Logo Search packages:      
Sourcecode: wflogs version File versions  Download package

snort.cc

#line 2 "snort.cc"

#line 4 "snort.cc"

#define  YY_INT_ALIGNED short int

/* A lexical scanner generated by flex */

#define FLEX_SCANNER
#define YY_FLEX_MAJOR_VERSION 2
#define YY_FLEX_MINOR_VERSION 5
#define YY_FLEX_SUBMINOR_VERSION 31
#if YY_FLEX_SUBMINOR_VERSION > 0
#define FLEX_BETA
#endif

/* First, we deal with  platform-specific or compiler-specific issues. */

/* begin standard C headers. */
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>

/* end standard C headers. */

/* flex integer type definitions */

#ifndef FLEXINT_H
#define FLEXINT_H

/* C99 systems have <inttypes.h>. Non-C99 systems may or may not. */

#if defined __STDC_VERSION__ && __STDC_VERSION__ >= 199901L
#include <inttypes.h>
typedef int8_t flex_int8_t;
typedef uint8_t flex_uint8_t;
typedef int16_t flex_int16_t;
typedef uint16_t flex_uint16_t;
typedef int32_t flex_int32_t;
typedef uint32_t flex_uint32_t;
#else
typedef signed char flex_int8_t;
typedef short int flex_int16_t;
typedef int flex_int32_t;
typedef unsigned char flex_uint8_t; 
typedef unsigned short int flex_uint16_t;
typedef unsigned int flex_uint32_t;
#endif /* ! C99 */

/* Limits of integral types. */
#ifndef INT8_MIN
#define INT8_MIN               (-128)
#endif
#ifndef INT16_MIN
#define INT16_MIN              (-32767-1)
#endif
#ifndef INT32_MIN
#define INT32_MIN              (-2147483647-1)
#endif
#ifndef INT8_MAX
#define INT8_MAX               (127)
#endif
#ifndef INT16_MAX
#define INT16_MAX              (32767)
#endif
#ifndef INT32_MAX
#define INT32_MAX              (2147483647)
#endif
#ifndef UINT8_MAX
#define UINT8_MAX              (255U)
#endif
#ifndef UINT16_MAX
#define UINT16_MAX             (65535U)
#endif
#ifndef UINT32_MAX
#define UINT32_MAX             (4294967295U)
#endif

#endif /* ! FLEXINT_H */

#ifdef __cplusplus

/* The "const" storage-class-modifier is valid. */
#define YY_USE_CONST

#else /* ! __cplusplus */

#if __STDC__

#define YY_USE_CONST

#endif      /* __STDC__ */
#endif      /* ! __cplusplus */

#ifdef YY_USE_CONST
#define yyconst const
#else
#define yyconst
#endif

/* Returned upon end-of-file. */
#define YY_NULL 0

/* Promotes a possibly negative, possibly signed char to an unsigned
 * integer for use as an array index.  If the signed char is negative,
 * we want to instead treat it as an 8-bit unsigned char, hence the
 * double cast.
 */
#define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c)

/* Enter a start condition.  This macro really ought to take a parameter,
 * but we do it the disgusting crufty way forced on us by the ()-less
 * definition of BEGIN.
 */
#define BEGIN (yy_start) = 1 + 2 *

/* Translate the current start state into a value that can be later handed
 * to BEGIN to return to the state.  The YYSTATE alias is for lex
 * compatibility.
 */
#define YY_START (((yy_start) - 1) / 2)
#define YYSTATE YY_START

/* Action number for EOF rule of a given start state. */
#define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1)

/* Special action meaning "start processing a new file". */
#define YY_NEW_FILE snortrestart(snortin  )

#define YY_END_OF_BUFFER_CHAR 0

/* Size of default input buffer. */
#ifndef YY_BUF_SIZE
#define YY_BUF_SIZE 16384
#endif

#ifndef YY_TYPEDEF_YY_BUFFER_STATE
#define YY_TYPEDEF_YY_BUFFER_STATE
typedef struct yy_buffer_state *YY_BUFFER_STATE;
#endif

extern int snortleng;

extern FILE *snortin, *snortout;

#define EOB_ACT_CONTINUE_SCAN 0
#define EOB_ACT_END_OF_FILE 1
#define EOB_ACT_LAST_MATCH 2

    #define YY_LESS_LINENO(n)
    
/* Return all but the first "n" matched characters back to the input stream. */
#define yyless(n) \
      do \
            { \
            /* Undo effects of setting up snorttext. */ \
        int yyless_macro_arg = (n); \
        YY_LESS_LINENO(yyless_macro_arg);\
            *yy_cp = (yy_hold_char); \
            YY_RESTORE_YY_MORE_OFFSET \
            (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \
            YY_DO_BEFORE_ACTION; /* set up snorttext again */ \
            } \
      while ( 0 )

#define unput(c) yyunput( c, (yytext_ptr)  )

/* The following is because we cannot portably get our hands on size_t
 * (without autoconf's help, which isn't available because we want
 * flex-generated scanners to compile on their own).
 */

#ifndef YY_TYPEDEF_YY_SIZE_T
#define YY_TYPEDEF_YY_SIZE_T
typedef unsigned int yy_size_t;
#endif

#ifndef YY_STRUCT_YY_BUFFER_STATE
#define YY_STRUCT_YY_BUFFER_STATE
struct yy_buffer_state
      {
      FILE *yy_input_file;

      char *yy_ch_buf;        /* input buffer */
      char *yy_buf_pos;       /* current position in input buffer */

      /* Size of input buffer in bytes, not including room for EOB
       * characters.
       */
      yy_size_t yy_buf_size;

      /* Number of characters read into yy_ch_buf, not including EOB
       * characters.
       */
      int yy_n_chars;

      /* Whether we "own" the buffer - i.e., we know we created it,
       * and can realloc() it to grow it, and should free() it to
       * delete it.
       */
      int yy_is_our_buffer;

      /* Whether this is an "interactive" input source; if so, and
       * if we're using stdio for input, then we want to use getc()
       * instead of fread(), to make sure we stop fetching input after
       * each newline.
       */
      int yy_is_interactive;

      /* Whether we're considered to be at the beginning of a line.
       * If so, '^' rules will be active on the next match, otherwise
       * not.
       */
      int yy_at_bol;

    int yy_bs_lineno; /**< The line count. */
    int yy_bs_column; /**< The column count. */
    
      /* Whether to try to fill the input buffer when we reach the
       * end of it.
       */
      int yy_fill_buffer;

      int yy_buffer_status;

#define YY_BUFFER_NEW 0
#define YY_BUFFER_NORMAL 1
      /* When an EOF's been seen but there's still some text to process
       * then we mark the buffer as YY_EOF_PENDING, to indicate that we
       * shouldn't try reading from the input source any more.  We might
       * still have a bunch of tokens to match, though, because of
       * possible backing-up.
       *
       * When we actually see the EOF, we change the status to "new"
       * (via snortrestart()), so that the user can continue scanning by
       * just pointing snortin at a new input file.
       */
#define YY_BUFFER_EOF_PENDING 2

      };
#endif /* !YY_STRUCT_YY_BUFFER_STATE */

/* Stack of input buffers. */
static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */
static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */
static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */

/* We provide macros for accessing buffer states in case in the
 * future we want to put the buffer states in a more general
 * "scanner state".
 *
 * Returns the top of the stack, or NULL.
 */
#define YY_CURRENT_BUFFER ( (yy_buffer_stack) \
                          ? (yy_buffer_stack)[(yy_buffer_stack_top)] \
                          : NULL)

/* Same as previous macro, but useful when we know that the buffer stack is not
 * NULL or when we need an lvalue. For internal use only.
 */
#define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)]

/* yy_hold_char holds the character lost when snorttext is formed. */
static char yy_hold_char;
static int yy_n_chars;        /* number of characters read into yy_ch_buf */
int snortleng;

/* Points to current character in buffer. */
static char *yy_c_buf_p = (char *) 0;
static int yy_init = 1;       /* whether we need to initialize */
static int yy_start = 0;      /* start state number */

/* Flag which is used to allow snortwrap()'s to do buffer switches
 * instead of setting up a fresh snortin.  A bit of a hack ...
 */
static int yy_did_buffer_switch_on_eof;

void snortrestart (FILE *input_file  );
void snort_switch_to_buffer (YY_BUFFER_STATE new_buffer  );
YY_BUFFER_STATE snort_create_buffer (FILE *file,int size  );
void snort_delete_buffer (YY_BUFFER_STATE b  );
void snort_flush_buffer (YY_BUFFER_STATE b  );
void snortpush_buffer_state (YY_BUFFER_STATE new_buffer  );
void snortpop_buffer_state (void );

static void snortensure_buffer_stack (void );
static void snort_load_buffer_state (void );
static void snort_init_buffer (YY_BUFFER_STATE b,FILE *file  );

#define YY_FLUSH_BUFFER snort_flush_buffer(YY_CURRENT_BUFFER )

YY_BUFFER_STATE snort_scan_buffer (char *base,yy_size_t size  );
YY_BUFFER_STATE snort_scan_string (yyconst char *yy_str  );
YY_BUFFER_STATE snort_scan_bytes (yyconst char *bytes,int len  );

void *snortalloc (yy_size_t  );
void *snortrealloc (void *,yy_size_t  );
void snortfree (void *  );

#define yy_new_buffer snort_create_buffer

#define yy_set_interactive(is_interactive) \
      { \
      if ( ! YY_CURRENT_BUFFER ){ \
        snortensure_buffer_stack (); \
            YY_CURRENT_BUFFER_LVALUE =    \
            snort_create_buffer(snortin,YY_BUF_SIZE ); \
      } \
      YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \
      }

#define yy_set_bol(at_bol) \
      { \
      if ( ! YY_CURRENT_BUFFER ){\
        snortensure_buffer_stack (); \
            YY_CURRENT_BUFFER_LVALUE =    \
            snort_create_buffer(snortin,YY_BUF_SIZE ); \
      } \
      YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \
      }

#define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol)

/* Begin user sect3 */

#define snortwrap(n) 1
#define YY_SKIP_YYWRAP

typedef unsigned char YY_CHAR;

FILE *snortin = (FILE *) 0, *snortout = (FILE *) 0;

typedef int yy_state_type;

extern int snortlineno;

int snortlineno = 1;

extern char *snorttext;
#define yytext_ptr snorttext

static yy_state_type yy_get_previous_state (void );
static yy_state_type yy_try_NUL_trans (yy_state_type current_state  );
static int yy_get_next_buffer (void );
static void yy_fatal_error (yyconst char msg[]  );

/* Done after the current pattern has been matched and before the
 * corresponding action - sets up snorttext.
 */
#define YY_DO_BEFORE_ACTION \
      (yytext_ptr) = yy_bp; \
      snortleng = (size_t) (yy_cp - yy_bp); \
      (yy_hold_char) = *yy_cp; \
      *yy_cp = '\0'; \
      (yy_c_buf_p) = yy_cp;

#define YY_NUM_RULES 18
#define YY_END_OF_BUFFER 19
/* This struct is not used in this scanner,
   but its presence is necessary. */
struct yy_trans_info
      {
      flex_int32_t yy_verify;
      flex_int32_t yy_nxt;
      };
static yyconst flex_int16_t yy_accept[181] =
    {   0,
       16,   16,   19,   17,   15,   14,   17,   16,   16,   16,
       16,   16,   16,   16,   16,   16,   16,   16,   17,   16,
       17,   14,    0,    5,   16,    0,   16,    5,    5,    5,
        5,    5,    5,    5,    5,    5,    5,    5,    0,    0,
        0,    5,    5,    0,    0,    0,    0,    5,    0,    0,
        0,    5,    5,    0,    0,    0,    0,    0,    0,    0,
        0,    5,   16,    0,    0,    0,    0,    0,    0,    0,
        0,    0,    5,    5,    5,    0,    0,    0,    0,    0,
        0,    0,    0,    0,    0,    5,    5,    0,    0,    0,
        0,    4,    0,    0,    2,    0,    5,    5,    0,    0,

        0,    0,    0,    0,    0,    5,    5,    0,    0,    0,
        0,    0,    0,    0,    0,    5,    5,    0,    0,   10,
        0,    0,    0,    0,    3,    5,    5,    0,    0,   10,
        0,    0,    0,    0,    5,   16,    0,    0,   10,   11,
        0,    0,    0,    5,    0,    0,    0,   11,    0,    0,
        0,    0,   13,    8,    0,   11,    0,    0,    7,   12,
       13,    8,    0,   11,    1,    0,   12,    8,    9,   11,
        1,    0,    9,    0,    9,    0,    6,    9,    9,    0
    } ;

static yyconst flex_int32_t yy_ec[256] =
    {   0,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    2,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    3,    4,    4,    4,    4,    4,    4,    4,    5,
        6,    4,    4,    4,    7,    8,    9,   10,   10,   10,
       10,   11,   10,   10,   10,   10,   10,   12,    4,    4,
        4,   13,    4,    4,   14,   15,   16,   17,   15,   18,
       15,   15,   19,   20,   15,   15,   21,   22,   23,   24,
       15,   15,   25,   26,   27,   15,   15,   15,   15,   15,
       28,    4,   29,    4,   30,    4,   31,   32,   33,   15,

       34,   35,   36,   15,   37,   15,   15,   38,   39,   40,
       41,   42,   15,   43,   44,   45,   46,   47,   15,   15,
       48,   15,   49,    4,   50,    4,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,

        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1
    } ;

static yyconst flex_int32_t yy_meta[51] =
    {   0,
        1,    2,    3,    4,    5,    5,    6,    6,    3,    6,
        6,    7,    8,    6,    6,    6,    6,    6,    6,    6,
        6,    6,    6,    6,    6,    6,    6,    1,    4,    6,
        6,    6,    6,    6,    6,    6,    6,    6,    6,    6,
        6,    6,    6,    6,    6,    6,    6,    6,    4,    4
    } ;

static yyconst flex_int16_t yy_base[188] =
    {   0,
        0,    0,  364,  439,  439,  360,   48,  349,  348,   76,
      120,  326,  325,   21,  327,  316,  323,  316,   50,   22,
       44,  345,  148,  176,  332,  341,    0,    0,  300,  306,
      308,  308,  299,   35,   29,  291,  292,  294,   78,  297,
      291,  292,  290,  315,  314,  312,   58,  325,   81,  291,
      283,  274,  286,  294,  290,  289,   85,  204,   87,  268,
      270,  265,   58,  285,  258,   93,   97,  232,  260,   99,
      263,  263,   89,  264,  259,  300,  103,  294,  288,  316,
      272,  263,  257,  289,  105,  246,  245,  109,  122,  126,
      344,  439,  252,  241,  439,  131,  240,  250,  135,  153,

      275,  372,  245,  233,  268,  235,  247,  128,  157,  137,
      161,  163,  244,  264,  263,  231,  199,  180,  228,  165,
      221,  182,  188,  207,  439,  177,  194,  184,  188,  190,
      193,  185,  144,  206,  142,  168,  210,  162,  154,  212,
      214,  125,  125,  140,  146,  216,  220,  222,  234,  103,
      128,  132,    0,  236,  116,  239,  118,   72,  439,    0,
        0,  241,  244,  246,    0,   82,    0,   68,  248,  439,
        0,   73,  250,   36,  262,   25,  439,  264,  439,  439,
      400,  401,  407,  413,  421,  425,  430
    } ;

static yyconst flex_int16_t yy_def[188] =
    {   0,
      180,    1,  180,  180,  180,  180,  181,  182,  182,  183,
      183,   11,   11,   11,   11,   11,   11,   11,  180,   11,
      180,  180,  181,  181,  182,  180,   11,   11,   11,   11,
       11,   11,   11,   11,   11,   11,   11,   11,  180,  180,
      180,   11,   11,  180,  180,  180,  180,   11,  180,  180,
      180,   11,   11,  180,  180,  180,  180,  181,  180,  180,
      180,   11,   11,  180,  180,  180,  180,  181,  181,  180,
      180,  180,   11,   11,   11,  180,  180,  180,  181,  181,
      180,  180,  180,  180,  180,   11,   11,  180,  180,  180,
      181,  180,  180,  180,  180,  180,   11,   11,  180,  180,

      180,  181,  180,  180,  180,   11,   11,  180,  180,  180,
      180,  180,  180,  180,  180,   11,   11,  180,  180,  180,
      180,  180,  180,  180,  180,   11,   11,  180,  180,  180,
      180,  180,  180,  180,   11,   11,  180,  180,  180,  180,
      180,  180,  180,   11,  180,  180,  180,  180,  180,  180,
      180,  180,  184,  180,  180,  180,  180,  180,  180,  185,
      184,  180,  180,  180,  186,  180,  185,  180,  180,  180,
      186,  180,  180,  187,  180,  187,  180,  180,  180,    0,
      180,  180,  180,  180,  180,  180,  180
    } ;

static yyconst flex_int16_t yy_nxt[490] =
    {   0,
        4,    5,    6,    4,    7,    4,    8,    9,    4,    9,
        9,    4,    4,   10,   11,   11,   12,   13,   11,   14,
       15,   16,   17,   11,   18,   11,   11,   19,    4,    9,
       11,   11,   11,   11,   11,   11,   11,   11,   11,   11,
       11,   11,   11,   20,   11,   11,   11,   11,   21,    4,
       23,   33,   23,  177,   23,   23,   23,   23,   23,   39,
       39,   42,   44,   43,  177,   40,   34,   57,   57,   45,
       46,   48,   48,   41,   48,  174,   48,   23,   23,  163,
       23,   24,   27,   27,   23,   27,   27,   39,   39,   49,
       59,   59,   66,  172,   67,   67,   59,   59,   70,   74,

       84,   75,   77,   77,   66,   27,   78,   78,   81,   81,
       89,  166,   90,   90,   96,   96,   85,   29,   99,   99,
      165,   30,   23,  146,   23,   24,   27,   27,   23,   27,
       27,  100,  100,   89,  160,  101,  101,  118,  118,  159,
       96,   96,  108,  158,  109,  109,  120,  120,  153,   27,
       23,  152,   23,  151,   23,   23,   23,   23,   23,  105,
      110,  150,  111,  111,  108,  131,  119,  119,  110,  128,
      121,  121,  122,  122,  130,  130,  131,   23,   23,  145,
       23,  144,   23,   23,   23,   23,   23,  128,  142,  129,
      129,  132,  132,  137,  137,  128,  141,  138,  138,  139,

      139,  131,  140,  140,  136,   23,   68,  135,   23,  134,
       23,   23,   23,   69,   69,  143,  143,  146,  133,  147,
      147,  148,  148,  149,  149,  154,  154,  146,  110,  155,
      155,  156,  156,   23,   23,  108,   23,  127,   23,   23,
       23,   69,   69,  157,  157,  162,  162,  163,  164,  164,
      168,  168,  163,  169,  169,  170,  170,  173,  173,  175,
      175,   23,   79,  126,   23,  125,   23,   23,   23,   80,
       80,  178,  178,  179,  179,  124,  123,  117,  116,  115,
      114,  113,   89,  107,  106,  104,  103,   98,   97,   23,
       23,   95,   23,   94,   23,   23,   23,   91,   91,   93,

       92,   66,   88,   87,   86,   83,   82,   76,   65,   73,
       72,   71,   65,   65,   64,   63,   62,   23,   79,   61,
       23,   60,   23,   23,   23,   23,   23,   58,   56,   55,
       54,   53,   52,   51,   50,   48,   48,   48,   48,   48,
       48,   48,   48,   47,  180,   23,   23,   22,   23,   38,
       23,   23,   23,  102,  102,   37,   36,   35,   32,   31,
      180,   26,   22,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,   23,   23,  180,   23,  180,   23,   23,
       23,   23,   23,  112,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,

      180,   23,   24,  180,   24,   24,   25,  180,   25,   28,
      180,   28,   28,  161,  180,  161,  161,  161,  161,  161,
      161,  167,  180,  167,  167,  167,  167,  167,  167,  171,
      171,  171,  176,  176,  176,  176,  176,  176,    3,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180
    } ;

static yyconst flex_int16_t yy_chk[490] =
    {   0,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        1,    1,    1,    1,    1,    1,    1,    1,    1,    1,
        7,   14,    7,  176,    7,    7,    7,    7,    7,   19,
       19,   20,   21,   20,  174,   19,   14,   47,   47,   21,
       21,   35,   34,   19,   34,  172,   35,    7,   10,  168,
       10,   10,   10,   10,   10,   10,   10,   39,   39,   39,
       49,   49,   57,  166,   57,   57,   59,   59,   59,   63,

       73,   63,   66,   66,   67,   10,   67,   67,   70,   70,
       77,  158,   77,   77,   85,   85,   73,   10,   88,   88,
      157,   10,   11,  155,   11,   11,   11,   11,   11,   11,
       11,   89,   89,   90,  152,   90,   90,  108,  108,  151,
       96,   96,   99,  150,   99,   99,  110,  110,  145,   11,
       23,  144,   23,  143,   23,   23,   23,   23,   23,   96,
      100,  142,  100,  100,  109,  139,  109,  109,  111,  138,
      111,  111,  112,  112,  120,  120,  120,   23,   24,  136,
       24,  135,   24,   24,   24,   24,   24,  118,  133,  118,
      118,  122,  122,  128,  128,  129,  132,  129,  129,  130,

      130,  130,  131,  131,  127,   24,   58,  126,   58,  124,
       58,   58,   58,   58,   58,  134,  134,  137,  123,  137,
      137,  140,  140,  141,  141,  146,  146,  147,  121,  147,
      147,  148,  148,   58,   68,  119,   68,  117,   68,   68,
       68,   68,   68,  149,  149,  154,  154,  154,  156,  156,
      162,  162,  162,  163,  163,  164,  164,  169,  169,  173,
      173,   68,   69,  116,   69,  115,   69,   69,   69,   69,
       69,  175,  175,  178,  178,  114,  113,  107,  106,  105,
      104,  103,  101,   98,   97,   94,   93,   87,   86,   69,
       79,   84,   79,   83,   79,   79,   79,   79,   79,   82,

       81,   78,   76,   75,   74,   72,   71,   65,   64,   62,
       61,   60,   56,   55,   54,   53,   52,   79,   80,   51,
       80,   50,   80,   80,   80,   80,   80,   48,   46,   45,
       44,   43,   42,   41,   40,   38,   37,   36,   33,   32,
       31,   30,   29,   26,   25,   80,   91,   22,   91,   18,
       91,   91,   91,   91,   91,   17,   16,   15,   13,   12,
        9,    8,    6,    3,    0,    0,    0,    0,    0,    0,
        0,    0,    0,   91,  102,    0,  102,    0,  102,  102,
      102,  102,  102,  102,    0,    0,    0,    0,    0,    0,
        0,    0,    0,    0,    0,    0,    0,    0,    0,    0,

        0,  102,  181,    0,  181,  181,  182,    0,  182,  183,
        0,  183,  183,  184,    0,  184,  184,  184,  184,  184,
      184,  185,    0,  185,  185,  185,  185,  185,  185,  186,
      186,  186,  187,  187,  187,  187,  187,  187,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180,  180,
      180,  180,  180,  180,  180,  180,  180,  180,  180
    } ;

static yy_state_type yy_last_accepting_state;
static char *yy_last_accepting_cpos;

extern int snort_flex_debug;
int snort_flex_debug = 0;

/* The intent behind this definition is that it'll catch
 * any uses of REJECT which flex missed.
 */
#define REJECT reject_used_but_not_detected
#define yymore() yymore_used_but_not_detected
#define YY_MORE_ADJ 0
#define YY_RESTORE_YY_MORE_OFFSET
char *snorttext;
#line 1 "snort.ll"
/* -*-c-*- */
/*
 * WallFire -- a comprehensive firewall administration tool.
 * 
 * Copyright (C) 2001 Hervé Eychenne <rv@wallfire.org>
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 * 
 */
#line 28 "snort.ll"
using namespace std;

#define YY_NO_UNPUT

#define IPLEN 16

#include <unistd.h>
#include <string.h>
#include <ctype.h>

#include "snort.h"
#include "common.h"
#include "defs.h"

#define SNORT_OPT_SRC 1
#define SNORT_OPT_DST 2
#define SNORT_OPT_PORT 4

static void snort_parse_branch(char* input);
static void snort_parse_ip(char* input, unsigned char mode);

static wf_logentry* logentry;
static bool nohit = false;
#line 654 "snort.cc"

#define INITIAL 0

#ifndef YY_NO_UNISTD_H
/* Special case for "unistd.h", since it is non-ANSI. We include it way
 * down here because we want the user's section 1 to have been scanned first.
 * The user has a chance to override it with an option.
 */
#include <unistd.h>
#endif

#ifndef YY_EXTRA_TYPE
#define YY_EXTRA_TYPE void *
#endif

/* Macros after this point can all be overridden by user definitions in
 * section 1.
 */

#ifndef YY_SKIP_YYWRAP
#ifdef __cplusplus
extern "C" int snortwrap (void );
#else
extern int snortwrap (void );
#endif
#endif

    static void yyunput (int c,char *buf_ptr  );
    
#ifndef yytext_ptr
static void yy_flex_strncpy (char *,yyconst char *,int );
#endif

#ifdef YY_NEED_STRLEN
static int yy_flex_strlen (yyconst char * );
#endif

#ifndef YY_NO_INPUT

#ifdef __cplusplus
static int yyinput (void );
#else
static int input (void );
#endif

#endif

/* Amount of stuff to slurp up with each read. */
#ifndef YY_READ_BUF_SIZE
#define YY_READ_BUF_SIZE 8192
#endif

/* Copy whatever the last rule matched to the standard output. */
#ifndef ECHO
/* This used to be an fputs(), but since the string might contain NUL's,
 * we now use fwrite().
 */
#define ECHO (void) fwrite( snorttext, snortleng, 1, snortout )
#endif

/* Gets input and stuffs it into "buf".  number of characters read, or YY_NULL,
 * is returned in "result".
 */
#ifndef YY_INPUT
#define YY_INPUT(buf,result,max_size) \
      if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \
            { \
            int c = '*'; \
            size_t n; \
            for ( n = 0; n < max_size && \
                       (c = getc( snortin )) != EOF && c != '\n'; ++n ) \
                  buf[n] = (char) c; \
            if ( c == '\n' ) \
                  buf[n++] = (char) c; \
            if ( c == EOF && ferror( snortin ) ) \
                  YY_FATAL_ERROR( "input in flex scanner failed" ); \
            result = n; \
            } \
      else \
            { \
            errno=0; \
            while ( (result = fread(buf, 1, max_size, snortin))==0 && ferror(snortin)) \
                  { \
                  if( errno != EINTR) \
                        { \
                        YY_FATAL_ERROR( "input in flex scanner failed" ); \
                        break; \
                        } \
                  errno=0; \
                  clearerr(snortin); \
                  } \
            }\
\

#endif

/* No semi-colon after return; correct usage is to write "yyterminate();" -
 * we don't want an extra ';' after the "return" because that will cause
 * some compilers to complain about unreachable statements.
 */
#ifndef yyterminate
#define yyterminate() return YY_NULL
#endif

/* Number of entries by which start-condition stack grows. */
#ifndef YY_START_STACK_INCR
#define YY_START_STACK_INCR 25
#endif

/* Report a fatal error. */
#ifndef YY_FATAL_ERROR
#define YY_FATAL_ERROR(msg) yy_fatal_error( msg )
#endif

/* end tables serialization structures and prototypes */

/* Default declaration of generated scanner - a define so the user can
 * easily add parameters.
 */
#ifndef YY_DECL
#define YY_DECL_IS_OURS 1

extern int snortlex (void);

#define YY_DECL int snortlex (void)
#endif /* !YY_DECL */

/* Code executed at the beginning of each rule, after snorttext and snortleng
 * have been set up.
 */
#ifndef YY_USER_ACTION
#define YY_USER_ACTION
#endif

/* Code executed at the end of each rule. */
#ifndef YY_BREAK
#define YY_BREAK break;
#endif

#define YY_RULE_SETUP \
      YY_USER_ACTION

/** The main scanner function which does all the work.
 */
YY_DECL
{
      register yy_state_type yy_current_state;
      register char *yy_cp, *yy_bp;
      register int yy_act;
    
#line 65 "snort.ll"


#line 808 "snort.cc"

      if ( (yy_init) )
            {
            (yy_init) = 0;

#ifdef YY_USER_INIT
            YY_USER_INIT;
#endif

            if ( ! (yy_start) )
                  (yy_start) = 1;   /* first start state */

            if ( ! snortin )
                  snortin = stdin;

            if ( ! snortout )
                  snortout = stdout;

            if ( ! YY_CURRENT_BUFFER ) {
                  snortensure_buffer_stack ();
                  YY_CURRENT_BUFFER_LVALUE =
                        snort_create_buffer(snortin,YY_BUF_SIZE );
            }

            snort_load_buffer_state( );
            }

      while ( 1 )       /* loops until end-of-file is reached */
            {
            yy_cp = (yy_c_buf_p);

            /* Support of snorttext. */
            *yy_cp = (yy_hold_char);

            /* yy_bp points to the position in yy_ch_buf of the start of
             * the current run.
             */
            yy_bp = yy_cp;

            yy_current_state = (yy_start);
yy_match:
            do
                  {
                  register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)];
                  if ( yy_accept[yy_current_state] )
                        {
                        (yy_last_accepting_state) = yy_current_state;
                        (yy_last_accepting_cpos) = yy_cp;
                        }
                  while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                        {
                        yy_current_state = (int) yy_def[yy_current_state];
                        if ( yy_current_state >= 181 )
                              yy_c = yy_meta[(unsigned int) yy_c];
                        }
                  yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
                  ++yy_cp;
                  }
            while ( yy_base[yy_current_state] != 439 );

yy_find_action:
            yy_act = yy_accept[yy_current_state];
            if ( yy_act == 0 )
                  { /* have to back up */
                  yy_cp = (yy_last_accepting_cpos);
                  yy_current_state = (yy_last_accepting_state);
                  yy_act = yy_accept[yy_current_state];
                  }

            YY_DO_BEFORE_ACTION;

do_action:  /* This label is used only to access EOF actions. */

            switch ( yy_act )
      { /* beginning of action switch */
                  case 0: /* must back up */
                  /* undo the effects of YY_DO_BEFORE_ACTION */
                  *yy_cp = (yy_hold_char);
                  yy_cp = (yy_last_accepting_cpos);
                  yy_current_state = (yy_last_accepting_state);
                  goto yy_find_action;

case 1:
YY_RULE_SETUP
#line 67 "snort.ll"
parse_date(snorttext, logentry);
      YY_BREAK
case 2:
YY_RULE_SETUP
#line 68 "snort.ll"
/* ignore */
      YY_BREAK
case 3:
YY_RULE_SETUP
#line 69 "snort.ll"
/* ignore */
      YY_BREAK
case 4:
YY_RULE_SETUP
#line 70 "snort.ll"
/* ignore */
      YY_BREAK
case 5:
YY_RULE_SETUP
#line 71 "snort.ll"
logentry->chainlabel = snorttext; // |SNORT_CHAIN;
      YY_BREAK
case 6:
YY_RULE_SETUP
#line 72 "snort.ll"
snort_parse_branch(snorttext + 17);
      YY_BREAK
case 7:
YY_RULE_SETUP
#line 73 "snort.ll"
/* ignore */
      YY_BREAK
case 8:
YY_RULE_SETUP
#line 74 "snort.ll"
snort_parse_ip(snorttext + 1, SNORT_OPT_SRC);
      YY_BREAK
case 9:
YY_RULE_SETUP
#line 75 "snort.ll"
snort_parse_ip(snorttext + 1, SNORT_OPT_SRC|SNORT_OPT_PORT);
      YY_BREAK
case 10:
YY_RULE_SETUP
#line 76 "snort.ll"
snort_parse_ip(snorttext, SNORT_OPT_DST);
      YY_BREAK
case 11:
YY_RULE_SETUP
#line 77 "snort.ll"
snort_parse_ip(snorttext, SNORT_OPT_DST|SNORT_OPT_PORT);
      YY_BREAK
case 12:
YY_RULE_SETUP
#line 78 "snort.ll"
nohit = true;
      YY_BREAK
case 13:
YY_RULE_SETUP
#line 79 "snort.ll"
nohit = true;
      YY_BREAK
case 14:
YY_RULE_SETUP
#line 80 "snort.ll"
/* ignore whitespace */
      YY_BREAK
case 15:
/* rule 15 can match eol */
YY_RULE_SETUP
#line 81 "snort.ll"
/* ignore */
      YY_BREAK
case 16:
YY_RULE_SETUP
#line 82 "snort.ll"
if (verbose) fprintf(stderr, _("Unrecognized token: %s\n"), snorttext);
      YY_BREAK
case 17:
YY_RULE_SETUP
#line 83 "snort.ll"
if (verbose) fprintf(stderr, _("Unrecognized character: %s\n"), snorttext);
      YY_BREAK
case 18:
YY_RULE_SETUP
#line 85 "snort.ll"
ECHO;
      YY_BREAK
#line 982 "snort.cc"
case YY_STATE_EOF(INITIAL):
      yyterminate();

      case YY_END_OF_BUFFER:
            {
            /* Amount of text matched not including the EOB char. */
            int yy_amount_of_matched_text = (int) (yy_cp - (yytext_ptr)) - 1;

            /* Undo the effects of YY_DO_BEFORE_ACTION. */
            *yy_cp = (yy_hold_char);
            YY_RESTORE_YY_MORE_OFFSET

            if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW )
                  {
                  /* We're scanning a new file or input source.  It's
                   * possible that this happened because the user
                   * just pointed snortin at a new source and called
                   * snortlex().  If so, then we have to assure
                   * consistency between YY_CURRENT_BUFFER and our
                   * globals.  Here is the right place to do so, because
                   * this is the first action (other than possibly a
                   * back-up) that will match for the new input source.
                   */
                  (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars;
                  YY_CURRENT_BUFFER_LVALUE->yy_input_file = snortin;
                  YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL;
                  }

            /* Note that here we test for yy_c_buf_p "<=" to the position
             * of the first EOB in the buffer, since yy_c_buf_p will
             * already have been incremented past the NUL character
             * (since all states make transitions on EOB to the
             * end-of-buffer state).  Contrast this with the test
             * in input().
             */
            if ( (yy_c_buf_p) <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] )
                  { /* This was really a NUL. */
                  yy_state_type yy_next_state;

                  (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text;

                  yy_current_state = yy_get_previous_state(  );

                  /* Okay, we're now positioned to make the NUL
                   * transition.  We couldn't have
                   * yy_get_previous_state() go ahead and do it
                   * for us because it doesn't know how to deal
                   * with the possibility of jamming (and we don't
                   * want to build jamming into it because then it
                   * will run more slowly).
                   */

                  yy_next_state = yy_try_NUL_trans( yy_current_state );

                  yy_bp = (yytext_ptr) + YY_MORE_ADJ;

                  if ( yy_next_state )
                        {
                        /* Consume the NUL. */
                        yy_cp = ++(yy_c_buf_p);
                        yy_current_state = yy_next_state;
                        goto yy_match;
                        }

                  else
                        {
                        yy_cp = (yy_c_buf_p);
                        goto yy_find_action;
                        }
                  }

            else switch ( yy_get_next_buffer(  ) )
                  {
                  case EOB_ACT_END_OF_FILE:
                        {
                        (yy_did_buffer_switch_on_eof) = 0;

                        if ( snortwrap( ) )
                              {
                              /* Note: because we've taken care in
                               * yy_get_next_buffer() to have set up
                               * snorttext, we can now set up
                               * yy_c_buf_p so that if some total
                               * hoser (like flex itself) wants to
                               * call the scanner after we return the
                               * YY_NULL, it'll still work - another
                               * YY_NULL will get returned.
                               */
                              (yy_c_buf_p) = (yytext_ptr) + YY_MORE_ADJ;

                              yy_act = YY_STATE_EOF(YY_START);
                              goto do_action;
                              }

                        else
                              {
                              if ( ! (yy_did_buffer_switch_on_eof) )
                                    YY_NEW_FILE;
                              }
                        break;
                        }

                  case EOB_ACT_CONTINUE_SCAN:
                        (yy_c_buf_p) =
                              (yytext_ptr) + yy_amount_of_matched_text;

                        yy_current_state = yy_get_previous_state(  );

                        yy_cp = (yy_c_buf_p);
                        yy_bp = (yytext_ptr) + YY_MORE_ADJ;
                        goto yy_match;

                  case EOB_ACT_LAST_MATCH:
                        (yy_c_buf_p) =
                        &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)];

                        yy_current_state = yy_get_previous_state(  );

                        yy_cp = (yy_c_buf_p);
                        yy_bp = (yytext_ptr) + YY_MORE_ADJ;
                        goto yy_find_action;
                  }
            break;
            }

      default:
            YY_FATAL_ERROR(
                  "fatal flex scanner internal error--no action found" );
      } /* end of action switch */
            } /* end of scanning one token */
} /* end of snortlex */

/* yy_get_next_buffer - try to read in a new buffer
 *
 * Returns a code representing an action:
 *    EOB_ACT_LAST_MATCH -
 *    EOB_ACT_CONTINUE_SCAN - continue scanning from current position
 *    EOB_ACT_END_OF_FILE - end of file
 */
static int yy_get_next_buffer (void)
{
      register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf;
      register char *source = (yytext_ptr);
      register int number_to_move, i;
      int ret_val;

      if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] )
            YY_FATAL_ERROR(
            "fatal flex scanner internal error--end of buffer missed" );

      if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 )
            { /* Don't try to fill the buffer, so this is an EOF. */
            if ( (yy_c_buf_p) - (yytext_ptr) - YY_MORE_ADJ == 1 )
                  {
                  /* We matched a single character, the EOB, so
                   * treat this as a final EOF.
                   */
                  return EOB_ACT_END_OF_FILE;
                  }

            else
                  {
                  /* We matched some text prior to the EOB, first
                   * process it.
                   */
                  return EOB_ACT_LAST_MATCH;
                  }
            }

      /* Try to read more data. */

      /* First move last chars to start of buffer. */
      number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1;

      for ( i = 0; i < number_to_move; ++i )
            *(dest++) = *(source++);

      if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING )
            /* don't do the read, it's not guaranteed to return an EOF,
             * just force an EOF
             */
            YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = 0;

      else
            {
                  size_t num_to_read =
                  YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1;

            while ( num_to_read <= 0 )
                  { /* Not enough room in the buffer - grow it. */

                  /* just a shorter name for the current buffer */
                  YY_BUFFER_STATE b = YY_CURRENT_BUFFER;

                  int yy_c_buf_p_offset =
                        (int) ((yy_c_buf_p) - b->yy_ch_buf);

                  if ( b->yy_is_our_buffer )
                        {
                        int new_size = b->yy_buf_size * 2;

                        if ( new_size <= 0 )
                              b->yy_buf_size += b->yy_buf_size / 8;
                        else
                              b->yy_buf_size *= 2;

                        b->yy_ch_buf = (char *)
                              /* Include room in for 2 EOB chars. */
                              snortrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2  );
                        }
                  else
                        /* Can't grow it, we don't own it. */
                        b->yy_ch_buf = 0;

                  if ( ! b->yy_ch_buf )
                        YY_FATAL_ERROR(
                        "fatal error - scanner input buffer overflow" );

                  (yy_c_buf_p) = &b->yy_ch_buf[yy_c_buf_p_offset];

                  num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size -
                                    number_to_move - 1;

                  }

            if ( num_to_read > YY_READ_BUF_SIZE )
                  num_to_read = YY_READ_BUF_SIZE;

            /* Read in more data. */
            YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
                  (yy_n_chars), num_to_read );

            YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
            }

      if ( (yy_n_chars) == 0 )
            {
            if ( number_to_move == YY_MORE_ADJ )
                  {
                  ret_val = EOB_ACT_END_OF_FILE;
                  snortrestart(snortin  );
                  }

            else
                  {
                  ret_val = EOB_ACT_LAST_MATCH;
                  YY_CURRENT_BUFFER_LVALUE->yy_buffer_status =
                        YY_BUFFER_EOF_PENDING;
                  }
            }

      else
            ret_val = EOB_ACT_CONTINUE_SCAN;

      (yy_n_chars) += number_to_move;
      YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] = YY_END_OF_BUFFER_CHAR;
      YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] = YY_END_OF_BUFFER_CHAR;

      (yytext_ptr) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0];

      return ret_val;
}

/* yy_get_previous_state - get the state just before the EOB char was reached */

    static yy_state_type yy_get_previous_state (void)
{
      register yy_state_type yy_current_state;
      register char *yy_cp;
    
      yy_current_state = (yy_start);

      for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp )
            {
            register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1);
            if ( yy_accept[yy_current_state] )
                  {
                  (yy_last_accepting_state) = yy_current_state;
                  (yy_last_accepting_cpos) = yy_cp;
                  }
            while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
                  {
                  yy_current_state = (int) yy_def[yy_current_state];
                  if ( yy_current_state >= 181 )
                        yy_c = yy_meta[(unsigned int) yy_c];
                  }
            yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
            }

      return yy_current_state;
}

/* yy_try_NUL_trans - try to make a transition on the NUL character
 *
 * synopsis
 *    next_state = yy_try_NUL_trans( current_state );
 */
    static yy_state_type yy_try_NUL_trans  (yy_state_type yy_current_state )
{
      register int yy_is_jam;
      register char *yy_cp = (yy_c_buf_p);

      register YY_CHAR yy_c = 1;
      if ( yy_accept[yy_current_state] )
            {
            (yy_last_accepting_state) = yy_current_state;
            (yy_last_accepting_cpos) = yy_cp;
            }
      while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
            {
            yy_current_state = (int) yy_def[yy_current_state];
            if ( yy_current_state >= 181 )
                  yy_c = yy_meta[(unsigned int) yy_c];
            }
      yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
      yy_is_jam = (yy_current_state == 180);

      return yy_is_jam ? 0 : yy_current_state;
}

    static void yyunput (int c, register char * yy_bp )
{
      register char *yy_cp;
    
    yy_cp = (yy_c_buf_p);

      /* undo effects of setting up snorttext */
      *yy_cp = (yy_hold_char);

      if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 )
            { /* need to shift things up to make room */
            /* +2 for EOB chars. */
            register int number_to_move = (yy_n_chars) + 2;
            register char *dest = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[
                              YY_CURRENT_BUFFER_LVALUE->yy_buf_size + 2];
            register char *source =
                        &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move];

            while ( source > YY_CURRENT_BUFFER_LVALUE->yy_ch_buf )
                  *--dest = *--source;

            yy_cp += (int) (dest - source);
            yy_bp += (int) (dest - source);
            YY_CURRENT_BUFFER_LVALUE->yy_n_chars =
                  (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_buf_size;

            if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 )
                  YY_FATAL_ERROR( "flex scanner push-back overflow" );
            }

      *--yy_cp = (char) c;

      (yytext_ptr) = yy_bp;
      (yy_hold_char) = *yy_cp;
      (yy_c_buf_p) = yy_cp;
}

#ifndef YY_NO_INPUT
#ifdef __cplusplus
    static int yyinput (void)
#else
    static int input  (void)
#endif

{
      int c;
    
      *(yy_c_buf_p) = (yy_hold_char);

      if ( *(yy_c_buf_p) == YY_END_OF_BUFFER_CHAR )
            {
            /* yy_c_buf_p now points to the character we want to return.
             * If this occurs *before* the EOB characters, then it's a
             * valid NUL; if not, then we've hit the end of the buffer.
             */
            if ( (yy_c_buf_p) < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] )
                  /* This was really a NUL. */
                  *(yy_c_buf_p) = '\0';

            else
                  { /* need more input */
                  int offset = (yy_c_buf_p) - (yytext_ptr);
                  ++(yy_c_buf_p);

                  switch ( yy_get_next_buffer(  ) )
                        {
                        case EOB_ACT_LAST_MATCH:
                              /* This happens because yy_g_n_b()
                               * sees that we've accumulated a
                               * token and flags that we need to
                               * try matching the token before
                               * proceeding.  But for input(),
                               * there's no matching to consider.
                               * So convert the EOB_ACT_LAST_MATCH
                               * to EOB_ACT_END_OF_FILE.
                               */

                              /* Reset buffer status. */
                              snortrestart(snortin );

                              /*FALLTHROUGH*/

                        case EOB_ACT_END_OF_FILE:
                              {
                              if ( snortwrap( ) )
                                    return EOF;

                              if ( ! (yy_did_buffer_switch_on_eof) )
                                    YY_NEW_FILE;
#ifdef __cplusplus
                              return yyinput();
#else
                              return input();
#endif
                              }

                        case EOB_ACT_CONTINUE_SCAN:
                              (yy_c_buf_p) = (yytext_ptr) + offset;
                              break;
                        }
                  }
            }

      c = *(unsigned char *) (yy_c_buf_p);      /* cast for 8-bit char's */
      *(yy_c_buf_p) = '\0';   /* preserve snorttext */
      (yy_hold_char) = *++(yy_c_buf_p);

      return c;
}
#endif      /* ifndef YY_NO_INPUT */

/** Immediately switch to a different input stream.
 * @param input_file A readable stream.
 * 
 * @note This function does not reset the start condition to @c INITIAL .
 */
    void snortrestart  (FILE * input_file )
{
    
      if ( ! YY_CURRENT_BUFFER ){
        snortensure_buffer_stack ();
            YY_CURRENT_BUFFER_LVALUE =
            snort_create_buffer(snortin,YY_BUF_SIZE );
      }

      snort_init_buffer(YY_CURRENT_BUFFER,input_file );
      snort_load_buffer_state( );
}

/** Switch to a different input buffer.
 * @param new_buffer The new input buffer.
 * 
 */
    void snort_switch_to_buffer  (YY_BUFFER_STATE  new_buffer )
{
    
      /* TODO. We should be able to replace this entire function body
       * with
       *          snortpop_buffer_state();
       *          snortpush_buffer_state(new_buffer);
     */
      snortensure_buffer_stack ();
      if ( YY_CURRENT_BUFFER == new_buffer )
            return;

      if ( YY_CURRENT_BUFFER )
            {
            /* Flush out information for old buffer. */
            *(yy_c_buf_p) = (yy_hold_char);
            YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p);
            YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
            }

      YY_CURRENT_BUFFER_LVALUE = new_buffer;
      snort_load_buffer_state( );

      /* We don't actually know whether we did this switch during
       * EOF (snortwrap()) processing, but the only time this flag
       * is looked at is after snortwrap() is called, so it's safe
       * to go ahead and always set it.
       */
      (yy_did_buffer_switch_on_eof) = 1;
}

static void snort_load_buffer_state  (void)
{
      (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars;
      (yytext_ptr) = (yy_c_buf_p) = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos;
      snortin = YY_CURRENT_BUFFER_LVALUE->yy_input_file;
      (yy_hold_char) = *(yy_c_buf_p);
}

/** Allocate and initialize an input buffer state.
 * @param file A readable stream.
 * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE.
 * 
 * @return the allocated buffer state.
 */
    YY_BUFFER_STATE snort_create_buffer  (FILE * file, int  size )
{
      YY_BUFFER_STATE b;
    
      b = (YY_BUFFER_STATE) snortalloc(sizeof( struct yy_buffer_state )  );
      if ( ! b )
            YY_FATAL_ERROR( "out of dynamic memory in snort_create_buffer()" );

      b->yy_buf_size = size;

      /* yy_ch_buf has to be 2 characters longer than the size given because
       * we need to put in 2 end-of-buffer characters.
       */
      b->yy_ch_buf = (char *) snortalloc(b->yy_buf_size + 2  );
      if ( ! b->yy_ch_buf )
            YY_FATAL_ERROR( "out of dynamic memory in snort_create_buffer()" );

      b->yy_is_our_buffer = 1;

      snort_init_buffer(b,file );

      return b;
}

/** Destroy the buffer.
 * @param b a buffer created with snort_create_buffer()
 * 
 */
    void snort_delete_buffer (YY_BUFFER_STATE  b )
{
    
      if ( ! b )
            return;

      if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */
            YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0;

      if ( b->yy_is_our_buffer )
            snortfree((void *) b->yy_ch_buf  );

      snortfree((void *) b  );
}

#ifndef __cplusplus
extern int isatty (int );
#endif /* __cplusplus */
    
/* Initializes or reinitializes a buffer.
 * This function is sometimes called more than once on the same buffer,
 * such as during a snortrestart() or at EOF.
 */
    static void snort_init_buffer  (YY_BUFFER_STATE  b, FILE * file )

{
      int oerrno = errno;
    
      snort_flush_buffer(b );

      b->yy_input_file = file;
      b->yy_fill_buffer = 1;

    /* If b is the current buffer, then snort_init_buffer was _probably_
     * called from snortrestart() or through yy_get_next_buffer.
     * In that case, we don't want to reset the lineno or column.
     */
    if (b != YY_CURRENT_BUFFER){
        b->yy_bs_lineno = 1;
        b->yy_bs_column = 0;
    }

        b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0;
    
      errno = oerrno;
}

/** Discard all buffered characters. On the next scan, YY_INPUT will be called.
 * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER.
 * 
 */
    void snort_flush_buffer (YY_BUFFER_STATE  b )
{
      if ( ! b )
            return;

      b->yy_n_chars = 0;

      /* We always need two end-of-buffer characters.  The first causes
       * a transition to the end-of-buffer state.  The second causes
       * a jam in that state.
       */
      b->yy_ch_buf[0] = YY_END_OF_BUFFER_CHAR;
      b->yy_ch_buf[1] = YY_END_OF_BUFFER_CHAR;

      b->yy_buf_pos = &b->yy_ch_buf[0];

      b->yy_at_bol = 1;
      b->yy_buffer_status = YY_BUFFER_NEW;

      if ( b == YY_CURRENT_BUFFER )
            snort_load_buffer_state( );
}

/** Pushes the new state onto the stack. The new state becomes
 *  the current state. This function will allocate the stack
 *  if necessary.
 *  @param new_buffer The new state.
 *  
 */
void snortpush_buffer_state (YY_BUFFER_STATE new_buffer )
{
      if (new_buffer == NULL)
            return;

      snortensure_buffer_stack();

      /* This block is copied from snort_switch_to_buffer. */
      if ( YY_CURRENT_BUFFER )
            {
            /* Flush out information for old buffer. */
            *(yy_c_buf_p) = (yy_hold_char);
            YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p);
            YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
            }

      /* Only push if top exists. Otherwise, replace top. */
      if (YY_CURRENT_BUFFER)
            (yy_buffer_stack_top)++;
      YY_CURRENT_BUFFER_LVALUE = new_buffer;

      /* copied from snort_switch_to_buffer. */
      snort_load_buffer_state( );
      (yy_did_buffer_switch_on_eof) = 1;
}

/** Removes and deletes the top of the stack, if present.
 *  The next element becomes the new top.
 *  
 */
void snortpop_buffer_state (void)
{
      if (!YY_CURRENT_BUFFER)
            return;

      snort_delete_buffer(YY_CURRENT_BUFFER );
      YY_CURRENT_BUFFER_LVALUE = NULL;
      if ((yy_buffer_stack_top) > 0)
            --(yy_buffer_stack_top);

      if (YY_CURRENT_BUFFER) {
            snort_load_buffer_state( );
            (yy_did_buffer_switch_on_eof) = 1;
      }
}

/* Allocates the stack if it does not exist.
 *  Guarantees space for at least one push.
 */
static void snortensure_buffer_stack (void)
{
      int num_to_alloc;
    
      if (!(yy_buffer_stack)) {

            /* First allocation is just for 2 elements, since we don't know if this
             * scanner will even need a stack. We use 2 instead of 1 to avoid an
             * immediate realloc on the next call.
         */
            num_to_alloc = 1;
            (yy_buffer_stack) = (struct yy_buffer_state**)snortalloc
                                                (num_to_alloc * sizeof(struct yy_buffer_state*)
                                                );
            
            memset((yy_buffer_stack), 0, num_to_alloc * sizeof(struct yy_buffer_state*));
                        
            (yy_buffer_stack_max) = num_to_alloc;
            (yy_buffer_stack_top) = 0;
            return;
      }

      if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){

            /* Increase the buffer to prepare for a possible push. */
            int grow_size = 8 /* arbitrary grow size */;

            num_to_alloc = (yy_buffer_stack_max) + grow_size;
            (yy_buffer_stack) = (struct yy_buffer_state**)snortrealloc
                                                ((yy_buffer_stack),
                                                num_to_alloc * sizeof(struct yy_buffer_state*)
                                                );

            /* zero only the new slots.*/
            memset((yy_buffer_stack) + (yy_buffer_stack_max), 0, grow_size * sizeof(struct yy_buffer_state*));
            (yy_buffer_stack_max) = num_to_alloc;
      }
}

/** Setup the input buffer state to scan directly from a user-specified character buffer.
 * @param base the character buffer
 * @param size the size in bytes of the character buffer
 * 
 * @return the newly allocated buffer state object. 
 */
YY_BUFFER_STATE snort_scan_buffer  (char * base, yy_size_t  size )
{
      YY_BUFFER_STATE b;
    
      if ( size < 2 ||
           base[size-2] != YY_END_OF_BUFFER_CHAR ||
           base[size-1] != YY_END_OF_BUFFER_CHAR )
            /* They forgot to leave room for the EOB's. */
            return 0;

      b = (YY_BUFFER_STATE) snortalloc(sizeof( struct yy_buffer_state )  );
      if ( ! b )
            YY_FATAL_ERROR( "out of dynamic memory in snort_scan_buffer()" );

      b->yy_buf_size = size - 2;    /* "- 2" to take care of EOB's */
      b->yy_buf_pos = b->yy_ch_buf = base;
      b->yy_is_our_buffer = 0;
      b->yy_input_file = 0;
      b->yy_n_chars = b->yy_buf_size;
      b->yy_is_interactive = 0;
      b->yy_at_bol = 1;
      b->yy_fill_buffer = 0;
      b->yy_buffer_status = YY_BUFFER_NEW;

      snort_switch_to_buffer(b  );

      return b;
}

/** Setup the input buffer state to scan a string. The next call to snortlex() will
 * scan from a @e copy of @a str.
 * @param str a NUL-terminated string to scan
 * 
 * @return the newly allocated buffer state object.
 * @note If you want to scan bytes that may contain NUL values, then use
 *       snort_scan_bytes() instead.
 */
YY_BUFFER_STATE snort_scan_string (yyconst char * yy_str )
{
    
      return snort_scan_bytes(yy_str,strlen(yy_str) );
}

/** Setup the input buffer state to scan the given bytes. The next call to snortlex() will
 * scan from a @e copy of @a bytes.
 * @param bytes the byte buffer to scan
 * @param len the number of bytes in the buffer pointed to by @a bytes.
 * 
 * @return the newly allocated buffer state object.
 */
YY_BUFFER_STATE snort_scan_bytes  (yyconst char * bytes, int  len )
{
      YY_BUFFER_STATE b;
      char *buf;
      yy_size_t n;
      int i;
    
      /* Get memory for full buffer, including space for trailing EOB's. */
      n = len + 2;
      buf = (char *) snortalloc(n  );
      if ( ! buf )
            YY_FATAL_ERROR( "out of dynamic memory in snort_scan_bytes()" );

      for ( i = 0; i < len; ++i )
            buf[i] = bytes[i];

      buf[len] = buf[len+1] = YY_END_OF_BUFFER_CHAR;

      b = snort_scan_buffer(buf,n );
      if ( ! b )
            YY_FATAL_ERROR( "bad buffer in snort_scan_bytes()" );

      /* It's okay to grow etc. this buffer, and we should throw it
       * away when we're done.
       */
      b->yy_is_our_buffer = 1;

      return b;
}

#ifndef YY_EXIT_FAILURE
#define YY_EXIT_FAILURE 2
#endif

static void yy_fatal_error (yyconst char* msg )
{
      (void) fprintf( stderr, "%s\n", msg );
      exit( YY_EXIT_FAILURE );
}

/* Redefine yyless() so it works in section 3 code. */

#undef yyless
#define yyless(n) \
      do \
            { \
            /* Undo effects of setting up snorttext. */ \
        int yyless_macro_arg = (n); \
        YY_LESS_LINENO(yyless_macro_arg);\
            snorttext[snortleng] = (yy_hold_char); \
            (yy_c_buf_p) = snorttext + yyless_macro_arg; \
            (yy_hold_char) = *(yy_c_buf_p); \
            *(yy_c_buf_p) = '\0'; \
            snortleng = yyless_macro_arg; \
            } \
      while ( 0 )

/* Accessor  methods (get/set functions) to struct members. */

/** Get the current line number.
 * 
 */
int snortget_lineno  (void)
{
        
    return snortlineno;
}

/** Get the input stream.
 * 
 */
FILE *snortget_in  (void)
{
        return snortin;
}

/** Get the output stream.
 * 
 */
FILE *snortget_out  (void)
{
        return snortout;
}

/** Get the length of the current token.
 * 
 */
int snortget_leng  (void)
{
        return snortleng;
}

/** Get the current token.
 * 
 */

char *snortget_text  (void)
{
        return snorttext;
}

/** Set the current line number.
 * @param line_number
 * 
 */
void snortset_lineno (int  line_number )
{
    
    snortlineno = line_number;
}

/** Set the input stream. This does not discard the current
 * input buffer.
 * @param in_str A readable stream.
 * 
 * @see snort_switch_to_buffer
 */
void snortset_in (FILE *  in_str )
{
        snortin = in_str ;
}

void snortset_out (FILE *  out_str )
{
        snortout = out_str ;
}

int snortget_debug  (void)
{
        return snort_flex_debug;
}

void snortset_debug (int  bdebug )
{
        snort_flex_debug = bdebug ;
}

/* snortlex_destroy is for both reentrant and non-reentrant scanners. */
int snortlex_destroy  (void)
{
    
    /* Pop the buffer stack, destroying each element. */
      while(YY_CURRENT_BUFFER){
            snort_delete_buffer(YY_CURRENT_BUFFER  );
            YY_CURRENT_BUFFER_LVALUE = NULL;
            snortpop_buffer_state();
      }

      /* Destroy the stack itself. */
      snortfree((yy_buffer_stack) );
      (yy_buffer_stack) = NULL;

    return 0;
}

/*
 * Internal utility routines.
 */

#ifndef yytext_ptr
static void yy_flex_strncpy (char* s1, yyconst char * s2, int n )
{
      register int i;
      for ( i = 0; i < n; ++i )
            s1[i] = s2[i];
}
#endif

#ifdef YY_NEED_STRLEN
static int yy_flex_strlen (yyconst char * s )
{
      register int n;
      for ( n = 0; s[n]; ++n )
            ;

      return n;
}
#endif

void *snortalloc (yy_size_t  size )
{
      return (void *) malloc( size );
}

void *snortrealloc  (void * ptr, yy_size_t  size )
{
      /* The cast to (char *) in the following accommodates both
       * implementations that use char* generic pointers, and those
       * that use void* generic pointers.  It works with the latter
       * because both ANSI C and C++ allow castless assignment from
       * any pointer type to void*, and deal with argument conversions
       * as though doing an assignment.
       */
      return (void *) realloc( (char *) ptr, size );
}

void snortfree (void * ptr )
{
      free( (char *) ptr );   /* see snortrealloc() for (char *) cast */
}

#define YYTABLES_NAME "yytables"

#undef YY_NEW_FILE
#undef YY_FLUSH_BUFFER
#undef yy_set_bol
#undef yy_new_buffer
#undef yy_set_interactive
#undef yytext_ptr
#undef YY_DO_BEFORE_ACTION

#ifdef YY_DECL_IS_OURS
#undef YY_DECL_IS_OURS
#undef YY_DECL
#endif
#line 85 "snort.ll"



static void
snort_parse_branch(char* input) {
  char* ptr = strchr(input, ']');
  *ptr = '\0';
  logentry->branchname = input;
  // |SNORT_BRANCH;
}

static void
snort_parse_ip(char* input, unsigned char mode) {
  char ip[IPLEN];
  int host1, host2, host3, host4;

  if (mode & SNORT_OPT_SRC) {
    char proto[9];
    if (mode & SNORT_OPT_PORT) {
      int sport;
      if (sscanf(input, "%8s %3d.%3d.%3d.%3d:%5d",
             proto, &host1, &host2, &host3, &host4, &sport) != 6)
      return;
      logentry->sport = sport;
    }
    else if (sscanf(input, "%8s %3d.%3d.%3d.%3d",
                proto, &host1, &host2, &host3, &host4) != 5)
      return;

    if (!strncmp(proto, "TCP", 3)) logentry->protocol = IPPROTO_TCP;
    else if (!strncmp(proto, "UDP", 3)) logentry->protocol = IPPROTO_UDP;
    else if (!strncmp(proto, "ICMP", 4)) logentry->protocol = IPPROTO_ICMP;
    
    // |SNORT_PROTO;
  }
  else if (mode & SNORT_OPT_DST) {
    if (mode & SNORT_OPT_PORT) {
      int dport;
      if (sscanf(input, "-> %3d.%3d.%3d.%3d:%5d",
             &host1, &host2, &host3, &host4, &dport) != 5)
      return;
      logentry->dport = dport;
    }
    else if (sscanf(input, "-> %3d.%3d.%3d.%3d",
                &host1, &host2, &host3, &host4) != 4)
      return;
  }
  else
    return;
  
  snprintf(ip, IPLEN, "%d.%d.%d.%d", host1, host2, host3, host4);

  if (mode & SNORT_OPT_SRC) {
    if (logentry->sipaddr.set(ip) == false)
      return;
    // |SNORT_SRC;
  }
  else if (mode & SNORT_OPT_DST) {
    if (logentry->dipaddr.set(ip) == false)
      return;
    // |SNORT_DST;
  }
}


wf_inmodule_snort::wf_inmodule_snort() {
}

bool
wf_inmodule_snort::match(const string& line) const {
  return (line.find(" snort") != string::npos);
}

enum wf_logentry_parsing_result
wf_inmodule_snort::parse(wf_logentry** retlogentry,
                   const string& line, int linenum) {
  logentry = new wf_logentry();
  if (logentry == NULL)
    return WF_LOGENTRY_PARSING_ERROR;

  snort_scan_string(line.c_str());
  snortlex();

  logentry->count = 1;
  logentry->format = "snort";

  if (nohit)
    return WF_LOGENTRY_PARSING_NOHIT;

  /*
  if (parser == (SNORT_DATE|SNORT_SRC|SNORT_DST))
  */
    *retlogentry = logentry;
    return WF_LOGENTRY_PARSING_OK;

  if (verbose)
    fprintf(stderr, _("snort parse error in line %d, ignoring.\n"),
          linenum);

  delete logentry;
  return WF_LOGENTRY_PARSING_ERROR;
}

extern "C" wf_inmodule*
wf_inmodule_snort_init() {
  return new wf_inmodule_snort();
}


Generated by  Doxygen 1.6.0   Back to index