dce2_roptions.c

snort2.8.4版本

                    DCE2_OpnumSetRange(opnum_mask, lo_opnum, hi_opnum);
                    state = DCE2_OPNUM_LIST_STATE__OPNUM_END;
                    continue;
                }

                break;

            case DCE2_OPNUM_LIST_STATE__OPNUM_END:
                if (DCE2_IsListSepChar(c))
                {
                    state = DCE2_OPNUM_LIST_STATE__START;
                }
                else if (DCE2_IsConfigEndChar(c))
                {
                    state = DCE2_OPNUM_LIST_STATE__END;
                    continue;
                }
                else if (!DCE2_IsSpaceChar(c))
                {
                    _dpd.logMsg("%s(%d) => %s: Invalid opnum list - not a valid opnum list token: '%c'\n",
                                *_dpd.config_file, *_dpd.config_line, DCE2_GNAME, c);

                    return DCE2_RET__ERROR;
                }

                break;

            default:
                _dpd.logMsg("%s(%d) => %s: Invalid opnum list state.\n", __FILE__, __LINE__, DCE2_GNAME);
                return DCE2_RET__ERROR;
        }

        (*ptr)++;
    }

    if (state != DCE2_OPNUM_LIST_STATE__END)
    {
        _dpd.logMsg("%s(%d) => %s: Invalid opnum list.\n",
                    *_dpd.config_file, *_dpd.config_line, DCE2_GNAME);

        return DCE2_RET__ERROR;
    }

    return DCE2_RET__SUCCESS;
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static INLINE int DCE2_OpnumIsSet(const uint8_t *opnum_mask, const uint16_t opnum_lo,
                                  const uint16_t opnum_hi, const uint16_t opnum)
{
    uint16_t otmp = opnum - opnum_lo;

    if ((opnum < opnum_lo) || (opnum > opnum_hi))
        return 0;

    return opnum_mask[(otmp / 8)] & (1 << (otmp % 8));
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static INLINE void DCE2_OpnumSet(uint8_t *opnum_mask, const uint16_t opnum)
{
    opnum_mask[(opnum / 8)] |= (1 << (opnum % 8));
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static INLINE void DCE2_OpnumSetRange(uint8_t *opnum_mask, uint16_t lo_opnum, uint16_t hi_opnum)
{
    uint16_t i;

    if (lo_opnum > hi_opnum)
    {
        uint16_t tmp = lo_opnum;
        lo_opnum = hi_opnum;
        hi_opnum = tmp;
    }

    for (i = lo_opnum; i <= hi_opnum; i++)
        DCE2_OpnumSet(opnum_mask, i);
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static int DCE2_StubDataInit(char *name, char *args, void **data)
{
    if (strcmp(name, DCE2_ROPT__STUB_DATA) != 0)
        return 0;

    /* Must not have arguments */
    if (!DCE2_IsEmptyStr(args))
    {
        DCE2_Die("%s(%d) => %s rule option: This option has no arguments.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__STUB_DATA);
    }

    /* Set it to something even though we don't need it */
    *data = (void *)1;

    return 1;
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static int DCE2_ByteTestInit(char *name, char *args, void **data)
{
    char *token, *saveptr;
    int tok_num = 0;
    DCE2_ByteTestData *bt_data;

    if (strcmp(name, DCE2_ROPT__BYTE_TEST) != 0)
        return 0;

    bt_data = (DCE2_ByteTestData *)DCE2_Alloc(sizeof(DCE2_ByteTestData), DCE2_MEM_TYPE__ROPTION);
    if (bt_data == NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: Failed to allocate memory for "
                 "byte test data structure.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_TEST);
    }

    bt_data->operator = DCE2_SENTINEL;

    /* Must have arguments */
    if (DCE2_IsEmptyStr(args))
    {
        DCE2_Die("%s(%d) => %s rule option: No arguments. Example => %s: "
                 "4,>,35000,0,relative;\n", *_dpd.config_file, *_dpd.config_line,
                 DCE2_ROPT__BYTE_TEST, DCE2_ROPT__BYTE_TEST);
    }

    /* Get argument */
    token = strtok_r(args, DCE2_RTOKEN__OPT_SEP, &saveptr);
    if (token == NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: strtok_r() returned NULL when "
                 "str argument was not NULL.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_TEST);
    }

    do
    {
        tok_num++;

        token = DCE2_PruneWhiteSpace(token);

        if (tok_num == 1)   /* Number of bytes to convert */
        {
            char *endptr;
            unsigned long int num_bytes = strtoul(token, &endptr, 10);

            if ((errno == ERANGE) || (*endptr != '\0'))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid number of bytes to "
                         "convert.  Should be one of 4, 2 or 1.\n",
                         *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_TEST);
            }

            if ((num_bytes != 4) && (num_bytes != 2) && (num_bytes != 1))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid number of bytes to "
                         "convert.  Should be one of 4, 2 or 1.\n",
                         *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_TEST);
            }

            bt_data->num_bytes = num_bytes;
        }
        else if (tok_num == 2)  /* Operator */
        {
            /* Should only be one byte */
            if (strlen(token) > 2)
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid argument: %s\n",
                         *_dpd.config_file, *_dpd.config_line,
                         DCE2_ROPT__BYTE_TEST, token);
            }

            /* If two bytes first must be '!' */
            if (strlen(token) == 2)
            {
                if (*token != DCE2_RARG__NE)
                {
                    DCE2_Die("%s(%d) => %s rule option: Invalid argument: %s\n",
                             *_dpd.config_file, *_dpd.config_line,
                             DCE2_ROPT__BYTE_TEST, token);
                }
                else
                {
                    bt_data->invert = 1;
                }

                token++;
            }

            switch (*token)
            {
                case DCE2_RARG__LT:
                    bt_data->operator = DCE2_BT_OP__LT;
                    break;
                case DCE2_RARG__EQ:
                    bt_data->operator = DCE2_BT_OP__EQ;
                    break;
                case DCE2_RARG__GT:
                    bt_data->operator = DCE2_BT_OP__GT;
                    break;
                case DCE2_RARG__AND:
                    bt_data->operator = DCE2_BT_OP__AND;
                    break;
                case DCE2_RARG__XOR:
                    bt_data->operator = DCE2_BT_OP__XOR;
                    break;
                default:
                    DCE2_Die("%s(%d) => %s rule option: Invalid argument: %s\n",
                             *_dpd.config_file, *_dpd.config_line,
                             DCE2_ROPT__BYTE_TEST, token);
                    break;
            }
        }
        else if (tok_num == 3)  /* Value to compare to */
        {
            char *endptr;
            unsigned long int value = strtoul(token, &endptr, 10);

            if ((errno == ERANGE) || (*endptr != '\0') || (value > UINT32_MAX))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid number - max 32 bit unsigned .\n",
                         *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_TEST);
            }

            bt_data->value = value;
        }
        else if (tok_num == 4)  /* Offset in packet data */
        {
            char *endptr;
            long int offset = strtol(token, &endptr, 10);

            if ((errno == ERANGE) || (*endptr != '\0') ||
                (offset > UINT16_MAX) || offset < (-1 * UINT16_MAX))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid offset. It should be "
                         "-%u to %u .\n", *_dpd.config_file, *_dpd.config_line,
                         DCE2_ROPT__BYTE_TEST, USHRT_MAX, USHRT_MAX);
            }

            bt_data->offset = offset;
        }
        else if ((tok_num == 5) || (tok_num == 6))
        {
            if (strcmp(token, DCE2_RARG__RELATIVE) == 0)
            {
                bt_data->relative = 1;
            }
            else if (strcmp(token, DCE2_RARG__DCE_OVERRIDE) != 0)
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid argument.  Last argument "
                         "must be \"%s\".\n", *_dpd.config_file, *_dpd.config_line,
                         DCE2_ROPT__BYTE_TEST, DCE2_RARG__RELATIVE);
            }
        }
        else
        {
            DCE2_Die("%s(%d) => %s rule option: Too many arguments\n",
                     *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_TEST);
        }

    } while ((token = strtok_r(NULL, DCE2_RTOKEN__OPT_SEP, &saveptr)) != NULL);

    if (tok_num < DCE2_BTEST__MIN_ARGS)
    {
        DCE2_Die("%s(%d) => %s rule option: Not enough arguments. Example => %s: "
                 "4,>,35000,0,relative;\n", *_dpd.config_file, *_dpd.config_line,
                 DCE2_ROPT__BYTE_TEST, DCE2_ROPT__BYTE_TEST);
    }

    *data = (void *)bt_data;

    return 1;
}

/********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 ********************************************************************/
static int DCE2_ByteJumpInit(char *name, char *args, void **data)
{
    char *token, *saveptr;
    int tok_num = 0;
    DCE2_ByteJumpData *bj_data;

    if (strcmp(name, DCE2_ROPT__BYTE_JUMP) != 0)
        return 0;

    bj_data = (DCE2_ByteJumpData *)DCE2_Alloc(sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
    if (bj_data == NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: Failed to allocate memory for "
                 "byte jump data structure.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_JUMP);
    }

    bj_data->multiplier = DCE2_SENTINEL;

    /* Must have arguments */
    if (DCE2_IsEmptyStr(args))
    {
        DCE2_Die("%s(%d) => %s rule option: No arguments. Example => %s: "
                 "4,-4,multiplier 2,relative,align;\n", *_dpd.config_file, *_dpd.config_line,
                 DCE2_ROPT__BYTE_JUMP, DCE2_ROPT__BYTE_JUMP);
    }

    /* Get argument */
    token = strtok_r(args, DCE2_RTOKEN__OPT_SEP, &saveptr);
    if (token == NULL)
    {
        DCE2_Die("%s(%d) => %s rule option: strtok_r() returned NULL when "
                 "str argument was not NULL.\n",
                 *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_JUMP);
    }

    do
    {
        tok_num++;

        token = DCE2_PruneWhiteSpace(token);

        if (tok_num == 1)   /* Number of bytes to convert */
        {
            char *endptr;
            unsigned long int num_bytes = strtoul(token, &endptr, 10);

            if ((errno == ERANGE) || (*endptr != '\0'))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid number of bytes to "
                         "convert.  Should be one of 4, 2 or 1.\n",
                         *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_JUMP);
            }

            if ((num_bytes != 4) && (num_bytes != 2) && (num_bytes != 1))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid number of bytes to "
                         "convert.  Should be one of 4, 2 or 1.\n",
                         *_dpd.config_file, *_dpd.config_line, DCE2_ROPT__BYTE_JUMP);
            }

            bj_data->num_bytes = num_bytes;
        }
        else if (tok_num == 2)  /* Offset in packet data */
        {
            char *endptr;
            long int offset = strtol(token, &endptr, 10);

            if ((errno == ERANGE) || (*endptr != '\0') ||
                (offset > UINT16_MAX) || offset < (-1 * UINT16_MAX))
            {
                DCE2_Die("%s(%d) => %s rule option: Invalid offset. It should be "
                         "-%u to %u .\n", *_dpd.config_file, *_dpd.config_line,
                         DCE2_ROPT__BYTE_JUMP, USHRT_MAX, USHRT_MAX);
            }

            bj_data->offset = offset;
        }