From 140eb4fde8388fbe2099898ce6eaf6717c3898c1 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 29 Mar 2011 20:56:29 +0200 Subject: [PATCH] Fix decode-event keyword parsing. Fix code that indicates a signature is decode-event only. Add 'pkthdr' protocol as an alias for any/ip to be used by decode-event signatures. --- src/detect-decode-event.c | 14 +++++++---- src/detect-decode-event.h | 4 ++-- src/detect-engine-proto.c | 3 ++- src/detect.c | 49 ++++++++++++++++----------------------- src/util-error.c | 1 + src/util-error.h | 1 + 6 files changed, 35 insertions(+), 37 deletions(-) diff --git a/src/detect-decode-event.c b/src/detect-decode-event.c index e133976058..db7f6efe01 100644 --- a/src/detect-decode-event.c +++ b/src/detect-decode-event.c @@ -40,7 +40,7 @@ #include "detect-decode-event.h" #include "util-unittest.h" -#define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z+]+$" +#define PARSE_REGEX "\\S[0-9A-z_]+[.][A-z0-9_+]+$" static pcre *parse_regex; static pcre_extra *parse_regex_study; @@ -128,7 +128,8 @@ DetectDecodeEventData *DetectDecodeEventParse (char *rawstr) ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); if (ret < 1) { - SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr); + SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 + ", string %s", ret, rawstr); goto error; } @@ -140,15 +141,18 @@ DetectDecodeEventData *DetectDecodeEventParse (char *rawstr) goto error; } - for(i = 0; DEvents[i].event_name != NULL; i++) { - if((strncasecmp(DEvents[i].event_name,str_ptr,strlen(DEvents[i].event_name))) == 0) { + for (i = 0; DEvents[i].event_name != NULL; i++) { + if (strcasecmp(DEvents[i].event_name,str_ptr) == 0) { found = 1; break; } } - if(found == 0) + if (found == 0) { + SCLogError(SC_ERR_UNKNOWN_DECODE_EVENT, "unknown decode event \"%s\"", + str_ptr); goto error; + } de = SCMalloc(sizeof(DetectDecodeEventData)); if (de == NULL) diff --git a/src/detect-decode-event.h b/src/detect-decode-event.h index 5d848ca72f..6ec9b96b0f 100644 --- a/src/detect-decode-event.h +++ b/src/detect-decode-event.h @@ -107,8 +107,8 @@ struct DetectDecodeEvents_ { { "gre.version1_wrong_protocol", GRE_VERSION1_WRONG_PROTOCOL, }, { "gre.version1_malformed_sre_hdr", GRE_VERSION1_MALFORMED_SRE_HDR, }, { "gre.version1_hdr_too_big", GRE_VERSION1_HDR_TOO_BIG, }, - { "ipraw.wrong_ip_version",IPRAW_INVALID_IPV, }, - { "vlan.hlen_too_small",VLAN_HEADER_TOO_SMALL, }, + { "ipraw.invalid_ip_version",IPRAW_INVALID_IPV, }, + { "vlan.header_too_small",VLAN_HEADER_TOO_SMALL, }, { "vlan.unknown_type",VLAN_UNKNOWN_TYPE, }, { NULL, 0 }, }; diff --git a/src/detect-engine-proto.c b/src/detect-engine-proto.c index 2f219c56c0..faaced5ac7 100644 --- a/src/detect-engine-proto.c +++ b/src/detect-engine-proto.c @@ -120,7 +120,8 @@ int DetectProtoParse(DetectProto *dp, char *str) proto = IPPROTO_SCTP; dp->proto[proto / 8] |= 1 << (proto % 8); SCLogDebug("SCTP protocol detected"); - } else if (strcasecmp(str,"ip") == 0) { + } else if (strcasecmp(str,"ip") == 0 || + strcasecmp(str,"pkthdr") == 0) { /* Proto "ip" is treated as an "any" */ dp->flags |= DETECT_PROTO_ANY; memset(dp->proto, 0xff, sizeof(dp->proto)); diff --git a/src/detect.c b/src/detect.c index 890a27b910..7f1afbf3e9 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1772,46 +1772,37 @@ static int SignatureIsInspectingPayload(DetectEngineCtx *de_ctx, Signature *s) { * \retval 1 DEOnly sig */ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) { - if (s->alproto != ALPROTO_UNKNOWN) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL) - return 0; - - if (s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL) - return 0; + if (s->alproto != ALPROTO_UNKNOWN) { + SCReturnInt(0); + } - if (s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL) - return 0; + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_AMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_HHDMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_HRHDMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_HMDMATCH] != NULL || + s->sm_lists[DETECT_SM_LIST_HCDMATCH] != NULL) + { + SCReturnInt(0); + } - SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; /* check for conflicting keywords */ + SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH]; for ( ;sm != NULL; sm = sm->next) { if ( !(sigmatch_table[sm->type].flags & SIGMATCH_DEONLY_COMPAT)) - return 0; + SCReturnInt(0); } /* need at least one decode event keyword to be condered decode event. */ + sm = s->sm_lists[DETECT_SM_LIST_MATCH]; for ( ;sm != NULL; sm = sm->next) { if (sm->type == DETECT_DECODE_EVENT) goto deonly; } - return 0; + + SCReturnInt(0); deonly: if (!(de_ctx->flags & DE_QUIET)) { @@ -1820,7 +1811,7 @@ deonly: s->flags & SIG_FLAG_DST_ANY ? "ANY" : "SET"); } - return 1; + SCReturnInt(1); } /* Create mask for this packet + it's flow if it has one diff --git a/src/util-error.c b/src/util-error.c index a215bb482c..76dd555f5d 100644 --- a/src/util-error.c +++ b/src/util-error.c @@ -202,6 +202,7 @@ const char * SCErrorToString(SCError err) CASE_CODE (SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES); CASE_CODE (SC_ERR_HTTP_COOKIE_RELATIVE_MISSING); CASE_CODE (SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING); + CASE_CODE (SC_ERR_UNKNOWN_DECODE_EVENT); default: return "UNKNOWN_ERROR"; diff --git a/src/util-error.h b/src/util-error.h index 33125392c4..5a79418940 100644 --- a/src/util-error.h +++ b/src/util-error.h @@ -213,6 +213,7 @@ typedef enum { SC_ERR_HTTP_COOKIE_INCOMPATIBLE_WITH_RAWBYTES, SC_ERR_HTTP_COOKIE_RELATIVE_MISSING, SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING, + SC_ERR_UNKNOWN_DECODE_EVENT, } SCError; const char *SCErrorToString(SCError);