|
|
|
@ -1214,45 +1214,57 @@ static int SigParseActionRejectValidate(const char *action)
|
|
|
|
return 1;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
/** \retval 0 on error
|
|
|
|
* \brief Parses the action that has been used by the Signature and allots it
|
|
|
|
* \retval flags on success
|
|
|
|
* to its Signature instance.
|
|
|
|
|
|
|
|
*
|
|
|
|
|
|
|
|
* \param s Pointer to the Signature instance to which the action belongs.
|
|
|
|
|
|
|
|
* \param action Pointer to the action string used by the Signature.
|
|
|
|
|
|
|
|
*
|
|
|
|
|
|
|
|
* \retval 0 On successfully parsing the action string and adding it to the
|
|
|
|
|
|
|
|
* Signature.
|
|
|
|
|
|
|
|
* \retval -1 On failure.
|
|
|
|
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
static int SigParseAction(Signature *s, const char *action)
|
|
|
|
static uint8_t ActionStringToFlags(const char *action)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
if (strcasecmp(action, "alert") == 0) {
|
|
|
|
if (strcasecmp(action, "alert") == 0) {
|
|
|
|
s->action = ACTION_ALERT;
|
|
|
|
return ACTION_ALERT;
|
|
|
|
} else if (strcasecmp(action, "drop") == 0) {
|
|
|
|
} else if (strcasecmp(action, "drop") == 0) {
|
|
|
|
s->action = ACTION_DROP | ACTION_ALERT;
|
|
|
|
return ACTION_DROP | ACTION_ALERT;
|
|
|
|
} else if (strcasecmp(action, "pass") == 0) {
|
|
|
|
} else if (strcasecmp(action, "pass") == 0) {
|
|
|
|
s->action = ACTION_PASS;
|
|
|
|
return ACTION_PASS;
|
|
|
|
} else if (strcasecmp(action, "reject") == 0 ||
|
|
|
|
} else if (strcasecmp(action, "reject") == 0 ||
|
|
|
|
strcasecmp(action, "rejectsrc") == 0)
|
|
|
|
strcasecmp(action, "rejectsrc") == 0)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
if (!(SigParseActionRejectValidate(action)))
|
|
|
|
if (!(SigParseActionRejectValidate(action)))
|
|
|
|
return -1;
|
|
|
|
return 0;
|
|
|
|
s->action = ACTION_REJECT | ACTION_DROP | ACTION_ALERT;
|
|
|
|
return ACTION_REJECT | ACTION_DROP | ACTION_ALERT;
|
|
|
|
} else if (strcasecmp(action, "rejectdst") == 0) {
|
|
|
|
} else if (strcasecmp(action, "rejectdst") == 0) {
|
|
|
|
if (!(SigParseActionRejectValidate(action)))
|
|
|
|
if (!(SigParseActionRejectValidate(action)))
|
|
|
|
return -1;
|
|
|
|
return 0;
|
|
|
|
s->action = ACTION_REJECT_DST | ACTION_DROP | ACTION_ALERT;
|
|
|
|
return ACTION_REJECT_DST | ACTION_DROP | ACTION_ALERT;
|
|
|
|
} else if (strcasecmp(action, "rejectboth") == 0) {
|
|
|
|
} else if (strcasecmp(action, "rejectboth") == 0) {
|
|
|
|
if (!(SigParseActionRejectValidate(action)))
|
|
|
|
if (!(SigParseActionRejectValidate(action)))
|
|
|
|
return -1;
|
|
|
|
return 0;
|
|
|
|
s->action = ACTION_REJECT_BOTH | ACTION_DROP | ACTION_ALERT;
|
|
|
|
return ACTION_REJECT_BOTH | ACTION_DROP | ACTION_ALERT;
|
|
|
|
} else if (strcasecmp(action, "config") == 0) {
|
|
|
|
} else if (strcasecmp(action, "config") == 0) {
|
|
|
|
s->action = ACTION_CONFIG;
|
|
|
|
return ACTION_CONFIG;
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
SCLogError("An invalid action \"%s\" was given", action);
|
|
|
|
SCLogError("An invalid action \"%s\" was given", action);
|
|
|
|
return -1;
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
|
|
|
* \brief Parses the action that has been used by the Signature and allots it
|
|
|
|
|
|
|
|
* to its Signature instance.
|
|
|
|
|
|
|
|
*
|
|
|
|
|
|
|
|
* \param s Pointer to the Signature instance to which the action belongs.
|
|
|
|
|
|
|
|
* \param action Pointer to the action string used by the Signature.
|
|
|
|
|
|
|
|
*
|
|
|
|
|
|
|
|
* \retval 0 On successfully parsing the action string and adding it to the
|
|
|
|
|
|
|
|
* Signature.
|
|
|
|
|
|
|
|
* \retval -1 On failure.
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
static int SigParseAction(Signature *s, const char *action)
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
uint8_t flags = ActionStringToFlags(action);
|
|
|
|
|
|
|
|
if (flags == 0)
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
s->action = flags;
|
|
|
|
return 0;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|