationEntry();
  };

ClientEnd:
  SF_AT_END_CLIENT
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client End\n"););
  };

ClientData:
  ClientDataRequired
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Data (no application)\n"););
  }
  | ClientDataRequired Application
  {
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Data (application)\n"););
  };

ClientDataRequired:
  Protocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Data Required (Proto)\n"););
  }
  | IPProtocol Protocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Data Required (IPProto Proto)\n"););
  }
  | Protocol IPProtocol
  {
    /* Order independent */
    DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Client Data Required (Proto IPProto)\n"););
  };

%%
/*
int yywrap(void)
{
    return 1;
}
*/
#endif /* TARGET_BASED */