Pull request #3532: parser: remove 138 from builtin GID exceptions

Merge in SNORT/snort3 from ~VHORBATO/snort3:sd_exc to master

Squashed commit of the following:

commit 2ae8f773e1afbc889c69fc283b28d9f3d31e1825
Author: Vitalii <vhorbato@cisco.com>
Date:   Mon Jul 25 13:43:35 2022 +0300

    parser: remove 138 from builtin GID exceptions

diff --git a/src/detection/rules.h b/src/detection/rules.h
index 816a1a54187ba120c0ee46eae084ad72b9fd391e..4d5d3253fdbdacbc481e8df28ca486181b9389ae 100644 (file)
--- a/src/detection/rules.h
+++ b/src/detection/rules.h
@@ -36,9 +36,6 @@
 #define GID_BUILTIN_MIN    100
 #define GID_BUILTIN_MAX    999
 
-// should be revoked in the future
-#define GID_EXCEPTION_SDF  138
-
 #define SESSION_EVENT_SYN_RX 1
 #define SESSION_EVENT_SETUP  2
 #define SESSION_EVENT_CLEAR  3

diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index 4f1b3e886eb9e30b64f49524f6b421784bfe3365..52eed81c45a15d534e7545d0ca49a63908be4533 100644 (file)
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1055,16 +1055,8 @@ static void parse_rule_state(SnortConfig* sc, const RuleTreeNode& rtn, OptTreeNo
 
 static bool is_builtin(uint32_t gid)
 {
-    if ( ModuleManager::gid_in_use(gid) )
-        return true;
-
-    // the builtin range prevents unloaded sids from firing on every packet
-    if ( gid < GID_BUILTIN_MIN or gid > GID_BUILTIN_MAX )
-        return false;
-
-    // not builtin but may get used and abused by snort2lua
-    // should be deleted at some point
-    return gid != GID_EXCEPTION_SDF;
+    return ModuleManager::gid_in_use(gid) or
+        ( gid >= GID_BUILTIN_MIN and gid <= GID_BUILTIN_MAX );
 }
 
 void parse_rule_close(SnortConfig* sc, RuleTreeNode& rtn, OptTreeNode* otn)