From: Russ Combs Date: Fri, 22 Aug 2014 15:54:58 +0000 (-0400) Subject: error tweaks X-Git-Tag: 3.0.0-233~1419^2~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d58a7df6f36e175f9cf15bf5063c06d3d6db6dfd;p=thirdparty%2Fsnort3.git error tweaks --- diff --git a/src/actions/act_reject.cc b/src/actions/act_reject.cc index d29c7a6c6..adb782a0d 100644 --- a/src/actions/act_reject.cc +++ b/src/actions/act_reject.cc @@ -61,14 +61,14 @@ #include "framework/parameter.h" #include "framework/module.h" -#define REJ_RST_SND 0x01 -#define REJ_RST_RCV 0x02 +#define REJ_RST_SRC 0x01 +#define REJ_RST_DST 0x02 #define REJ_UNR_NET 0x04 #define REJ_UNR_HOST 0x08 #define REJ_UNR_PORT 0x10 -#define REJ_RST (REJ_RST_SND|REJ_RST_RCV) -#define REJ_UNR (REJ_UNR_NET|REJ_UNR_HOST|REJ_UNR_PORT) +#define REJ_RST_BOTH (REJ_RST_SRC|REJ_RST_DST) +#define REJ_UNR_ALL (REJ_UNR_NET|REJ_UNR_HOST|REJ_UNR_PORT) static const char* s_name = "reject"; @@ -108,15 +108,15 @@ void RejectAction::send(Packet* p) uint32_t flags = 0; if ( Active_IsRSTCandidate(p) ) - flags |= (mask & REJ_RST); + flags |= (mask & REJ_RST_BOTH); if ( Active_IsUNRCandidate(p) ) - flags |= (mask & REJ_UNR); + flags |= (mask & REJ_UNR_ALL); - if ( flags & REJ_RST_SND ) + if ( flags & REJ_RST_SRC ) Active_SendReset(p, 0); - if ( flags & REJ_RST_RCV ) + if ( flags & REJ_RST_DST ) Active_SendReset(p, ENC_FLAG_FWD); if ( flags & REJ_UNR_NET ) @@ -137,35 +137,11 @@ void RejectAction::send(Packet* p) static const Parameter rej_params[] = { - { "reset_source", Parameter::PT_STRING, nullptr, nullptr, - "reset sender" }, + { "reset", Parameter::PT_ENUM, "source|dest|both", nullptr, + "send tcp reset to one or both ends" }, - { "rst_snd", Parameter::PT_STRING, nullptr, nullptr, - "reset sender" }, - - { "reset_dest", Parameter::PT_STRING, nullptr, nullptr, - "reset receiver" }, - - { "rst_rcv", Parameter::PT_STRING, nullptr, nullptr, - "reset receiver" }, - - { "reset_both", Parameter::PT_STRING, nullptr, nullptr, - "reset both sender and receiver" }, - - { "rst_all", Parameter::PT_STRING, nullptr, nullptr, - "reset both sender and receiver" }, - - { "icmp_net", Parameter::PT_STRING, nullptr, nullptr, - "send icmp network unreachable to sender" }, - - { "icmp_host", Parameter::PT_STRING, nullptr, nullptr, - "send icmp host unreachable to sender" }, - - { "icmp_port", Parameter::PT_STRING, nullptr, nullptr, - "send icmp port unreachable to sender" }, - - { "icmp_all", Parameter::PT_STRING, nullptr, nullptr, - "send icmp net, host, and port unreachable to sender" }, + { "control", Parameter::PT_ENUM, "network|host|port|all", nullptr, + "send icmp unreachable(s)" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -176,6 +152,7 @@ public: RejectModule() : Module(s_name, rej_params) { }; bool begin(const char*, int, SnortConfig*); + bool end(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); ProfileStats* get_profile() const @@ -190,28 +167,33 @@ bool RejectModule::begin(const char*, int, SnortConfig*) return true; } -bool RejectModule::set(const char*, Value& v, SnortConfig*) +bool RejectModule::end(const char*, int, SnortConfig*) { - if ( v.is("reset_source") || v.is("rst_snd") ) - flags |= REJ_RST_SND; - - else if ( v.is("reset_dest") || v.is("rst_rcv") ) - flags |= REJ_RST_RCV; - - else if ( v.is("reset_both") || v.is("rst_all") ) - flags |= (REJ_RST_RCV | REJ_RST_SND); + return ( flags != 0 ); +} - else if ( v.is("icmp_net") ) - flags |= REJ_UNR_NET; +static const int rst[] = +{ + REJ_RST_SRC, + REJ_RST_DST, + REJ_RST_BOTH +}; - else if ( v.is("icmp_host") ) - flags |= REJ_UNR_HOST; +static const int unr[] = +{ + REJ_UNR_PORT, + REJ_UNR_HOST, + REJ_UNR_NET, + REJ_UNR_ALL +}; - else if ( v.is("icmp_port") ) - flags |= REJ_UNR_PORT; +bool RejectModule::set(const char*, Value& v, SnortConfig*) +{ + if ( v.is("reset") ) + flags |= rst[v.get_long()]; - else if ( v.is("icmp_all") ) - flags |= (REJ_UNR_NET | REJ_UNR_HOST | REJ_UNR_PORT); + else if ( v.is("control") ) + flags |= unr[v.get_long()]; else return false; diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc index eb65fd908..4fbc66774 100644 --- a/src/ips_options/ips_content.cc +++ b/src/ips_options/ips_content.cc @@ -703,50 +703,6 @@ static void parse_within(PatternMatchData* pmd, const char *data) pmd->relative = 1; } -static const char* error_str = - "fast_pattern_offset + fast_pattern_length must be less " - "than or equal to the actual pattern length which is %u."; - -static void parse_fast_pattern_offset(PatternMatchData* pmd, const char *data) -{ - if (data == NULL) - { - ParseError("missing argument to 'fast_pattern_offset' option"); - return; - } - - long offset = parse_int(data, "fast_pattern_offset", 0, UINT16_MAX); - - if ((int)pmd->pattern_size < (offset + pmd->fp_length)) - { - ParseError(error_str, data, pmd->pattern_size); - return; - } - - pmd->fp_offset = offset; - pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible -} - -static void parse_fast_pattern_length(PatternMatchData* pmd, const char *data) -{ - if (data == NULL) - { - ParseError("missing argument to 'fast_pattern_length' option"); - return; - } - - long length = parse_int(data, "fast_pattern_length", 0, UINT16_MAX); - - if ((int)pmd->pattern_size < (pmd->fp_offset + length)) - { - ParseError(error_str, data, pmd->pattern_size); - return; - } - - pmd->fp_length = length; - pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible -} - //------------------------------------------------------------------------- // module //------------------------------------------------------------------------- @@ -820,6 +776,22 @@ bool ContentModule::begin(const char*, int, SnortConfig*) bool ContentModule::end(const char*, int, SnortConfig*) { + if ( (int)pmd->pattern_size <= pmd->fp_offset ) + { + ParseError( + "fast_pattern_offset must be less " + "than the actual pattern length which is %u.", + pmd->pattern_size); + return false; + } + if ( (int)pmd->pattern_size < (pmd->fp_offset + pmd->fp_length) ) + { + ParseError( + "fast_pattern_offset + fast_pattern_length must be less " + "than or equal to the actual pattern length which is %u.", + pmd->pattern_size); + return false; + } if ( pmd->no_case ) { for ( unsigned i = 0; i < pmd->pattern_size; i++ ) @@ -852,11 +824,15 @@ bool ContentModule::set(const char*, Value& v, SnortConfig*) pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible else if ( v.is("fast_pattern_offset") ) - parse_fast_pattern_offset(pmd, v.get_string()); - + { + pmd->fp_offset = v.get_long(); + pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible + } else if ( v.is("fast_pattern_length") ) - parse_fast_pattern_length(pmd, v.get_string()); - + { + pmd->fp_length = v.get_long(); + pmd->fp = 1; // FIXIT-H must ensure current buffer is fp compatible + } else return false; diff --git a/src/main/shell.cc b/src/main/shell.cc index 00a78c902..b32713237 100644 --- a/src/main/shell.cc +++ b/src/main/shell.cc @@ -108,8 +108,8 @@ static void config_lua( run_config(L); - if ( ModuleManager::get_errors() ) - FatalError("%s\n", "see prior configuration errors"); + if ( int k = ModuleManager::get_errors() ) + FatalError("see prior %d errors\n", k); ModuleManager::set_config(nullptr); }