dce2_config.c

snort2.8.4版本

                            _dpd.logMsg("%s(%d) => %s: Invalid event specified.\n",
                                        *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                            return DCE2_RET__ERROR;

                        case DCE2_EVENT_FLAG__NONE:
                            if (!one_event)
                            {
                                _dpd.logMsg("%s(%d) => %s: Event type \"%s\" cannot be "
                                            "configured in a list.\n", *_dpd.config_file,
                                            *_dpd.config_line, DCE2_GNAME, DCE2_GARG__EVENTS_NONE);

                                return DCE2_RET__ERROR;
                            }

                            /* Not really necessary since we're returning early,
                             * but leave it here since this would be the action */
                            DCE2_GcClearAllEvents(gc);

                            break;

                        case DCE2_EVENT_FLAG__ALL:
                            if (!one_event)
                            {
                                _dpd.logMsg("%s(%d) => %s: Event type \"%s\" cannot be "
                                            "configured in a list.\n", *_dpd.config_file,
                                            *_dpd.config_line, DCE2_GNAME, DCE2_GARG__EVENTS_ALL);

                                return DCE2_RET__ERROR;
                            }

                            DCE2_GcSetEvent(gc, eflag);

                            break;

                        default:
                            DCE2_GcSetEvent(gc, eflag);
                            break;
                    }

                    if (one_event)
                        return DCE2_RET__SUCCESS;

                    state = DCE2_WORD_LIST_STATE__WORD_END;
                    continue;
                }

                break;

            case DCE2_WORD_LIST_STATE__WORD_END:
                if (DCE2_IsListEndChar(c))
                {
                    state = DCE2_WORD_LIST_STATE__END;
                }
                else if (DCE2_IsListSepChar(c))
                {
                    state = DCE2_WORD_LIST_STATE__WORD_START;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid events argument.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            default:
                _dpd.logMsg("%s(%d) => %s: Invalid events state.\n", __FILE__, __LINE__, DCE2_GNAME);
                return DCE2_RET__ERROR;
        }

        last_char = c;
        (*ptr)++;
    }

    if (state != DCE2_WORD_LIST_STATE__END)
        return DCE2_RET__ERROR;

    return DCE2_RET__SUCCESS;
}

/********************************************************************
 * Function: DCE2_GcParseEvent()
 *
 * Parses event type and returns flag indication the type of event.
 * Checks and sets a bit in a mask to prevent multiple 
 * configurations of the same event type.
 *
 * Arguments:
 *  char *
 *      Pointer to the first character of the event type name.
 *  char *
 *      Pointer to the byte after the last character of
 *      the event type name.
 *  int
 *      Pointer to the current event type mask.  Contains bits set
 *      for each event type that has already been configured.  Mask
 *      is checked and updated for new event type.
 *
 * Returns:
 *  DCE2_EventFlag
 *      Flag indicating the type of event.
 *      DCE2_EVENT_FLAG__NULL if no event type or multiple
 *          configuration of event type.
 *
 ********************************************************************/
static INLINE DCE2_EventFlag DCE2_GcParseEvent(char *start, char *end, int *emask)
{
    int eflag = DCE2_EVENT_FLAG__NULL;
    size_t event_len = end - start;

    if (event_len == strlen(DCE2_GARG__EVENTS_NONE) &&
        strncasecmp(DCE2_GARG__EVENTS_NONE, start, event_len) == 0)
    {
        eflag = DCE2_EVENT_FLAG__NONE;
    }
    else if (event_len == strlen(DCE2_GARG__EVENTS_MEMCAP) &&
             strncasecmp(DCE2_GARG__EVENTS_MEMCAP, start, event_len) == 0)
    {
        eflag = DCE2_EVENT_FLAG__MEMCAP;
    }
    else if (event_len == strlen(DCE2_GARG__EVENTS_SMB) &&
             strncasecmp(DCE2_GARG__EVENTS_SMB, start, event_len) == 0)
    {
        eflag = DCE2_EVENT_FLAG__SMB;
    }
    else if (event_len == strlen(DCE2_GARG__EVENTS_CO) &&
             strncasecmp(DCE2_GARG__EVENTS_CO, start, event_len) == 0)
    {
        eflag = DCE2_EVENT_FLAG__CO;
    }
    else if (event_len == strlen(DCE2_GARG__EVENTS_CL) &&
             strncasecmp(DCE2_GARG__EVENTS_CL, start, event_len) == 0)
    {
        eflag = DCE2_EVENT_FLAG__CL;
    }
    else if (event_len == strlen(DCE2_GARG__EVENTS_ALL) &&
             strncasecmp(DCE2_GARG__EVENTS_ALL, start, event_len) == 0)
    {
        eflag = DCE2_EVENT_FLAG__ALL;
    }

    if (DCE2_CheckAndSetMask(eflag, emask) != DCE2_RET__SUCCESS)
    {
        _dpd.logMsg("%s(%d) => %s: Event type cannot be specified more than once: %.*s\n",
                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME, event_len, start);

        return DCE2_EVENT_FLAG__NULL;
    }

    return eflag;
}

/*********************************************************************
 * Function: DCE2_GcSetEvent()
 *
 * Sets the event types the user wants to see during processing in
 * the global configuration event mask.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to global config structure.
 *  DCE2_EventFlag
 *      The event type flag to set.
 *
 * Returns: None
 *
 *********************************************************************/
static INLINE void DCE2_GcSetEvent(DCE2_GlobalConfig *gc, DCE2_EventFlag eflag)
{
    gc->event_mask |= eflag;
}

/*********************************************************************
 * Function: DCE2_GcClearEvent()
 *
 * Clears the bit associated with the event type flag passed in for
 * the global configuration event mask.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to global config structure.
 *  DCE2_EventFlag
 *      The event type flag to clear.
 *
 * Returns: None
 *
 *********************************************************************/
static INLINE void DCE2_GcClearEvent(DCE2_GlobalConfig *gc, DCE2_EventFlag eflag)
{
    gc->event_mask &= ~eflag;
}

/*********************************************************************
 * Function: DCE2_GcClearAllEvents()
 *
 * Clears all of the bits in the global configuration event mask.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to global config structure.
 *
 * Returns: None
 *
 *********************************************************************/
static INLINE void DCE2_GcClearAllEvents(DCE2_GlobalConfig *gc)
{
    gc->event_mask = DCE2_EVENT_FLAG__NULL;
}

/********************************************************************
 * Function: DCE2_GcParseReassembleThreshold()
 *
 * Parses the argument to the reassemble threshold option and adds
 * to global configuration if successfully parsed.
 *
 * Arguments:
 *  DCE2_GlobalConfig *
 *      Pointer to the global configuration structure.
 *  char **
 *      Pointer to the pointer to the current position in the
 *      configuration line.  This is updated to the current position
 *      after parsing the reassemble threshold.
 *  char *
 *      Pointer to the end of the configuration line.
 *
 * Returns:
 *  DCE2_Ret
 *      DCE2_RET__SUCCESS if we were able to successfully parse the
 *          value for the reassemble threshold.
 *      DCE2_RET__ERROR if an error occured in parsing the
 *          reassemble threshold.
 *
 ********************************************************************/
static DCE2_Ret DCE2_GcParseReassembleThreshold(DCE2_GlobalConfig *gc, char **ptr, char *end)
{
    uint16_t reassemble_threshold;

    if (DCE2_ParseValue(ptr, end, &reassemble_threshold, DCE2_INT_TYPE__UINT16) != DCE2_RET__SUCCESS)
    {
        _dpd.logMsg("%s(%d) => %s: Error parsing reassemble threshold: %.*s. "
                    "Threshold must be between 0 and 65535.\n",
                    *_dpd.config_file, *_dpd.config_line,
                    DCE2_GNAME, end - *ptr, *ptr);

        return DCE2_RET__ERROR;
    }

    gc->reassemble_threshold = reassemble_threshold;

    return DCE2_RET__SUCCESS;
}

/********************************************************************
 * Function: DCE2_ScInitConfig
 *
 * Initializes a server configuration to defaults.
 *
 * Arguments:
 *  DCE2_ServerConfig *
 *      Pointer to server configuration structure to initialize.
 *
 * Returns: None
 *
 ********************************************************************/
static void DCE2_ScInitConfig(DCE2_ServerConfig *sc)
{
    if (sc == NULL)
        return;

    /* Set defaults */
    sc->policy = DCE2_POLICY__WINXP;
    sc->smb_max_chain = DCE2_SMB_MAX_CHAIN__DEFAULT;
    sc->autodetect_http_proxy_ports = DCE2_CS__ENABLED;

    /* Add default detect ports */
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__SMB, 0);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__TCP, 0);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__UDP, 0);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__HTTP_PROXY, 0);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__HTTP_SERVER, 0);

    /* Add default autodetect ports */
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__SMB, 1);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__TCP, 1);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__UDP, 1);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__HTTP_PROXY, 1);
    DCE2_ScInitPortArray(sc, DCE2_DETECT_FLAG__HTTP_SERVER, 1);
}

/********************************************************************
 * Function: DCE2_ScInitPortArray
 *
 * Initializes a detect or autodetect port array to default
 * values.
 *
 * Arguments:
 *  DCE2_ServerConfig *
 *      Pointer to server configuration structure to initialize.
 *  DCE2_DetectFlag
 *      The transport for which to set defaults
 *  int
 *      Non-zero to set autodetect ports
 *      Zero to set detect ports
 *
 * Returns: None
 *
 ********************************************************************/
static void DCE2_ScInitPortArray(DCE2_ServerConfig *sc, DCE2_DetectFlag dflag, int autodetect)
{
    if (!autodetect)
    {
        unsigned int array_len;
        unsigned int i;

        switch (dflag)
        {
            case DCE2_DETECT_FLAG__SMB:
                DCE2_ClearPorts(sc->smb_ports);
                array_len =
                    sizeof(DCE2_PORTS_SMB__DEFAULT) / sizeof(DCE2_PORTS_SMB__DEFAULT[0]);

                for (i = 0; i < array_len; i++)
                    DCE2_SetPort(sc->smb_ports, DCE2_PORTS_SMB__DEFAULT[i]);

                break;

            case DCE2_DETECT_FLAG__TCP:
                DCE2_ClearPorts(sc->tcp_ports);
                array_len =
                    sizeof(DCE2_PORTS_TCP__DEFAULT) / sizeof(DCE2_PORTS_TCP__DEFAULT[0]);

                for (i = 0; i < array_len; i++)
                    DCE2_SetPort(sc->tcp_ports, DCE2_PORTS_TCP__DEFAULT[i]);

                break;

            case DCE2_DETECT_FLAG__UDP:
                DCE2_ClearPorts(sc->udp_ports);
                array_len =
                    sizeof(DCE2_PORTS_UDP__DEFAULT) / sizeof(DCE2_PORTS_UDP__DEFAULT[0]);

                for (i = 0; i < array_len; i++)
                    DCE2_SetPort(sc->udp_ports, DCE2_PORTS_UDP__DEFAULT[i]);

                break;

            case DCE2_DETECT_FLAG__HTTP_PROXY:
                DCE2_ClearPorts(sc->http_proxy_ports);
                array_len =
                    sizeof(DCE2_PORTS_HTTP_PROXY__DEFAULT) / sizeof(DCE2_PORTS_HTTP_PROXY__DEFAULT[0]);

                for (i = 0; i < array_len; i++)
                    DCE2_SetPort(sc->http_proxy_ports, DCE2_PORTS_HTTP_PROXY__DEFAULT[i]);

                break;

            case DCE2_DETECT_FLAG__HTTP_SERVER:
                DCE2_ClearPorts(sc->http_server_ports);
                array_len =
                    sizeof(DCE2_PORTS_HTTP_SERVER__DEFAULT) / sizeof(DCE2_PORTS_HTTP_SERVER__DEFAULT[0]);

                for (i = 0; i < array_len; i++)
                    DCE2_SetPort(sc->http_server_ports, DCE2_PORTS_HTTP_SERVER__DEFAULT[i]);

                break;

            default: