|
|
|
@ -267,26 +267,33 @@ int SigParseAddress(Signature *s, const char *addrstr, char flag) {
|
|
|
|
|
if (strcasecmp(addrstr, "any") == 0)
|
|
|
|
|
s->flags |= SIG_FLAG_SRC_ANY;
|
|
|
|
|
|
|
|
|
|
if (DetectAddressGroupParse(&s->src,addr) < 0) {
|
|
|
|
|
if (DetectAddressGroupParse(&s->src, addr) < 0)
|
|
|
|
|
goto error;
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
if (strcasecmp(addrstr, "any") == 0)
|
|
|
|
|
s->flags |= SIG_FLAG_DST_ANY;
|
|
|
|
|
|
|
|
|
|
if (DetectAddressGroupParse(&s->dst,addr) < 0) {
|
|
|
|
|
if (DetectAddressGroupParse(&s->dst, addr) < 0)
|
|
|
|
|
goto error;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
error:
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* http://www.iana.org/assignments/protocol-numbers
|
|
|
|
|
/**
|
|
|
|
|
* \brief Parses the protocol supplied by the Signature.
|
|
|
|
|
*
|
|
|
|
|
* http://www.iana.org/assignments/protocol-numbers
|
|
|
|
|
*
|
|
|
|
|
* \param s Pointer to the Signature instance to which the parsed
|
|
|
|
|
* protocol has to be added.
|
|
|
|
|
* \param protostr Pointer to the character string containing the protocol name.
|
|
|
|
|
*
|
|
|
|
|
* \retval 0 On successfully parsing the protocl sent as the argument.
|
|
|
|
|
* \retval -1 On failure
|
|
|
|
|
*/
|
|
|
|
|
int SigParseProto(Signature *s, const char *protostr) {
|
|
|
|
|
int r = DetectProtoParse(&s->proto, (char *)protostr);
|
|
|
|
@ -349,6 +356,17 @@ int SigParsePort(Signature *s, const char *portstr, char flag) {
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \brief Parses the action that has been used by the Signature and allots it
|
|
|
|
|
* to its Signatue instance.
|
|
|
|
|
*
|
|
|
|
|
* \param s Pointer to the Signatue instance to which the action belongs.
|
|
|
|
|
* \param action Pointer to the action string used by the Signature.
|
|
|
|
|
*
|
|
|
|
|
* \retval 0 On successfully parsing the action string and adding it to the
|
|
|
|
|
* Signature.
|
|
|
|
|
* \retval -1 On failure.
|
|
|
|
|
*/
|
|
|
|
|
int SigParseAction(Signature *s, const char *action) {
|
|
|
|
|
if (strcasecmp(action, "alert") == 0) {
|
|
|
|
|
s->action = ACTION_ALERT;
|
|
|
|
@ -409,9 +427,8 @@ int SigParseBasics(Signature *s, char *sigstr, char ***result) {
|
|
|
|
|
if (SigParseAddress(s, arr[CONFIG_SRC], 0) < 0)
|
|
|
|
|
goto error;
|
|
|
|
|
|
|
|
|
|
/* For "ip" we parse the ports as well, even though they will
|
|
|
|
|
be just "any". We do this for later sgh building for the
|
|
|
|
|
tcp and udp protocols. */
|
|
|
|
|
/* For "ip" we parse the ports as well, even though they will be just "any".
|
|
|
|
|
* We do this for later sgh building for the tcp and udp protocols. */
|
|
|
|
|
if (strcasecmp(arr[CONFIG_PROTO],"tcp") == 0 ||
|
|
|
|
|
strcasecmp(arr[CONFIG_PROTO],"udp") == 0 ||
|
|
|
|
|
strcasecmp(arr[CONFIG_PROTO],"ip") == 0) {
|
|
|
|
@ -456,7 +473,7 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* cleanup */
|
|
|
|
|
if (basics) {
|
|
|
|
|
if (basics != NULL) {
|
|
|
|
|
int i = 0;
|
|
|
|
|
while (basics[i] != NULL) {
|
|
|
|
|
free(basics[i]);
|
|
|
|
@ -464,6 +481,7 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr) {
|
|
|
|
|
}
|
|
|
|
|
free(basics);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -495,6 +513,15 @@ void SigFree(Signature *s) {
|
|
|
|
|
free(s);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \brief Parses a signature and adds it to the Detection Engine Context
|
|
|
|
|
*
|
|
|
|
|
* \param de_ctx Pointer to the Detection Engine Context
|
|
|
|
|
* \param sigstr Pointer to a character string containing the signature to be
|
|
|
|
|
* parsed
|
|
|
|
|
*
|
|
|
|
|
* \retval Pointer to the Signature instance on success; NULL on failure
|
|
|
|
|
*/
|
|
|
|
|
Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
|
|
|
|
|
Signature *sig = SigAlloc();
|
|
|
|
|
if (sig == NULL)
|
|
|
|
|