From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Tue, 6 Jun 2017 15:47:26 +0000 (-0400)
Subject: Merge pull request #917 in SNORT/snort3 from RangeCheck_valid to master
X-Git-Tag: 3.0.0-239~58
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9b4882885e72ebd398b72c2c3bcc879fc759daeb;p=thirdparty%2Fsnort3.git

Merge pull request #917 in SNORT/snort3 from RangeCheck_valid to master

Squashed commit of the following:

commit ed402874266886db364e582e062dd4f28813a949
Author: Steven Baigal <sbaigal@cisco.com>
Date:   Thu Jun 1 15:47:29 2017 -0400

    add validate check for range
---

diff --git a/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc b/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc
index a9de0da0b..4b1a96da2 100644
--- a/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc
+++ b/extra/src/ips_options/ips_pkt_num/ips_pkt_num.cc
@@ -120,7 +120,7 @@ bool PktNumModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------
diff --git a/extra/src/ips_options/ips_urg/ips_urg.cc b/extra/src/ips_options/ips_urg/ips_urg.cc
index b2224c38a..f3818bb95 100644
--- a/extra/src/ips_options/ips_urg/ips_urg.cc
+++ b/extra/src/ips_options/ips_urg/ips_urg.cc
@@ -93,10 +93,12 @@ int TcpUrgOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if urgent offset is min<>max | <max | >min" },
+      "check if urgent offset is min<>max | <max | >min, range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -126,7 +128,7 @@ bool UrgModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc
index 8be57d8d5..5e55ccaf2 100644
--- a/src/ips_options/ips_ack.cc
+++ b/src/ips_options/ips_ack.cc
@@ -127,7 +127,7 @@ bool AckModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_bufferlen.cc b/src/ips_options/ips_bufferlen.cc
index 9718bf24a..df072a0a6 100644
--- a/src/ips_options/ips_bufferlen.cc
+++ b/src/ips_options/ips_bufferlen.cc
@@ -93,10 +93,12 @@ int LenOption::eval(Cursor& c, Packet*)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "len | min<>max | <max | >min" },
+      "len | min<>max | <max | >min, range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -126,7 +128,7 @@ bool LenModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_dsize.cc b/src/ips_options/ips_dsize.cc
index 750ced00f..540fa8a76 100644
--- a/src/ips_options/ips_dsize.cc
+++ b/src/ips_options/ips_dsize.cc
@@ -99,10 +99,12 @@ int DsizeOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if packet payload size is 'size | min<>max | <max | >min'" },
+      "check if packet payload size is 'size | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -135,7 +137,7 @@ bool DsizeModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc
index e9b971856..60f42ca9e 100644
--- a/src/ips_options/ips_icmp_id.cc
+++ b/src/ips_options/ips_icmp_id.cc
@@ -124,10 +124,12 @@ int IcmpIdOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if icmp id is 'id | min<>max | <max | >min'" },
+      "check if icmp id is 'id | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -160,7 +162,7 @@ bool IcmpIdModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc
index b775299a0..6f66bf110 100644
--- a/src/ips_options/ips_icmp_seq.cc
+++ b/src/ips_options/ips_icmp_seq.cc
@@ -125,10 +125,12 @@ int IcmpSeqOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if icmp sequence number is 'seq | min<>max | <max | >min'" },
+      "check if icmp sequence number is 'seq | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -161,7 +163,7 @@ bool IcmpSeqModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_icode.cc b/src/ips_options/ips_icode.cc
index 5c693e64d..9a0353b6c 100644
--- a/src/ips_options/ips_icode.cc
+++ b/src/ips_options/ips_icode.cc
@@ -95,10 +95,12 @@ int IcodeOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if ICMP code is 'code | min<>max | <max | >min'" },
+      "check if ICMP code is 'code | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -131,7 +133,7 @@ bool IcodeModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_id.cc b/src/ips_options/ips_id.cc
index e5e282e25..a76cf6740 100644
--- a/src/ips_options/ips_id.cc
+++ b/src/ips_options/ips_id.cc
@@ -129,7 +129,7 @@ bool IpIdModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_itype.cc b/src/ips_options/ips_itype.cc
index 0a9b5b9e4..9aeae999f 100644
--- a/src/ips_options/ips_itype.cc
+++ b/src/ips_options/ips_itype.cc
@@ -96,10 +96,12 @@ int IcmpTypeOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if icmp type is 'type | min<>max | <max | >min'" },
+      "check if icmp type is 'type | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -132,7 +134,7 @@ bool ItypeModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_seq.cc b/src/ips_options/ips_seq.cc
index 62251bff2..9339f1a89 100644
--- a/src/ips_options/ips_seq.cc
+++ b/src/ips_options/ips_seq.cc
@@ -129,7 +129,7 @@ bool SeqModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), "0:");
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_tos.cc b/src/ips_options/ips_tos.cc
index a711fd935..7954160ca 100644
--- a/src/ips_options/ips_tos.cc
+++ b/src/ips_options/ips_tos.cc
@@ -97,10 +97,12 @@ int IpTosOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if ip tos value is 'value | min<>max | <max | >min'" },
+      "check if ip tos value is 'value | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -133,7 +135,7 @@ bool TosModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_ttl.cc b/src/ips_options/ips_ttl.cc
index f2433aaaf..80d5d868c 100644
--- a/src/ips_options/ips_ttl.cc
+++ b/src/ips_options/ips_ttl.cc
@@ -94,10 +94,12 @@ int TtlOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:255"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if ip ttl field value is 'value | min<>max | <max | >min'" },
+      "check if ip ttl field value is 'value | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -130,7 +132,7 @@ bool TtlModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/ips_options/ips_window.cc b/src/ips_options/ips_window.cc
index 26b83c0fb..02dc5b0b8 100644
--- a/src/ips_options/ips_window.cc
+++ b/src/ips_options/ips_window.cc
@@ -94,10 +94,12 @@ int TcpWinOption::eval(Cursor&, Packet* p)
 // module
 //-------------------------------------------------------------------------
 
+#define RANGE "0:65535"
+
 static const Parameter s_params[] =
 {
     { "~range", Parameter::PT_STRING, nullptr, nullptr,
-      "check if tcp window field size is 'size | min<>max | <max | >min'" },
+      "check if tcp window field size is 'size | min<>max | <max | >min', range is " RANGE },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -130,7 +132,7 @@ bool WindowModule::set(const char*, Value& v, SnortConfig*)
     if ( !v.is("~range") )
         return false;
 
-    return data.parse(v.get_string());
+    return data.validate(v.get_string(), RANGE);
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/service_inspectors/dce_rpc/ips_dce_iface.cc b/src/service_inspectors/dce_rpc/ips_dce_iface.cc
index a35a25203..b5d53c876 100644
--- a/src/service_inspectors/dce_rpc/ips_dce_iface.cc
+++ b/src/service_inspectors/dce_rpc/ips_dce_iface.cc
@@ -456,7 +456,7 @@ bool Dce2IfaceModule::begin(const char*, int, SnortConfig*)
 bool Dce2IfaceModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("version") )
-        return version.parse(v.get_string());
+        return version.validate(v.get_string(), "0:");
     else if ( v.is("any_frag") )
         any_frag = true;
     else if ( v.is("uuid") )
diff --git a/src/stream/tcp/ips_stream_size.cc b/src/stream/tcp/ips_stream_size.cc
index f72418a55..26d18d2fb 100644
--- a/src/stream/tcp/ips_stream_size.cc
+++ b/src/stream/tcp/ips_stream_size.cc
@@ -198,14 +198,14 @@ bool SizeModule::begin(const char*, int, SnortConfig*)
 bool SizeModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("~range") )
-        ssod.parse(v.get_string());
+        return ssod.validate(v.get_string(), "0:");
 
     else if ( v.is("~direction") )
         direction = v.get_long();
 
     else
         return false;
-
+    
     return true;
 }