aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bug 333 - support new Size Parsing API. Update various conf params inside the engine to use this API to parse sizes in the format xxx <-just the no represents bytes, xxxkb <- kilobytes, xxxmb <- megabytes, xxxgb <- gigabytes, where xxx is a \d+

Browse Source
remotes/origin/master-1.2.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent 79e0299643
commit e0c13434ef
12 changed files with 1220 additions and 56 deletions
Show Stats Download Patch File Download Diff File

1
src/Makefile.am
Unescape Escape View File

@ -160,6 +160,7 @@ detect-ssl-state.c detect-ssl-state.h \
detect-byte-extract.c detect-byte-extract.h \
detect-replace.c detect-replace.h \
util-magic.c util-magic.h \
util-misc.c util-misc.h \
util-atomic.h \
util-print.c util-print.h \
util-fmemopen.c util-fmemopen.h \

9
src/alert-unified2-alert.c
Unescape Escape View File

@ -44,6 +44,7 @@
#include "util-debug.h"
#include "util-time.h"
#include "util-byte.h"
#include "util-misc.h"
#include "output.h"
#include "alert-unified2-alert.h"
@ -64,7 +65,7 @@
#define DEFAULT_LIMIT 32
/**< Minimum log file limit in MB. */
#define MIN_LIMIT 1
#define MIN_LIMIT 1 * 1024 * 1024
/**
* Unified2 file header struct
@ -1172,12 +1173,14 @@ OutputCtx *Unified2AlertInitCtx(ConfNode *conf)
if (conf != NULL) {
s_limit = ConfNodeLookupChildValue(conf, "limit");
if (s_limit != NULL) {
if (ByteExtractStringUint64(&limit, 10, 0, s_limit) == -1) {
long double res;
if (ParseSizeString(s_limit, &res) < 0) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Failed to initialize unified2 output, invalid limit: %s",
s_limit);
exit(EXIT_FAILURE);
}
limit = res;
if (limit < MIN_LIMIT) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Failed to initialize unified2 output, limit less than "
@ -1186,7 +1189,7 @@ OutputCtx *Unified2AlertInitCtx(ConfNode *conf)
}
}
}
file_ctx->size_limit = limit * 1024 * 1024;
file_ctx->size_limit = limit;
ret = Unified2AlertOpenFileCtx(file_ctx, filename);
if (ret < 0)

47
src/app-layer-htp.c
Unescape Escape View File

@ -58,6 +58,7 @@
#include "util-spm.h"
#include "util-debug.h"
#include "util-time.h"
#include "util-misc.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
@ -1737,23 +1738,14 @@ static void HTPConfigure(void)
} else if (strcasecmp("request-body-limit", p->name) == 0 ||
strcasecmp("request_body_limit", p->name) == 0) {
/* limit */
int limit = atoi(p->val);
if (limit >= 0) {
SCLogDebug("LIBHTP default: %s=%s (%d)",
p->name, p->val, limit);
cfglist.request_body_limit = (uint32_t)limit;
}
else {
SCLogWarning(SC_ERR_UNKNOWN_VALUE,
"LIBHTP malformed request-body-limit "
"\"%s\", using default %u", p->val,
HTP_CONFIG_DEFAULT_REQUEST_BODY_LIMIT);
cfglist.request_body_limit = HTP_CONFIG_DEFAULT_REQUEST_BODY_LIMIT;
continue;
long double res;
if (ParseSizeString(p->val, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing request-body-limit "
"from conf file - %s. Killing engine",
p->val);
exit(EXIT_FAILURE);
}
cfglist.request_body_limit = (uint32_t)res;
} else if (strcasecmp("response-body-limit", p->name) == 0) {
/* limit */
@ -1773,7 +1765,6 @@ static void HTPConfigure(void)
cfglist.response_body_limit = HTP_CONFIG_DEFAULT_RESPONSE_BODY_LIMIT;
continue;
}
} else {
SCLogWarning(SC_ERR_UNKNOWN_VALUE,
"LIBHTP Ignoring unknown default config: %s",
@ -1915,22 +1906,14 @@ static void HTPConfigure(void)
SCLogDebug("LIBHTP default: %s=%s",
p->name, p->val);
int limit = atoi(p->val);
if (limit >= 0) {
SCLogDebug("LIBHTP default: %s=%s (%d)",
p->name, p->val, limit);
htprec->request_body_limit = (uint32_t)limit;
}
else {
SCLogWarning(SC_ERR_UNKNOWN_VALUE,
"LIBHTP malformed request_body_limit "
"\"%s\", using default %u", p->val,
HTP_CONFIG_DEFAULT_REQUEST_BODY_LIMIT);
htprec->request_body_limit = HTP_CONFIG_DEFAULT_REQUEST_BODY_LIMIT;
continue;
long double res;
if (ParseSizeString(p->val, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing request-body-limit "
"from conf file - %s. Killing engine",
p->val);
exit(EXIT_FAILURE);
}
htprec->request_body_limit = (uint32_t)res;
} else if (strcasecmp("response-body-limit", p->name) == 0) {
/* limit */

12
src/flow.c
Unescape Escape View File

@ -53,6 +53,7 @@
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-byte.h"
#include "util-misc.h"
#include "util-debug.h"
#include "util-privs.h"
@ -860,15 +861,18 @@ void FlowInitConfig(char quiet)
/* Check if we have memcap and hash_size defined at config */
char *conf_val;
uint32_t configval = 0;
uint64_t configval64 = 0;
/** set config values for memcap, prealloc and hash_size */
if ((ConfGet("flow.memcap", &conf_val)) == 1)
{
if (ByteExtractStringUint64(&configval64, 10, strlen(conf_val),
conf_val) > 0) {
flow_config.memcap = configval64;
long double res;
if (ParseSizeString(conf_val, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing flow.memcap "
"from conf file - %s. Killing engine",
conf_val);
exit(EXIT_FAILURE);
}
flow_config.memcap = res;
}
if ((ConfGet("flow.hash_size", &conf_val)) == 1)
{

11
src/log-pcap.c
Unescape Escape View File

@ -47,6 +47,7 @@
#include "util-debug.h"
#include "util-time.h"
#include "util-byte.h"
#include "util-misc.h"
#include "source-pcap.h"
@ -56,7 +57,7 @@
#define DEFAULT_LOG_FILENAME "pcaplog"
#define MODULE_NAME "PcapLog"
#define MIN_LIMIT 1
#define MIN_LIMIT 1 * 1024 * 1024
#define DEFAULT_LIMIT 100
#define DEFAULT_FILE_LIMIT 0
@ -429,12 +430,14 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
const char *s_limit = NULL;
s_limit = ConfNodeLookupChildValue(conf, "limit");
if (s_limit != NULL) {
if (ByteExtractStringUint64(&limit, 10, 0, s_limit) == -1) {
long double res;
if (ParseSizeString(s_limit, &res) < 0) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Fail to initialize pcap-log output, invalid limit: %s",
"Failed to initialize unified2 output, invalid limit: %s",
s_limit);
exit(EXIT_FAILURE);
}
limit = res;
if (limit < MIN_LIMIT) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Fail to initialize pcap-log output, limit less than "
@ -443,7 +446,7 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
}
}
}
pl->size_limit = limit * 1024 * 1024;
pl->size_limit = limit;
if (conf != NULL) {
const char *s_mode = NULL;

70
src/stream-tcp.c
Unescape Escape View File

@ -65,6 +65,7 @@
#include "util-host-os-info.h"
#include "util-privs.h"
#include "util-profiling.h"
#include "util-misc.h"
//#define DEBUG
@ -358,8 +359,16 @@ void StreamTcpInitConfig(char quiet)
SCLogInfo("stream \"prealloc_sessions\": %"PRIu32"", stream_config.prealloc_sessions);
}
if ((ConfGetInt("stream.memcap", &value)) == 1) {
stream_config.memcap = (uint64_t)value;
char *temp_stream_memcap_str;
if (ConfGet("stream.memcap", &temp_stream_memcap_str) == 1) {
long double res;
if (ParseSizeString(temp_stream_memcap_str, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing stream.memcap "
"from conf file - %s. Killing engine",
temp_stream_memcap_str);
exit(EXIT_FAILURE);
}
stream_config.memcap = res;
} else {
stream_config.memcap = STREAMTCP_DEFAULT_MEMCAP;
}
@ -407,17 +416,36 @@ void StreamTcpInitConfig(char quiet)
SCLogInfo("stream.\"inline\": %s", stream_inline ? "enabled" : "disabled");
}
if ((ConfGetInt("stream.reassembly.memcap", &value)) == 1) {
stream_config.reassembly_memcap = (uint64_t)value;
char *temp_stream_reassembly_memcap_str;
if (ConfGet("stream.reassembly.memcap", &temp_stream_reassembly_memcap_str) == 1) {
long double res;
if (ParseSizeString(temp_stream_reassembly_memcap_str, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing "
"stream.reassembly.memcap "
"from conf file - %s. Killing engine",
temp_stream_reassembly_memcap_str);
exit(EXIT_FAILURE);
}
stream_config.reassembly_memcap = res;
} else {
stream_config.reassembly_memcap = STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP;
}
if (!quiet) {
SCLogInfo("stream.reassembly \"memcap\": %"PRIu64"", stream_config.reassembly_memcap);
}
if ((ConfGetInt("stream.reassembly.depth", &value)) == 1) {
stream_config.reassembly_depth = (uint32_t)value;
char *temp_stream_reassembly_depth_str;
if (ConfGet("stream.reassembly.depth", &temp_stream_reassembly_depth_str) == 1) {
long double res;
if (ParseSizeString(temp_stream_reassembly_depth_str, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing "
"stream.reassembly.depth "
"from conf file - %s. Killing engine",
temp_stream_reassembly_depth_str);
exit(EXIT_FAILURE);
}
stream_config.reassembly_depth = res;
} else {
stream_config.reassembly_depth = 0;
}
@ -426,8 +454,19 @@ void StreamTcpInitConfig(char quiet)
SCLogInfo("stream.reassembly \"depth\": %"PRIu32"", stream_config.reassembly_depth);
}
if ((ConfGetInt("stream.reassembly.toserver_chunk_size", &value)) == 1) {
stream_config.reassembly_toserver_chunk_size = (uint16_t)value;
char *temp_stream_reassembly_toserver_chunk_size_str;
if (ConfGet("stream.reassembly.toserver_chunk_size",
&temp_stream_reassembly_toserver_chunk_size_str) == 1) {
long double res;
if (ParseSizeString(temp_stream_reassembly_toserver_chunk_size_str,
&res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing "
"stream.reassembly.toserver_chunk_size "
"from conf file - %s. Killing engine",
temp_stream_reassembly_toserver_chunk_size_str);
exit(EXIT_FAILURE);
}
stream_config.reassembly_toserver_chunk_size = res;
} else {
stream_config.reassembly_toserver_chunk_size =
STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE;
@ -435,8 +474,19 @@ void StreamTcpInitConfig(char quiet)
StreamMsgQueueSetMinChunkLen(FLOW_PKT_TOSERVER,
stream_config.reassembly_toserver_chunk_size);
if ((ConfGetInt("stream.reassembly.toclient_chunk_size", &value)) == 1) {
stream_config.reassembly_toclient_chunk_size = (uint16_t)value;
char *temp_stream_reassembly_toclient_chunk_size_str;
if (ConfGet("stream.reassembly.toclient_chunk_size",
&temp_stream_reassembly_toclient_chunk_size_str) == 1) {
long double res;
if (ParseSizeString(temp_stream_reassembly_toclient_chunk_size_str,
&res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing "
"stream.reassembly.toclient_chunk_size "
"from conf file - %s. Killing engine",
temp_stream_reassembly_toclient_chunk_size_str);
exit(EXIT_FAILURE);
}
stream_config.reassembly_toclient_chunk_size = res;
} else {
stream_config.reassembly_toclient_chunk_size =
STREAMTCP_DEFAULT_TOCLIENT_CHUNK_SIZE;

16
src/suricata.c
Unescape Escape View File

@ -48,6 +48,7 @@
#include "util-pidfile.h"
#include "util-ioctl.h"
#include "util-device.h"
#include "util-misc.h"
#include "detect-parse.h"
#include "detect-engine.h"
@ -1144,7 +1145,8 @@ int main(int argc, char **argv)
/* Pull the default packet size from the config, if not found fall
* back on a sane default. */
if (ConfGetInt("default-packet-size", &default_packet_size) != 1) {
char *temp_default_packet_size;
if ((ConfGet("default-packet-size", &temp_default_packet_size)) != 1) {
switch (run_mode) {
case RUNMODE_PCAP_DEV:
case RUNMODE_AFP_DEV:
@ -1157,7 +1159,17 @@ int main(int argc, char **argv)
default:
default_packet_size = DEFAULT_PACKET_SIZE;
}
} else {
long double res;
if (ParseSizeString(temp_default_packet_size, &res) < 0) {
SCLogError(SC_ERR_SIZE_PARSE, "Error parsing max-pending-packets "
"from conf file - %s. Killing engine",
temp_default_packet_size);
exit(EXIT_FAILURE);
}
default_packet_size = res;
}
SCLogDebug("Default packet size set to %"PRIiMAX, default_packet_size);
#ifdef NFQ
@ -1363,7 +1375,7 @@ int main(int argc, char **argv)
SCLogRegisterTests();
SMTPParserRegisterTests();
MagicRegisterTests();
UtilMiscRegisterTests();
if (list_unittests) {
UtListTests(regex_arg);
}

1
src/util-error.c
Unescape Escape View File

@ -210,6 +210,7 @@ const char * SCErrorToString(SCError err)
CASE_CODE (SC_ERR_AFP_READ);
CASE_CODE (SC_ERR_AFP_DISPATCH);
CASE_CODE (SC_ERR_CMD_LINE);
CASE_CODE (SC_ERR_SIZE_PARSE);
default:
return "UNKNOWN_ERROR";

1
src/util-error.h
Unescape Escape View File

@ -225,6 +225,7 @@ typedef enum {
SC_ERR_CMD_LINE,
SC_ERR_MAGIC_OPEN,
SC_ERR_MAGIC_LOAD,
SC_ERR_SIZE_PARSE,
} SCError;
const char *SCErrorToString(SCError);

1068
src/util-misc.c
View File

File diff suppressed because it is too large Load Diff

30
src/util-misc.h
Unescape Escape View File

@ -0,0 +1,30 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#ifndef __UTIL_MISC_H__
#define __UTIL_MISC_H__
int ParseSizeString(const char *, long double *);
void UtilMiscRegisterTests(void);
#endif /* __UTIL_MISC_H__ */

10
src/util-mpm.c
Unescape Escape View File

@ -541,7 +541,15 @@ MpmCudaConf *MpmCudaConfParse(void)
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for "
"cuda.mpm.packet_size_limit. Either NULL or empty");
} else {
profile->packet_size_limit = atoi(packet_size_limit);
long double res;
if (ParseSizeString(packet_size_limit, &res) < 0) {
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for "
"cuda.mpm.packet_size_limit - %s", packet_size_limit);
exit(EXIT_FAILURE);
}
profile->packet_size_limit = res;
if (profile->packet_size_limit <= 0) {
SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for "
"cuda.mpm.packet_size_limit - %s", packet_size_limit);

Write Preview
Loading…
Cancel
Save