]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
coccinelle: add tcp flag check 341/head
authorEric Leblond <eric@regit.org>
Mon, 8 Apr 2013 17:16:31 +0000 (19:16 +0200)
committerEric Leblond <eric@regit.org>
Tue, 9 Apr 2013 07:09:26 +0000 (09:09 +0200)
The different TCP related structures have all a flags field and its
value must match the type of structure. This patch adds a check
alerting on invalid value usage.

qa/coccinelle/tcp-struct-flags.cocci [new file with mode: 0644]

diff --git a/qa/coccinelle/tcp-struct-flags.cocci b/qa/coccinelle/tcp-struct-flags.cocci
new file mode 100644 (file)
index 0000000..5c8b34d
--- /dev/null
@@ -0,0 +1,38 @@
+@flags@
+TcpSession *ssn;
+identifier ssn_flags =~ "^(?!STREAMTCP_FLAG).+";
+TcpStream *stream;
+identifier stream_flags =~ "^(?!STREAMTCP_STREAM_FLAG).+";
+TcpSegment *segment;
+identifier segment_flags =~ "^(?!SEGMENTTCP_FLAG)_.+";
+position p1;
+@@
+
+(
+ssn->flags@p1 |= ssn_flags
+|
+ssn->flags@p1 & ssn_flags
+|
+ssn->flags@p1 &= ~ssn_flags
+|
+stream->flags@p1 |= stream_flags
+|
+stream->flags@p1 & stream_flags
+|
+stream->flags@p1 &= ~stream_flags
+|
+segment->flags@p1 |= segment_flags
+|
+segment->flags@p1 &= ~segment_flags
+|
+segment->flags@p1 & segment_flags
+)
+
+
+@script:python@
+p1 << flags.p1;
+@@
+
+print "Invalid usage of flags field at %s:%s, flags value is incorrect (wrong family)." % (p1[0].file, p1[0].line)
+import sys
+sys.exit(1)