aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix "ip" rules not ending up in the tcp and udp sig group heads correctly.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 17 years ago
parent d883a993f7
commit 733c3bcb8c
5 changed files with 56 additions and 46 deletions
Show Stats Download Patch File Download Diff File

3
src/detect-engine-siggroup.c
Unescape Escape View File

@ -720,6 +720,9 @@ int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint3
return 0;
for (sig = 0; sig < sgh->sig_cnt; sig++) {
if (sgh->sig_array == NULL)
return 0;
if (!(sgh->sig_array[(sig/8)] & (1<<(sig%8))))
continue;

2
src/detect-engine-siggroup.h
Unescape Escape View File

@ -42,5 +42,7 @@ void SigGroupHeadSetSigCnt(SigGroupHead *sgh, uint32_t max_idx);
int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx);
void SigGroupHeadFreeSigArrays(DetectEngineCtx *de_ctx);
int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid);
#endif /* __DETECT_ENGINE_SIGGROUP_H__ */

10
src/detect-parse.c
Unescape Escape View File

@ -330,8 +330,9 @@ int SigParsePort(Signature *s, const char *portstr, char flag) {
}
if (flag == 0) {
if (strcasecmp(port,"any") == 0)
if (strcasecmp(port,"any") == 0) {
s->flags |= SIG_FLAG_SP_ANY;
}
r = DetectPortParse(&s->sp,(char *)port);
} else if (flag == 1) {
@ -410,8 +411,13 @@ int SigParseBasics(Signature *s, char *sigstr, char ***result) {
/* Parse Address & Ports */
if (SigParseAddress(s, arr[CONFIG_SRC], 0) < 0)
goto error;
/* For "ip" we parse the ports as well, even though they will
be just "any". We do this for later sgh building for the
tcp and udp protocols. */
if (strcasecmp(arr[CONFIG_PROTO],"tcp") == 0 ||
strcasecmp(arr[CONFIG_PROTO],"udp") == 0) {
strcasecmp(arr[CONFIG_PROTO],"udp") == 0 ||
strcasecmp(arr[CONFIG_PROTO],"ip") == 0) {
if (SigParsePort(s, arr[CONFIG_SP], 0) < 0)
goto error;
if (SigParsePort(s, arr[CONFIG_DP], 1) < 0)

64
src/detect.c
Unescape Escape View File

@ -60,6 +60,9 @@ SigMatch *SigMatchAlloc(void);
void SigMatchFree(SigMatch *sm);
void DetectExitPrintStats(ThreadVars *tv, void *data);
void DbgPrintSigs(DetectEngineCtx *, SigGroupHead *);
void DbgPrintSigs2(DetectEngineCtx *, SigGroupHead *);
/* tm module api functions */
int Detect(ThreadVars *, Packet *, void *, PacketQueue *);
int DetectThreadInit(ThreadVars *, void *, void **);
@ -173,6 +176,9 @@ int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file) {
sig = SigInit(de_ctx, line);
if (sig != NULL) {
#ifdef DEBUG
printf("Sig %"PRIu32" loaded\n", sig->id);
#endif
if (de_ctx->sig_list == NULL) {
de_ctx->sig_list = sig;
} else {
@ -696,6 +702,8 @@ static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, Det
DetectAddressGroup *gr = NULL, *lookup_gr = NULL, *head = NULL;
int proto;
//printf("DetectEngineLookupBuildSourceAddressList: sig %"PRIu32", family %"PRIi32"\n", s->id, family);
if (family == AF_INET) {
head = s->src.ipv4_head;
} else if (family == AF_INET6) {
@ -815,6 +823,8 @@ static int DetectEngineLookupFlowAddSig(DetectEngineCtx *de_ctx, DetectEngineLoo
else
dsize ? g_detectengine_any_big_toserver++ : g_detectengine_any_small_toserver++;
} else {
//printf("DetectEngineLookupFlowAddSig: s->id %"PRIu32"\n", s->id);
/* both */
DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[0], s, family);
DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[1], s, family);
@ -972,7 +982,7 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
unique_groups++;
//printf(" 1 -= Address "); DetectAddressDataPrint(gr->ad); printf("\n");
//printf(" : "); DbgPrintSigs2(gr->sh);
//printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
groups++;
@ -1135,9 +1145,11 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
#endif
}
#ifdef DEBUG
for (gr = newhead->ipv4_head; gr != NULL; gr = gr->next) {
//printf(" 4 -= R Address "); DetectAddressDataPrint(gr->ad); printf(" : "); DbgPrintSigs2(gr->sh);
printf(" 4 -= R Address "); DetectAddressDataPrint(gr->ad); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
}
#endif
return 0;
error:
@ -1184,9 +1196,9 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete
unique_groups++;
groups++;
//printf(":-:1:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 ", cost %" PRIu32 ", maxlen %" PRIu32 ") ", gr->cnt, gr->sh->cost, gr->sh->mpm_content_maxlen);DbgSghContainsSig(de_ctx,gr->sh,2001330);
#ifdef DEBUG
printf(" -= 1:Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
#endif
/* alloc a copy */
DetectPort *newtmp = DetectPortCopySingle(de_ctx,gr);
if (newtmp == NULL) {
@ -1284,11 +1296,12 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete
DetectPortInsert(de_ctx,newhead,joingr);
}
#ifdef DEBUG
for (gr = *newhead; gr != NULL; gr = gr->next) {
//printf(":-:9:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 ", cost %" PRIu32 ") ", gr->cnt, gr->sh->cost); DbgSghContainsSig(de_ctx,gr->sh,2001330);
//printf(" -= Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(gr->sh);
//printf(":-:9:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 "", gr->cnt); DbgSghContainsSig(de_ctx,gr->sh,489);
printf(" -= 9:Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
}
#endif
return 0;
error:
return -1;
@ -1325,6 +1338,7 @@ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) {
/* now for every rule add the source group to our temp lists */
for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) {
//printf("SigAddressPrepareStage2 tmp_s->id %u\n", tmp_s->id);
if (!(tmp_s->flags & SIG_FLAG_IPONLY)) {
DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET);
DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET6);
@ -2154,7 +2168,7 @@ void DbgSghContainsSig(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid)
/* shortcut for debugging. If enabled Stage5 will
* print sigid's for all groups */
//#define PRINTSIGS
#define PRINTSIGS
/* just printing */
int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
@ -2211,13 +2225,6 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
printf("%" PRIu32 " ", s->id);
}
#endif
printf(" - ");
for (i = 0; i < dp->sh->sig_cnt; i++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[i]];
if (s->id == 2008335 || s->id == 2001329 || s->id == 2001330 ||
s->id == 2001331 || s->id == 2003321 || s->id == 2003322)
printf("%" PRIu32 " ", s->id);
}
printf("\n");
}
}
@ -2254,8 +2261,8 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
}
}
}
#if 0
for (global_src_gr = de_ctx->src_gh[proto]->ipv6_head; global_src_gr != NULL;
//#if 0
for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv6_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next)
{
printf("- "); DetectAddressDataPrint(global_src_gr->ad);
@ -2329,7 +2336,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
}
}
for (global_src_gr = de_ctx->src_gh[proto]->any_head; global_src_gr != NULL;
for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->any_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next)
{
printf("- "); DetectAddressDataPrint(global_src_gr->ad);
@ -2433,7 +2440,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
}
}
}
#endif
//#endif
}
}
}
@ -2441,17 +2448,17 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
return 0;
}
/** \brief Convert the signature list into the runtime
* match structure. */
int SigGroupBuild (DetectEngineCtx *de_ctx) {
SigAddressPrepareStage1(de_ctx);
SigAddressPrepareStage2(de_ctx);
SigAddressPrepareStage3(de_ctx);
//abort();
// SigAddressPrepareStage5();
// SigAddressPrepareStage5(de_ctx);
DbgPrintScanSearchStats();
// DetectAddressGroupPrintMemory();
// DetectSigGroupPrintMemory();
// DetectPortPrintMemory();
//SigGroupGetSrcAddress(NULL);
return 0;
}
@ -2460,17 +2467,6 @@ int SigGroupCleanup (DetectEngineCtx *de_ctx) {
return 0;
}
int SigGroupGetSrcAddress(DetectAddressGroupsHead *src) {
uint32_t ip = 0x04030201; /* 1.2.3.4 */
printf("ip & 0x000000ff %8u 0x%08X >> 0 %" PRIu32 "\n", ip & 0x000000ff, ip & 0x000000ff, (ip & 0x000000ff) >> 0);
printf("ip & 0x0000ff00 %8u 0x%08X >> 8 %" PRIu32 "\n", ip & 0x0000ff00, ip & 0x0000ff00, (ip & 0x0000ff00) >> 8);
printf("ip & 0x00ff0000 %8u 0x%08X >> 16 %" PRIu32 "\n", ip & 0x00ff0000, ip & 0x00ff0000, (ip & 0x00ff0000) >> 16);
printf("ip & 0xff000000 %8u 0x%08X >> 24 %" PRIu32 "\n", ip & 0xff000000, ip & 0xff000000, (ip & 0xff000000) >> 24);
return 0;
}
void SigTableSetup(void) {
memset(sigmatch_table, 0, sizeof(sigmatch_table));

23
src/util-mpm-b2g.c
Unescape Escape View File

@ -113,8 +113,7 @@ static inline void B2gEndMatchAppend(MpmCtx *mpm_ctx, B2gPattern *p,
m->next = em;
}
/** \todo XXX Unused??? */
#if 0
#ifdef PRINTMATCH
static void prt (uint8_t *buf, uint16_t buflen) {
uint16_t i;
@ -1148,7 +1147,9 @@ uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatc
continue;
if (memcmp_lowercase(p->ci, buf+j, p->len) == 0) {
//printf("CI Exact match: "); prt(p->ci, p->len); printf("\n");
#ifdef PRINTMATCH
printf("CI Exact match: "); prt(p->ci, p->len); printf("\n");
#endif
COUNT(tctx->scan_stat_loop_match++);
MpmEndMatch *em;
@ -1165,7 +1166,9 @@ uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatc
continue;
if (memcmp(p->cs, buf+j, p->len) == 0) {
//printf("CS Exact match: "); prt(p->cs, p->len); printf("\n");
#ifdef PRINTMATCH
printf("CS Exact match: "); prt(p->cs, p->len); printf("\n");
#endif
COUNT(tctx->scan_stat_loop_match++);
MpmEndMatch *em;
@ -1266,12 +1269,12 @@ uint32_t B2gScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQu
#endif
COUNT(tctx->scan_stat_loop_match++);
MpmEndMatch *em;
MpmEndMatch *em;
for (em = p->em; em; em = em->next) {
#ifdef PRINTMATCH
printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)");
printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)");
printf("em %p id %" PRIu32 "\n", em, em->id);
#endif
//printf("em %p id %" PRIu32 "\n", em, em->id);
if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len))
matches++;
}
@ -1291,12 +1294,12 @@ printf("\n");
#endif
COUNT(tctx->scan_stat_loop_match++);
MpmEndMatch *em;
MpmEndMatch *em;
for (em = p->em; em; em = em->next) {
#ifdef PRINTMATCH
printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)");
printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)");
printf("em %p id %" PRIu32 "\n", em, em->id);
#endif
//printf("em %p id %" PRIu32 "\n", em, em->id);
if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len))
matches++;
}

Write Preview
Loading…
Cancel
Save