From: Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <oshumeik@cisco.com>
Date: Fri, 29 Jul 2022 10:20:26 +0000 (+0000)
Subject: Pull request #3532: parser: remove 138 from builtin GID exceptions
X-Git-Tag: 3.1.39.0~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c3bd7abe39564d7c78687e41a9b9192772d12324;p=thirdparty%2Fsnort3.git

Pull request #3532: parser: remove 138 from builtin GID exceptions

Merge in SNORT/snort3 from ~VHORBATO/snort3:sd_exc to master

Squashed commit of the following:

commit 2ae8f773e1afbc889c69fc283b28d9f3d31e1825
Author: Vitalii <vhorbato@cisco.com>
Date:   Mon Jul 25 13:43:35 2022 +0300

    parser: remove 138 from builtin GID exceptions
---

diff --git a/src/detection/rules.h b/src/detection/rules.h
index 816a1a541..4d5d3253f 100644
--- a/src/detection/rules.h
+++ b/src/detection/rules.h
@@ -36,9 +36,6 @@
 #define GID_BUILTIN_MIN    100
 #define GID_BUILTIN_MAX    999
 
-// should be revoked in the future
-#define GID_EXCEPTION_SDF  138
-
 #define SESSION_EVENT_SYN_RX 1
 #define SESSION_EVENT_SETUP  2
 #define SESSION_EVENT_CLEAR  3
diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index 4f1b3e886..52eed81c4 100644
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1055,16 +1055,8 @@ static void parse_rule_state(SnortConfig* sc, const RuleTreeNode& rtn, OptTreeNo
 
 static bool is_builtin(uint32_t gid)
 {
-    if ( ModuleManager::gid_in_use(gid) )
-        return true;
-
-    // the builtin range prevents unloaded sids from firing on every packet
-    if ( gid < GID_BUILTIN_MIN or gid > GID_BUILTIN_MAX )
-        return false;
-
-    // not builtin but may get used and abused by snort2lua
-    // should be deleted at some point
-    return gid != GID_EXCEPTION_SDF;
+    return ModuleManager::gid_in_use(gid) or
+        ( gid >= GID_BUILTIN_MIN and gid <= GID_BUILTIN_MAX );
 }
 
 void parse_rule_close(SnortConfig* sc, RuleTreeNode& rtn, OptTreeNode* otn)