Merge pull request #2759 in SNORT/snort3 from ~OSHUMEIK/snort3:cvars to master

Squashed commit of the following:

commit 5a87d044fb559592ece9f0d340f79d1f330b3095
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Tue Feb 16 17:09:05 2021 +0200

    detection: use IP and port variables from the targeted policy

    Port lists are updated for every duped RTN if its ports have been changed.

diff --git a/src/detection/rules.cc b/src/detection/rules.cc
index 4690a8c4187dcd5891879b1b76fe4e9a4af21e9e..e1bd6c3683136873acea185a74a1e9e6d44b3297 100644 (file)
--- a/src/detection/rules.cc
+++ b/src/detection/rules.cc
@@ -32,6 +32,9 @@
 #include "main/snort_config.h"
 #include "parser/parse_conf.h"
 #include "parser/parser.h"
+#include "parser/parse_rule.h"
+#include "ports/port_object.h"
+#include "ports/port_var_table.h"
 #include "sfip/sf_ipvar.h"
 #include "sfip/sf_vartable.h"
 
@@ -86,30 +89,58 @@ void RuleStateMap::apply(
     SnortConfig* sc, OptTreeNode* otn, unsigned ips_num, const RuleState& s)
 {
     IpsPolicy* policy = nullptr;
-    RuleTreeNode* rtn = getRtnFromOtn(otn, ips_num);
+    RuleTreeNode* b_rtn = getRtnFromOtn(otn, ips_num);
 
-    if ( !rtn )
-        if ( ips_num and (rtn = getRtnFromOtn(otn, 0)) )
-            policy = sc->policy_map->get_ips_policy(ips_num);
+    if ( !b_rtn and ips_num and (b_rtn = getRtnFromOtn(otn, 0)) )
+        policy = sc->policy_map->get_ips_policy(ips_num);
 
-    if ( !rtn )
+    if ( !b_rtn )
         return;
 
     if ( policy )
         policy->rules_shared++;
 
-    rtn = dup_rtn(rtn);
-    update_rtn(rtn, s);
-    addRtnToOtn(sc, otn, rtn, ips_num);
+    RuleTreeNode* t_rtn = dup_rtn(b_rtn, policy);
+    update_rtn(t_rtn, s);
+
+    auto bspo = b_rtn->src_portobject;
+    auto bdpo = b_rtn->dst_portobject;
+    auto tspo = t_rtn->src_portobject;
+    auto tdpo = t_rtn->dst_portobject;
+
+    if ( (bspo and tspo and !PortObjectEqual(bspo, tspo)) or
+         (bdpo and tdpo and !PortObjectEqual(bdpo, tdpo)) )
+        parse_rule_finish_portlist(sc, t_rtn, otn);
+
+    addRtnToOtn(sc, otn, t_rtn, ips_num);
 }
 
-RuleTreeNode* RuleStateMap::dup_rtn(RuleTreeNode* rtn)
+RuleTreeNode* RuleStateMap::dup_rtn(RuleTreeNode* rtn, IpsPolicy* policy)
 {
     RuleTreeNode* ret = new RuleTreeNode(*rtn);
 
+    auto ipvt = policy ? policy->ip_vartable : nullptr;
+    auto povt = policy ? policy->portVarTable : nullptr;
+
+    auto sip = sfvt_lookup_var(ipvt, rtn->sip->name);
+    auto dip = sfvt_lookup_var(ipvt, rtn->dip->name);
+    auto spo = rtn->src_portobject
+        ? PortVarTableFind(povt, rtn->src_portobject->name, false) : nullptr;
+    auto dpo = rtn->dst_portobject
+        ? PortVarTableFind(povt, rtn->dst_portobject->name, false) : nullptr;
+
+    ret->sip = sip
+        ? sfvar_create_alias(sip, sip->name)
+        : sfvar_deep_copy(rtn->sip);
+
+    ret->dip = dip
+        ? sfvar_create_alias(dip, dip->name)
+        : sfvar_deep_copy(rtn->dip);
+
+    ret->src_portobject = spo ? spo : ret->src_portobject;
+    ret->dst_portobject = dpo ? dpo : ret->dst_portobject;
+
     ret->otnRefCount = 0;
-    ret->sip = sfvar_deep_copy(rtn->sip);
-    ret->dip = sfvar_deep_copy(rtn->dip);
 
     RuleFpList* from = rtn->rule_func;
 

diff --git a/src/detection/rules.h b/src/detection/rules.h
index 8ff47e270ab0f9c74af8cfcfdcd5d3765b3465db..b5bd75b238a9db8b57d0c31782db14f5b0433a32 100644 (file)
--- a/src/detection/rules.h
+++ b/src/detection/rules.h
@@ -96,7 +96,7 @@ public:
     void apply(snort::SnortConfig*);
 
 private:
-    RuleTreeNode* dup_rtn(RuleTreeNode*);
+    RuleTreeNode* dup_rtn(RuleTreeNode*, IpsPolicy*);
     void update_rtn(RuleTreeNode*, const RuleState&);
     void apply(snort::SnortConfig*, OptTreeNode*, unsigned ips_num, const RuleState&);
 

diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc
index e0a32ff6e6df871b8b6297d3e6b69b1305e25ad9..6cba980bddf3134125ca76db8af0df7886bc69ca 100644 (file)
--- a/src/main/snort_config.cc
+++ b/src/main/snort_config.cc
@@ -300,6 +300,7 @@ void SnortConfig::setup()
         rule_states = nullptr;
     }
 
+    ParseRulesFinish(this);
     ShowPolicyStats(this);
 
     /* Need to do this after dynamic detection stuff is initialized, too */

diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index b769eda01fc1a436ad3b4076bb369bf081c6301a..804128f810c45f70b4767e0623af9865d96b762a 100644 (file)
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1382,9 +1382,7 @@ void parse_rule_close(SnortConfig* sc, RuleTreeNode& rtn, OptTreeNode* otn)
 
     validate_services(sc, otn);
     OtnLookupAdd(sc->otn_map, otn);
-
-    if ( FinishPortListRule(sc->port_tables, new_rtn, otn, sc->fast_pattern_config) )
-        ParseError("Failed to finish a port list rule.");
+    parse_rule_finish_portlist(sc, new_rtn, otn);
 
     if ( s_capture )
     {
@@ -1395,3 +1393,9 @@ void parse_rule_close(SnortConfig* sc, RuleTreeNode& rtn, OptTreeNode* otn)
     ClearIpsOptionsVars();
 }
 
+void parse_rule_finish_portlist(SnortConfig* sc, RuleTreeNode* rtn, OptTreeNode* otn)
+{
+    if ( FinishPortListRule(sc->port_tables, rtn, otn, sc->fast_pattern_config) )
+        ParseError("%u:%u rule failed to finish a port list.",
+            otn->sigInfo.gid, otn->sigInfo.sid);
+}

diff --git a/src/parser/parse_rule.h b/src/parser/parse_rule.h
index 917845b3eb96b707ec5feb9d64501f294255c3c0..9ddd00665bb4d241551e15c203284914dba07253 100644 (file)
--- a/src/parser/parse_rule.h
+++ b/src/parser/parse_rule.h
@@ -49,6 +49,7 @@ void parse_rule_opt_end(snort::SnortConfig*, const char* key, OptTreeNode*);
 
 OptTreeNode* parse_rule_open(snort::SnortConfig*, RuleTreeNode&, bool stub = false);
 void parse_rule_close(snort::SnortConfig*, RuleTreeNode&, OptTreeNode*);
+void parse_rule_finish_portlist(snort::SnortConfig*, RuleTreeNode*, OptTreeNode*);
 
 #endif
 

diff --git a/src/parser/parser.cc b/src/parser/parser.cc
index 1e51dd90b9e5dc1152851584bc1b2ce8ab963206..315a43feab30fb81988af53121b6e1bf73b05306 100644 (file)
--- a/src/parser/parser.cc
+++ b/src/parser/parser.cc
@@ -463,12 +463,14 @@ void ParseRules(SnortConfig* sc)
         p->rules_loaded = get_policy_loaded_rule_count();
         p->rules_shared = get_policy_shared_rule_count();
     }
+}
 
+void ParseRulesFinish(SnortConfig* sc)
+{
     set_ips_policy(sc, 0);
 
     /* Compile/Finish and Print the PortList Tables */
     PortTablesFinish(sc->port_tables, sc->fast_pattern_config);
-
     parse_rule_print();
 }
 

diff --git a/src/parser/parser.h b/src/parser/parser.h
index ec6ef76a33135cb751100638411f72c7cba3be0a..5b4821c91b6303933a16913921e85c2fea856882 100644 (file)
--- a/src/parser/parser.h
+++ b/src/parser/parser.h
@@ -45,6 +45,7 @@ void inc_parse_position();
 snort::SnortConfig* ParseSnortConf(const snort::SnortConfig*, const char* fname = nullptr,
     bool is_fatal = true);
 void ParseRules(snort::SnortConfig*);
+void ParseRulesFinish(snort::SnortConfig*);
 void ShowPolicyStats(const snort::SnortConfig*);
 
 char* ProcessFileOption(snort::SnortConfig*, const char*);