Bro-Nids: Pads Signatures Conversion

ssh,v/OpenSSH/$2/Protocol $1/,SSH-([.\d]+)-OpenSSH[_-](\S+)
ssh,v/Cisco SSH/$2/Protocol $1/,SSH-([.\d]+)-Cisco[_-](\S+)
www,v/Apache/$1//,Server: Apache\/([\S]+)[\r\n]
www,v/Apache/$1/$2/,Server: Apache\/([\S]+)[\s]+\((.*)\)

# Format:
# <service>,<version info>,<signature>

In order to convert it, we had figured the way with the sed and awk madness. Here's the one liner -

shell>egrep -v '(^#|^ +*$)' pads-signature-list | \ 
awk -F "," '{ 
    printf "signature %s\n", $1; 
    printf "{\n"; printf "\tipproto == tcp\n"; 
    printf "\tsrc-ip != local_nets\n"; 
    printf "\tdst-ip == local_nets\n"; 
    printf "\tpayload /%s/\n", $3; 
    printf "\ttcp-state established\n"; 
    printf "\tevent \"%s\"\n", $2; printf "}\n"; printf "\n" }' | \
sed -e 's/v\///g; s/\$[0-9]//g; s/\/\{3\}//g'

After the conversion, the one of the signature looks like this -

signature ssh
{
    ipproto == tcp
    src-ip != local_nets
    dst-ip == local_nets
    payload /SSH-([.\d]+)-OpenSSH[_-](\S+)/
    tcp-state established
    event "OpenSSH//Protocol /"
}

The conversion is not done perfectly but it is really helpful as I need to sharpen on the signature replacement only because most of the stuffs are formatted accordingly. What todo next, testing round for the signature I guess.

Enjoy (;])