|
|
|
|
@ -52,7 +52,6 @@
|
|
|
|
|
#include "util-unittest.h"
|
|
|
|
|
#include "util-unittest-helper.h"
|
|
|
|
|
#include "util-debug.h"
|
|
|
|
|
#include "util-memcmp.h"
|
|
|
|
|
#include "string.h"
|
|
|
|
|
#include "detect-parse.h"
|
|
|
|
|
#include "detect-engine-iponly.h"
|
|
|
|
|
@ -1080,6 +1079,10 @@ static void SigBuildAddressMatchArray(Signature *s) {
|
|
|
|
|
* \retval 1 valid
|
|
|
|
|
*/
|
|
|
|
|
int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
uint32_t u = 0;
|
|
|
|
|
uint32_t sig_flags = 0;
|
|
|
|
|
SigMatch *sm, *pm;
|
|
|
|
|
|
|
|
|
|
SCEnter();
|
|
|
|
|
|
|
|
|
|
if ((s->flags & SIG_FLAG_REQUIRE_PACKET) &&
|
|
|
|
|
@ -1089,7 +1092,6 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
SCReturnInt(0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SigMatch *sm;
|
|
|
|
|
for (sm = s->sm_lists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) {
|
|
|
|
|
if (sm->type == DETECT_FLOW) {
|
|
|
|
|
DetectFlowData *fd = (DetectFlowData *)sm->ctx;
|
|
|
|
|
@ -1123,7 +1125,6 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
uint32_t sig_flags = 0;
|
|
|
|
|
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL ||
|
|
|
|
|
s->sm_lists[DETECT_SM_LIST_HRUDMATCH] != NULL ||
|
|
|
|
|
s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL ||
|
|
|
|
|
@ -1162,7 +1163,7 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL) {
|
|
|
|
|
for (SigMatch *sm = s->sm_lists[DETECT_SM_LIST_HHHDMATCH];
|
|
|
|
|
for (sm = s->sm_lists[DETECT_SM_LIST_HHHDMATCH];
|
|
|
|
|
sm != NULL; sm = sm->next) {
|
|
|
|
|
if (sm->type == DETECT_CONTENT) {
|
|
|
|
|
DetectContentData *cd = (DetectContentData *)sm->ctx;
|
|
|
|
|
@ -1173,7 +1174,6 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
"is actually lowercase. So having a "
|
|
|
|
|
"nocase is redundant.");
|
|
|
|
|
} else {
|
|
|
|
|
uint8_t u = 0;
|
|
|
|
|
for (u = 0; u < cd->content_len; u++) {
|
|
|
|
|
if (isupper(cd->content[u]))
|
|
|
|
|
break;
|
|
|
|
|
@ -1186,13 +1186,13 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
"lowercase pattern.");
|
|
|
|
|
SCReturnInt(0);
|
|
|
|
|
}
|
|
|
|
|
} /* else */
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (s->flags & SIG_FLAG_REQUIRE_PACKET) {
|
|
|
|
|
SigMatch *pm = SigMatchGetLastSMFromLists(s, 24,
|
|
|
|
|
pm = SigMatchGetLastSMFromLists(s, 24,
|
|
|
|
|
DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH],
|
|
|
|
|
DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH],
|
|
|
|
|
DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH],
|
|
|
|
|
@ -1240,7 +1240,7 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
if (s->proto.proto[IPPROTO_TCP / 8] & (1 << (IPPROTO_TCP % 8))) {
|
|
|
|
|
if (!(s->flags & (SIG_FLAG_REQUIRE_PACKET | SIG_FLAG_REQUIRE_STREAM))) {
|
|
|
|
|
s->flags |= SIG_FLAG_REQUIRE_STREAM;
|
|
|
|
|
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
|
|
|
|
|
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
|
|
|
|
|
while (sm != NULL) {
|
|
|
|
|
if (sm->type == DETECT_CONTENT &&
|
|
|
|
|
(((DetectContentData *)(sm->ctx))->flags &
|
|
|
|
|
@ -1257,7 +1257,6 @@ int SigValidate(DetectEngineCtx *de_ctx, Signature *s) {
|
|
|
|
|
int i;
|
|
|
|
|
for (i = 0; i < DETECT_SM_LIST_MAX; i++) {
|
|
|
|
|
if (s->sm_lists[i] != NULL) {
|
|
|
|
|
SigMatch *sm;
|
|
|
|
|
for (sm = s->sm_lists[i]; sm != NULL; sm = sm->next) {
|
|
|
|
|
BUG_ON(sm == sm->prev);
|
|
|
|
|
BUG_ON(sm == sm->next);
|
|
|
|
|
|