diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c index d8c0a536b8..c066dfae73 100644 --- a/src/detect-bytejump.c +++ b/src/detect-bytejump.c @@ -524,13 +524,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) goto error; } cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; - } else { - pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_PCRE); - if (pm == NULL) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "relative bytejump match " - "needs a previous content option"); - goto error; - } + } else if ((pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_PCRE)) != NULL) { DetectPcreData *pe = NULL; pe = (DetectPcreData *) pm->ctx; if (pe == NULL) { @@ -538,6 +532,20 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) goto error; } pe->flags |= DETECT_PCRE_RELATIVE; + } else if ((pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_BYTEJUMP)) != + NULL) + { + DetectBytejumpData *data = NULL; + data = (DetectBytejumpData *)pm->ctx; + if (data == NULL) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!"); + goto error; + } + data->flags |= DETECT_BYTEJUMP_RELATIVE; + } else { + SCLogError(SC_ERR_INVALID_SIGNATURE, "relative bytejump match " + "needs a previous content option"); + goto error; } } @@ -759,6 +767,38 @@ int DetectByteJumpTestPacket01 (void) { end: return result; } + +/** + * \test DetectByteJumpTestPacket02 is a test to check matches of + * byte_jump and byte_jump relative works if the previous keyword is byte_jump + * (bug 165) + */ +int DetectByteJumpTestPacket02 (void) { + int result = 0; + uint8_t buf[] = { 0x00, 0x00, 0x00, 0x77, 0xff, 0x53, + 0x4d, 0x42, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, + 0x01, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, + 0x92, 0xa4, 0x01, 0x08, 0x17, 0x5c, 0x0e, 0xff, + 0x00, 0x00, 0x00, 0x01, 0x40, 0x48, 0x00, 0x00, + 0x00, 0xff }; + uint16_t buflen = sizeof(buf); + Packet *p; + p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP); + + if (p == NULL) + goto end; + + char sig[] = "alert tcp any any -> any any (msg:\"byte_test with byte_test" + " + relative\"; byte_jump:1,13; byte_jump:4,0,relative; " + "content:\"|48 00 00|\"; within:3; sid:144; rev:1;)"; + + result = UTHPacketMatchSig(p, sig); + + UTHFreePacket(p); +end: + return result; +} #endif /* UNITTESTS */ @@ -776,6 +816,7 @@ void DetectBytejumpRegisterTests(void) { UtRegisterTest("DetectBytejumpTestParse07", DetectBytejumpTestParse07, 1); UtRegisterTest("DetectBytejumpTestParse08", DetectBytejumpTestParse08, 1); UtRegisterTest("DetectByteJumpTestPacket01", DetectByteJumpTestPacket01, 1); + UtRegisterTest("DetectByteJumpTestPacket02", DetectByteJumpTestPacket02, 1); #endif /* UNITTESTS */ } diff --git a/src/detect-within.c b/src/detect-within.c index 737f1474f1..baf3b248c9 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -31,6 +31,7 @@ #include "detect-parse.h" #include "detect-content.h" #include "detect-uricontent.h" +#include "detect-bytejump.h" #include "flow-var.h" @@ -161,22 +162,28 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi goto error; } cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; - } else { - pm = SigMatchGetLastSM(s->pmatch_tail->prev, DETECT_PCRE); - if (pm != NULL) { - DetectPcreData *pe = NULL; - pe = (DetectPcreData *)pm->ctx; - if (pe == NULL) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-" - "previous keyword!"); - goto error; - } - pe->flags |= DETECT_PCRE_RELATIVE; - } else { - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two" - " preceeding content or uricontent options"); + } else if ((pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_PCRE)) != NULL) { + DetectPcreData *pe = NULL; + pe = (DetectPcreData *) pm->ctx; + if (pe == NULL) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!"); + goto error; + } + pe->flags |= DETECT_PCRE_RELATIVE; + } else if ((pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_BYTEJUMP)) + != NULL) + { + DetectBytejumpData *data = NULL; + data = (DetectBytejumpData *) pm->ctx; + if (data == NULL) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!"); goto error; } + data->flags |= DETECT_BYTEJUMP_RELATIVE; + } else { + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two" + " preceeding content or uricontent options"); + goto error; } break;