aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/priority: change duplicate priority behavior

Browse Source 
Introduce Signature init_flag to indicate priority has been set.
This will be needed in a follow-up classtype update.

Detect duplicate priority instances in a keyword, and use the
highest priority in the rule. Do issue a warning in this case.
pull/4288/head
Victor Julien 7 years ago
parent 828d2572f8
commit c471d81f04
2 changed files with 54 additions and 76 deletions
Show Stats Download Patch File Download Diff File

129
src/detect-priority.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation /* Copyright (C) 2007-2019 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -85,9 +85,15 @@ static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, const cha
"to priority keyword"); "to priority keyword");
return -1; return -1;
} }
/* if we have reached here, we have had a valid priority. Assign it */
s->prio = prio;
if (s->init_data->init_flags & SIG_FLAG_INIT_PRIO_EXPLICT) {
SCLogWarning(SC_ERR_CONFLICTING_RULE_KEYWORDS, "duplicate priority "
"keyword. Using highest priority in the rule");
s->prio = MIN(s->prio, prio);
} else {
s->prio = prio;
s->init_data->init_flags |= SIG_FLAG_INIT_PRIO_EXPLICT;
}
return 0; return 0;
} }
@ -97,93 +103,68 @@ static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, const cha
static int DetectPriorityTest01(void) static int DetectPriorityTest01(void)
{ {
int result = 0;
DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) { FAIL_IF_NULL(de_ctx);
goto end;
}
de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:2; sid:1;)"); "(msg:\"Priority test\"; priority:2; sid:1;)");
if (de_ctx->sig_list != NULL) FAIL_IF_NULL(de_ctx->sig_list);
result = 1;
DetectEngineCtxFree(de_ctx); FAIL_IF_NOT(de_ctx->sig_list->prio == 2);
end: DetectEngineCtxFree(de_ctx);
return result; PASS;
} }
static int DetectPriorityTest02(void) static int DetectPriorityTest02(void)
{ {
int result = 0;
Signature *last = NULL;
Signature *sig = NULL;
DetectEngineCtx *de_ctx = DetectEngineCtxInit(); DetectEngineCtx *de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL) { FAIL_IF_NULL(de_ctx);
goto end;
}
sig = SigInit(de_ctx, "alert tcp any any -> any any " Signature *sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:1; sid:1;)"); "(msg:\"Priority test\"; priority:1; sid:1;)");
de_ctx->sig_list = last = sig; FAIL_IF_NULL(sig);
if (sig == NULL) { FAIL_IF_NOT(sig->prio == 1);
result = 0;
} else {
result = 1;
result &= (sig->prio == 1);
}
sig = SigInit(de_ctx, "alert tcp any any -> any any " sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:boo; sid:1;)"); "(msg:\"Priority test\"; priority:boo; sid:2;)");
if (last != NULL) FAIL_IF_NOT_NULL(sig);
last->next = sig;
result &= (sig == NULL);
sig = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:10boo; sid:1;)");
if (last != NULL)
last->next = sig;
result &= (sig == NULL);
sig = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:b10oo; sid:1;)");
if (last != NULL)
last->next = sig;
result &= (sig == NULL);
sig = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:boo10; sid:1;)");
if (last != NULL)
last->next = sig;
result &= (sig == NULL);
sig = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:-1; sid:1;)");
if (last != NULL)
last->next = sig;
result &= (sig == NULL);
sig = SigInit(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; sid:1;)");
if (last != NULL)
last->next = sig;
if (sig == NULL) {
result &= 0;
} else {
result &= (sig->prio == 3);
}
SigCleanSignatures(de_ctx); sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
DetectEngineCtxFree(de_ctx); "(msg:\"Priority test\"; priority:10boo; sid:3;)");
FAIL_IF_NOT_NULL(sig);
end: sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
return result; "(msg:\"Priority test\"; priority:b10oo; sid:4;)");
} FAIL_IF_NOT_NULL(sig);
sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:boo10; sid:5;)");
FAIL_IF_NOT_NULL(sig);
sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:-1; sid:6;)");
FAIL_IF_NOT_NULL(sig);
sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; sid:7;)");
FAIL_IF_NULL(sig);
FAIL_IF_NOT(sig->prio == 3);
sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:5; priority:4; sid:8;)");
FAIL_IF_NULL(sig);
FAIL_IF_NOT(sig->prio == 4);
sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
"(msg:\"Priority test\"; priority:5; priority:4; "
"priority:1; sid:9;)");
FAIL_IF_NULL(sig);
FAIL_IF_NOT(sig->prio == 1);
DetectEngineCtxFree(de_ctx);
PASS;
}
#endif /* UNITTESTS */ #endif /* UNITTESTS */
/** /**
@ -191,12 +172,8 @@ end:
*/ */
void SCPriorityRegisterTests(void) void SCPriorityRegisterTests(void)
{ {
#ifdef UNITTESTS #ifdef UNITTESTS
UtRegisterTest("DetectPriorityTest01", DetectPriorityTest01); UtRegisterTest("DetectPriorityTest01", DetectPriorityTest01);
UtRegisterTest("DetectPriorityTest02", DetectPriorityTest02); UtRegisterTest("DetectPriorityTest02", DetectPriorityTest02);
#endif /* UNITTESTS */ #endif /* UNITTESTS */
} }

1
src/detect.h
Unescape Escape View File

@ -257,6 +257,7 @@ typedef struct DetectPort_ {
#define SIG_FLAG_INIT_HAS_TRANSFORM BIT_U32(5) #define SIG_FLAG_INIT_HAS_TRANSFORM BIT_U32(5)
#define SIG_FLAG_INIT_STATE_MATCH BIT_U32(6) /**< signature has matches that require stateful inspection */ #define SIG_FLAG_INIT_STATE_MATCH BIT_U32(6) /**< signature has matches that require stateful inspection */
#define SIG_FLAG_INIT_NEED_FLUSH BIT_U32(7) #define SIG_FLAG_INIT_NEED_FLUSH BIT_U32(7)
#define SIG_FLAG_INIT_PRIO_EXPLICT BIT_U32(8) /**< priority is explicitly set by the priority keyword */
/* signature mask flags */ /* signature mask flags */
/** \note: additions should be added to the rule analyzer as well */ /** \note: additions should be added to the rule analyzer as well */

Write Preview
Loading…
Cancel
Save