|
|
|
@ -140,21 +140,19 @@ void DetectPktInspectEngineRegister(const char *name,
|
|
|
|
DetectBufferTypeRegister(name);
|
|
|
|
DetectBufferTypeRegister(name);
|
|
|
|
const int sm_list = DetectBufferTypeGetByName(name);
|
|
|
|
const int sm_list = DetectBufferTypeGetByName(name);
|
|
|
|
if (sm_list == -1) {
|
|
|
|
if (sm_list == -1) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION,
|
|
|
|
FatalError("failed to register inspect engine %s", name);
|
|
|
|
"failed to register inspect engine %s", name);
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
|
|
|
|
if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
|
|
|
|
(Callback == NULL))
|
|
|
|
(Callback == NULL))
|
|
|
|
{
|
|
|
|
{
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments");
|
|
|
|
SCLogError("Invalid arguments");
|
|
|
|
BUG_ON(1);
|
|
|
|
BUG_ON(1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
DetectEnginePktInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
|
|
|
|
DetectEnginePktInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
|
|
|
|
if (unlikely(new_engine == NULL)) {
|
|
|
|
if (unlikely(new_engine == NULL)) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION,
|
|
|
|
FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
|
|
|
|
"failed to register inspect engine %s: %s", name, strerror(errno));
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
new_engine->sm_list = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list_base = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list_base = (uint16_t)sm_list;
|
|
|
|
@ -182,11 +180,11 @@ void DetectFrameInspectEngineRegister(const char *name, int dir,
|
|
|
|
DetectBufferTypeRegister(name);
|
|
|
|
DetectBufferTypeRegister(name);
|
|
|
|
const int sm_list = DetectBufferTypeGetByName(name);
|
|
|
|
const int sm_list = DetectBufferTypeGetByName(name);
|
|
|
|
if (sm_list == -1) {
|
|
|
|
if (sm_list == -1) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION, "failed to register inspect engine %s", name);
|
|
|
|
FatalError("failed to register inspect engine %s", name);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
|
|
|
|
if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments");
|
|
|
|
SCLogError("Invalid arguments");
|
|
|
|
BUG_ON(1);
|
|
|
|
BUG_ON(1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -199,8 +197,7 @@ void DetectFrameInspectEngineRegister(const char *name, int dir,
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineFrameInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
|
|
|
|
DetectEngineFrameInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
|
|
|
|
if (unlikely(new_engine == NULL)) {
|
|
|
|
if (unlikely(new_engine == NULL)) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION, "failed to register inspect engine %s: %s", name,
|
|
|
|
FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
|
|
|
|
strerror(errno));
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
new_engine->sm_list = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list_base = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list_base = (uint16_t)sm_list;
|
|
|
|
@ -234,8 +231,7 @@ void DetectAppLayerInspectEngineRegister2(const char *name,
|
|
|
|
DetectBufferTypeRegister(name);
|
|
|
|
DetectBufferTypeRegister(name);
|
|
|
|
const int sm_list = DetectBufferTypeGetByName(name);
|
|
|
|
const int sm_list = DetectBufferTypeGetByName(name);
|
|
|
|
if (sm_list == -1) {
|
|
|
|
if (sm_list == -1) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION,
|
|
|
|
FatalError("failed to register inspect engine %s", name);
|
|
|
|
"failed to register inspect engine %s", name);
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if ((alproto >= ALPROTO_FAILED) ||
|
|
|
|
if ((alproto >= ALPROTO_FAILED) ||
|
|
|
|
@ -244,11 +240,11 @@ void DetectAppLayerInspectEngineRegister2(const char *name,
|
|
|
|
(progress < 0 || progress >= SHRT_MAX) ||
|
|
|
|
(progress < 0 || progress >= SHRT_MAX) ||
|
|
|
|
(Callback2 == NULL))
|
|
|
|
(Callback2 == NULL))
|
|
|
|
{
|
|
|
|
{
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments");
|
|
|
|
SCLogError("Invalid arguments");
|
|
|
|
BUG_ON(1);
|
|
|
|
BUG_ON(1);
|
|
|
|
} else if (Callback2 == DetectEngineInspectBufferGeneric && GetData == NULL) {
|
|
|
|
} else if (Callback2 == DetectEngineInspectBufferGeneric && GetData == NULL) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments: must register "
|
|
|
|
SCLogError("Invalid arguments: must register "
|
|
|
|
"GetData with DetectEngineInspectBufferGeneric");
|
|
|
|
"GetData with DetectEngineInspectBufferGeneric");
|
|
|
|
BUG_ON(1);
|
|
|
|
BUG_ON(1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -422,11 +418,11 @@ void DetectEngineFrameInspectEngineRegister(DetectEngineCtx *de_ctx, const char
|
|
|
|
{
|
|
|
|
{
|
|
|
|
const int sm_list = DetectEngineBufferTypeRegister(de_ctx, name);
|
|
|
|
const int sm_list = DetectEngineBufferTypeRegister(de_ctx, name);
|
|
|
|
if (sm_list < 0) {
|
|
|
|
if (sm_list < 0) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION, "failed to register inspect engine %s", name);
|
|
|
|
FatalError("failed to register inspect engine %s", name);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
|
|
|
|
if ((sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments");
|
|
|
|
SCLogError("Invalid arguments");
|
|
|
|
BUG_ON(1);
|
|
|
|
BUG_ON(1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -439,8 +435,7 @@ void DetectEngineFrameInspectEngineRegister(DetectEngineCtx *de_ctx, const char
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineFrameInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
|
|
|
|
DetectEngineFrameInspectionEngine *new_engine = SCCalloc(1, sizeof(*new_engine));
|
|
|
|
if (unlikely(new_engine == NULL)) {
|
|
|
|
if (unlikely(new_engine == NULL)) {
|
|
|
|
FatalError(SC_ERR_INITIALIZATION, "failed to register inspect engine %s: %s", name,
|
|
|
|
FatalError("failed to register inspect engine %s: %s", name, strerror(errno));
|
|
|
|
strerror(errno));
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
new_engine->sm_list = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list_base = (uint16_t)sm_list;
|
|
|
|
new_engine->sm_list_base = (uint16_t)sm_list;
|
|
|
|
@ -970,9 +965,8 @@ static void DetectBufferTypeFreeFunc(void *data)
|
|
|
|
if (map->transforms.transforms[i].options == NULL)
|
|
|
|
if (map->transforms.transforms[i].options == NULL)
|
|
|
|
continue;
|
|
|
|
continue;
|
|
|
|
if (sigmatch_table[map->transforms.transforms[i].transform].Free == NULL) {
|
|
|
|
if (sigmatch_table[map->transforms.transforms[i].transform].Free == NULL) {
|
|
|
|
SCLogError(SC_ERR_UNIMPLEMENTED,
|
|
|
|
SCLogError("%s allocates transform option memory but has no free routine",
|
|
|
|
"%s allocates transform option memory but has no free routine",
|
|
|
|
sigmatch_table[map->transforms.transforms[i].transform].name);
|
|
|
|
sigmatch_table[map->transforms.transforms[i].transform].name);
|
|
|
|
|
|
|
|
continue;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
sigmatch_table[map->transforms.transforms[i].transform].Free(NULL, map->transforms.transforms[i].options);
|
|
|
|
sigmatch_table[map->transforms.transforms[i].transform].Free(NULL, map->transforms.transforms[i].options);
|
|
|
|
@ -1316,9 +1310,9 @@ int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s)
|
|
|
|
if (s->init_data->list && s->init_data->transforms.cnt) {
|
|
|
|
if (s->init_data->list && s->init_data->transforms.cnt) {
|
|
|
|
if (s->init_data->list == DETECT_SM_LIST_NOTSET ||
|
|
|
|
if (s->init_data->list == DETECT_SM_LIST_NOTSET ||
|
|
|
|
s->init_data->list < DETECT_SM_LIST_DYNAMIC_START) {
|
|
|
|
s->init_data->list < DETECT_SM_LIST_DYNAMIC_START) {
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "previous transforms not consumed "
|
|
|
|
SCLogError("previous transforms not consumed "
|
|
|
|
"(list: %u, transform_cnt %u)", s->init_data->list,
|
|
|
|
"(list: %u, transform_cnt %u)",
|
|
|
|
s->init_data->transforms.cnt);
|
|
|
|
s->init_data->list, s->init_data->transforms.cnt);
|
|
|
|
SCReturnInt(-1);
|
|
|
|
SCReturnInt(-1);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -1669,8 +1663,7 @@ int DetectEngineBufferTypeGetByIdTransforms(
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!base_map->supports_transforms) {
|
|
|
|
if (!base_map->supports_transforms) {
|
|
|
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "buffer '%s' does not support transformations",
|
|
|
|
SCLogError("buffer '%s' does not support transformations", base_map->name);
|
|
|
|
base_map->name);
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -2220,7 +2213,7 @@ static int DetectEngineReloadThreads(DetectEngineCtx *new_de_ctx)
|
|
|
|
|
|
|
|
|
|
|
|
new_det_ctx[i] = DetectEngineThreadCtxInitForReload(tv, new_de_ctx, 1);
|
|
|
|
new_det_ctx[i] = DetectEngineThreadCtxInitForReload(tv, new_de_ctx, 1);
|
|
|
|
if (new_det_ctx[i] == NULL) {
|
|
|
|
if (new_det_ctx[i] == NULL) {
|
|
|
|
SCLogError(SC_ERR_LIVE_RULE_SWAP, "Detect engine thread init "
|
|
|
|
SCLogError("Detect engine thread init "
|
|
|
|
"failure in live rule swap. Let's get out of here");
|
|
|
|
"failure in live rule swap. Let's get out of here");
|
|
|
|
SCMutexUnlock(&tv_root_lock);
|
|
|
|
SCMutexUnlock(&tv_root_lock);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
@ -2563,9 +2556,8 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
} else if (strcmp(de_ctx_profile, "custom") == 0) {
|
|
|
|
} else if (strcmp(de_ctx_profile, "custom") == 0) {
|
|
|
|
profile = ENGINE_PROFILE_CUSTOM;
|
|
|
|
profile = ENGINE_PROFILE_CUSTOM;
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY,
|
|
|
|
SCLogError("invalid value for detect.profile: '%s'. "
|
|
|
|
"invalid value for detect.profile: '%s'. "
|
|
|
|
"Valid options: low, medium, high and custom.",
|
|
|
|
"Valid options: low, medium, high and custom.",
|
|
|
|
|
|
|
|
de_ctx_profile);
|
|
|
|
de_ctx_profile);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -2595,10 +2587,11 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
} else if (strcmp(sgh_mpm_context, "full") == 0) {
|
|
|
|
} else if (strcmp(sgh_mpm_context, "full") == 0) {
|
|
|
|
de_ctx->sgh_mpm_ctx_cnf = ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL;
|
|
|
|
de_ctx->sgh_mpm_ctx_cnf = ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL;
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "You have supplied an "
|
|
|
|
SCLogError("You have supplied an "
|
|
|
|
"invalid conf value for detect-engine.sgh-mpm-context-"
|
|
|
|
"invalid conf value for detect-engine.sgh-mpm-context-"
|
|
|
|
"%s", sgh_mpm_context);
|
|
|
|
"%s",
|
|
|
|
exit(EXIT_FAILURE);
|
|
|
|
sgh_mpm_context);
|
|
|
|
|
|
|
|
exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -2653,10 +2646,9 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
(const char *)max_uniq_toclient_groups_str) <= 0) {
|
|
|
|
(const char *)max_uniq_toclient_groups_str) <= 0) {
|
|
|
|
de_ctx->max_uniq_toclient_groups = 20;
|
|
|
|
de_ctx->max_uniq_toclient_groups = 20;
|
|
|
|
|
|
|
|
|
|
|
|
SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for "
|
|
|
|
SCLogWarning("parsing '%s' for "
|
|
|
|
"toclient-groups failed, using %u",
|
|
|
|
"toclient-groups failed, using %u",
|
|
|
|
max_uniq_toclient_groups_str,
|
|
|
|
max_uniq_toclient_groups_str, de_ctx->max_uniq_toclient_groups);
|
|
|
|
de_ctx->max_uniq_toclient_groups);
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
de_ctx->max_uniq_toclient_groups = 20;
|
|
|
|
de_ctx->max_uniq_toclient_groups = 20;
|
|
|
|
@ -2669,10 +2661,9 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
(const char *)max_uniq_toserver_groups_str) <= 0) {
|
|
|
|
(const char *)max_uniq_toserver_groups_str) <= 0) {
|
|
|
|
de_ctx->max_uniq_toserver_groups = 40;
|
|
|
|
de_ctx->max_uniq_toserver_groups = 40;
|
|
|
|
|
|
|
|
|
|
|
|
SCLogWarning(SC_ERR_SIZE_PARSE, "parsing '%s' for "
|
|
|
|
SCLogWarning("parsing '%s' for "
|
|
|
|
"toserver-groups failed, using %u",
|
|
|
|
"toserver-groups failed, using %u",
|
|
|
|
max_uniq_toserver_groups_str,
|
|
|
|
max_uniq_toserver_groups_str, de_ctx->max_uniq_toserver_groups);
|
|
|
|
de_ctx->max_uniq_toserver_groups);
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
de_ctx->max_uniq_toserver_groups = 40;
|
|
|
|
de_ctx->max_uniq_toserver_groups = 40;
|
|
|
|
@ -2709,8 +2700,8 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
|
|
|
|
|
|
|
|
insp_recursion_limit_node = ConfNodeLookupChild(opt, opt->val);
|
|
|
|
insp_recursion_limit_node = ConfNodeLookupChild(opt, opt->val);
|
|
|
|
if (insp_recursion_limit_node == NULL) {
|
|
|
|
if (insp_recursion_limit_node == NULL) {
|
|
|
|
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Error retrieving conf "
|
|
|
|
SCLogError("Error retrieving conf "
|
|
|
|
"entry for detect-engine:inspection-recursion-limit");
|
|
|
|
"entry for detect-engine:inspection-recursion-limit");
|
|
|
|
break;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
insp_recursion_limit = insp_recursion_limit_node->val;
|
|
|
|
insp_recursion_limit = insp_recursion_limit_node->val;
|
|
|
|
@ -2722,10 +2713,9 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
if (insp_recursion_limit != NULL) {
|
|
|
|
if (insp_recursion_limit != NULL) {
|
|
|
|
if (StringParseInt32(&de_ctx->inspection_recursion_limit, 10,
|
|
|
|
if (StringParseInt32(&de_ctx->inspection_recursion_limit, 10,
|
|
|
|
0, (const char *)insp_recursion_limit) < 0) {
|
|
|
|
0, (const char *)insp_recursion_limit) < 0) {
|
|
|
|
SCLogWarning(SC_EINVAL,
|
|
|
|
SCLogWarning("Invalid value for "
|
|
|
|
"Invalid value for "
|
|
|
|
"detect-engine.inspection-recursion-limit: %s "
|
|
|
|
"detect-engine.inspection-recursion-limit: %s "
|
|
|
|
"resetting to %d",
|
|
|
|
"resetting to %d",
|
|
|
|
|
|
|
|
insp_recursion_limit, DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT);
|
|
|
|
insp_recursion_limit, DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT);
|
|
|
|
de_ctx->inspection_recursion_limit =
|
|
|
|
de_ctx->inspection_recursion_limit =
|
|
|
|
DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT;
|
|
|
|
DETECT_ENGINE_DEFAULT_INSPECTION_RECURSION_LIMIT;
|
|
|
|
@ -2755,14 +2745,16 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (DetectPortParse(de_ctx, &de_ctx->tcp_whitelist, ports) != 0) {
|
|
|
|
if (DetectPortParse(de_ctx, &de_ctx->tcp_whitelist, ports) != 0) {
|
|
|
|
SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value "
|
|
|
|
SCLogWarning("'%s' is not a valid value "
|
|
|
|
"for detect.grouping.tcp-whitelist", ports);
|
|
|
|
"for detect.grouping.tcp-whitelist",
|
|
|
|
|
|
|
|
ports);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
DetectPort *x = de_ctx->tcp_whitelist;
|
|
|
|
DetectPort *x = de_ctx->tcp_whitelist;
|
|
|
|
for ( ; x != NULL; x = x->next) {
|
|
|
|
for ( ; x != NULL; x = x->next) {
|
|
|
|
if (x->port != x->port2) {
|
|
|
|
if (x->port != x->port2) {
|
|
|
|
SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value "
|
|
|
|
SCLogWarning("'%s' is not a valid value "
|
|
|
|
"for detect.grouping.tcp-whitelist: only single ports allowed", ports);
|
|
|
|
"for detect.grouping.tcp-whitelist: only single ports allowed",
|
|
|
|
|
|
|
|
ports);
|
|
|
|
DetectPortCleanupList(de_ctx, de_ctx->tcp_whitelist);
|
|
|
|
DetectPortCleanupList(de_ctx, de_ctx->tcp_whitelist);
|
|
|
|
de_ctx->tcp_whitelist = NULL;
|
|
|
|
de_ctx->tcp_whitelist = NULL;
|
|
|
|
break;
|
|
|
|
break;
|
|
|
|
@ -2779,15 +2771,15 @@ static int DetectEngineCtxLoadConf(DetectEngineCtx *de_ctx)
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (DetectPortParse(de_ctx, &de_ctx->udp_whitelist, ports) != 0) {
|
|
|
|
if (DetectPortParse(de_ctx, &de_ctx->udp_whitelist, ports) != 0) {
|
|
|
|
SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY,
|
|
|
|
SCLogWarning("'%s' is not a valid value "
|
|
|
|
"'%s' is not a valid value "
|
|
|
|
"for detect.grouping.udp-whitelist",
|
|
|
|
"for detect.grouping.udp-whitelist",
|
|
|
|
|
|
|
|
ports);
|
|
|
|
ports);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
for (x = de_ctx->udp_whitelist; x != NULL; x = x->next) {
|
|
|
|
for (x = de_ctx->udp_whitelist; x != NULL; x = x->next) {
|
|
|
|
if (x->port != x->port2) {
|
|
|
|
if (x->port != x->port2) {
|
|
|
|
SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "'%s' is not a valid value "
|
|
|
|
SCLogWarning("'%s' is not a valid value "
|
|
|
|
"for detect.grouping.udp-whitelist: only single ports allowed", ports);
|
|
|
|
"for detect.grouping.udp-whitelist: only single ports allowed",
|
|
|
|
|
|
|
|
ports);
|
|
|
|
DetectPortCleanupList(de_ctx, de_ctx->udp_whitelist);
|
|
|
|
DetectPortCleanupList(de_ctx, de_ctx->udp_whitelist);
|
|
|
|
de_ctx->udp_whitelist = NULL;
|
|
|
|
de_ctx->udp_whitelist = NULL;
|
|
|
|
break;
|
|
|
|
break;
|
|
|
|
@ -2837,7 +2829,7 @@ static int DetectEngineThreadCtxInitGlobalKeywords(DetectEngineThreadCtx *det_ct
|
|
|
|
// coverity[suspicious_sizeof : FALSE]
|
|
|
|
// coverity[suspicious_sizeof : FALSE]
|
|
|
|
det_ctx->global_keyword_ctxs_array = (void **)SCCalloc(master->keyword_id, sizeof(void *));
|
|
|
|
det_ctx->global_keyword_ctxs_array = (void **)SCCalloc(master->keyword_id, sizeof(void *));
|
|
|
|
if (det_ctx->global_keyword_ctxs_array == NULL) {
|
|
|
|
if (det_ctx->global_keyword_ctxs_array == NULL) {
|
|
|
|
SCLogError(SC_ERR_DETECT_PREPARE, "setting up thread local detect ctx");
|
|
|
|
SCLogError("setting up thread local detect ctx");
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
det_ctx->global_keyword_ctxs_size = master->keyword_id;
|
|
|
|
det_ctx->global_keyword_ctxs_size = master->keyword_id;
|
|
|
|
@ -2846,8 +2838,9 @@ static int DetectEngineThreadCtxInitGlobalKeywords(DetectEngineThreadCtx *det_ct
|
|
|
|
while (item) {
|
|
|
|
while (item) {
|
|
|
|
det_ctx->global_keyword_ctxs_array[item->id] = item->InitFunc(item->data);
|
|
|
|
det_ctx->global_keyword_ctxs_array[item->id] = item->InitFunc(item->data);
|
|
|
|
if (det_ctx->global_keyword_ctxs_array[item->id] == NULL) {
|
|
|
|
if (det_ctx->global_keyword_ctxs_array[item->id] == NULL) {
|
|
|
|
SCLogError(SC_ERR_DETECT_PREPARE, "setting up thread local detect ctx "
|
|
|
|
SCLogError("setting up thread local detect ctx "
|
|
|
|
"for keyword \"%s\" failed", item->name);
|
|
|
|
"for keyword \"%s\" failed",
|
|
|
|
|
|
|
|
item->name);
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
item = item->next;
|
|
|
|
item = item->next;
|
|
|
|
@ -2884,7 +2877,7 @@ static int DetectEngineThreadCtxInitKeywords(DetectEngineCtx *de_ctx, DetectEngi
|
|
|
|
// coverity[suspicious_sizeof : FALSE]
|
|
|
|
// coverity[suspicious_sizeof : FALSE]
|
|
|
|
det_ctx->keyword_ctxs_array = SCMalloc(de_ctx->keyword_id * sizeof(void *));
|
|
|
|
det_ctx->keyword_ctxs_array = SCMalloc(de_ctx->keyword_id * sizeof(void *));
|
|
|
|
if (det_ctx->keyword_ctxs_array == NULL) {
|
|
|
|
if (det_ctx->keyword_ctxs_array == NULL) {
|
|
|
|
SCLogError(SC_ERR_DETECT_PREPARE, "setting up thread local detect ctx");
|
|
|
|
SCLogError("setting up thread local detect ctx");
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -2898,8 +2891,9 @@ static int DetectEngineThreadCtxInitKeywords(DetectEngineCtx *de_ctx, DetectEngi
|
|
|
|
|
|
|
|
|
|
|
|
det_ctx->keyword_ctxs_array[item->id] = item->InitFunc(item->data);
|
|
|
|
det_ctx->keyword_ctxs_array[item->id] = item->InitFunc(item->data);
|
|
|
|
if (det_ctx->keyword_ctxs_array[item->id] == NULL) {
|
|
|
|
if (det_ctx->keyword_ctxs_array[item->id] == NULL) {
|
|
|
|
SCLogError(SC_ERR_DETECT_PREPARE, "setting up thread local detect ctx "
|
|
|
|
SCLogError("setting up thread local detect ctx "
|
|
|
|
"for keyword \"%s\" failed", item->name);
|
|
|
|
"for keyword \"%s\" failed",
|
|
|
|
|
|
|
|
item->name);
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -2935,8 +2929,8 @@ static TmEcode DetectEngineThreadCtxInitForMT(ThreadVars *tv, DetectEngineThread
|
|
|
|
HashTable *mt_det_ctxs_hash = NULL;
|
|
|
|
HashTable *mt_det_ctxs_hash = NULL;
|
|
|
|
|
|
|
|
|
|
|
|
if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) {
|
|
|
|
if (master->tenant_selector == TENANT_SELECTOR_UNKNOWN) {
|
|
|
|
SCLogError(SC_ERR_MT_NO_SELECTOR, "no tenant selector set: "
|
|
|
|
SCLogError("no tenant selector set: "
|
|
|
|
"set using multi-detect.selector");
|
|
|
|
"set using multi-detect.selector");
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -3370,7 +3364,7 @@ TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
|
|
|
|
DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
|
|
|
|
DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
|
|
|
|
|
|
|
|
|
|
|
|
if (det_ctx == NULL) {
|
|
|
|
if (det_ctx == NULL) {
|
|
|
|
SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "argument \"data\" NULL");
|
|
|
|
SCLogWarning("argument \"data\" NULL");
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -3670,28 +3664,27 @@ static int DetectEngineMultiTenantLoadTenant(uint32_t tenant_id, const char *fil
|
|
|
|
struct stat st;
|
|
|
|
struct stat st;
|
|
|
|
if(stat(filename, &st) != 0) {
|
|
|
|
if(stat(filename, &st) != 0) {
|
|
|
|
#endif /* OS_WIN32 */
|
|
|
|
#endif /* OS_WIN32 */
|
|
|
|
SCLogError(SC_ERR_FOPEN, "failed to stat file %s", filename);
|
|
|
|
SCLogError("failed to stat file %s", filename);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
de_ctx = DetectEngineGetByTenantId(tenant_id);
|
|
|
|
de_ctx = DetectEngineGetByTenantId(tenant_id);
|
|
|
|
if (de_ctx != NULL) {
|
|
|
|
if (de_ctx != NULL) {
|
|
|
|
SCLogError(SC_ERR_MT_DUPLICATE_TENANT, "tenant %u already registered",
|
|
|
|
SCLogError("tenant %u already registered", tenant_id);
|
|
|
|
tenant_id);
|
|
|
|
|
|
|
|
DetectEngineDeReference(&de_ctx);
|
|
|
|
DetectEngineDeReference(&de_ctx);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
ConfNode *node = ConfGetNode(prefix);
|
|
|
|
ConfNode *node = ConfGetNode(prefix);
|
|
|
|
if (node == NULL) {
|
|
|
|
if (node == NULL) {
|
|
|
|
SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to properly setup yaml %s", filename);
|
|
|
|
SCLogError("failed to properly setup yaml %s", filename);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
de_ctx = DetectEngineCtxInitWithPrefix(prefix);
|
|
|
|
de_ctx = DetectEngineCtxInitWithPrefix(prefix);
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
if (de_ctx == NULL) {
|
|
|
|
SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine "
|
|
|
|
SCLogError("initializing detection engine "
|
|
|
|
"context failed.");
|
|
|
|
"context failed.");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
SCLogDebug("de_ctx %p with prefix %s", de_ctx, de_ctx->config_prefix);
|
|
|
|
SCLogDebug("de_ctx %p with prefix %s", de_ctx, de_ctx->config_prefix);
|
|
|
|
@ -3701,7 +3694,7 @@ static int DetectEngineMultiTenantLoadTenant(uint32_t tenant_id, const char *fil
|
|
|
|
de_ctx->loader_id = loader_id;
|
|
|
|
de_ctx->loader_id = loader_id;
|
|
|
|
|
|
|
|
|
|
|
|
if (SigLoadSignatures(de_ctx, NULL, 0) < 0) {
|
|
|
|
if (SigLoadSignatures(de_ctx, NULL, 0) < 0) {
|
|
|
|
SCLogError(SC_ERR_NO_RULES_LOADED, "Loading signatures failed.");
|
|
|
|
SCLogError("Loading signatures failed.");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -3720,7 +3713,7 @@ static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *f
|
|
|
|
{
|
|
|
|
{
|
|
|
|
DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id);
|
|
|
|
DetectEngineCtx *old_de_ctx = DetectEngineGetByTenantId(tenant_id);
|
|
|
|
if (old_de_ctx == NULL) {
|
|
|
|
if (old_de_ctx == NULL) {
|
|
|
|
SCLogError(SC_ERR_INITIALIZATION, "tenant detect engine not found");
|
|
|
|
SCLogError("tenant detect engine not found");
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -3730,20 +3723,20 @@ static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *f
|
|
|
|
SCLogDebug("prefix %s", prefix);
|
|
|
|
SCLogDebug("prefix %s", prefix);
|
|
|
|
|
|
|
|
|
|
|
|
if (ConfYamlLoadFileWithPrefix(filename, prefix) != 0) {
|
|
|
|
if (ConfYamlLoadFileWithPrefix(filename, prefix) != 0) {
|
|
|
|
SCLogError(SC_ERR_INITIALIZATION,"failed to load yaml");
|
|
|
|
SCLogError("failed to load yaml");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
ConfNode *node = ConfGetNode(prefix);
|
|
|
|
ConfNode *node = ConfGetNode(prefix);
|
|
|
|
if (node == NULL) {
|
|
|
|
if (node == NULL) {
|
|
|
|
SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to properly setup yaml %s", filename);
|
|
|
|
SCLogError("failed to properly setup yaml %s", filename);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix);
|
|
|
|
DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix);
|
|
|
|
if (new_de_ctx == NULL) {
|
|
|
|
if (new_de_ctx == NULL) {
|
|
|
|
SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine "
|
|
|
|
SCLogError("initializing detection engine "
|
|
|
|
"context failed.");
|
|
|
|
"context failed.");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
SCLogDebug("de_ctx %p with prefix %s", new_de_ctx, new_de_ctx->config_prefix);
|
|
|
|
SCLogDebug("de_ctx %p with prefix %s", new_de_ctx, new_de_ctx->config_prefix);
|
|
|
|
@ -3753,7 +3746,7 @@ static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *f
|
|
|
|
new_de_ctx->loader_id = old_de_ctx->loader_id;
|
|
|
|
new_de_ctx->loader_id = old_de_ctx->loader_id;
|
|
|
|
|
|
|
|
|
|
|
|
if (SigLoadSignatures(new_de_ctx, NULL, 0) < 0) {
|
|
|
|
if (SigLoadSignatures(new_de_ctx, NULL, 0) < 0) {
|
|
|
|
SCLogError(SC_ERR_NO_RULES_LOADED, "Loading signatures failed.");
|
|
|
|
SCLogError("Loading signatures failed.");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -3878,21 +3871,21 @@ static int DetectEngineMultiTenantSetupLoadLivedevMappings(const ConfNode *mappi
|
|
|
|
uint32_t tenant_id = 0;
|
|
|
|
uint32_t tenant_id = 0;
|
|
|
|
if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
|
|
|
|
if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
|
|
|
|
tenant_id_node->val) < 0) {
|
|
|
|
tenant_id_node->val) < 0) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant-id "
|
|
|
|
SCLogError("tenant-id "
|
|
|
|
"of %s is invalid", tenant_id_node->val);
|
|
|
|
"of %s is invalid",
|
|
|
|
|
|
|
|
tenant_id_node->val);
|
|
|
|
goto bad_mapping;
|
|
|
|
goto bad_mapping;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
const char *dev = device_node->val;
|
|
|
|
const char *dev = device_node->val;
|
|
|
|
LiveDevice *ld = LiveGetDevice(dev);
|
|
|
|
LiveDevice *ld = LiveGetDevice(dev);
|
|
|
|
if (ld == NULL) {
|
|
|
|
if (ld == NULL) {
|
|
|
|
SCLogWarning(SC_ERR_MT_NO_MAPPING, "device %s not found", dev);
|
|
|
|
SCLogWarning("device %s not found", dev);
|
|
|
|
goto bad_mapping;
|
|
|
|
goto bad_mapping;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (ld->tenant_id_set) {
|
|
|
|
if (ld->tenant_id_set) {
|
|
|
|
SCLogWarning(SC_ERR_MT_NO_MAPPING, "device %s already mapped to tenant-id %u",
|
|
|
|
SCLogWarning("device %s already mapped to tenant-id %u", dev, ld->tenant_id);
|
|
|
|
dev, ld->tenant_id);
|
|
|
|
|
|
|
|
goto bad_mapping;
|
|
|
|
goto bad_mapping;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -3937,21 +3930,24 @@ static int DetectEngineMultiTenantSetupLoadVlanMappings(const ConfNode *mappings
|
|
|
|
uint32_t tenant_id = 0;
|
|
|
|
uint32_t tenant_id = 0;
|
|
|
|
if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
|
|
|
|
if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
|
|
|
|
tenant_id_node->val) < 0) {
|
|
|
|
tenant_id_node->val) < 0) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant-id "
|
|
|
|
SCLogError("tenant-id "
|
|
|
|
"of %s is invalid", tenant_id_node->val);
|
|
|
|
"of %s is invalid",
|
|
|
|
|
|
|
|
tenant_id_node->val);
|
|
|
|
goto bad_mapping;
|
|
|
|
goto bad_mapping;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
uint16_t vlan_id = 0;
|
|
|
|
uint16_t vlan_id = 0;
|
|
|
|
if (StringParseUint16(
|
|
|
|
if (StringParseUint16(
|
|
|
|
&vlan_id, 10, (uint16_t)strlen(vlan_id_node->val), vlan_id_node->val) < 0) {
|
|
|
|
&vlan_id, 10, (uint16_t)strlen(vlan_id_node->val), vlan_id_node->val) < 0) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT, "vlan-id "
|
|
|
|
SCLogError("vlan-id "
|
|
|
|
"of %s is invalid", vlan_id_node->val);
|
|
|
|
"of %s is invalid",
|
|
|
|
|
|
|
|
vlan_id_node->val);
|
|
|
|
goto bad_mapping;
|
|
|
|
goto bad_mapping;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (vlan_id == 0 || vlan_id >= 4095) {
|
|
|
|
if (vlan_id == 0 || vlan_id >= 4095) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT, "vlan-id "
|
|
|
|
SCLogError("vlan-id "
|
|
|
|
"of %s is invalid. Valid range 1-4094.", vlan_id_node->val);
|
|
|
|
"of %s is invalid. Valid range 1-4094.",
|
|
|
|
|
|
|
|
vlan_id_node->val);
|
|
|
|
goto bad_mapping;
|
|
|
|
goto bad_mapping;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -4007,8 +4003,8 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
|
|
|
|
|
|
|
|
|
|
|
|
int vlanbool = 0;
|
|
|
|
int vlanbool = 0;
|
|
|
|
if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) {
|
|
|
|
if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) {
|
|
|
|
SCLogError(SC_EINVAL, "vlan tracking is disabled, "
|
|
|
|
SCLogError("vlan tracking is disabled, "
|
|
|
|
"can't use multi-detect selector 'vlan'");
|
|
|
|
"can't use multi-detect selector 'vlan'");
|
|
|
|
SCMutexUnlock(&master->lock);
|
|
|
|
SCMutexUnlock(&master->lock);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -4018,16 +4014,14 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
|
|
|
|
} else if (strcmp(handler, "device") == 0) {
|
|
|
|
} else if (strcmp(handler, "device") == 0) {
|
|
|
|
tenant_selector = master->tenant_selector = TENANT_SELECTOR_LIVEDEV;
|
|
|
|
tenant_selector = master->tenant_selector = TENANT_SELECTOR_LIVEDEV;
|
|
|
|
if (EngineModeIsIPS()) {
|
|
|
|
if (EngineModeIsIPS()) {
|
|
|
|
SCLogWarning(SC_ERR_MT_NO_MAPPING,
|
|
|
|
SCLogWarning("multi-tenant 'device' mode not supported for IPS");
|
|
|
|
"multi-tenant 'device' mode not supported for IPS");
|
|
|
|
|
|
|
|
SCMutexUnlock(&master->lock);
|
|
|
|
SCMutexUnlock(&master->lock);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
SCLogError(SC_EINVAL,
|
|
|
|
SCLogError("unknown value %s "
|
|
|
|
"unknown value %s "
|
|
|
|
"multi-detect.selector",
|
|
|
|
"multi-detect.selector",
|
|
|
|
|
|
|
|
handler);
|
|
|
|
handler);
|
|
|
|
SCMutexUnlock(&master->lock);
|
|
|
|
SCMutexUnlock(&master->lock);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
@ -4052,10 +4046,10 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
|
|
|
|
"tenants won't be used until mappings are added");
|
|
|
|
"tenants won't be used until mappings are added");
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
if (failure_fatal) {
|
|
|
|
if (failure_fatal) {
|
|
|
|
SCLogError(SC_ERR_MT_NO_MAPPING, "no multi-detect mappings defined");
|
|
|
|
SCLogError("no multi-detect mappings defined");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
SCLogWarning(SC_ERR_MT_NO_MAPPING, "no multi-detect mappings defined");
|
|
|
|
SCLogWarning("no multi-detect mappings defined");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -4064,10 +4058,10 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
|
|
|
|
failure_fatal);
|
|
|
|
failure_fatal);
|
|
|
|
if (mapping_cnt == 0) {
|
|
|
|
if (mapping_cnt == 0) {
|
|
|
|
if (failure_fatal) {
|
|
|
|
if (failure_fatal) {
|
|
|
|
SCLogError(SC_ERR_MT_NO_MAPPING, "no multi-detect mappings defined");
|
|
|
|
SCLogError("no multi-detect mappings defined");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
} else {
|
|
|
|
} else {
|
|
|
|
SCLogWarning(SC_ERR_MT_NO_MAPPING, "no multi-detect mappings defined");
|
|
|
|
SCLogWarning("no multi-detect mappings defined");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -4090,8 +4084,9 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
|
|
|
|
uint32_t tenant_id = 0;
|
|
|
|
uint32_t tenant_id = 0;
|
|
|
|
if (StringParseUint32(
|
|
|
|
if (StringParseUint32(
|
|
|
|
&tenant_id, 10, (uint16_t)strlen(id_node->val), id_node->val) < 0) {
|
|
|
|
&tenant_id, 10, (uint16_t)strlen(id_node->val), id_node->val) < 0) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ARGUMENT, "tenant_id "
|
|
|
|
SCLogError("tenant_id "
|
|
|
|
"of %s is invalid", id_node->val);
|
|
|
|
"of %s is invalid",
|
|
|
|
|
|
|
|
id_node->val);
|
|
|
|
goto bad_tenant;
|
|
|
|
goto bad_tenant;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
SCLogDebug("tenant id: %u, %s", tenant_id, yaml_node->val);
|
|
|
|
SCLogDebug("tenant id: %u, %s", tenant_id, yaml_node->val);
|
|
|
|
@ -4101,7 +4096,7 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
|
|
|
|
char prefix[64];
|
|
|
|
char prefix[64];
|
|
|
|
snprintf(prefix, sizeof(prefix), "multi-detect.%u", tenant_id);
|
|
|
|
snprintf(prefix, sizeof(prefix), "multi-detect.%u", tenant_id);
|
|
|
|
if (ConfYamlLoadFileWithPrefix(yaml_node->val, prefix) != 0) {
|
|
|
|
if (ConfYamlLoadFileWithPrefix(yaml_node->val, prefix) != 0) {
|
|
|
|
SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to load yaml %s", yaml_node->val);
|
|
|
|
SCLogError("failed to load yaml %s", yaml_node->val);
|
|
|
|
goto bad_tenant;
|
|
|
|
goto bad_tenant;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -4447,15 +4442,13 @@ int DetectEngineReload(const SCInstance *suri)
|
|
|
|
if (suri->conf_filename != NULL) {
|
|
|
|
if (suri->conf_filename != NULL) {
|
|
|
|
snprintf(prefix, sizeof(prefix), "detect-engine-reloads.%d", reloads++);
|
|
|
|
snprintf(prefix, sizeof(prefix), "detect-engine-reloads.%d", reloads++);
|
|
|
|
if (ConfYamlLoadFileWithPrefix(suri->conf_filename, prefix) != 0) {
|
|
|
|
if (ConfYamlLoadFileWithPrefix(suri->conf_filename, prefix) != 0) {
|
|
|
|
SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to load yaml %s",
|
|
|
|
SCLogError("failed to load yaml %s", suri->conf_filename);
|
|
|
|
suri->conf_filename);
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
ConfNode *node = ConfGetNode(prefix);
|
|
|
|
ConfNode *node = ConfGetNode(prefix);
|
|
|
|
if (node == NULL) {
|
|
|
|
if (node == NULL) {
|
|
|
|
SCLogError(SC_ERR_CONF_YAML_ERROR, "failed to properly setup yaml %s",
|
|
|
|
SCLogError("failed to properly setup yaml %s", suri->conf_filename);
|
|
|
|
suri->conf_filename);
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#if 0
|
|
|
|
#if 0
|
|
|
|
@ -4482,8 +4475,8 @@ int DetectEngineReload(const SCInstance *suri)
|
|
|
|
/* get new detection engine */
|
|
|
|
/* get new detection engine */
|
|
|
|
new_de_ctx = DetectEngineCtxInitWithPrefix(prefix);
|
|
|
|
new_de_ctx = DetectEngineCtxInitWithPrefix(prefix);
|
|
|
|
if (new_de_ctx == NULL) {
|
|
|
|
if (new_de_ctx == NULL) {
|
|
|
|
SCLogError(SC_ERR_INITIALIZATION, "initializing detection engine "
|
|
|
|
SCLogError("initializing detection engine "
|
|
|
|
"context failed.");
|
|
|
|
"context failed.");
|
|
|
|
DetectEngineDeReference(&old_de_ctx);
|
|
|
|
DetectEngineDeReference(&old_de_ctx);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -4653,8 +4646,9 @@ int DetectEngineGetEventInfo(const char *event_name, int *event_id,
|
|
|
|
{
|
|
|
|
{
|
|
|
|
*event_id = SCMapEnumNameToValue(event_name, det_ctx_event_table);
|
|
|
|
*event_id = SCMapEnumNameToValue(event_name, det_ctx_event_table);
|
|
|
|
if (*event_id == -1) {
|
|
|
|
if (*event_id == -1) {
|
|
|
|
SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in "
|
|
|
|
SCLogError("event \"%s\" not present in "
|
|
|
|
"det_ctx's enum map table.", event_name);
|
|
|
|
"det_ctx's enum map table.",
|
|
|
|
|
|
|
|
event_name);
|
|
|
|
/* this should be treated as fatal */
|
|
|
|
/* this should be treated as fatal */
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Victor Julien
3 years ago