aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Set DROP flag for reject action so in addition to sending the rst, in IPS mode also drop the offending packet.

Browse Source
remotes/origin/master-1.2.x
Victor Julien 15 years ago
parent f084874998
commit aac2d91bcc
5 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File

12
src/alert-fastlog.c
Unescape Escape View File

@ -145,9 +145,9 @@ TmEcode AlertFastLogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "[Drop] ";
} else if (pa->action == ACTION_DROP) {
} else if (pa->action & ACTION_DROP) {
action = "[wDrop] ";
}
@ -199,9 +199,9 @@ TmEcode AlertFastLogIPv6(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "[Drop] ";
} else if (pa->action == ACTION_DROP) {
} else if (pa->action & ACTION_DROP) {
action = "[wDrop] ";
}
@ -251,9 +251,9 @@ TmEcode AlertFastLogDecoderEvent(ThreadVars *tv, Packet *p, void *data, PacketQu
continue;
}
if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "[Drop] ";
} else if (pa->action == ACTION_DROP) {
} else if (pa->action & ACTION_DROP) {
action = "[wDrop] ";
}

12
src/alert-syslog.c
Unescape Escape View File

@ -275,9 +275,9 @@ TmEcode AlertSyslogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "[Drop] ";
} else if (pa->action == ACTION_DROP) {
} else if (pa->action & ACTION_DROP) {
action = "[wDrop] ";
}
@ -336,9 +336,9 @@ TmEcode AlertSyslogIPv6(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "[Drop] ";
} else if (pa->action == ACTION_DROP) {
} else if (pa->action & ACTION_DROP) {
action = "[wDrop] ";
}
@ -399,9 +399,9 @@ TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, Packet *p, void *data,
continue;
}
if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
if (pa->action & ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {
action = "[Drop] ";
} else if (pa->action == ACTION_DROP) {
} else if (pa->action & ACTION_DROP) {
action = "[wDrop] ";
}

2
src/detect-engine-sigorder.c
Unescape Escape View File

@ -1862,7 +1862,7 @@ static int SCSigTestSignatureOrdering08(void)
prevsig->next = sig;
prevsig = sig;
sig = SigInit(de_ctx, "drop tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:6; rev:4; priority:1;)");
sig = SigInit(de_ctx, "reject tcp any !21:902 -> any any (msg:\"Testing sigordering drop\"; content:\"220\"; offset:11; depth:4; pcre:\"/220[- ]/\"; sid:6; rev:4; priority:1;)");
if (sig == NULL) {
goto end;
}

8
src/detect-parse.c
Unescape Escape View File

@ -912,22 +912,22 @@ int SigParseAction(Signature *s, const char *action) {
} else if (strcasecmp(action, "reject") == 0) {
if (!(SigParseActionRejectValidate(action)))
return -1;
s->action = ACTION_REJECT;
s->action = ACTION_REJECT|ACTION_DROP;
return 0;
} else if (strcasecmp(action, "rejectsrc") == 0) {
if (!(SigParseActionRejectValidate(action)))
return -1;
s->action = ACTION_REJECT;
s->action = ACTION_REJECT|ACTION_DROP;
return 0;
} else if (strcasecmp(action, "rejectdst") == 0) {
if (!(SigParseActionRejectValidate(action)))
return -1;
s->action = ACTION_REJECT_DST;
s->action = ACTION_REJECT_DST|ACTION_DROP;
return 0;
} else if (strcasecmp(action, "rejectboth") == 0) {
if (!(SigParseActionRejectValidate(action)))
return -1;
s->action = ACTION_REJECT_BOTH;
s->action = ACTION_REJECT_BOTH|ACTION_DROP;
return 0;
} else {
SCLogError(SC_ERR_INVALID_ACTION,"An invalid action \"%s\" was given",action);

4
src/detect.c
Unescape Escape View File

@ -1523,7 +1523,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
pmatch = 1;
/* Tell the engine that this reassembled stream can drop the
* rest of the pkts with no further inspection */
if (s->action == ACTION_DROP)
if (s->action & ACTION_DROP)
alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW;
/* store ptr to current smsg */
@ -1630,7 +1630,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
}
/* match */
if (s->action == ACTION_DROP)
if (s->action & ACTION_DROP)
alert_flags |= PACKET_ALERT_FLAG_DROP_FLOW;
alert_flags |= PACKET_ALERT_FLAG_STATE_MATCH;

Write Preview
Loading…
Cancel
Save