From: Russ Combs Date: Tue, 6 Jan 2015 19:30:56 +0000 (-0500) Subject: fixed stream_size option X-Git-Tag: 3.0.0-233~1091^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a3d16cbcf82cf277cde7a29845055ee71f798d9a;p=thirdparty%2Fsnort3.git fixed stream_size option --- diff --git a/ChangeLog b/ChangeLog index 7e22bdfd5..cda75e915 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,5 @@ +-- fixed stream_size rule option + 15/01/05 - build 132 -- added this change log diff --git a/src/framework/range.cc b/src/framework/range.cc index b80d3d88a..856be93e1 100644 --- a/src/framework/range.cc +++ b/src/framework/range.cc @@ -137,6 +137,7 @@ bool RangeCheck::parse(const char* s) max = b; break; case LG: + case LEG: min = a; max = b; break; diff --git a/src/stream/tcp/ips_stream_size.cc b/src/stream/tcp/ips_stream_size.cc index 652d0175b..53a2684b1 100644 --- a/src/stream/tcp/ips_stream_size.cc +++ b/src/stream/tcp/ips_stream_size.cc @@ -25,60 +25,13 @@ #include "framework/ips_option.h" #include "framework/module.h" #include "framework/parameter.h" +#include "framework/range.h" #include "detection/detect.h" #include "detection/detection_defines.h" #include "hash/sfhashfcn.h" #include "time/profiler.h" #include "sfip/sf_ip.h" -enum SsodOp -{ - SSOD_EQ = 1, - SSOD_NE, - SSOD_LT, - SSOD_GT, - SSOD_LE, - SSOD_GE, - SSOD_MAX -}; - -struct StreamSizeOptionData -{ - SsodOp opcode; - uint32_t size; - char direction; - - bool compare(uint32_t, uint32_t); -}; - -bool StreamSizeOptionData::compare(uint32_t size1, uint32_t size2) -{ - switch (opcode) - { - case SSOD_EQ: - return (size1 == size2); - - case SSOD_NE: - return (size1 != size2); - - case SSOD_LT: - return (size1 < size2); - - case SSOD_GT: - return (size1 > size2); - - case SSOD_LE: - return (size1 <= size2); - - case SSOD_GE: - return (size1 >= size2); - - default: - break; - } - return false; -} - //------------------------------------------------------------------------- // stream_size //------------------------------------------------------------------------- @@ -92,9 +45,9 @@ static THREAD_LOCAL ProfileStats streamSizePerfStats; class SizeOption : public IpsOption { public: - SizeOption(const StreamSizeOptionData& c) : + SizeOption(const RangeCheck& c, int dir) : IpsOption(s_name) - { ssod = c; }; + { ssod = c; direction = dir; }; uint32_t hash() const override; bool operator==(const IpsOption&) const override; @@ -102,7 +55,8 @@ public: int eval(Cursor&, Packet*) override; private: - StreamSizeOptionData ssod; + RangeCheck ssod; + int direction; }; //------------------------------------------------------------------------- @@ -113,11 +67,14 @@ uint32_t SizeOption::hash() const { uint32_t a,b,c; - a = ssod.direction; - b = ssod.opcode; - c = ssod.size; + a = ssod.op; + b = ssod.min; + c = ssod.max; mix(a,b,c); + + a = direction; + mix_str(a,b,c,get_name()); final(a,b,c); @@ -131,9 +88,7 @@ bool SizeOption::operator==(const IpsOption& ips) const const SizeOption& rhs = (SizeOption&)ips; - if ( (ssod.direction == rhs.ssod.direction) && - (ssod.opcode == rhs.ssod.opcode) && - (ssod.size == rhs.ssod.size) ) + if ( (direction == rhs.direction) && (ssod == rhs.ssod) ) return true; return false; @@ -176,32 +131,26 @@ int SizeOption::eval(Cursor&, Packet* pkt) int result = DETECTION_OPTION_NO_MATCH; - switch (ssod.direction) + switch ( direction ) { case SSN_DIR_FROM_CLIENT: - if ( ssod.compare(client_size, ssod.size) ) + if ( ssod.eval(client_size) ) result = DETECTION_OPTION_MATCH; break; case SSN_DIR_FROM_SERVER: - if ( ssod.compare(server_size, ssod.size) ) + if ( ssod.eval(server_size) ) result = DETECTION_OPTION_MATCH; break; case SSN_DIR_NONE: /* overloaded. really, its an 'either' */ - if ( ssod.compare(client_size, ssod.size) || - ssod.compare(server_size, ssod.size) ) - { + if ( ssod.eval(client_size) || ssod.eval(server_size) ) result = DETECTION_OPTION_MATCH; - } break; case SSN_DIR_BOTH: - if ( ssod.compare(client_size, ssod.size) && - ssod.compare(server_size, ssod.size) ) - { + if ( ssod.eval(client_size) && ssod.eval(server_size) ) result = DETECTION_OPTION_MATCH; - } break; default: @@ -217,15 +166,12 @@ int SizeOption::eval(Cursor&, Packet* pkt) static const Parameter s_params[] = { - { "direction", Parameter::PT_ENUM, "either|client|server|both", nullptr, - "compare applies to the given direction(s)" }, - - { "operator", Parameter::PT_ENUM, "= | != | < | > | <= | >=", nullptr, - "how to compare" }, - - { "size", Parameter::PT_INT, nullptr, nullptr, + { "~range", Parameter::PT_STRING, nullptr, nullptr, "size for comparison" }, + { "~direction", Parameter::PT_ENUM, "either|to_server|to_client|both", nullptr, + "compare applies to the given direction(s)" }, + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -240,27 +186,24 @@ public: ProfileStats* get_profile() const override { return &streamSizePerfStats; }; - StreamSizeOptionData ssod; + RangeCheck ssod; + int direction; }; bool SizeModule::begin(const char*, int, SnortConfig*) { - ssod.direction = 0; - ssod.opcode = SSOD_EQ; - ssod.size = 0; + ssod.init(); + direction = 0; return true; } bool SizeModule::set(const char*, Value& v, SnortConfig*) { - if ( v.is("*direction") ) - ssod.direction = v.get_long(); - - else if ( v.is("*operator") ) - ssod.opcode = (SsodOp)(v.get_long() + 1); + if ( v.is("~range") ) + ssod.parse(v.get_string()); - else if ( v.is("*size") ) - ssod.size = 0; + else if ( v.is("~direction") ) + direction = v.get_long(); else return false; @@ -285,7 +228,7 @@ static void mod_dtor(Module* m) static IpsOption* size_ctor(Module* p, OptTreeNode*) { SizeModule* m = (SizeModule*)p; - return new SizeOption(m->ssod); + return new SizeOption(m->ssod, m->direction); } static void opt_dtor(IpsOption* p)