Fix decode-event keyword parsing. Fix code that indicates a signature is decode-event only. Add 'pkthdr' protocol as an alias for any/ip to be used by decode-event signatures.

src/detect-decode-event.c

@@ -40,7 +40,7 @@
 #include "detect-decode-event.h"
 #include "util-unittest.h"
 
-#define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z+]+$"
+#define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z0-9_+]+$"
 
 static pcre *parse_regex;
 static pcre_extra *parse_regex_study;
@@ -128,7 +128,8 @@ DetectDecodeEventData *DetectDecodeEventParse (char *rawstr)
 
     ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
     if (ret < 1) {
-        SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr);
+        SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32
+                ", string %s", ret, rawstr);
         goto error;
     }
 
@@ -140,15 +141,18 @@ DetectDecodeEventData *DetectDecodeEventParse (char *rawstr)
         goto error;
     }
 
-    for(i = 0; DEvents[i].event_name != NULL; i++)  {
-        if((strncasecmp(DEvents[i].event_name,str_ptr,strlen(DEvents[i].event_name))) == 0) {
+    for (i = 0; DEvents[i].event_name != NULL; i++) {
+        if (strcasecmp(DEvents[i].event_name,str_ptr) == 0) {
             found = 1;
             break;
         }
     }
 
-    if(found == 0)
+    if (found == 0) {
+        SCLogError(SC_ERR_UNKNOWN_DECODE_EVENT, "unknown decode event \"%s\"",
+                str_ptr);
         goto error;
+    }
 
     de = SCMalloc(sizeof(DetectDecodeEventData));
     if (de == NULL)

src/detect-decode-event.h

@@ -107,8 +107,8 @@ struct DetectDecodeEvents_ {
     { "gre.version1_wrong_protocol", GRE_VERSION1_WRONG_PROTOCOL, },
     { "gre.version1_malformed_sre_hdr", GRE_VERSION1_MALFORMED_SRE_HDR, },
     { "gre.version1_hdr_too_big", GRE_VERSION1_HDR_TOO_BIG, },
-    { "ipraw.wrong_ip_version",IPRAW_INVALID_IPV, },
-    { "vlan.hlen_too_small",VLAN_HEADER_TOO_SMALL, },
+    { "ipraw.invalid_ip_version",IPRAW_INVALID_IPV, },
+    { "vlan.header_too_small",VLAN_HEADER_TOO_SMALL, },
     { "vlan.unknown_type",VLAN_UNKNOWN_TYPE, },
     { NULL, 0 },
 };

src/detect-engine-proto.c

@@ -120,7 +120,8 @@ int DetectProtoParse(DetectProto *dp, char *str)
         proto = IPPROTO_SCTP;
         dp->proto[proto / 8] |= 1 << (proto % 8);
         SCLogDebug("SCTP protocol detected");
-    } else if (strcasecmp(str,"ip") == 0) {
+    } else if (strcasecmp(str,"ip") == 0 ||
+               strcasecmp(str,"pkthdr") == 0) {
         /* Proto "ip" is treated as an "any" */
         dp->flags |= DETECT_PROTO_ANY;
         memset(dp->proto, 0xff, sizeof(dp->proto));

src/detect.c

@@ -1772,46 +1772,37 @@ static int SignatureIsInspectingPayload(DetectEngineCtx *de_ctx, Signature *s) {
  *  \retval 1 DEOnly sig
  */
 static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) {
-    if (s->alproto != ALPROTO_UNKNOWN)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL)
-        return 0;
-
-    if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL)
-        return 0;
+    if (s->alproto != ALPROTO_UNKNOWN) {
+        SCReturnInt(0);
+    }
 
-    if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL)
-        return 0;
+    if (s->sm_lists[DETECT_SM_LIST_PMATCH]    != NULL ||
+        s->sm_lists[DETECT_SM_LIST_UMATCH]    != NULL ||
+        s->sm_lists[DETECT_SM_LIST_AMATCH]    != NULL ||
+        s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL ||
+        s->sm_lists[DETECT_SM_LIST_HHDMATCH]  != NULL ||
+        s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL ||
+        s->sm_lists[DETECT_SM_LIST_HMDMATCH]  != NULL ||
+        s->sm_lists[DETECT_SM_LIST_HCDMATCH]  != NULL)
+    {
+        SCReturnInt(0);
+    }
 
-    SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH];
     /* check for conflicting keywords */
+    SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH];
     for ( ;sm != NULL; sm = sm->next) {
         if ( !(sigmatch_table[sm->type].flags & SIGMATCH_DEONLY_COMPAT))
-            return 0;
+            SCReturnInt(0);
     }
 
     /* need at least one decode event keyword to be condered decode event. */
+    sm = s->sm_lists[DETECT_SM_LIST_MATCH];
     for ( ;sm != NULL; sm = sm->next) {
         if (sm->type == DETECT_DECODE_EVENT)
             goto deonly;
     }
-    return 0;
+
+    SCReturnInt(0);
 
 deonly:
     if (!(de_ctx->flags & DE_QUIET)) {
@@ -1820,7 +1811,7 @@ deonly:
                    s->flags & SIG_FLAG_DST_ANY ? "ANY" : "SET");
     }
 
-    return 1;
+    SCReturnInt(1);
 }
 
 /* Create mask for this packet + it's flow if it has one

src/util-error.c

@@ -202,6 +202,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES);
         CASE_CODE (SC_ERR_HTTP_COOKIE_RELATIVE_MISSING);
         CASE_CODE (SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING);
+        CASE_CODE (SC_ERR_UNKNOWN_DECODE_EVENT);
 
         default:
             return "UNKNOWN_ERROR";

src/util-error.h

@@ -213,6 +213,7 @@ typedef enum {
     SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES,
     SC_ERR_HTTP_COOKIE_RELATIVE_MISSING,
     SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING,
+    SC_ERR_UNKNOWN_DECODE_EVENT,
 } SCError;
 
 const char *SCErrorToString(SCError);