WIP addressing handling. Big progress. Address groups for ipv4 more or less getting shape.

remotes/origin/master-1.0.x
Victor Julien 17 years ago
parent 3488cf1a93
commit fad31a43c2

@ -82,6 +82,18 @@ void DetectAddress2GroupFree(DetectAddress2Group *ag) {
}
}
void DetectAddress2GroupPrintList(void) {
DetectAddress2Group *cur;
printf("list:\n");
if (head != NULL) {
for (cur = head; cur != NULL; cur = cur->next) {
DetectAddress2DataPrint(cur->ad);
}
}
printf("endlist\n");
}
void DetectAddress2GroupCleanupList (void) {
if (head == NULL)
return;
@ -98,59 +110,63 @@ void DetectAddress2GroupCleanupList (void) {
head = NULL;
}
int DetectAddress2GroupSetup(char *s) {
DetectAddress2Group *ag = NULL, *cur = NULL, *next = NULL, *prev = NULL;
DetectAddress2Data *ad = NULL;
int DetectAddress2GroupInsert(DetectAddress2Data *new) {
DetectAddress2Group *ag = NULL,*cur = NULL;
int r = 0;
/* parse the address */
ad = DetectAddress2Parse(s);
if (ad == NULL) {
printf("DetectAddress2Parse error \"%s\"\n",s);
goto error;
}
//printf("DetectAddress2GroupInsert start inserting: ");
//DetectAddress2DataPrint(new);
//DetectAddress2GroupPrintList();
/* see if it already exists or overlaps with existing ag's */
if (head != NULL) {
//printf("DetectAddress2GroupInsert we have a head\n");
for (cur = head; cur != NULL; cur = cur->next) {
r = Address2Cmp(ad, cur->ad);
//printf("DetectAddress2GroupInsert list: ");
//DetectAddress2DataPrint(cur->ad);
r = Address2Cmp(new,cur->ad);
if (r == ADDRESS_ER) {
//printf("ADDRESS_ER\n");
goto error;
}
/* if so, handle that */
if (r == ADDRESS_EQ) {
//printf("ADDRESS_EQ\n");
/* exact overlap/match, we don't need to do a thing
*/
return 0;
} else if (r == ADDRESS_ES) {
/* we are within another ad, now it gets interesting
* we need to cut up the 'cur' ad.
*
* we can be like this:
* [[ababa]aaa]
* [aa[bbb]aaa]
* [aaa[ababa]]
*
* XXX */
printf ("overlapped!\n");
DetectAddress2DataPrint(ad);
DetectAddress2DataPrint(cur->ad);
} else if (r == ADDRESS_EB) {
/* we fully overlap and extend 'cur'
* we need to add the none overlapping part(s)
* and we need to see if we overlap other parts too
* XXX */
printf("overlapping!\n");
} else if (r == ADDRESS_GT) {
//printf("ADDRESS_GT\n");
/* only add it now if we are bigger than the last
* group. Otherwise we'll handle it later. */
if (cur->next == NULL) {
/* append */
ag = DetectAddress2GroupInit();
if (ag == NULL) {
goto error;
}
ag->ad = new;
/* put in the list */
ag->prev = cur;
cur->next = ag;
return 0;
}
} else if (r == ADDRESS_LT) {
//printf("ADDRESS_LT\n");
/* see if we need to insert the ag anywhere */
ag = DetectAddress2GroupInit();
if (ag == NULL) {
goto error;
}
ag->ad = ad;
ag->ad = new;
/* put in the list */
if (cur->prev != NULL)
cur->prev->next = ag;
ag->prev = cur->prev;
ag->next = cur;
cur->prev = ag;
@ -159,41 +175,71 @@ int DetectAddress2GroupSetup(char *s) {
if (head == cur) {
head = ag;
}
return 0;
} else if (r == ADDRESS_LE) {
printf("partially overlapping, partially smaller\n");
} else if (r == ADDRESS_GT) {
/* only add it now if we are bigger than the last
* group. Otherwise we'll handle it later. */
if (cur->next == NULL) {
/* append */
ag = DetectAddress2GroupInit();
if (ag == NULL) {
goto error;
}
ag->ad = ad;
/* put in the list */
ag->prev = cur;
cur->next = ag;
} else {
/* alright, those were the simple cases,
* lets handle the more complex ones now */
}
} else if (r == ADDRESS_ES) {
DetectAddress2Data *c = NULL;
r = Address2CutIPv4(cur->ad,new,&c);
//printf("ADDRESS_ES: r = %d: ", r);
//DetectAddress2DataPrint(cur->ad);
DetectAddress2GroupInsert(new);
if (c) DetectAddress2GroupInsert(c);
} else if (r == ADDRESS_EB) {
DetectAddress2Data *c = NULL;
r = Address2CutIPv4(cur->ad,new,&c);
//printf("ADDRESS_EB: r = %d: ", r);
//DetectAddress2DataPrint(cur->ad);
DetectAddress2GroupInsert(new);
if (c) DetectAddress2GroupInsert(c);
} else if (r == ADDRESS_LE) {
DetectAddress2Data *c = NULL;
r = Address2CutIPv4(cur->ad,new,&c);
//printf("ADDRESS_LE: r = %d: ", r);
//DetectAddress2DataPrint(cur->ad);
DetectAddress2GroupInsert(new);
if (c) DetectAddress2GroupInsert(c);
} else if (r == ADDRESS_GE) {
printf("partially overlapping, partially bigger\n");
DetectAddress2Data *c = NULL;
r = Address2CutIPv4(cur->ad,new,&c);
//printf("ADDRESS_GE: r = %d: ", r);
//DetectAddress2DataPrint(cur->ad);
DetectAddress2GroupInsert(new);
if (c) DetectAddress2GroupInsert(c);
}
}
} else {
//printf("DetectAddress2GroupInsert no head, empty list\n");
head = ag = DetectAddress2GroupInit();
if (ag == NULL) {
goto error;
}
ag->ad = ad;
ag->ad = new;
}
return 0;
error:
return -1;
}
int DetectAddress2GroupSetup(char *s) {
DetectAddress2Group *ag = NULL, *cur = NULL, *next = NULL, *prev = NULL;
DetectAddress2Data *ad = NULL;
int r = 0;
/* parse the address */
ad = DetectAddress2Parse(s);
if (ad == NULL) {
printf("DetectAddress2Parse error \"%s\"\n",s);
goto error;
}
//printf("\n");
DetectAddress2GroupInsert(ad);
//DetectAddress2GroupPrintList();
return 0;
error:
printf("DetectAddress2GroupSetup error\n");
@ -244,6 +290,115 @@ int Address2CmpIPv4(DetectAddress2Data *a, DetectAddress2Data *b) {
return ADDRESS_ER;
}
int Address2CutIPv42(DetectAddress2Data *a, DetectAddress2Data *b) {
u_int32_t a_ip1 = ntohl(a->ip[0]);
u_int32_t a_ip2 = ntohl(a->mask[0]);
u_int32_t b_ip1 = ntohl(b->ip[0]);
u_int32_t b_ip2 = ntohl(b->mask[0]);
int r = Address2Cmp(a,b);
if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
goto error;
}
/* we have 3 parts: [aaa[abab]bbb]
* part a: a_ip1 <-> b_ip1 - 1
* part b: b_ip1 <-> a_ip2
* part c: a_ip2 + 1 <-> b_ip2
*/
if (r == ADDRESS_LE) {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(b_ip1 - 1);
b->ip[0] = htonl(b_ip1);
b->mask[0] = htonl(b_ip2);
/* we have 3 parts: [bbb[baba]aaa]
* part a: b_ip1 <-> a_ip1 - 1
* part b: a_ip1 <-> b_ip2
* part c: b_ip2 + 1 <-> a_ip2
*/
} else if (r == ADDRESS_GE) {
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(a_ip1 - 1);
b->ip[0] = htonl(a_ip1);
b->mask[0] = htonl(a_ip2);
/* we have 2 or three parts:
*
* 2 part: [[abab]bbb] or [bbb[baba]]
* part a: a_ip1 <-> a_ip2
* part b: a_ip2 + 1 <-> b_ip2
*
* part a: b_ip1 <-> a_ip1 - 1
* part b: a_ip1 <-> a_ip2
*
* 3 part [bbb[aaa]bbb]
* part a: b_ip1 <-> a_ip1 - 1
* part b: a_ip1 <-> a_ip2
* part c: a_ip2 + 1 <-> b_ip2
*/
} else if (r == ADDRESS_ES) {
if (a_ip1 == b_ip1) {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(a_ip2);
b->ip[0] = htonl(a_ip2 + 1);
b->mask[0] = htonl(b_ip2);
} else if (a_ip2 == b_ip2) {
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(a_ip1 - 1);
b->ip[0] = htonl(a_ip1);
b->mask[0] = htonl(a_ip2);
} else {
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(a_ip1 - 1);
b->ip[0] = htonl(a_ip1);
b->mask[0] = htonl(b_ip2);
}
/* we have 2 or three parts:
*
* 2 part: [[baba]aaa] or [aaa[abab]]
* part a: b_ip1 <-> b_ip2
* part b: b_ip2 + 1 <-> a_ip2
*
* part a: a_ip1 <-> b_ip1 - 1
* part b: b_ip1 <-> b_ip2
*
* 3 part [aaa[bbb]aaa]
* part a: a_ip1 <-> b_ip2 - 1
* part b: b_ip1 <-> b_ip2
* part c: b_ip2 + 1 <-> a_ip2
*/
} else if (r == ADDRESS_EB) {
if (a_ip1 == b_ip1) {
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(b_ip2);
b->ip[0] = htonl(b_ip2 + 1);
b->mask[0] = htonl(a_ip2);
} else if (a_ip2 == b_ip2) {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(b_ip1 - 1);
b->ip[0] = htonl(b_ip1);
b->mask[0] = htonl(b_ip2);
} else {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(b_ip1 - 1);
b->ip[0] = htonl(b_ip1);
b->mask[0] = htonl(a_ip2);
}
}
return 0;
error:
return -1;
}
/* a = 1.2.3.4, b = 1.2.3.4-1.2.3.5
* must result in: a == 1.2.3.4, b == 1.2.3.5, c == NULL
*
@ -262,6 +417,9 @@ int Address2CutIPv4(DetectAddress2Data *a, DetectAddress2Data *b, DetectAddress2
u_int32_t b_ip1 = ntohl(b->ip[0]);
u_int32_t b_ip2 = ntohl(b->mask[0]);
/* default to NULL */
*c = NULL;
int r = Address2Cmp(a,b);
if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
goto error;
@ -313,12 +471,12 @@ int Address2CutIPv4(DetectAddress2Data *a, DetectAddress2Data *b, DetectAddress2
/* we have 2 or three parts:
*
* 2 part: [[abab]bbb] or [aaa[baba]]
* 2 part: [[abab]bbb] or [bbb[baba]]
* part a: a_ip1 <-> a_ip2
* part b: a_ip2 + 1 <-> b_ip2
*
* part a: a_ip1 <-> b_ip1 - 1
* part b: b_ip1 <-> b_ip2
* part a: b_ip1 <-> a_ip1 - 1
* part b: a_ip1 <-> a_ip2
*
* 3 part [bbb[aaa]bbb]
* part a: b_ip1 <-> a_ip1 - 1
@ -333,11 +491,11 @@ int Address2CutIPv4(DetectAddress2Data *a, DetectAddress2Data *b, DetectAddress2
b->ip[0] = htonl(a_ip2 + 1);
b->mask[0] = htonl(b_ip2);
} else if (a_ip2 == b_ip2) {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(b_ip1 - 1);
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(a_ip1 - 1);
b->ip[0] = htonl(b_ip1);
b->mask[0] = htonl(b_ip2);
b->ip[0] = htonl(a_ip1);
b->mask[0] = htonl(a_ip2);
} else {
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(a_ip1 - 1);
@ -357,25 +515,25 @@ int Address2CutIPv4(DetectAddress2Data *a, DetectAddress2Data *b, DetectAddress2
}
/* we have 2 or three parts:
*
* 2 part: [[baba]aaa] or [bbb[abab]]
* part a: a_ip1 <-> a_ip2
* part b: a_ip2 + 1 <-> b_ip2
* 2 part: [[baba]aaa] or [aaa[abab]]
* part a: b_ip1 <-> b_ip2
* part b: b_ip2 + 1 <-> a_ip2
*
* part a: a_ip1 <-> b_ip1 - 1
* part b: b_ip1 <-> b_ip2
*
* 3 part [aaa[bbb]aaa]
* part a: b_ip1 <-> a_ip1 - 1
* part b: a_ip1 <-> a_ip2
* part c: a_ip2 + 1 <-> b_ip2
* part a: a_ip1 <-> b_ip2 - 1
* part b: b_ip1 <-> b_ip2
* part c: b_ip2 + 1 <-> a_ip2
*/
} else if (r == ADDRESS_EB) {
if (a_ip1 == b_ip1) {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(a_ip2);
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(b_ip2);
b->ip[0] = htonl(a_ip2 + 1);
b->mask[0] = htonl(b_ip2);
b->ip[0] = htonl(b_ip2 + 1);
b->mask[0] = htonl(a_ip2);
} else if (a_ip2 == b_ip2) {
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(b_ip1 - 1);
@ -383,11 +541,11 @@ int Address2CutIPv4(DetectAddress2Data *a, DetectAddress2Data *b, DetectAddress2
b->ip[0] = htonl(b_ip1);
b->mask[0] = htonl(b_ip2);
} else {
a->ip[0] = htonl(b_ip1);
a->mask[0] = htonl(a_ip1 - 1);
a->ip[0] = htonl(a_ip1);
a->mask[0] = htonl(b_ip1 - 1);
b->ip[0] = htonl(a_ip1);
b->mask[0] = htonl(a_ip2);
b->ip[0] = htonl(b_ip1);
b->mask[0] = htonl(b_ip2);
DetectAddress2Data *tmp_c;
tmp_c = malloc(sizeof(DetectAddress2Data));
@ -395,11 +553,10 @@ int Address2CutIPv4(DetectAddress2Data *a, DetectAddress2Data *b, DetectAddress2
goto error;
}
tmp_c->family = AF_INET;
tmp_c->ip[0] = htonl(a_ip2 + 1);
tmp_c->mask[0] = htonl(b_ip2);
tmp_c->ip[0] = htonl(b_ip2 + 1);
tmp_c->mask[0] = htonl(a_ip2);
*c = tmp_c;
}
}
return 0;
@ -2057,6 +2214,108 @@ int Address2TestAddress2GroupSetup10 (void) {
return result;
}
int Address2TestAddress2GroupSetup11 (void) {
int result = 0;
int r = DetectAddress2GroupSetup("10.10.10.10-10.10.11.1");
if (r == 0) {
r = DetectAddress2GroupSetup("10.10.10.0/24");
if (r == 0) {
r = DetectAddress2GroupSetup("0.0.0.0/0");
if (r == 0) {
DetectAddress2Group *one = head, *two = one->next,
*three = two->next, *four = three->next,
*five = four->next;
/* result should be:
* 0.0.0.0/10.10.9.255
* 10.10.10.0/10.10.10.9
* 10.10.10.10/10.10.10.255
* 10.10.11.0/10.10.11.1
* 10.10.11.2/255.255.255.255
*/
if (one->ad->ip[0] == 0x00000000 && one->ad->mask[0] == 0xFF090A0A &&
two->ad->ip[0] == 0x000A0A0A && two->ad->mask[0] == 0x090A0A0A &&
three->ad->ip[0] == 0x0A0A0A0A && three->ad->mask[0] == 0xFF0A0A0A &&
four->ad->ip[0] == 0x000B0A0A && four->ad->mask[0] == 0x010B0A0A &&
five->ad->ip[0] == 0x020B0A0A && five->ad->mask[0] == 0xFFFFFFFF) {
result = 1;
}
}
}
}
DetectAddress2GroupCleanupList();
return result;
}
int Address2TestAddress2GroupSetup12 (void) {
int result = 0;
int r = DetectAddress2GroupSetup("10.10.10.10-10.10.11.1");
if (r == 0) {
r = DetectAddress2GroupSetup("0.0.0.0/0");
if (r == 0) {
r = DetectAddress2GroupSetup("10.10.10.0/24");
if (r == 0) {
DetectAddress2Group *one = head, *two = one->next,
*three = two->next, *four = three->next,
*five = four->next;
/* result should be:
* 0.0.0.0/10.10.9.255
* 10.10.10.0/10.10.10.9
* 10.10.10.10/10.10.10.255
* 10.10.11.0/10.10.11.1
* 10.10.11.2/255.255.255.255
*/
if (one->ad->ip[0] == 0x00000000 && one->ad->mask[0] == 0xFF090A0A &&
two->ad->ip[0] == 0x000A0A0A && two->ad->mask[0] == 0x090A0A0A &&
three->ad->ip[0] == 0x0A0A0A0A && three->ad->mask[0] == 0xFF0A0A0A &&
four->ad->ip[0] == 0x000B0A0A && four->ad->mask[0] == 0x010B0A0A &&
five->ad->ip[0] == 0x020B0A0A && five->ad->mask[0] == 0xFFFFFFFF) {
result = 1;
}
}
}
}
DetectAddress2GroupCleanupList();
return result;
}
int Address2TestAddress2GroupSetup13 (void) {
int result = 0;
int r = DetectAddress2GroupSetup("0.0.0.0/0");
if (r == 0) {
r = DetectAddress2GroupSetup("10.10.10.10-10.10.11.1");
if (r == 0) {
r = DetectAddress2GroupSetup("10.10.10.0/24");
if (r == 0) {
DetectAddress2Group *one = head, *two = one->next,
*three = two->next, *four = three->next,
*five = four->next;
/* result should be:
* 0.0.0.0/10.10.9.255
* 10.10.10.0/10.10.10.9
* 10.10.10.10/10.10.10.255
* 10.10.11.0/10.10.11.1
* 10.10.11.2/255.255.255.255
*/
if (one->ad->ip[0] == 0x00000000 && one->ad->mask[0] == 0xFF090A0A &&
two->ad->ip[0] == 0x000A0A0A && two->ad->mask[0] == 0x090A0A0A &&
three->ad->ip[0] == 0x0A0A0A0A && three->ad->mask[0] == 0xFF0A0A0A &&
four->ad->ip[0] == 0x000B0A0A && four->ad->mask[0] == 0x010B0A0A &&
five->ad->ip[0] == 0x020B0A0A && five->ad->mask[0] == 0xFFFFFFFF) {
result = 1;
}
}
}
}
DetectAddress2GroupCleanupList();
return result;
}
int Address2TestCutIPv401(void) {
DetectAddress2Data *a;
DetectAddress2Data *b;
@ -2213,6 +2472,122 @@ error:
return 0;
}
int Address2TestCutIPv407(void) {
DetectAddress2Data *a;
DetectAddress2Data *b;
DetectAddress2Data *c;
a = DetectAddress2Parse("1.2.3.0-1.2.3.6");
b = DetectAddress2Parse("1.2.3.0-1.2.3.9");
if (Address2CutIPv4(a,b,&c) == -1) {
goto error;
}
if (c != NULL) {
goto error;
}
if (a->ip[0] != 0x00030201 && a->mask[0] != 0x06030201) {
goto error;
}
if (b->ip[0] != 0x07030201 && b->mask[0] != 0x09030201) {
goto error;
}
return 1;
error:
return 0;
}
int Address2TestCutIPv408(void) {
DetectAddress2Data *a;
DetectAddress2Data *b;
DetectAddress2Data *c;
a = DetectAddress2Parse("1.2.3.3-1.2.3.9");
b = DetectAddress2Parse("1.2.3.0-1.2.3.9");
if (Address2CutIPv4(a,b,&c) == -1) {
goto error;
}
if (c != NULL) {
goto error;
}
if (a->ip[0] != 0x00030201 && a->mask[0] != 0x02030201) {
DetectAddress2DataPrint(a);
DetectAddress2DataPrint(b);
goto error;
}
if (b->ip[0] != 0x03030201 && b->mask[0] != 0x09030201) {
DetectAddress2DataPrint(a);
DetectAddress2DataPrint(b);
goto error;
}
return 1;
error:
return 0;
}
int Address2TestCutIPv409(void) {
DetectAddress2Data *a;
DetectAddress2Data *b;
DetectAddress2Data *c;
a = DetectAddress2Parse("1.2.3.0-1.2.3.9");
b = DetectAddress2Parse("1.2.3.0-1.2.3.6");
if (Address2CutIPv4(a,b,&c) == -1) {
goto error;
}
if (c != NULL) {
goto error;
}
if (a->ip[0] != 0x00030201 && a->mask[0] != 0x06030201) {
goto error;
}
if (b->ip[0] != 0x07030201 && b->mask[0] != 0x09030201) {
goto error;
}
return 1;
error:
return 0;
}
int Address2TestCutIPv410(void) {
DetectAddress2Data *a;
DetectAddress2Data *b;
DetectAddress2Data *c;
a = DetectAddress2Parse("1.2.3.0-1.2.3.9");
b = DetectAddress2Parse("1.2.3.3-1.2.3.9");
if (Address2CutIPv4(a,b,&c) == -1) {
goto error;
}
if (c != NULL) {
goto error;
}
if (a->ip[0] != 0x00030201 && a->mask[0] != 0x02030201) {
DetectAddress2DataPrint(a);
DetectAddress2DataPrint(b);
goto error;
}
if (b->ip[0] != 0x03030201 && b->mask[0] != 0x09030201) {
DetectAddress2DataPrint(a);
DetectAddress2DataPrint(b);
goto error;
}
return 1;
error:
return 0;
}
void DetectAddress2Tests(void) {
UtRegisterTest("Address2TestParse01", Address2TestParse01, 1);
UtRegisterTest("Address2TestParse02", Address2TestParse02, 1);
@ -2297,13 +2672,21 @@ void DetectAddress2Tests(void) {
UtRegisterTest("Address2TestAddress2GroupSetup08", Address2TestAddress2GroupSetup08, 1);
UtRegisterTest("Address2TestAddress2GroupSetup09", Address2TestAddress2GroupSetup09, 1);
UtRegisterTest("Address2TestAddress2GroupSetup10", Address2TestAddress2GroupSetup10, 1);
UtRegisterTest("Address2TestAddress2GroupSetup11", Address2TestAddress2GroupSetup11, 1);
UtRegisterTest("Address2TestAddress2GroupSetup12", Address2TestAddress2GroupSetup12, 1);
UtRegisterTest("Address2TestAddress2GroupSetup13", Address2TestAddress2GroupSetup13, 1);
/*
UtRegisterTest("Address2TestCutIPv401", Address2TestCutIPv401, 1);
UtRegisterTest("Address2TestCutIPv402", Address2TestCutIPv402, 1);
UtRegisterTest("Address2TestCutIPv403", Address2TestCutIPv403, 1);
UtRegisterTest("Address2TestCutIPv404", Address2TestCutIPv404, 1);
UtRegisterTest("Address2TestCutIPv405", Address2TestCutIPv405, 1);
UtRegisterTest("Address2TestCutIPv406", Address2TestCutIPv406, 1);
UtRegisterTest("Address2TestCutIPv407", Address2TestCutIPv407, 1);
UtRegisterTest("Address2TestCutIPv408", Address2TestCutIPv408, 1);
UtRegisterTest("Address2TestCutIPv409", Address2TestCutIPv409, 1);
UtRegisterTest("Address2TestCutIPv410", Address2TestCutIPv410, 1);
*/
}

Loading…
Cancel
Save