dce2_roptions.c

snort2.8.4版本

    /* Has to be a uuid in string format, e.g 4b324fc8-1670-01d3-1278-5a47bf6ee188
     * Check the length */
    if (strlen(token) != DCE2_IFACE__LEN)
    {
        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. Example => %s: "
                 "4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
    }

    /* Detach token */
    iface = strtok_r(token, DCE2_RTOKEN__ARG_SEP, &ifaceptr);
    if (iface == NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: strtok_r() returned NULL when "
                 "str argument was not NULL.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE);
    }

    /* Cut into pieces separated by '-' */
    if_hex = strtok_r(iface, DCE2_RTOKEN__IFACE_SEP, &if_hexptr);
    if (if_hex == NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: strtok_r() returned NULL when "
                 "str argument was not NULL.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE);
    }

    do
    {
        char *endptr;

        switch (num_pieces)
        {
            case 0:
                {
                    unsigned long int time_low;
 
                    if (strlen(if_hex) != DCE2_IFACE__TIME_LOW_LEN)
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }
                    
                    time_low = strtoul(if_hex, &endptr, 16);
                    if ((errno == ERANGE) || (*endptr != '\0'))
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    iface_data->iface.time_low = (uint32_t)time_low;
                }

                break;

            case 1:
                {
                    unsigned long int time_mid;

                    if (strlen(if_hex) != DCE2_IFACE__TIME_MID_LEN)
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }
                    
                    time_mid = strtoul(if_hex, &endptr, 16);
                    if ((errno == ERANGE) || (*endptr != '\0'))
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    /* Length check ensures 16 bit value */
                    iface_data->iface.time_mid = (uint16_t)time_mid;
                }

                break;

            case 2:
                {
                    unsigned long int time_high;

                    if (strlen(if_hex) != DCE2_IFACE__TIME_HIGH_LEN)
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }
                    
                    time_high = strtoul(if_hex, &endptr, 16);
                    if ((errno == ERANGE) || (*endptr != '\0'))
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    /* Length check ensures 16 bit value */
                    iface_data->iface.time_high_and_version = (uint16_t)time_high;
                }

                break;

            case 3:
                {
                    unsigned long int clock_seq_and_reserved, clock_seq_low;

                    if (strlen(if_hex) != DCE2_IFACE__CLOCK_SEQ_LEN)
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    /* Work backwards */
                    clock_seq_low = strtoul(&if_hex[2], &endptr, 16);
                    if ((errno == ERANGE) || (*endptr != '\0'))
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    iface_data->iface.clock_seq_low = (uint8_t)clock_seq_low;

                    /* Set third byte to null so we can strtoul the first part */
                    if_hex[2] = '\x00';

                    clock_seq_and_reserved = strtoul(if_hex, &endptr, 16);
                    if ((errno == ERANGE) || (*endptr != '\0'))
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    iface_data->iface.clock_seq_and_reserved = (uint8_t)clock_seq_and_reserved;
                }
              
                break;

            case 4:
                {
                    int i, j;

                    if (strlen(if_hex) != DCE2_IFACE__NODE_LEN)
                    {
                        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                 "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                    }

                    /* Walk back a byte at a time - 2 hex digits */
                    for (i = DCE2_IFACE__NODE_LEN - 2, j = sizeof(iface_data->iface.node) - 1;
                         (i >= 0) && (j >= 0);
                         i -= 2, j--)
                    {
                        /* Only giving strtoul 1 byte */
                        iface_data->iface.node[j] = (uint8_t)strtoul(&if_hex[i], &endptr, 16);
                        if ((errno == ERANGE) || (*endptr != '\0'))
                        {
                            DCE2_Die("%s(%d) => %s rule option: Invalid uuid. "
                                     "Example => %s: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                                     *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
                        }

                        if_hex[i] = '\0';
                    }
                }

                break;

            default:
                break;
        }

        num_pieces++;

    } while ((if_hex = strtok_r(NULL, DCE2_RTOKEN__IFACE_SEP, &if_hexptr)) != NULL);

    if (num_pieces != 5)
    {
        DCE2_Die("%s(%d) => %s rule option: Invalid uuid. Example => %s: "
                 "4b324fc8-1670-01d3-1278-5a47bf6ee188;\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE, DCE2_ROPT__IFACE);
    }

    /* Check for more arguments */
    iface = strtok_r(NULL, DCE2_RTOKEN__ARG_SEP, &ifaceptr);
    if (iface != NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: strtok_r() returned NULL when "
                 "str argument was not NULL.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__IFACE);
    }
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static int DCE2_OpnumInit(char *name, char *args, void **data)
{
    uint8_t opnum_mask[DCE2_OPNUM__MAX_INDEX];  /* 65536 bits */
    char *args_end;
    uint16_t num_opnums = 0;
    unsigned int i;
    int opnum_lo = DCE2_SENTINEL;
    int opnum_hi = 0;

    if (strcmp(name, DCE2_ROPT__OPNUM) != 0)
        return 0;

    /* Must have arguments */
    if (DCE2_IsEmptyStr(args))
    {
        DCE2_Die("%s(%d) => %s rule option: No arguments. Must supply "
                 "the value of the opnum\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__OPNUM);
    }

    /* Include NULL byte for parsing */
    args_end = args + (strlen(args) + 1);
    memset(opnum_mask, 0, sizeof(opnum_mask));

    if (DCE2_ParseOpnumList(&args, args_end, opnum_mask) != DCE2_RET__SUCCESS)
    {
        DCE2_Die("%s(%d) => %s: rule option: Failed to parse.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__OPNUM);
    }

    /* Must have at least one bit set or the parsing would have errored */
    for (i = 0; i < DCE2_OPNUM__MAX; i++)
    {
        if (DCE2_OpnumIsSet(opnum_mask, 0, DCE2_OPNUM__MAX - 1, (uint16_t)i))
        {
            num_opnums++;

            if (opnum_lo == DCE2_SENTINEL)
                opnum_lo = (uint16_t)i;

            opnum_hi = (uint16_t)i;
        }
    }

    if (num_opnums == 1)
    {
        DCE2_OpnumSingle *odata =
            (DCE2_OpnumSingle *)DCE2_Alloc(sizeof(DCE2_OpnumSingle), DCE2_MEM_TYPE__ROPTION);

        if (odata == NULL)
        {
            DCE2_Die("%s(%d) => %s: Failed to allocate memory for opnum data.\n",
                     __FILE__, __LINE__, DCE2_GNAME);
        }

        odata->odata.type = DCE2_OPNUM_TYPE__SINGLE;
        odata->opnum = (uint16_t)opnum_lo;

        *data = (void *)odata;
    }
    else
    {
        int opnum_range = opnum_hi - opnum_lo;
        int mask_size = (opnum_range / 8) + 1;
        DCE2_OpnumMultiple *odata =
            (DCE2_OpnumMultiple *)DCE2_Alloc(sizeof(DCE2_OpnumMultiple), DCE2_MEM_TYPE__ROPTION);

        if (odata == NULL)
        {
            DCE2_Die("%s(%d) => %s: Failed to allocate memory for opnum data.\n",
                     __FILE__, __LINE__, DCE2_GNAME);
        }

        odata->mask = (uint8_t *)DCE2_Alloc(mask_size, DCE2_MEM_TYPE__ROPTION);
        if (odata->mask == NULL)
        {
            DCE2_Die("%s(%d) => %s: Failed to allocate memory for opnum data.\n",
                     __FILE__, __LINE__, DCE2_GNAME);
        }

        odata->odata.type = DCE2_OPNUM_TYPE__MULTIPLE;
        odata->mask_size = (uint16_t)mask_size;
        odata->opnum_lo = (uint16_t)opnum_lo;
        odata->opnum_hi = (uint16_t)opnum_hi;

        /* Set the opnum bits in our reduced size opnum mask */
        for (i = (unsigned int)opnum_lo; i <= (unsigned int)opnum_hi; i++)
        {
            if (DCE2_OpnumIsSet(opnum_mask, 0, DCE2_OPNUM__MAX - 1, (uint16_t)i))
                DCE2_OpnumSet(odata->mask, (uint16_t)(i - opnum_lo));
        }

        *data = (void *)odata;
    }

    return 1;
}

/********************************************************************
 * Function:
 *
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static DCE2_Ret DCE2_ParseOpnumList(char **ptr, char *end, uint8_t *opnum_mask)
{
    char *lo_start = NULL;
    char *hi_start = NULL;
    DCE2_OpnumListState state = DCE2_OPNUM_LIST_STATE__START;
    uint16_t lo_opnum = 0, hi_opnum = 0;

    while (*ptr < end)
    {
        char c = **ptr;

        if (state == DCE2_OPNUM_LIST_STATE__END)
            break;

        switch (state)
        {
            case DCE2_OPNUM_LIST_STATE__START:
                if (DCE2_IsOpnumChar(c))
                {
                    lo_start = *ptr;
                    state = DCE2_OPNUM_LIST_STATE__OPNUM_LO;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid opnum list.\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

                    return DCE2_RET__ERROR;
                }

                break;

            case DCE2_OPNUM_LIST_STATE__OPNUM_LO:
                if (!DCE2_IsOpnumChar(c))
                {
                    DCE2_Ret status = DCE2_GetValue(lo_start, *ptr, &lo_opnum,
                                                    0, DCE2_INT_TYPE__UINT16, 10);

                    if (status != DCE2_RET__SUCCESS)
                    {
                        _dpd.logMsg("%s(%d) => %s: Invalid opnum: %.*s\n", *_dpd.config_file,
                                    *_dpd.config_line, DCE2_GNAME, *ptr - lo_start, lo_start);

                        return DCE2_RET__ERROR;
                    }

                    if (DCE2_IsOpnumRangeChar(c))
                    {
                        state = DCE2_OPNUM_LIST_STATE__OPNUM_RANGE;
                    }
                    else
                    {
                        DCE2_OpnumSet(opnum_mask, lo_opnum);
                        state = DCE2_OPNUM_LIST_STATE__OPNUM_END;
                        continue;
                    }
                }

                break;

            case DCE2_OPNUM_LIST_STATE__OPNUM_RANGE:
                if (DCE2_IsOpnumChar(c))
                {
                    hi_start = *ptr;
                    state = DCE2_OPNUM_LIST_STATE__OPNUM_HI;
                }
                else
                {
                    DCE2_OpnumSetRange(opnum_mask, lo_opnum, 65535);
                    state = DCE2_OPNUM_LIST_STATE__OPNUM_END;
                    continue;
                }

                break;

            case DCE2_OPNUM_LIST_STATE__OPNUM_HI:
                if (!DCE2_IsOpnumChar(c))
                {
                    DCE2_Ret status = DCE2_GetValue(hi_start, *ptr, &hi_opnum,
                                                    0, DCE2_INT_TYPE__UINT16, 10);

                    if (status != DCE2_RET__SUCCESS)
                    {
                        _dpd.logMsg("%s(%d) => %s: Invalid opnum: %.*s\n", *_dpd.config_file,
                                    *_dpd.config_line, DCE2_GNAME, *ptr - hi_start, hi_start);

                        return DCE2_RET__ERROR;
                    }