Pull request #3861: parser: base service_only on services not cursor type

Merge in SNORT/snort3 from ~BRASTULT/snort3:pkt_data_b64_fix to master

Squashed commit of the following:

commit 4c0959d1ce906b582268c2c639bf3788d40ff04f
Author: Brandon Stultz <brastult@cisco.com>
Date:   Fri May 19 12:51:15 2023 -0400

    parser: base service_only on services not cursor type

diff --git a/src/detection/fp_utils.cc b/src/detection/fp_utils.cc
index dae70d9dc3bcfcf65ab601d6822eb676836dc618..094be3b488341974c45970c6eba3962b3dffab7b 100644 (file)
--- a/src/detection/fp_utils.cc
+++ b/src/detection/fp_utils.cc
@@ -531,6 +531,10 @@ void validate_services(SnortConfig* sc, OptTreeNode* otn)
         }
         svc = s;
     }
+
+    if ( !svc.empty() or !multi_svc_buf.empty() or guess )
+        otn->set_service_only();
+
     if ( otn->sigInfo.services.size() == 1 and !svc.empty() and otn->sigInfo.services[0].service != svc )
     {
         ParseWarning(WARN_RULES, "%u:%u:%u has service:%s with %s buffer",
@@ -560,8 +564,6 @@ void validate_services(SnortConfig* sc, OptTreeNode* otn)
 
         if ( !strcmp(guess, "netbios-ssn") )  // :(
             add_service_to_otn(sc, otn, "dcerpc");
-
-        otn->set_service_only();
     }
 }
 

diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index 7b2d1c1ff166d68bd5b3d1632c87a4afc151ee51..d6e8eae7d121b8062a941ff86adf3e97bb8b73da 100644 (file)
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1014,11 +1014,7 @@ void parse_rule_opt_end(SnortConfig* sc, const char* key, OptTreeNode* otn)
     CursorActionType cat = ips ? ips->get_cursor_type() : CAT_NONE;
 
     if ( cat > CAT_ADJUST )
-    {
-        if ( cat != CAT_SET_RAW )
-            otn->set_service_only();
         buf_is_set = true;
-    }
 
     if ( type != OPT_TYPE_META )
         otn->num_detection_opts++;