mirror of https://github.com/OISF/suricata
coccinelle: add tcp flag check
The different TCP related structures have all a flags field and its value must match the type of structure. This patch adds a check alerting on invalid value usage.pull/341/head
parent
b8078742c3
commit
c9d90e6596
@ -0,0 +1,38 @@
|
||||
@flags@
|
||||
TcpSession *ssn;
|
||||
identifier ssn_flags =~ "^(?!STREAMTCP_FLAG).+";
|
||||
TcpStream *stream;
|
||||
identifier stream_flags =~ "^(?!STREAMTCP_STREAM_FLAG).+";
|
||||
TcpSegment *segment;
|
||||
identifier segment_flags =~ "^(?!SEGMENTTCP_FLAG)_.+";
|
||||
position p1;
|
||||
@@
|
||||
|
||||
(
|
||||
ssn->flags@p1 |= ssn_flags
|
||||
|
|
||||
ssn->flags@p1 & ssn_flags
|
||||
|
|
||||
ssn->flags@p1 &= ~ssn_flags
|
||||
|
|
||||
stream->flags@p1 |= stream_flags
|
||||
|
|
||||
stream->flags@p1 & stream_flags
|
||||
|
|
||||
stream->flags@p1 &= ~stream_flags
|
||||
|
|
||||
segment->flags@p1 |= segment_flags
|
||||
|
|
||||
segment->flags@p1 &= ~segment_flags
|
||||
|
|
||||
segment->flags@p1 & segment_flags
|
||||
)
|
||||
|
||||
|
||||
@script:python@
|
||||
p1 << flags.p1;
|
||||
@@
|
||||
|
||||
print "Invalid usage of flags field at %s:%s, flags value is incorrect (wrong family)." % (p1[0].file, p1[0].line)
|
||||
import sys
|
||||
sys.exit(1)
|
Loading…
Reference in New Issue