|
|
|
@ -69,7 +69,8 @@ void DetectSslVersionFree(void *);
|
|
|
|
/**
|
|
|
|
/**
|
|
|
|
* \brief Registration function for keyword: ssl_version
|
|
|
|
* \brief Registration function for keyword: ssl_version
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
void DetectSslVersionRegister (void) {
|
|
|
|
void DetectSslVersionRegister(void)
|
|
|
|
|
|
|
|
{
|
|
|
|
sigmatch_table[DETECT_AL_SSL_VERSION].name = "ssl_version";
|
|
|
|
sigmatch_table[DETECT_AL_SSL_VERSION].name = "ssl_version";
|
|
|
|
sigmatch_table[DETECT_AL_SSL_VERSION].Match = NULL;
|
|
|
|
sigmatch_table[DETECT_AL_SSL_VERSION].Match = NULL;
|
|
|
|
sigmatch_table[DETECT_AL_SSL_VERSION].AppLayerMatch = DetectSslVersionMatch;
|
|
|
|
sigmatch_table[DETECT_AL_SSL_VERSION].AppLayerMatch = DetectSslVersionMatch;
|
|
|
|
@ -96,6 +97,7 @@ void DetectSslVersionRegister (void) {
|
|
|
|
SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
|
|
|
|
SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
return;
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
|
|
error:
|
|
|
|
error:
|
|
|
|
@ -125,12 +127,8 @@ int DetectSslVersionMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
|
|
|
|
SCReturnInt(0);
|
|
|
|
SCReturnInt(0);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (ssl == NULL) {
|
|
|
|
|
|
|
|
SCLogDebug("no ssl_version data, no match");
|
|
|
|
|
|
|
|
SCReturnInt(0);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SCMutexLock(&f->m);
|
|
|
|
SCMutexLock(&f->m);
|
|
|
|
|
|
|
|
|
|
|
|
int ret = 0;
|
|
|
|
int ret = 0;
|
|
|
|
uint16_t ver = 0;
|
|
|
|
uint16_t ver = 0;
|
|
|
|
uint8_t sig_ver = -1;
|
|
|
|
uint8_t sig_ver = -1;
|
|
|
|
@ -302,7 +300,8 @@ static int DetectSslVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
|
|
|
|
SigMatch *sm = NULL;
|
|
|
|
SigMatch *sm = NULL;
|
|
|
|
|
|
|
|
|
|
|
|
ssl = DetectSslVersionParse(str);
|
|
|
|
ssl = DetectSslVersionParse(str);
|
|
|
|
if (ssl == NULL) goto error;
|
|
|
|
if (ssl == NULL)
|
|
|
|
|
|
|
|
goto error;
|
|
|
|
|
|
|
|
|
|
|
|
/* Okay so far so good, lets get this into a SigMatch
|
|
|
|
/* Okay so far so good, lets get this into a SigMatch
|
|
|
|
* and put it in the Signature. */
|
|
|
|
* and put it in the Signature. */
|
|
|
|
@ -324,10 +323,11 @@ static int DetectSslVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
|
|
|
|
return 0;
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
|
|
error:
|
|
|
|
error:
|
|
|
|
if (ssl != NULL) DetectSslVersionFree(ssl);
|
|
|
|
if (ssl != NULL)
|
|
|
|
if (sm != NULL) SCFree(sm);
|
|
|
|
DetectSslVersionFree(ssl);
|
|
|
|
|
|
|
|
if (sm != NULL)
|
|
|
|
|
|
|
|
SCFree(sm);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
/**
|
|
|
|
@ -335,11 +335,14 @@ error:
|
|
|
|
*
|
|
|
|
*
|
|
|
|
* \param id_d pointer to DetectSslVersionData
|
|
|
|
* \param id_d pointer to DetectSslVersionData
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
void DetectSslVersionFree(void *ptr) {
|
|
|
|
void DetectSslVersionFree(void *ptr)
|
|
|
|
DetectSslVersionData *svd = (DetectSslVersionData *)ptr;
|
|
|
|
{
|
|
|
|
SCFree(svd);
|
|
|
|
if (ptr != NULL)
|
|
|
|
|
|
|
|
SCFree(ptr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**********************************Unittests***********************************/
|
|
|
|
|
|
|
|
|
|
|
|
#ifdef UNITTESTS /* UNITTESTS */
|
|
|
|
#ifdef UNITTESTS /* UNITTESTS */
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
/**
|
|
|
|
@ -495,6 +498,7 @@ static int DetectSslVersionTestDetect01(void) {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
end:
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
@ -608,6 +612,7 @@ static int DetectSslVersionTestDetect02(void) {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
end:
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
SigCleanSignatures(de_ctx);
|
|
|
|
@ -740,6 +745,7 @@ static int DetectSslVersionTestDetect03(void) {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
result = 1;
|
|
|
|
result = 1;
|
|
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
end:
|
|
|
|
if (de_ctx != NULL) {
|
|
|
|
if (de_ctx != NULL) {
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
SigGroupCleanup(de_ctx);
|
|
|
|
|