dce2_config.c

snort2.8.4版本

                        _dpd.logMsg("%s(%d) => %s: Invalid option.\n",
                                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                        return DCE2_RET__ERROR;
                    }

                    opt_flag = DCE2_GcParseOption(opt_start, ptr, &option_mask);

                    switch (opt_flag)
                    {
                        case DCE2_GC_OPT_FLAG__MEMCAP:
                            if (DCE2_GcParseMemcap(gc, &ptr, end) != DCE2_RET__SUCCESS)
                            {
                                _dpd.logMsg("%s(%d) => %s: Failed to parse memcap.\n",
                                            *_dpd.config_file, *_dpd.config_line, DCE2_SNAME);

                                return DCE2_RET__ERROR;
                            }

                            break;

                        case DCE2_GC_OPT_FLAG__DISABLE_DEFRAG:
                            gc->dce_defrag = DCE2_CS__DISABLED;
                            break;

                        case DCE2_GC_OPT_FLAG__MAX_FRAG_LEN:
                            if (DCE2_GcParseMaxFrag(gc, &ptr, end) != DCE2_RET__SUCCESS)
                            {
                                _dpd.logMsg("%s(%d) => %s: Failed to parse max frag.\n",
                                            *_dpd.config_file, *_dpd.config_line, DCE2_SNAME);

                                return DCE2_RET__ERROR;
                            }

                            break;

                        case DCE2_GC_OPT_FLAG__EVENTS:
                            if (DCE2_GcParseEvents(gc, &ptr, end) != DCE2_RET__SUCCESS)
                            {
                                _dpd.logMsg("%s(%d) => %s: Failed to parse events.\n",
                                            *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                                return DCE2_RET__ERROR;
                            }

                            break;

                        case DCE2_GC_OPT_FLAG__REASSEMBLE_THRESHOLD:
                            if (DCE2_GcParseReassembleThreshold(gc, &ptr, end) != DCE2_RET__SUCCESS)
                            {
                                _dpd.logMsg("%s(%d) => %s: Failed to parse reassemble threshold.\n",
                                            *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                                return DCE2_RET__ERROR;
                            }

                            break;

                        default:
                            _dpd.logMsg("%s(%d) => %s: Invalid option.\n",
                                        *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                            return DCE2_RET__ERROR;
                    }

                    state = DCE2_GC_STATE__OPT_END;
                    continue;
                }

                break;

            case DCE2_GC_STATE__OPT_END:
                if (DCE2_IsConfigEndChar(c))
                {
                    return DCE2_RET__SUCCESS;
                }
                else if (DCE2_IsOptEndChar(c))
                {
                    state = DCE2_GC_STATE__OPT_START;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid end of option.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            default:
                _dpd.logMsg("%s(%d) => %s: Invalid option state.\n", __FILE__, __LINE__, DCE2_GNAME);
                return DCE2_RET__ERROR;
        }

        last_char = c;
        ptr++;
    }

    return DCE2_RET__ERROR;
}

/********************************************************************
 * Function: DCE2_GcParseOption()
 *
 * Parses the option and returns an option flag.  Checks to make
 * sure option is only configured once.
 *
 * Arguments:
 *  char *
 *      Pointer to the first character of the option name.
 *  char *
 *      Pointer to the byte after the last character of
 *      the option name.
 *  int
 *      Pointer to the current option mask.  Contains bits set
 *      for each option that has already been configured.  Mask
 *      is checked and updated for new option.
 *
 * Returns:
 *  DCE2_GcOptFlag
 *      Flag for the global option that is being configured.
 *      NULL flag if not a valid option or option has already
 *          been configured.
 *
 ********************************************************************/
static INLINE DCE2_GcOptFlag DCE2_GcParseOption(char *opt_start, char *opt_end, int *opt_mask)
{
    DCE2_GcOptFlag opt_flag = DCE2_GC_OPT_FLAG__NULL;
    size_t opt_len = opt_end - opt_start;

    if (opt_len == strlen(DCE2_GOPT__MEMCAP) &&
        strncasecmp(DCE2_GOPT__MEMCAP, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_GC_OPT_FLAG__MEMCAP;
    }
    else if (opt_len == strlen(DCE2_GOPT__DISABLE_DEFRAG) &&
             strncasecmp(DCE2_GOPT__DISABLE_DEFRAG, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_GC_OPT_FLAG__DISABLE_DEFRAG;
    }
    else if (opt_len == strlen(DCE2_GOPT__MAX_FRAG_LEN) &&
             strncasecmp(DCE2_GOPT__MAX_FRAG_LEN, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_GC_OPT_FLAG__MAX_FRAG_LEN;
    }
    else if (opt_len == strlen(DCE2_GOPT__EVENTS) &&
             strncasecmp(DCE2_GOPT__EVENTS, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_GC_OPT_FLAG__EVENTS;
    }
    else if (opt_len == strlen(DCE2_GOPT__REASSEMBLE_THRESHOLD) &&
             strncasecmp(DCE2_GOPT__REASSEMBLE_THRESHOLD, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_GC_OPT_FLAG__REASSEMBLE_THRESHOLD;
    }

    if (DCE2_CheckAndSetMask(opt_flag, opt_mask) != DCE2_RET__SUCCESS)
    {
        _dpd.logMsg("%s(%d) => %s: Can only configure opt_flag once: %.*s\n",
                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME, opt_len, opt_start);

        return DCE2_GC_OPT_FLAG__NULL;
    }

    return opt_flag;
}

/********************************************************************
 * Function: DCE2_GcParseMemcap()
 *
 * Parses the argument to the memcap option and adds to global
 * configuration if successfully parsed.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to the global configuration structure.
 *  char **
 *      Pointer to the pointer to the current position in the
 *      configuration line.  This is updated to the current position
 *      after parsing memcap.
 *  char *
 *      Pointer to the end of the configuration line.
 *
 * Returns:
 *  DCE2_Ret
 *      DCE2_RET__SUCCESS if we were able to successfully parse the
 *          value for the memcap.
 *      DCE2_RET__ERROR if an error occured in parsing the memcap.
 *
 ********************************************************************/
static DCE2_Ret DCE2_GcParseMemcap(DCE2_GlobalConfig *gc, char **ptr, char *end)
{
    uint32_t memcap;

    if (DCE2_ParseValue(ptr, end, &memcap, DCE2_INT_TYPE__UINT32) != DCE2_RET__SUCCESS)
    {
        _dpd.logMsg("%s(%d) => %s: %s: Error parsing memcap. Memcap must be between "
                    "%d and %d KB.\n", *_dpd.config_file, *_dpd.config_line, DCE2_GNAME,
                    DCE2_GOPT__MEMCAP, DCE2_MEMCAP__MIN, DCE2_MEMCAP__MAX);

        return DCE2_RET__ERROR;
    }

    if ((memcap < DCE2_MEMCAP__MIN) || (memcap > DCE2_MEMCAP__MAX))
    {
        _dpd.logMsg("%s(%d) => %s: %s: Invalid memcap: %u. Memcap must be between "
                    "%d and %d KB.\n", *_dpd.config_file, *_dpd.config_line, DCE2_GNAME,
                    DCE2_GOPT__MEMCAP, memcap, DCE2_MEMCAP__MIN, DCE2_MEMCAP__MAX);

        return DCE2_RET__ERROR;
    }

    /* Memcap is configured as kilobytes - convert to bytes */
    gc->memcap = memcap * 1024;

    return DCE2_RET__SUCCESS;
}

/********************************************************************
 * Function: DCE2_GcParseMaxFrag()
 *
 * Parses the argument to the max frag option and adds to global
 * configuration if successfully parsed.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to the global configuration structure.
 *  char **
 *      Pointer to the pointer to the current position in the
 *      configuration line.  This is updated to the current position
 *      after parsing max frag.
 *  char *
 *      Pointer to the end of the configuration line.
 *
 * Returns:
 *  DCE2_Ret
 *      DCE2_RET__SUCCESS if we were able to successfully parse the
 *          value for the max frag option.
 *      DCE2_RET__ERROR if an error occured in parsing the max frag
 *          option.
 *
 ********************************************************************/
static DCE2_Ret DCE2_GcParseMaxFrag(DCE2_GlobalConfig *gc, char **ptr, char *end)
{
    uint16_t max_frag_len;

    if (DCE2_ParseValue(ptr, end, &max_frag_len, DCE2_INT_TYPE__UINT16) != DCE2_RET__SUCCESS)
    {
        _dpd.logMsg("%s(%d) => %s: %s: Error parsing max frag value: %.*s. Value must be between "
                    "%d and %d.\n", *_dpd.config_file, *_dpd.config_line, DCE2_GNAME,
                    DCE2_GOPT__MAX_FRAG_LEN, end - *ptr, *ptr,
                    DCE2_MAX_FRAG__MIN, DCE2_MAX_FRAG__MAX);

        return DCE2_RET__ERROR;
    }

    if (max_frag_len < DCE2_MAX_FRAG__MIN)
    {
        _dpd.logMsg("%s(%d) => %s: %s: Invalid max frag value: %d. Value must be between "
                    "%d and %d.\n", *_dpd.config_file, *_dpd.config_line, DCE2_GNAME,
                    DCE2_GOPT__MAX_FRAG_LEN, max_frag_len, DCE2_MAX_FRAG__MIN, DCE2_MAX_FRAG__MAX);

        return DCE2_RET__ERROR;
    }

    /* Cast since we initialize max frag len in global structure to a sentinel */
    gc->max_frag_len = (int)max_frag_len;

    return DCE2_RET__SUCCESS;
}

/********************************************************************
 * Function: DCE2_GcParseEvents()
 *
 * Parses the event types for the events option and adds to
 * global configuration.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to the global configuration structure.
 *  char **
 *      Pointer to the pointer to the current position in the
 *      configuration line.  This is updated to the current position
 *      after parsing memcap.
 *  char *
 *      Pointer to the end of the configuration line.
 *
 * Returns:
 *  DCE2_Ret
 *      DCE2_RET__SUCCESS if we were able to successfully parse the
 *          events.
 *      DCE2_RET__ERROR if an error occured in parsing the events.
 *
 ********************************************************************/
static DCE2_Ret DCE2_GcParseEvents(DCE2_GlobalConfig *gc, char **ptr, char *end)
{
    DCE2_WordListState state = DCE2_WORD_LIST_STATE__START;
    char *event_start = *ptr;
    char last_char = 0;
    int one_event = 0;
    int event_mask = 0;

    DCE2_GcClearAllEvents(gc);

    while (*ptr < end)
    {
        char c = **ptr;

        if (state == DCE2_WORD_LIST_STATE__END)
            break;

        switch (state)
        {
            case DCE2_WORD_LIST_STATE__START:
                if (DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__START))
                {
                    /* Only one event */
                    event_start = *ptr;
                    one_event = 1;
                    state = DCE2_WORD_LIST_STATE__WORD;
                }
                else if (DCE2_IsListStartChar(c))
                {
                    state = DCE2_WORD_LIST_STATE__WORD_START;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid events argument.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            case DCE2_WORD_LIST_STATE__WORD_START:
                if (DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__START))
                {
                    event_start = *ptr;
                    state = DCE2_WORD_LIST_STATE__WORD;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid events argument.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            case DCE2_WORD_LIST_STATE__WORD:
                if (!DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__MIDDLE))
                {
                    DCE2_EventFlag eflag;

                    if (!DCE2_IsWordChar(last_char, DCE2_WORD_CHAR_POSITION__END))
                    {
                        _dpd.logMsg("%s(%d) => %s: Invalid events argument.\n",
                                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                        return DCE2_RET__ERROR;
                    }


                    eflag = DCE2_GcParseEvent(event_start, *ptr, &event_mask);
                    switch (eflag)
                    {
                        case DCE2_EVENT_FLAG__NULL: