Merge pull request #917 in SNORT/snort3 from RangeCheck_valid to master

Squashed commit of the following:

commit ed402874266886db364e582e062dd4f28813a949
Author: Steven Baigal <sbaigal@cisco.com>
Date:   Thu Jun 1 15:47:29 2017 -0400

    add validate check for range

diff --git a/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc b/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc
index a9de0da0b20402132db113f0d3df1c13d2cd26b2..4b1a96da2466d58539872f894f8c1fa9ed29eaa5 100644 (file)
--- a/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc
+++ b/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc
@@ -120,7 +120,7 @@ bool PktNumModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------

diff --git a/extra/src/ips_options/ips_urg/ips_urg.cc b/extra/src/ips_options/ips_urg/ips_urg.cc
index b2224c38ab906ad50c1669466862a609c313dd3f..f3818bb9506c2dc63b498a6c67676e132e6f5892 100644 (file)
--- a/extra/src/ips_options/ips_urg/ips_urg.cc
+++ b/extra/src/ips_options/ips_urg/ips_urg.cc
@@ -93,10 +93,12 @@ int TcpUrgOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if urgent offset is min<>max | <max | >min" },
+      "check if urgent offset is min<>max | <max | >min, range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -126,7 +128,7 @@ bool UrgModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc
index 8be57d8d5d775888fea012ff23053b640621a3e4..5e55ccaf2984d93b8a1b46a7f3cd444bb9c46508 100644 (file)
--- a/src/ips_options/ips_ack.cc
+++ b/src/ips_options/ips_ack.cc
@@ -127,7 +127,7 @@ bool AckModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_bufferlen.cc b/src/ips_options/ips_bufferlen.cc
index 9718bf24a71187dc738a5248cec26ddcd9d659d7..df072a0a6b7a2e802131ee4b72c0a999729fbeba 100644 (file)
--- a/src/ips_options/ips_bufferlen.cc
+++ b/src/ips_options/ips_bufferlen.cc
@@ -93,10 +93,12 @@ int LenOption::eval(Cursor& c, Packet*)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "len | min<>max | <max | >min" },
+      "len | min<>max | <max | >min, range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -126,7 +128,7 @@ bool LenModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_dsize.cc b/src/ips_options/ips_dsize.cc
index 750ced00fb0064e55274157bc01f6148d5b9ed6b..540fa8a769867b3cd81218184e4d42ea9646927f 100644 (file)
--- a/src/ips_options/ips_dsize.cc
+++ b/src/ips_options/ips_dsize.cc
@@ -99,10 +99,12 @@ int DsizeOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if packet payload size is 'size | min<>max | <max | >min'" },
+      "check if packet payload size is 'size | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -135,7 +137,7 @@ bool DsizeModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc
index e9b97185672d1a3314e9ca4520535dfdbdb56d6e..60f42ca9e643c1b70932c8634df4733fdcaba88f 100644 (file)
--- a/src/ips_options/ips_icmp_id.cc
+++ b/src/ips_options/ips_icmp_id.cc
@@ -124,10 +124,12 @@ int IcmpIdOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if icmp id is 'id | min<>max | <max | >min'" },
+      "check if icmp id is 'id | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -160,7 +162,7 @@ bool IcmpIdModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc
index b775299a0d1853f7fc00d95414dde555f6b18168..6f66bf110a17848334588539ac547994c5b3c15c 100644 (file)
--- a/src/ips_options/ips_icmp_seq.cc
+++ b/src/ips_options/ips_icmp_seq.cc
@@ -125,10 +125,12 @@ int IcmpSeqOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if icmp sequence number is 'seq | min<>max | <max | >min'" },
+      "check if icmp sequence number is 'seq | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -161,7 +163,7 @@ bool IcmpSeqModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_icode.cc b/src/ips_options/ips_icode.cc
index 5c693e64d5a8d6a142605a45d4f1bf2bfdcb0146..9a0353b6c29dd8aaaa6652ddf6f1100f98198bce 100644 (file)
--- a/src/ips_options/ips_icode.cc
+++ b/src/ips_options/ips_icode.cc
@@ -95,10 +95,12 @@ int IcodeOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if ICMP code is 'code | min<>max | <max | >min'" },
+      "check if ICMP code is 'code | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -131,7 +133,7 @@ bool IcodeModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_id.cc b/src/ips_options/ips_id.cc
index e5e282e25c4b7f00d320f35634665d11741c647a..a76cf6740653fb794bef43f1a7745aa28eb1414d 100644 (file)
--- a/src/ips_options/ips_id.cc
+++ b/src/ips_options/ips_id.cc
@@ -129,7 +129,7 @@ bool IpIdModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_itype.cc b/src/ips_options/ips_itype.cc
index 0a9b5b9e479d1014d98620d25467210f57f29965..9aeae999f5c411c30a911ba93853831b9c85a5eb 100644 (file)
--- a/src/ips_options/ips_itype.cc
+++ b/src/ips_options/ips_itype.cc
@@ -96,10 +96,12 @@ int IcmpTypeOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if icmp type is 'type | min<>max | <max | >min'" },
+      "check if icmp type is 'type | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -132,7 +134,7 @@ bool ItypeModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_seq.cc b/src/ips_options/ips_seq.cc
index 62251bff25e1b6b1bb8d3246f3906cf0387c6201..9339f1a8982c475015f6dbd0a168070401d22626 100644 (file)
--- a/src/ips_options/ips_seq.cc
+++ b/src/ips_options/ips_seq.cc
@@ -129,7 +129,7 @@ bool SeqModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_tos.cc b/src/ips_options/ips_tos.cc
index a711fd935972f6faf05e9a035b7d70afc412d2b9..7954160caf3c44284b721e56d8f0d56473cc4452 100644 (file)
--- a/src/ips_options/ips_tos.cc
+++ b/src/ips_options/ips_tos.cc
@@ -97,10 +97,12 @@ int IpTosOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if ip tos value is 'value | min<>max | <max | >min'" },
+      "check if ip tos value is 'value | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -133,7 +135,7 @@ bool TosModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_ttl.cc b/src/ips_options/ips_ttl.cc
index f2433aaaf4d0766663cd9c3a20550c965946d0f3..80d5d868cc8659198b70f77d59cb2b08a748ab34 100644 (file)
--- a/src/ips_options/ips_ttl.cc
+++ b/src/ips_options/ips_ttl.cc
@@ -94,10 +94,12 @@ int TtlOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if ip ttl field value is 'value | min<>max | <max | >min'" },
+      "check if ip ttl field value is 'value | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -130,7 +132,7 @@ bool TtlModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/ips_options/ips_window.cc b/src/ips_options/ips_window.cc
index 26b83c0fb9ddba29e6f7b63e7ed5a3093e542b01..02dc5b0b8ec6187724a73e69a3c9ad2461ceeb86 100644 (file)
--- a/src/ips_options/ips_window.cc
+++ b/src/ips_options/ips_window.cc
@@ -94,10 +94,12 @@ int TcpWinOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if tcp window field size is 'size | min<>max | <max | >min'" },
+      "check if tcp window field size is 'size | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -130,7 +132,7 @@ bool WindowModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/service_inspectors/dce_rpc/ips_dce_iface.cc b/src/service_inspectors/dce_rpc/ips_dce_iface.cc
index a35a252033488f2f17fe96ed705f34cc85f79781..b5d53c876b64c533a6fcc5638bb54fc9e6f39deb 100644 (file)
--- a/src/service_inspectors/dce_rpc/ips_dce_iface.cc
+++ b/src/service_inspectors/dce_rpc/ips_dce_iface.cc
@@ -456,7 +456,7 @@ bool Dce2IfaceModule::begin(const char*, int, SnortConfig*)
 bool Dce2IfaceModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("version") )
-        return version.parse(v.get_string());
+        return version.validate(v.get_string(), "0:");
     else if ( v.is("any_frag") )
         any_frag = true;
     else if ( v.is("uuid") )

diff --git a/src/stream/tcp/ips_stream_size.cc b/src/stream/tcp/ips_stream_size.cc
index f72418a5587e20cf29efd54b9fafd9c1d0e92607..26d18d2fb3f8290fe8455079b6bce544ba1296da 100644 (file)
--- a/src/stream/tcp/ips_stream_size.cc
+++ b/src/stream/tcp/ips_stream_size.cc
@@ -198,14 +198,14 @@ bool SizeModule::begin(const char*, int, SnortConfig*)
 bool SizeModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("~range") )
-        ssod.parse(v.get_string());
+        return ssod.validate(v.get_string(), "0:");
 
     else if ( v.is("~direction") )
         direction = v.get_long();
 
     else
         return false;
-
+    
     return true;
 }