dce2_config.c

snort2.8.4版本

                break;

            case DCE2_SC_STATE__OPT_END:
                if (DCE2_IsConfigEndChar(c))
                {
                    return DCE2_RET__SUCCESS;
                }
                else if (DCE2_IsOptEndChar(c))
                {
                    state = DCE2_SC_STATE__OPT_START;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid end of option.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            default:
                _dpd.logMsg("%s(%d) => %s: Invalid option state.\n", __FILE__, __LINE__, DCE2_GNAME);
                return DCE2_RET__ERROR;
        }

        last_char = c;
        ptr++;
    }

    return DCE2_RET__ERROR;
}

/********************************************************************
 * Function: DCE2_ScParseOption()
 *
 * Parses the option and returns an option flag.  Checks to make
 * sure option is only configured once.
 *
 * Arguments:
 *  char *
 *      Pointer to the first character of the option name.
 *  char *
 *      Pointer to the byte after the last character of
 *      the option name.
 *  int
 *      Pointer to the current option mask.  Contains bits set
 *      for each option that has already been configured.  Mask
 *      is checked and updated for new option.
 *
 * Returns:
 *  DCE2_ScOptFlag
 *      Flag for the server option that is being configured.
 *      NULL flag if not a valid option or option has already
 *          been configured.
 *
 ********************************************************************/
static INLINE DCE2_ScOptFlag DCE2_ScParseOption(char *opt_start, char *opt_end, int *opt_mask)
{
    DCE2_ScOptFlag opt_flag = DCE2_SC_OPT_FLAG__NULL;
    size_t opt_len = opt_end - opt_start;

    if (opt_len == strlen(DCE2_SOPT__DEFAULT) &&
        strncasecmp(DCE2_SOPT__DEFAULT, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__DEFAULT;
    }
    else if (opt_len == strlen(DCE2_SOPT__NET) &&
             strncasecmp(DCE2_SOPT__NET, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__NET;
    }
    else if (opt_len == strlen(DCE2_SOPT__POLICY) &&
             strncasecmp(DCE2_SOPT__POLICY, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__POLICY;
    }
    else if (opt_len == strlen(DCE2_SOPT__DETECT) &&
             strncasecmp(DCE2_SOPT__DETECT, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__DETECT;
    }
    else if (opt_len == strlen(DCE2_SOPT__AUTODETECT) &&
             strncasecmp(DCE2_SOPT__AUTODETECT, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__AUTODETECT;
    }
    else if (opt_len == strlen(DCE2_SOPT__NO_AUTODETECT_HTTP_PROXY_PORTS) &&
             strncasecmp(DCE2_SOPT__NO_AUTODETECT_HTTP_PROXY_PORTS, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__NO_AUTODETECT_HTTP_PROXY_PORTS;
    }
    else if (opt_len == strlen(DCE2_SOPT__SMB_INVALID_SHARES) &&
             strncasecmp(DCE2_SOPT__SMB_INVALID_SHARES, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__SMB_INVALID_SHARES;
    }
    else if (opt_len == strlen(DCE2_SOPT__SMB_MAX_CHAIN) &&
             strncasecmp(DCE2_SOPT__SMB_MAX_CHAIN, opt_start, opt_len) == 0)
    {
        opt_flag = DCE2_SC_OPT_FLAG__SMB_MAX_CHAIN;
    }

    if (DCE2_CheckAndSetMask(opt_flag, opt_mask) != DCE2_RET__SUCCESS)
    {
        _dpd.logMsg("%s(%d) => %s: Can only configure option once: %.*s\n",
                    *_dpd.config_file, *_dpd.config_line, DCE2_SNAME, opt_len, opt_start);

        return DCE2_SC_OPT_FLAG__NULL;
    }

    return opt_flag;
}

/********************************************************************
 * Function: DCE2_ScParsePolicy()
 *
 * Parses the argument given to the policy option.
 *
 * Arguments:
 *  DCE2_ServerConfig *
 *      Pointer to a server configuration structure.
 *  char **
 *      Pointer to the pointer to the current position in the
 *      configuration line.  This is updated to the current position
 *      after parsing the policy argument.
 *  char *
 *      Pointer to the end of the configuration line.
 *
 * Returns:
 *  DCE2_Ret
 *      DCE2_RET__SUCCESS if we were able to successfully parse the
 *          value for the policy.
 *      DCE2_RET__ERROR if an error occured in parsing the policy.
 *
 ********************************************************************/
static DCE2_Ret DCE2_ScParsePolicy(DCE2_ServerConfig *sc, char **ptr, char *end)
{
    DCE2_WordListState state = DCE2_WORD_LIST_STATE__START;
    char *policy_start = *ptr;
    char last_char = 0;

    while (*ptr < end)
    {
        char c = **ptr;

        if (state == DCE2_WORD_LIST_STATE__END)
            break;

        switch (state)
        {
            case DCE2_WORD_LIST_STATE__START:
                if (DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__START))
                {
                    policy_start = *ptr;
                    state = DCE2_WORD_LIST_STATE__WORD;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid events argument.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            case DCE2_WORD_LIST_STATE__WORD:
                if (!DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__MIDDLE))
                {
                    size_t policy_len = *ptr - policy_start;

                    if (!DCE2_IsWordChar(last_char, DCE2_WORD_CHAR_POSITION__END))
                    {
                        _dpd.logMsg("%s(%d) => %s: Invalid events argument.\n",
                                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                        return DCE2_RET__ERROR;
                    }

                    if (policy_len == strlen(DCE2_SARG__POLICY_WIN2000) &&
                        strncasecmp(DCE2_SARG__POLICY_WIN2000, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__WIN2000;
                    }
                    else if (policy_len == strlen(DCE2_SARG__POLICY_WINXP) &&
                             strncasecmp(DCE2_SARG__POLICY_WINXP, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__WINXP;
                    }
                    else if (policy_len == strlen(DCE2_SARG__POLICY_WINVISTA) &&
                             strncasecmp(DCE2_SARG__POLICY_WINVISTA, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__WINVISTA;
                    }
                    else if (policy_len == strlen(DCE2_SARG__POLICY_WIN2003) &&
                             strncasecmp(DCE2_SARG__POLICY_WIN2003, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__WIN2003;
                    }
                    else if (policy_len == strlen(DCE2_SARG__POLICY_SAMBA) &&
                             strncasecmp(DCE2_SARG__POLICY_SAMBA, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__SAMBA;
                    }
                    else if (policy_len == strlen(DCE2_SARG__POLICY_SAMBA_3_0_22) &&
                             strncasecmp(DCE2_SARG__POLICY_SAMBA_3_0_22, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__SAMBA_3_0_22;
                    }
                    else if (policy_len == strlen(DCE2_SARG__POLICY_SAMBA_3_0_20) &&
                             strncasecmp(DCE2_SARG__POLICY_SAMBA_3_0_20, policy_start, policy_len) == 0)
                    {
                        sc->policy = DCE2_POLICY__SAMBA_3_0_20;
                    }
                    else
                    {
                        _dpd.logMsg("%s(%d) => %s: Invalid policy specified.\n",
                                    *_dpd.config_file, *_dpd.config_line, DCE2_SNAME);

                        return DCE2_RET__ERROR;
                    }

                    return DCE2_RET__SUCCESS;
                }

                break;

            default:
                _dpd.logMsg("%s(%d) => %s: Invalid policy state.\n", __FILE__, __LINE__, DCE2_SNAME);
                return DCE2_RET__ERROR;
        }

        last_char = c;
        (*ptr)++;
    }

    return DCE2_RET__ERROR;
}

/********************************************************************
 * Function: DCE2_ScParseDetect()
 *
 * Parses the arguments to the detect or autodetect options.  These
 * options take the same arguments.
 *
 * Arguments:
 *  DCE2_ServerConfig *
 *      Pointer to a server configuration structure.
 *  char **
 *      Pointer to the pointer to the current position in the
 *      configuration line.  This is updated to the current position
 *      after parsing the policy argument.
 *  char *
 *      Pointer to the end of the configuration line.
 *  int
 *      Non-zero if we're configuring for the autodetect option.
 *      Zero if we're configuring for the detect option.
 *
 * Returns:
 *  DCE2_Ret
 *      DCE2_RET__SUCCESS if we were able to successfully parse the
 *          arguments for the detect or autodetect options.
 *      DCE2_RET__ERROR if an error occured in parsing the detect
 *          or autodetect arguments.
 *
 ********************************************************************/
static DCE2_Ret DCE2_ScParseDetect(DCE2_ServerConfig *sc, char **ptr, char *end, int autodetect)
{
    DCE2_DetectListState state = DCE2_DETECT_LIST_STATE__START;
    char *type_start = *ptr;
    uint8_t *port_array = NULL;
    int dmask = DCE2_DETECT_FLAG__NULL;
    int one_type = 0;
    char last_char = 0;
    DCE2_DetectFlag dflag = DCE2_DETECT_FLAG__NULL;

    DCE2_ScResetPortsArrays(sc, autodetect);

    while (*ptr < end)
    {
        char c = **ptr;

        if (state == DCE2_DETECT_LIST_STATE__END)
            break;

        switch (state)
        {
            case DCE2_DETECT_LIST_STATE__START:
                if (DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__START))
                {
                    type_start = *ptr;
                    one_type = 1;
                    state = DCE2_DETECT_LIST_STATE__TYPE;
                }
                else if (DCE2_IsListStartChar(c))
                {
                    state = DCE2_DETECT_LIST_STATE__TYPE_START;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid detect/autodetect type.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_SNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            case DCE2_DETECT_LIST_STATE__TYPE_START:
                if (DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__START))
                {
                    type_start = *ptr;
                    state = DCE2_DETECT_LIST_STATE__TYPE;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid character to start events argument: %c\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME, c);

                    return DCE2_RET__ERROR;
                }

                break;

            case DCE2_DETECT_LIST_STATE__TYPE:
                if (!DCE2_IsWordChar(c, DCE2_WORD_CHAR_POSITION__MIDDLE))
                {
                    if (!DCE2_IsWordChar(last_char, DCE2_WORD_CHAR_POSITION__END))
                    {
                        _dpd.logMsg("%s(%d) => %s: Invalid detect/autodetect type.\n",
                                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                        return DCE2_RET__ERROR;
                    }

                    dflag = DCE2_ScParseDetectType(type_start, *ptr, &dmask);

                    switch (dflag)
                    {
                        case DCE2_DETECT_FLAG__NONE:
                            /* This can only be used by itself */
                            if (dmask != DCE2_DETECT_FLAG__NONE)
                            {
                                _dpd.logMsg("%s(%d) => %s: Can only use detect/autodetect "
                                            "type \"none\" by itself.\n",
                                            *_dpd.config_file, *_dpd.config_line, DCE2_SNAME);

                                return DCE2_RET__ERROR;
                            }

                            return DCE2_RET__SUCCESS;

                        case DCE2_DETECT_FLAG__SMB:
                            if (autodetect)
                                port_array = sc->auto_smb_ports;
                            else
                                port_array = sc->smb_ports;

                            break;

                        case DCE2_DETECT_FLAG__TCP:
                            if (autodetect)
                                port_array = sc->auto_tcp_ports;
                            else
                                port_array = sc->tcp_po