aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix "ip" rules not ending up in the tcp and udp sig group heads correctly.

Browse Source
remotes/origin/master-1.0.x
Victor Julien 17 years ago
parent d883a993f7
commit 733c3bcb8c
5 changed files with 56 additions and 46 deletions
Show Stats Download Patch File Download Diff File

3
src/detect-engine-siggroup.c
Unescape Escape View File

@ -720,6 +720,9 @@ int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint3
return 0; return 0;
for (sig = 0; sig < sgh->sig_cnt; sig++) { for (sig = 0; sig < sgh->sig_cnt; sig++) {
if (sgh->sig_array == NULL)
return 0;
if (!(sgh->sig_array[(sig/8)] & (1<<(sig%8)))) if (!(sgh->sig_array[(sig/8)] & (1<<(sig%8))))
continue; continue;

2
src/detect-engine-siggroup.h
Unescape Escape View File

@ -42,5 +42,7 @@ void SigGroupHeadSetSigCnt(SigGroupHead *sgh, uint32_t max_idx);
int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx); int SigGroupHeadBuildMatchArray (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t max_idx);
void SigGroupHeadFreeSigArrays(DetectEngineCtx *de_ctx); void SigGroupHeadFreeSigArrays(DetectEngineCtx *de_ctx);
int SigGroupHeadContainsSigId (DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid);
#endif /* __DETECT_ENGINE_SIGGROUP_H__ */ #endif /* __DETECT_ENGINE_SIGGROUP_H__ */

10
src/detect-parse.c
Unescape Escape View File

@ -330,8 +330,9 @@ int SigParsePort(Signature *s, const char *portstr, char flag) {
} }
if (flag == 0) { if (flag == 0) {
if (strcasecmp(port,"any") == 0) if (strcasecmp(port,"any") == 0) {
s->flags |= SIG_FLAG_SP_ANY; s->flags |= SIG_FLAG_SP_ANY;
}
r = DetectPortParse(&s->sp,(char *)port); r = DetectPortParse(&s->sp,(char *)port);
} else if (flag == 1) { } else if (flag == 1) {
@ -410,8 +411,13 @@ int SigParseBasics(Signature *s, char *sigstr, char ***result) {
/* Parse Address & Ports */ /* Parse Address & Ports */
if (SigParseAddress(s, arr[CONFIG_SRC], 0) < 0) if (SigParseAddress(s, arr[CONFIG_SRC], 0) < 0)
goto error; goto error;
/* For "ip" we parse the ports as well, even though they will
be just "any". We do this for later sgh building for the
tcp and udp protocols. */
if (strcasecmp(arr[CONFIG_PROTO],"tcp") == 0 || if (strcasecmp(arr[CONFIG_PROTO],"tcp") == 0 ||
strcasecmp(arr[CONFIG_PROTO],"udp") == 0) { strcasecmp(arr[CONFIG_PROTO],"udp") == 0 ||
strcasecmp(arr[CONFIG_PROTO],"ip") == 0) {
if (SigParsePort(s, arr[CONFIG_SP], 0) < 0) if (SigParsePort(s, arr[CONFIG_SP], 0) < 0)
goto error; goto error;
if (SigParsePort(s, arr[CONFIG_DP], 1) < 0) if (SigParsePort(s, arr[CONFIG_DP], 1) < 0)

64
src/detect.c
Unescape Escape View File

@ -60,6 +60,9 @@ SigMatch *SigMatchAlloc(void);
void SigMatchFree(SigMatch *sm); void SigMatchFree(SigMatch *sm);
void DetectExitPrintStats(ThreadVars *tv, void *data); void DetectExitPrintStats(ThreadVars *tv, void *data);
void DbgPrintSigs(DetectEngineCtx *, SigGroupHead *);
void DbgPrintSigs2(DetectEngineCtx *, SigGroupHead *);
/* tm module api functions */ /* tm module api functions */
int Detect(ThreadVars *, Packet *, void *, PacketQueue *); int Detect(ThreadVars *, Packet *, void *, PacketQueue *);
int DetectThreadInit(ThreadVars *, void *, void **); int DetectThreadInit(ThreadVars *, void *, void **);
@ -173,6 +176,9 @@ int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file) {
sig = SigInit(de_ctx, line); sig = SigInit(de_ctx, line);
if (sig != NULL) { if (sig != NULL) {
#ifdef DEBUG
printf("Sig %"PRIu32" loaded\n", sig->id);
#endif
if (de_ctx->sig_list == NULL) { if (de_ctx->sig_list == NULL) {
de_ctx->sig_list = sig; de_ctx->sig_list = sig;
} else { } else {
@ -696,6 +702,8 @@ static int DetectEngineLookupBuildSourceAddressList(DetectEngineCtx *de_ctx, Det
DetectAddressGroup *gr = NULL, *lookup_gr = NULL, *head = NULL; DetectAddressGroup *gr = NULL, *lookup_gr = NULL, *head = NULL;
int proto; int proto;
//printf("DetectEngineLookupBuildSourceAddressList: sig %"PRIu32", family %"PRIi32"\n", s->id, family);
if (family == AF_INET) { if (family == AF_INET) {
head = s->src.ipv4_head; head = s->src.ipv4_head;
} else if (family == AF_INET6) { } else if (family == AF_INET6) {
@ -815,6 +823,8 @@ static int DetectEngineLookupFlowAddSig(DetectEngineCtx *de_ctx, DetectEngineLoo
else else
dsize ? g_detectengine_any_big_toserver++ : g_detectengine_any_small_toserver++; dsize ? g_detectengine_any_big_toserver++ : g_detectengine_any_small_toserver++;
} else { } else {
//printf("DetectEngineLookupFlowAddSig: s->id %"PRIu32"\n", s->id);
/* both */ /* both */
DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[0], s, family); DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[0], s, family);
DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[1], s, family); DetectEngineLookupBuildSourceAddressList(de_ctx, &ds->flow_gh[1], s, family);
@ -972,7 +982,7 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
unique_groups++; unique_groups++;
//printf(" 1 -= Address "); DetectAddressDataPrint(gr->ad); printf("\n"); //printf(" 1 -= Address "); DetectAddressDataPrint(gr->ad); printf("\n");
//printf(" : "); DbgPrintSigs2(gr->sh); //printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
groups++; groups++;
@ -1135,9 +1145,11 @@ int CreateGroupedAddrList(DetectEngineCtx *de_ctx, DetectAddressGroup *srchead,
#endif #endif
} }
#ifdef DEBUG
for (gr = newhead->ipv4_head; gr != NULL; gr = gr->next) { for (gr = newhead->ipv4_head; gr != NULL; gr = gr->next) {
//printf(" 4 -= R Address "); DetectAddressDataPrint(gr->ad); printf(" : "); DbgPrintSigs2(gr->sh); printf(" 4 -= R Address "); DetectAddressDataPrint(gr->ad); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
} }
#endif
return 0; return 0;
error: error:
@ -1184,9 +1196,9 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete
unique_groups++; unique_groups++;
groups++; groups++;
#ifdef DEBUG
//printf(":-:1:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 ", cost %" PRIu32 ", maxlen %" PRIu32 ") ", gr->cnt, gr->sh->cost, gr->sh->mpm_content_maxlen);DbgSghContainsSig(de_ctx,gr->sh,2001330); printf(" -= 1:Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
#endif
/* alloc a copy */ /* alloc a copy */
DetectPort *newtmp = DetectPortCopySingle(de_ctx,gr); DetectPort *newtmp = DetectPortCopySingle(de_ctx,gr);
if (newtmp == NULL) { if (newtmp == NULL) {
@ -1284,11 +1296,12 @@ int CreateGroupedPortList(DetectEngineCtx *de_ctx,HashListTable *port_hash, Dete
DetectPortInsert(de_ctx,newhead,joingr); DetectPortInsert(de_ctx,newhead,joingr);
} }
#ifdef DEBUG
for (gr = *newhead; gr != NULL; gr = gr->next) { for (gr = *newhead; gr != NULL; gr = gr->next) {
//printf(":-:9:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 ", cost %" PRIu32 ") ", gr->cnt, gr->sh->cost); DbgSghContainsSig(de_ctx,gr->sh,2001330); //printf(":-:9:-: Port "); DetectPortPrint(gr); printf(" (cnt %" PRIu32 "", gr->cnt); DbgSghContainsSig(de_ctx,gr->sh,489);
//printf(" -= Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(gr->sh); printf(" -= 9:Port "); DetectPortPrint(gr); printf(" : "); DbgPrintSigs2(de_ctx, gr->sh);
} }
#endif
return 0; return 0;
error: error:
return -1; return -1;
@ -1325,6 +1338,7 @@ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) {
/* now for every rule add the source group to our temp lists */ /* now for every rule add the source group to our temp lists */
for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) { for (tmp_s = de_ctx->sig_list; tmp_s != NULL; tmp_s = tmp_s->next) {
//printf("SigAddressPrepareStage2 tmp_s->id %u\n", tmp_s->id);
if (!(tmp_s->flags & SIG_FLAG_IPONLY)) { if (!(tmp_s->flags & SIG_FLAG_IPONLY)) {
DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET); DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET);
DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET6); DetectEngineLookupDsizeAddSig(de_ctx, tmp_s, AF_INET6);
@ -2154,7 +2168,7 @@ void DbgSghContainsSig(DetectEngineCtx *de_ctx, SigGroupHead *sgh, uint32_t sid)
/* shortcut for debugging. If enabled Stage5 will /* shortcut for debugging. If enabled Stage5 will
* print sigid's for all groups */ * print sigid's for all groups */
//#define PRINTSIGS #define PRINTSIGS
/* just printing */ /* just printing */
int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
@ -2211,13 +2225,6 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
printf("%" PRIu32 " ", s->id); printf("%" PRIu32 " ", s->id);
} }
#endif #endif
printf(" - ");
for (i = 0; i < dp->sh->sig_cnt; i++) {
Signature *s = de_ctx->sig_array[dp->sh->match_array[i]];
if (s->id == 2008335 || s->id == 2001329 || s->id == 2001330 ||
s->id == 2001331 || s->id == 2003321 || s->id == 2003322)
printf("%" PRIu32 " ", s->id);
}
printf("\n"); printf("\n");
} }
} }
@ -2254,8 +2261,8 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
} }
} }
} }
#if 0 //#if 0
for (global_src_gr = de_ctx->src_gh[proto]->ipv6_head; global_src_gr != NULL; for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv6_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next) global_src_gr = global_src_gr->next)
{ {
printf("- "); DetectAddressDataPrint(global_src_gr->ad); printf("- "); DetectAddressDataPrint(global_src_gr->ad);
@ -2329,7 +2336,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
} }
} }
for (global_src_gr = de_ctx->src_gh[proto]->any_head; global_src_gr != NULL; for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->any_head; global_src_gr != NULL;
global_src_gr = global_src_gr->next) global_src_gr = global_src_gr->next)
{ {
printf("- "); DetectAddressDataPrint(global_src_gr->ad); printf("- "); DetectAddressDataPrint(global_src_gr->ad);
@ -2433,7 +2440,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
} }
} }
} }
#endif //#endif
} }
} }
} }
@ -2441,17 +2448,17 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
return 0; return 0;
} }
/** \brief Convert the signature list into the runtime
* match structure. */
int SigGroupBuild (DetectEngineCtx *de_ctx) { int SigGroupBuild (DetectEngineCtx *de_ctx) {
SigAddressPrepareStage1(de_ctx); SigAddressPrepareStage1(de_ctx);
SigAddressPrepareStage2(de_ctx); SigAddressPrepareStage2(de_ctx);
SigAddressPrepareStage3(de_ctx); SigAddressPrepareStage3(de_ctx);
//abort(); // SigAddressPrepareStage5(de_ctx);
// SigAddressPrepareStage5();
DbgPrintScanSearchStats(); DbgPrintScanSearchStats();
// DetectAddressGroupPrintMemory(); // DetectAddressGroupPrintMemory();
// DetectSigGroupPrintMemory(); // DetectSigGroupPrintMemory();
// DetectPortPrintMemory(); // DetectPortPrintMemory();
//SigGroupGetSrcAddress(NULL);
return 0; return 0;
} }
@ -2460,17 +2467,6 @@ int SigGroupCleanup (DetectEngineCtx *de_ctx) {
return 0; return 0;
} }
int SigGroupGetSrcAddress(DetectAddressGroupsHead *src) {
uint32_t ip = 0x04030201; /* 1.2.3.4 */
printf("ip & 0x000000ff %8u 0x%08X >> 0 %" PRIu32 "\n", ip & 0x000000ff, ip & 0x000000ff, (ip & 0x000000ff) >> 0);
printf("ip & 0x0000ff00 %8u 0x%08X >> 8 %" PRIu32 "\n", ip & 0x0000ff00, ip & 0x0000ff00, (ip & 0x0000ff00) >> 8);
printf("ip & 0x00ff0000 %8u 0x%08X >> 16 %" PRIu32 "\n", ip & 0x00ff0000, ip & 0x00ff0000, (ip & 0x00ff0000) >> 16);
printf("ip & 0xff000000 %8u 0x%08X >> 24 %" PRIu32 "\n", ip & 0xff000000, ip & 0xff000000, (ip & 0xff000000) >> 24);
return 0;
}
void SigTableSetup(void) { void SigTableSetup(void) {
memset(sigmatch_table, 0, sizeof(sigmatch_table)); memset(sigmatch_table, 0, sizeof(sigmatch_table));

15
src/util-mpm-b2g.c
Unescape Escape View File

@ -113,8 +113,7 @@ static inline void B2gEndMatchAppend(MpmCtx *mpm_ctx, B2gPattern *p,
m->next = em; m->next = em;
} }
/** \todo XXX Unused??? */ #ifdef PRINTMATCH
#if 0
static void prt (uint8_t *buf, uint16_t buflen) { static void prt (uint8_t *buf, uint16_t buflen) {
uint16_t i; uint16_t i;
@ -1148,7 +1147,9 @@ uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatc
continue; continue;
if (memcmp_lowercase(p->ci, buf+j, p->len) == 0) { if (memcmp_lowercase(p->ci, buf+j, p->len) == 0) {
//printf("CI Exact match: "); prt(p->ci, p->len); printf("\n"); #ifdef PRINTMATCH
printf("CI Exact match: "); prt(p->ci, p->len); printf("\n");
#endif
COUNT(tctx->scan_stat_loop_match++); COUNT(tctx->scan_stat_loop_match++);
MpmEndMatch *em; MpmEndMatch *em;
@ -1165,7 +1166,9 @@ uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatc
continue; continue;
if (memcmp(p->cs, buf+j, p->len) == 0) { if (memcmp(p->cs, buf+j, p->len) == 0) {
//printf("CS Exact match: "); prt(p->cs, p->len); printf("\n"); #ifdef PRINTMATCH
printf("CS Exact match: "); prt(p->cs, p->len); printf("\n");
#endif
COUNT(tctx->scan_stat_loop_match++); COUNT(tctx->scan_stat_loop_match++);
MpmEndMatch *em; MpmEndMatch *em;
@ -1270,8 +1273,8 @@ uint32_t B2gScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQu
for (em = p->em; em; em = em->next) { for (em = p->em; em; em = em->next) {
#ifdef PRINTMATCH #ifdef PRINTMATCH
printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)"); printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)");
printf("em %p id %" PRIu32 "\n", em, em->id);
#endif #endif
//printf("em %p id %" PRIu32 "\n", em, em->id);
if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len)) if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len))
matches++; matches++;
} }
@ -1295,8 +1298,8 @@ printf("\n");
for (em = p->em; em; em = em->next) { for (em = p->em; em; em = em->next) {
#ifdef PRINTMATCH #ifdef PRINTMATCH
printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)"); printf("(%" PRIu32 "%s) ", g_de_ctx->sig_array[em->sig_id]->id, em->flags & MPM_ENDMATCH_NOSEARCH ? "" : " (searchable)");
printf("em %p id %" PRIu32 "\n", em, em->id);
#endif #endif
//printf("em %p id %" PRIu32 "\n", em, em->id);
if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len)) if (MpmMatchAppend(mpm_thread_ctx, pmq, em, &mpm_thread_ctx->match[em->id], pos, p->len))
matches++; matches++;
} }

Write Preview
Loading…
Cancel
Save