diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml index ab12cda16fe2..48c86c9b7680 100644 --- a/.github/workflows/builds.yml +++ b/.github/workflows/builds.yml @@ -35,7 +35,7 @@ env: # A recent version of stable Rust that is known to pass build, test and other # verification steps in this workflow. This was added because using "stable" # could cause some steps to fail. - RUST_VERSION_KNOWN: "1.93.0" + RUST_VERSION_KNOWN: "1.98.0" jobs: diff --git a/doc/userguide/firewall/firewall-design.rst b/doc/userguide/firewall/firewall-design.rst index 07d7d4f20061..8ac8e757d3e0 100644 --- a/doc/userguide/firewall/firewall-design.rst +++ b/doc/userguide/firewall/firewall-design.rst @@ -356,3 +356,25 @@ Example for DNS:: # Accept all responses. response-started: ["accept:tx"] + +ARP handling in bridge mode +--------------------------- + +When running Suricata in bridge mode with a default deny policy, ARP packets are dropped by the +default ``packet.filter`` policy. In Suricata 8.0.x ARP detection is not available, so ARP +rules cannot be created. A global option can be used to automatically accept ARP packets +without requiring an explicit firewall rule for ARP. + +The option is:: + + firewall: + policies: + accept-arp: yes + +When ``accept-arp`` is enabled, ARP packets are accepted regardless of the default packet +filter policy. The default is ``no`` to preserve the existing deny-by-default behaviour. + +This is a minimal, non-intrusive backport for the 8.0.x stable branch. In the main branch ARP +detection is available and ARP can be accepted via explicit rules, e.g.: + + accept:packet arp:all any any -> any any (sid:1;) diff --git a/rust/src/detect/byte_math.rs b/rust/src/detect/byte_math.rs index 735d0bdfa563..c7447330fbec 100644 --- a/rust/src/detect/byte_math.rs +++ b/rust/src/detect/byte_math.rs @@ -350,10 +350,8 @@ fn parse_bytemath(input: &str) -> IResult<&str, DetectByteMathData, RuleParseErr // Using left/right shift further restricts the value of nbytes. Note that // validation has already ensured nbytes is in [1..10] match byte_math.oper { - ByteMathOperator::LeftShift | ByteMathOperator::RightShift => { - if byte_math.nbytes > 4 { - return Err(make_error(format!("nbytes must be 1 through 4 (inclusive) when used with \"<<\" or \">>\"; {} is not valid", byte_math.nbytes))); - } + ByteMathOperator::LeftShift | ByteMathOperator::RightShift if byte_math.nbytes > 4 => { + return Err(make_error(format!("nbytes must be 1 through 4 (inclusive) when used with \"<<\" or \">>\"; {} is not valid", byte_math.nbytes))); } _ => {} }; diff --git a/rust/src/detect/datasets.rs b/rust/src/detect/datasets.rs index 2f4d968be200..2f37b554e1bb 100644 --- a/rust/src/detect/datasets.rs +++ b/rust/src/detect/datasets.rs @@ -19,6 +19,7 @@ //! This module exposes items from the datasets C code to Rust. +use crate::ffi::hashing::{SC_MD5_LEN, SC_SHA256_LEN}; use base64::{self, Engine}; use std::ffi::{c_char, CStr}; use std::fs::{File, OpenOptions}; @@ -168,12 +169,15 @@ unsafe fn process_md5_set( Ok(rs) => rs, Err(_) => return -1, }; + if md5_string.len() != SC_MD5_LEN { + return -1; + } if no_rep { - DatasetAdd(set, md5_string.as_ptr(), 16); + DatasetAdd(set, md5_string.as_ptr(), SC_MD5_LEN as u32); } else if let Ok(val) = v[1].to_string().parse::() { let rep: DataRepType = DataRepType { value: val }; - DatasetAddwRep(set, md5_string.as_ptr(), 16, &rep); + DatasetAddwRep(set, md5_string.as_ptr(), SC_MD5_LEN as u32, &rep); } else { SCFatalErrorOnInit!( "invalid datarep value {} in {}", @@ -192,12 +196,15 @@ unsafe fn process_sha256_set( Ok(rs) => rs, Err(_) => return -1, }; + if sha256_string.len() != SC_SHA256_LEN { + return -1; + } if no_rep { - DatasetAdd(set, sha256_string.as_ptr(), 32); + DatasetAdd(set, sha256_string.as_ptr(), SC_SHA256_LEN as u32); } else if let Ok(val) = v[1].to_string().parse::() { let rep: DataRepType = DataRepType { value: val }; - DatasetAddwRep(set, sha256_string.as_ptr(), 32, &rep); + DatasetAddwRep(set, sha256_string.as_ptr(), SC_SHA256_LEN as u32, &rep); } else { SCFatalErrorOnInit!( "invalid datarep value {} in {}", diff --git a/rust/src/detect/requires.rs b/rust/src/detect/requires.rs index 4db997df6b42..5ad3dab8c489 100644 --- a/rust/src/detect/requires.rs +++ b/rust/src/detect/requires.rs @@ -408,7 +408,7 @@ pub unsafe extern "C" fn SCDetectRequiresStatusLog( "rule was" }, suricata_version, - &min_version + min_version ); parts.push(msg); } @@ -445,7 +445,7 @@ pub unsafe extern "C" fn SCDetectRequiresStatusLog( "rule was" }, if status.feature_count > 1 { "s" } else { "" }, - &features + features ); parts.push(msg); } diff --git a/rust/src/dhcp/logger.rs b/rust/src/dhcp/logger.rs index d2751bf427db..2ec3a7c5cf83 100644 --- a/rust/src/dhcp/logger.rs +++ b/rust/src/dhcp/logger.rs @@ -46,10 +46,8 @@ impl DHCPLogger { { #[allow(clippy::single_match)] match code { - DHCP_OPT_TYPE => { - if !option.data.is_empty() { - return Some(option.data[0]); - } + DHCP_OPT_TYPE if !option.data.is_empty() => { + return Some(option.data[0]); } _ => {} } @@ -156,10 +154,8 @@ impl DHCPLogger { self.log_opt_routers(js, option)?; } } - DHCP_OPT_VENDOR_CLASS_ID => { - if self.extended && !option.data.is_empty() { - js.set_string_from_bytes("vendor_class_identifier", &option.data)?; - } + DHCP_OPT_VENDOR_CLASS_ID if self.extended && !option.data.is_empty() => { + js.set_string_from_bytes("vendor_class_identifier", &option.data)?; } _ => {} }, diff --git a/rust/src/dhcp/parser.rs b/rust/src/dhcp/parser.rs index c5de4fd24afd..63e55d7cf380 100644 --- a/rust/src/dhcp/parser.rs +++ b/rust/src/dhcp/parser.rs @@ -234,7 +234,6 @@ pub fn parse_dhcp(input: &[u8]) -> IResult<&[u8], DHCPMessage> { #[cfg(test)] mod tests { - use crate::dhcp::dhcp::*; use crate::dhcp::parser::*; #[test] diff --git a/rust/src/http2/decompression.rs b/rust/src/http2/decompression.rs index a7bebf70239b..7d4af774c268 100644 --- a/rust/src/http2/decompression.rs +++ b/rust/src/http2/decompression.rs @@ -190,15 +190,15 @@ impl HTTP2DecoderHalf { pub fn http2_encoding_fromvec(&mut self, input: &[u8]) { //use first encoding... if self.encoding == HTTP2ContentEncoding::Unknown { - if input == b"gzip" { + if input.eq_ignore_ascii_case(b"gzip") { self.encoding = HTTP2ContentEncoding::Gzip; self.decoder = HTTP2Decompresser::Gzip(Box::new(GzDecoder::new(HTTP2cursor::new()))); - } else if input == b"deflate" { + } else if input.eq_ignore_ascii_case(b"deflate") { self.encoding = HTTP2ContentEncoding::Deflate; self.decoder = HTTP2Decompresser::Deflate(Box::new(DeflateDecoder::new(HTTP2cursor::new()))); - } else if input == b"br" { + } else if input.eq_ignore_ascii_case(b"br") { self.encoding = HTTP2ContentEncoding::Br; self.decoder = HTTP2Decompresser::Brotli(Box::new(brotli::Decompressor::new( HTTP2cursor::new(), diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs index 182fc7811fc6..7dd4e6dd4620 100644 --- a/rust/src/http2/detect.rs +++ b/rust/src/http2/detect.rs @@ -79,10 +79,8 @@ fn http2_tx_has_errorcode( return 1; } } - HTTP2FrameTypeData::RSTSTREAM(rst) => { - if rst.errorcode == code { - return 1; - } + HTTP2FrameTypeData::RSTSTREAM(rst) if rst.errorcode == code => { + return 1; } _ => {} } @@ -95,10 +93,8 @@ fn http2_tx_has_errorcode( return 1; } } - HTTP2FrameTypeData::RSTSTREAM(rst) => { - if rst.errorcode == code { - return 1; - } + HTTP2FrameTypeData::RSTSTREAM(rst) if rst.errorcode == code => { + return 1; } _ => {} } @@ -806,7 +802,7 @@ struct Http2ThreadBuf { #[no_mangle] pub unsafe extern "C" fn SCHttp2ThreadBufDataInit(_cfg: *mut c_void) -> *mut c_void { - let boxed = Box::new(Http2ThreadBuf::default()); + let boxed = Box::::default(); return Box::into_raw(boxed) as *mut c_void; } @@ -951,7 +947,7 @@ struct Http2ThreadMultiBuf { #[no_mangle] pub unsafe extern "C" fn SCHttp2ThreadMultiBufDataInit(_cfg: *mut c_void) -> *mut c_void { - let boxed = Box::new(Http2ThreadMultiBuf::default()); + let boxed = Box::::default(); return Box::into_raw(boxed) as *mut c_void; } diff --git a/rust/src/http2/logger.rs b/rust/src/http2/logger.rs index 2197d7a83e1e..8028e834d6dc 100644 --- a/rust/src/http2/logger.rs +++ b/rust/src/http2/logger.rs @@ -127,7 +127,7 @@ fn log_http2_frames(frames: &[HTTP2Frame], js: &mut JsonBuilder) -> Result { - if sa == "alg_dh" { - ret_val = e.0 as u32; - ret_code = 1; - break; - } + IkeV2Transform::DH(ref e) if sa == "alg_dh" => { + ret_val = e.0 as u32; + ret_code = 1; + break; } _ => (), } diff --git a/rust/src/jsonbuilder.rs b/rust/src/jsonbuilder.rs index b62ab18e3abd..cb4159c929f9 100644 --- a/rust/src/jsonbuilder.rs +++ b/rust/src/jsonbuilder.rs @@ -172,7 +172,7 @@ impl JsonBuilder { // Reset the builder to its initial state, without losing // the current capacity. pub fn reset(&mut self) { - self.buf.truncate(0); + self.buf.clear(); self.state.clear(); match self.init_type { Type::Array => { @@ -1618,6 +1618,4 @@ static ESCAPED: [u8; 256] = [ __, __, __, __, __, __, __, __, __, __, __, __, __, __, __, __, // F ]; -pub static HEX: [u8; 16] = [ - b'0', b'1', b'2', b'3', b'4', b'5', b'6', b'7', b'8', b'9', b'a', b'b', b'c', b'd', b'e', b'f', -]; +pub static HEX: [u8; 16] = *b"0123456789abcdef"; diff --git a/rust/src/mime/mime.rs b/rust/src/mime/mime.rs index 852460efc33b..4935ab6a5e70 100644 --- a/rust/src/mime/mime.rs +++ b/rust/src/mime/mime.rs @@ -117,14 +117,10 @@ pub fn mime_find_header_token<'a>( // check for initial section of a parameter current_section_slice.extend_from_slice(token); current_section_slice.extend_from_slice(b"*0"); - match t.tokens.get(¤t_section_slice[..]) { - Some(value) => { - sections_values.extend_from_slice(value); - let l = current_section_slice.len(); - current_section_slice[l - 1] = b'1'; - } - None => return None, - } + let value = t.tokens.get(¤t_section_slice[..])?; + sections_values.extend_from_slice(value); + let l = current_section_slice.len(); + current_section_slice[l - 1] = b'1'; } } diff --git a/rust/src/nfs/nfs3_records.rs b/rust/src/nfs/nfs3_records.rs index 86a13fe5df8a..9d8c587f5b01 100644 --- a/rust/src/nfs/nfs3_records.rs +++ b/rust/src/nfs/nfs3_records.rs @@ -390,7 +390,8 @@ pub fn parse_nfs3_request_write(i: &[u8], complete: bool) -> IResult<&[u8], Nfs3 pub fn parse_nfs3_reply_read(i: &[u8], complete: bool) -> IResult<&[u8], NfsReplyRead<'_>> { let (i, status) = be_u32(i)?; let (i, attr_follows) = verify(be_u32, |&v| v <= 1)(i)?; - let (i, attr_blob) = take(84_usize)(i)?; // fixed size? + let (i, attr_blob_opt) = cond(attr_follows == 1, take(84_usize))(i)?; + let attr_blob = attr_blob_opt.unwrap_or(&[]); let (i, count) = be_u32(i)?; let (i, eof) = verify(be_u32, |&v| v <= 1)(i)?; let (i, data_len) = verify(be_u32, |&v| v <= count)(i)?; diff --git a/rust/src/nfs/nfs4.rs b/rust/src/nfs/nfs4.rs index 9e3b4f7b0944..0335725183af 100644 --- a/rust/src/nfs/nfs4.rs +++ b/rust/src/nfs/nfs4.rs @@ -380,11 +380,11 @@ impl NFSState { .put(rd.value.to_vec(), xidmap.file_name.to_vec()); } } - Nfs4ResponseContent::PutRootFH(s) => { - if s == NFS4_OK && xidmap.file_name.is_empty() { - xidmap.file_name = b"".to_vec(); - SCLogDebug!("filename {:?}", xidmap.file_name); - } + Nfs4ResponseContent::PutRootFH(s) + if s == NFS4_OK && xidmap.file_name.is_empty() => + { + xidmap.file_name = b"".to_vec(); + SCLogDebug!("filename {:?}", xidmap.file_name); } _ => {} } diff --git a/rust/src/sdp/parser.rs b/rust/src/sdp/parser.rs index 105bc51f6c28..f4656039c3d0 100644 --- a/rust/src/sdp/parser.rs +++ b/rust/src/sdp/parser.rs @@ -263,9 +263,9 @@ fn parse_connection_data(i: &[u8]) -> IResult<&[u8], String> { let mut connection_data = format!( "{} {} {}", - &nettype, - &addrtype, - &connection_address.to_string() + nettype, + addrtype, + connection_address ); if let Some(ttl) = ttl { connection_data = format!("{}/{}", connection_data, ttl); @@ -463,7 +463,7 @@ fn parse_media_description(i: &[u8]) -> IResult<&[u8], MediaDescription> { } else { format!("{}", port) }; - let mut media_str = format!("{} {} {}", &media, &port, &proto); + let mut media_str = format!("{} {} {}", media, port, proto); if !fmt.is_empty() { let fmt: Vec = fmt.into_iter().map(String::from).collect(); media_str = format!("{} {}", media_str, fmt.join(" ")); diff --git a/rust/src/ssh/parser.rs b/rust/src/ssh/parser.rs index 68784c32d8bc..d5e05545c245 100644 --- a/rust/src/ssh/parser.rs +++ b/rust/src/ssh/parser.rs @@ -164,7 +164,7 @@ pub struct SshPacketKeyExchange<'a> { pub reserved: u32, } -const SSH_HASSH_STRING_DELIMITER_SLICE: [u8; 1] = [b';']; +const SSH_HASSH_STRING_DELIMITER_SLICE: [u8; 1] = *b";"; impl SshPacketKeyExchange<'_> { pub fn generate_hassh( diff --git a/rust/suricatasc/src/unix/client.rs b/rust/suricatasc/src/unix/client.rs index 9ba55e309636..20a1c693fd8a 100644 --- a/rust/suricatasc/src/unix/client.rs +++ b/rust/suricatasc/src/unix/client.rs @@ -62,7 +62,7 @@ impl Client { { let mut encoded = serde_json::to_string(&msg)?; if self.verbose { - println!("SND: {}", &encoded); + println!("SND: {}", encoded); } encoded.push('\n'); self.socket.write_all(encoded.as_bytes())?; diff --git a/rust/suricatasc/src/unix/main.rs b/rust/suricatasc/src/unix/main.rs index 535ae8d116d2..bff39208b264 100644 --- a/rust/suricatasc/src/unix/main.rs +++ b/rust/suricatasc/src/unix/main.rs @@ -39,13 +39,13 @@ pub fn main() -> Result<(), Box> { let verbose = args.verbose; if verbose { - println!("Using Suricata command socket: {}", &socket_filename); + println!("Using Suricata command socket: {}", socket_filename); } let client = match Client::connect(&socket_filename, verbose) { Ok(client) => client, Err(err) => { - eprintln!("Unable to connect socket to {}: {}", &socket_filename, err); + eprintln!("Unable to connect socket to {}: {}", socket_filename, err); std::process::exit(1); } }; @@ -95,7 +95,7 @@ fn run_interactive(mut client: Client) -> Result<(), Box> break; } if let Err(err) = client.reconnect() { - println!("Error: {}", &err); + println!("Error: {}", err); break; } else { retry = true; diff --git a/src/app-layer-expectation.c b/src/app-layer-expectation.c index 6635054268a6..87c1037ef734 100644 --- a/src/app-layer-expectation.c +++ b/src/app-layer-expectation.c @@ -188,6 +188,7 @@ static ExpectationList *AppLayerExpectationRemove(IPPair *ipp, { CIRCLEQ_REMOVE(&exp_list->list, exp, entries); AppLayerFreeExpectation(exp); + IPPairDecrUsecnt(ipp); SC_ATOMIC_SUB(expectation_count, 1); exp_list->length--; if (exp_list->length == 0) { diff --git a/src/detect-engine-address.c b/src/detect-engine-address.c index 2abee10ffdd2..21532bc2329f 100644 --- a/src/detect-engine-address.c +++ b/src/detect-engine-address.c @@ -518,6 +518,7 @@ static int DetectAddressParseString(DetectAddress *dd, const char *str) dd->ip2.addr_data32[2] |=~ netmask[2]; dd->ip2.addr_data32[3] |=~ netmask[3]; } else if ((ip2 = strchr(ip, '-')) != NULL) { + dd->flags |= ADDRESS_FLAG_RANGE; /* 2001::1-2001::4 range format */ ip[ip2 - ip] = '\0'; ip2++; @@ -657,6 +658,9 @@ static int DetectAddressSetup(DetectAddressHead *gh, const char *s) } } } + if (ad->flags & ADDRESS_FLAG_RANGE) { + gh->contains_range = true; + } int r = DetectAddressInsert(NULL, gh, ad); if (r < 0) { @@ -752,8 +756,8 @@ static int DetectAddressParseInternal(const DetectEngineCtx *de_ctx, DetectAddre * applicable. Then insert the result into the ghn list. */ SCLogDebug("negated block"); - DetectAddressHead tmp_gh = { NULL, NULL }; - DetectAddressHead tmp_ghn = { NULL, NULL }; + DetectAddressHead tmp_gh = { NULL, NULL, false }; + DetectAddressHead tmp_ghn = { NULL, NULL, false }; if (DetectAddressParse2(de_ctx, &tmp_gh, &tmp_ghn, address, 0, var_list, recur) < 0) { DetectAddressHeadCleanup(&tmp_gh); @@ -1290,6 +1294,7 @@ typedef struct DetectAddressMap_ { char *string; DetectAddressHead *address; bool contains_negation; + bool contains_range; } DetectAddressMap; static uint32_t DetectAddressMapHashFunc(HashListTable *ht, void *data, uint16_t datalen) @@ -1344,7 +1349,7 @@ void DetectAddressMapFree(DetectEngineCtx *de_ctx) } static bool DetectAddressMapAdd(DetectEngineCtx *de_ctx, const char *string, - DetectAddressHead *address, bool contains_negation) + DetectAddressHead *address, bool contains_negation, bool contains_range) { DetectAddressMap *map = SCCalloc(1, sizeof(*map)); if (map == NULL) @@ -1357,6 +1362,7 @@ static bool DetectAddressMapAdd(DetectEngineCtx *de_ctx, const char *string, } map->address = address; map->contains_negation = contains_negation; + map->contains_range = contains_range; if (HashListTableAdd(de_ctx->address_table, map, 0) != 0) { SCFree(map->string); @@ -1370,7 +1376,7 @@ static bool DetectAddressMapAdd(DetectEngineCtx *de_ctx, const char *string, static const DetectAddressMap *DetectAddressMapLookup(DetectEngineCtx *de_ctx, const char *string) { - DetectAddressMap map = { (char *)string, NULL, false }; + DetectAddressMap map = { (char *)string, NULL, false, false }; const DetectAddressMap *res = HashListTableLookup(de_ctx->address_table, &map, 0); @@ -1391,8 +1397,8 @@ static const DetectAddressMap *DetectAddressMapLookup(DetectEngineCtx *de_ctx, * \retval 0 On success. Did not contain negation. * \retval -1 On failure. */ -int DetectAddressParse(const DetectEngineCtx *de_ctx, - DetectAddressHead *gh, const char *str) +int DetectAddressParse( + const DetectEngineCtx *de_ctx, DetectAddressHead *gh, const char *str, bool *contains_range) { SCLogDebug("gh %p, str %s", gh, str); @@ -1418,6 +1424,9 @@ int DetectAddressParse(const DetectEngineCtx *de_ctx, ghn->ipv4_head); bool contains_negation = (ghn->ipv4_head != NULL || ghn->ipv6_head != NULL); + if (contains_range != NULL) { + *contains_range = (gh->contains_range == true || ghn->contains_range == true); + } /* merge the 'not' address groups */ if (DetectAddressMergeNot(gh, ghn) < 0) { @@ -1431,13 +1440,20 @@ int DetectAddressParse(const DetectEngineCtx *de_ctx, return contains_negation ? 1 : 0; } -const DetectAddressHead *DetectParseAddress(DetectEngineCtx *de_ctx, - const char *string, bool *contains_negation) +const DetectAddressHead *DetectParseAddress( + DetectEngineCtx *de_ctx, const char *string, bool *contains_negation, bool *contains_range) { + DEBUG_VALIDATE_BUG_ON(contains_range == NULL); + if (contains_range == NULL) { + SCLogError("contain_range should not be NULL"); + return NULL; + } + const DetectAddressMap *res = DetectAddressMapLookup(de_ctx, string); if (res != NULL) { SCLogDebug("found: %s :: %p", string, res); *contains_negation = res->contains_negation; + *contains_range = res->contains_range; return res->address; } @@ -1447,7 +1463,7 @@ const DetectAddressHead *DetectParseAddress(DetectEngineCtx *de_ctx, if (head == NULL) return NULL; - const int r = DetectAddressParse(de_ctx, head, string); + const int r = DetectAddressParse(de_ctx, head, string, contains_range); if (r < 0) { DetectAddressHeadFree(head); return NULL; @@ -1457,7 +1473,8 @@ const DetectAddressHead *DetectParseAddress(DetectEngineCtx *de_ctx, *contains_negation = false; } - if (!DetectAddressMapAdd((DetectEngineCtx *)de_ctx, string, head, *contains_negation)) { + if (!DetectAddressMapAdd( + (DetectEngineCtx *)de_ctx, string, head, *contains_negation, *contains_range)) { DetectAddressHeadFree(head); return NULL; } @@ -2276,7 +2293,7 @@ static int AddressTestParse23(void) { DetectAddressHead *gh = DetectAddressHeadInit(); FAIL_IF_NULL(gh); - int r = DetectAddressParse(NULL, gh, "any"); + int r = DetectAddressParse(NULL, gh, "any", NULL); FAIL_IF_NOT(r == 0); DetectAddressHeadFree(gh); PASS; @@ -2286,7 +2303,7 @@ static int AddressTestParse24(void) { DetectAddressHead *gh = DetectAddressHeadInit(); FAIL_IF_NULL(gh); - int r = DetectAddressParse(NULL, gh, "Any"); + int r = DetectAddressParse(NULL, gh, "Any", NULL); FAIL_IF_NOT(r == 0); DetectAddressHeadFree(gh); PASS; @@ -2296,7 +2313,7 @@ static int AddressTestParse25(void) { DetectAddressHead *gh = DetectAddressHeadInit(); FAIL_IF_NULL(gh); - int r = DetectAddressParse(NULL, gh, "ANY"); + int r = DetectAddressParse(NULL, gh, "ANY", NULL); FAIL_IF_NOT(r == 0); DetectAddressHeadFree(gh); PASS; @@ -2311,8 +2328,8 @@ static int AddressTestParse26(void) int r = DetectAddressParse(NULL, gh, "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[" "1.2.3.4" - "]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]" - ); + "]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]", + NULL); FAIL_IF_NOT(r == 0); DetectAddressHeadFree(gh); gh = DetectAddressHeadInit(); @@ -2321,8 +2338,8 @@ static int AddressTestParse26(void) r = DetectAddressParse(NULL, gh, "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[" "1.2.3.4" - "]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]" - ); + "]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]", + NULL); FAIL_IF(r == 0); DetectAddressHeadFree(gh); PASS; @@ -3119,7 +3136,7 @@ static int AddressTestAddressGroupSetup01(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "1.2.3.4"); + int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL); if (r == 0) result = 1; @@ -3134,7 +3151,7 @@ static int AddressTestAddressGroupSetup02(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "1.2.3.4"); + int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL); if (r == 0 && gh->ipv4_head != NULL) result = 1; @@ -3149,11 +3166,11 @@ static int AddressTestAddressGroupSetup03(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "1.2.3.4"); + int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; - r = DetectAddressParse(NULL, gh, "1.2.3.3"); + r = DetectAddressParse(NULL, gh, "1.2.3.3", NULL); if (r == 0 && gh->ipv4_head != prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next == prev_head) { result = 1; @@ -3171,16 +3188,16 @@ static int AddressTestAddressGroupSetup04(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "1.2.3.4"); + int r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; - r = DetectAddressParse(NULL, gh, "1.2.3.3"); + r = DetectAddressParse(NULL, gh, "1.2.3.3", NULL); if (r == 0 && gh->ipv4_head != prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next == prev_head) { DetectAddress *ph = gh->ipv4_head; - r = DetectAddressParse(NULL, gh, "1.2.3.2"); + r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL); if (r == 0 && gh->ipv4_head != ph && gh->ipv4_head != NULL && gh->ipv4_head->next == ph) { result = 1; @@ -3199,16 +3216,16 @@ static int AddressTestAddressGroupSetup05(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "1.2.3.2"); + int r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; - r = DetectAddressParse(NULL, gh, "1.2.3.3"); + r = DetectAddressParse(NULL, gh, "1.2.3.3", NULL); if (r == 0 && gh->ipv4_head == prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next != prev_head) { DetectAddress *ph = gh->ipv4_head; - r = DetectAddressParse(NULL, gh, "1.2.3.4"); + r = DetectAddressParse(NULL, gh, "1.2.3.4", NULL); if (r == 0 && gh->ipv4_head == ph && gh->ipv4_head != NULL && gh->ipv4_head->next != ph) { result = 1; @@ -3227,11 +3244,11 @@ static int AddressTestAddressGroupSetup06(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "1.2.3.2"); + int r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL); if (r == 0 && gh->ipv4_head != NULL) { DetectAddress *prev_head = gh->ipv4_head; - r = DetectAddressParse(NULL, gh, "1.2.3.2"); + r = DetectAddressParse(NULL, gh, "1.2.3.2", NULL); if (r == 0 && gh->ipv4_head == prev_head && gh->ipv4_head != NULL && gh->ipv4_head->next == NULL) { result = 1; @@ -3249,9 +3266,9 @@ static int AddressTestAddressGroupSetup07(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "10.0.0.0/8"); + int r = DetectAddressParse(NULL, gh, "10.0.0.0/8", NULL); if (r == 0 && gh->ipv4_head != NULL) { - r = DetectAddressParse(NULL, gh, "10.10.10.10"); + r = DetectAddressParse(NULL, gh, "10.10.10.10", NULL); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { @@ -3270,9 +3287,9 @@ static int AddressTestAddressGroupSetup08(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "10.10.10.10"); + int r = DetectAddressParse(NULL, gh, "10.10.10.10", NULL); if (r == 0 && gh->ipv4_head != NULL) { - r = DetectAddressParse(NULL, gh, "10.0.0.0/8"); + r = DetectAddressParse(NULL, gh, "10.0.0.0/8", NULL); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { @@ -3291,9 +3308,9 @@ static int AddressTestAddressGroupSetup09(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); + int r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL); if (r == 0 && gh->ipv4_head != NULL) { - r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); + r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { @@ -3312,9 +3329,9 @@ static int AddressTestAddressGroupSetup10(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); + int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL); if (r == 0 && gh->ipv4_head != NULL) { - r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); + r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL); if (r == 0 && gh->ipv4_head != NULL && gh->ipv4_head->next != NULL && gh->ipv4_head->next->next != NULL) { @@ -3333,11 +3350,11 @@ static int AddressTestAddressGroupSetup11(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); + int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); + r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "0.0.0.0/0"); + r = DetectAddressParse(NULL, gh, "0.0.0.0/0", NULL); if (r == 0) { DetectAddress *one = gh->ipv4_head, *two = one->next, *three = two->next, *four = three->next, @@ -3372,11 +3389,11 @@ static int AddressTestAddressGroupSetup12 (void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); + int r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "0.0.0.0/0"); + r = DetectAddressParse(NULL, gh, "0.0.0.0/0", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); + r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL); if (r == 0) { DetectAddress *one = gh->ipv4_head, *two = one->next, *three = two->next, *four = three->next, @@ -3411,11 +3428,11 @@ static int AddressTestAddressGroupSetup13(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "0.0.0.0/0"); + int r = DetectAddressParse(NULL, gh, "0.0.0.0/0", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1"); + r = DetectAddressParse(NULL, gh, "10.10.10.10-10.10.11.1", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "10.10.10.0/24"); + r = DetectAddressParse(NULL, gh, "10.10.10.0/24", NULL); if (r == 0) { DetectAddress *one = gh->ipv4_head, *two = one->next, *three = two->next, *four = three->next, @@ -3449,7 +3466,7 @@ static int AddressTestAddressGroupSetupIPv414(void) DetectAddressHead *gh = DetectAddressHeadInit(); FAIL_IF_NULL(gh); - int r = DetectAddressParse(NULL, gh, "!1.2.3.4"); + int r = DetectAddressParse(NULL, gh, "!1.2.3.4", NULL); FAIL_IF_NOT(r == 1); DetectAddress *one = gh->ipv4_head; @@ -3475,7 +3492,7 @@ static int AddressTestAddressGroupSetupIPv415(void) DetectAddressHead *gh = DetectAddressHeadInit(); FAIL_IF_NULL(gh); - int r = DetectAddressParse(NULL, gh, "!0.0.0.0"); + int r = DetectAddressParse(NULL, gh, "!0.0.0.0", NULL); FAIL_IF_NOT(r == 1); DetectAddress *one = gh->ipv4_head; @@ -3497,7 +3514,7 @@ static int AddressTestAddressGroupSetupIPv416(void) DetectAddressHead *gh = DetectAddressHeadInit(); FAIL_IF_NULL(gh); - int r = DetectAddressParse(NULL, gh, "!255.255.255.255"); + int r = DetectAddressParse(NULL, gh, "!255.255.255.255", NULL); FAIL_IF_NOT(r == 1); DetectAddress *one = gh->ipv4_head; @@ -3520,7 +3537,7 @@ static int AddressTestAddressGroupSetup14(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::1"); + int r = DetectAddressParse(NULL, gh, "2001::1", NULL); if (r == 0) result = 1; @@ -3535,7 +3552,7 @@ static int AddressTestAddressGroupSetup15(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::1"); + int r = DetectAddressParse(NULL, gh, "2001::1", NULL); if (r == 0 && gh->ipv6_head != NULL) result = 1; @@ -3550,11 +3567,11 @@ static int AddressTestAddressGroupSetup16(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::4"); + int r = DetectAddressParse(NULL, gh, "2001::4", NULL); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; - r = DetectAddressParse(NULL, gh, "2001::3"); + r = DetectAddressParse(NULL, gh, "2001::3", NULL); if (r == 0 && gh->ipv6_head != prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next == prev_head) { result = 1; @@ -3572,16 +3589,16 @@ static int AddressTestAddressGroupSetup17(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::4"); + int r = DetectAddressParse(NULL, gh, "2001::4", NULL); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; - r = DetectAddressParse(NULL, gh, "2001::3"); + r = DetectAddressParse(NULL, gh, "2001::3", NULL); if (r == 0 && gh->ipv6_head != prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next == prev_head) { DetectAddress *ph = gh->ipv6_head; - r = DetectAddressParse(NULL, gh, "2001::2"); + r = DetectAddressParse(NULL, gh, "2001::2", NULL); if (r == 0 && gh->ipv6_head != ph && gh->ipv6_head != NULL && gh->ipv6_head->next == ph) { result = 1; @@ -3600,16 +3617,16 @@ static int AddressTestAddressGroupSetup18(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::2"); + int r = DetectAddressParse(NULL, gh, "2001::2", NULL); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; - r = DetectAddressParse(NULL, gh, "2001::3"); + r = DetectAddressParse(NULL, gh, "2001::3", NULL); if (r == 0 && gh->ipv6_head == prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next != prev_head) { DetectAddress *ph = gh->ipv6_head; - r = DetectAddressParse(NULL, gh, "2001::4"); + r = DetectAddressParse(NULL, gh, "2001::4", NULL); if (r == 0 && gh->ipv6_head == ph && gh->ipv6_head != NULL && gh->ipv6_head->next != ph) { result = 1; @@ -3628,11 +3645,11 @@ static int AddressTestAddressGroupSetup19(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::2"); + int r = DetectAddressParse(NULL, gh, "2001::2", NULL); if (r == 0 && gh->ipv6_head != NULL) { DetectAddress *prev_head = gh->ipv6_head; - r = DetectAddressParse(NULL, gh, "2001::2"); + r = DetectAddressParse(NULL, gh, "2001::2", NULL); if (r == 0 && gh->ipv6_head == prev_head && gh->ipv6_head != NULL && gh->ipv6_head->next == NULL) { result = 1; @@ -3650,9 +3667,9 @@ static int AddressTestAddressGroupSetup20(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2000::/3"); + int r = DetectAddressParse(NULL, gh, "2000::/3", NULL); if (r == 0 && gh->ipv6_head != NULL) { - r = DetectAddressParse(NULL, gh, "2001::4"); + r = DetectAddressParse(NULL, gh, "2001::4", NULL); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { @@ -3671,9 +3688,9 @@ static int AddressTestAddressGroupSetup21(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::4"); + int r = DetectAddressParse(NULL, gh, "2001::4", NULL); if (r == 0 && gh->ipv6_head != NULL) { - r = DetectAddressParse(NULL, gh, "2000::/3"); + r = DetectAddressParse(NULL, gh, "2000::/3", NULL); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { @@ -3692,9 +3709,9 @@ static int AddressTestAddressGroupSetup22(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2000::/3"); + int r = DetectAddressParse(NULL, gh, "2000::/3", NULL); if (r == 0 && gh->ipv6_head != NULL) { - r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); + r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { @@ -3713,9 +3730,9 @@ static int AddressTestAddressGroupSetup23(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); + int r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL); if (r == 0 && gh->ipv6_head != NULL) { - r = DetectAddressParse(NULL, gh, "2000::/3"); + r = DetectAddressParse(NULL, gh, "2000::/3", NULL); if (r == 0 && gh->ipv6_head != NULL && gh->ipv6_head->next != NULL && gh->ipv6_head->next->next != NULL) { @@ -3734,11 +3751,11 @@ static int AddressTestAddressGroupSetup24(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); + int r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "2001::/3"); + r = DetectAddressParse(NULL, gh, "2001::/3", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "::/0"); + r = DetectAddressParse(NULL, gh, "::/0", NULL); if (r == 0) { DetectAddress *one = gh->ipv6_head, *two = one->next, *three = two->next, *four = three->next, @@ -3804,11 +3821,11 @@ static int AddressTestAddressGroupSetup25(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); + int r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "::/0"); + r = DetectAddressParse(NULL, gh, "::/0", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "2001::/3"); + r = DetectAddressParse(NULL, gh, "2001::/3", NULL); if (r == 0) { DetectAddress *one = gh->ipv6_head, *two = one->next, *three = two->next, *four = three->next, @@ -3874,11 +3891,11 @@ static int AddressTestAddressGroupSetup26(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "::/0"); + int r = DetectAddressParse(NULL, gh, "::/0", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "2001::4-2001::6"); + r = DetectAddressParse(NULL, gh, "2001::4-2001::6", NULL); if (r == 0) { - r = DetectAddressParse(NULL, gh, "2001::/3"); + r = DetectAddressParse(NULL, gh, "2001::/3", NULL); if (r == 0) { DetectAddress *one = gh->ipv6_head, *two = one->next, *three = two->next, *four = three->next, @@ -3944,7 +3961,7 @@ static int AddressTestAddressGroupSetup27(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[1.2.3.4]"); + int r = DetectAddressParse(NULL, gh, "[1.2.3.4]", NULL); if (r == 0) result = 1; @@ -3959,7 +3976,7 @@ static int AddressTestAddressGroupSetup28(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1]"); + int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1]", NULL); if (r == 0) result = 1; @@ -3974,7 +3991,7 @@ static int AddressTestAddressGroupSetup29(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1,10.10.10.10]"); + int r = DetectAddressParse(NULL, gh, "[1.2.3.4,4.3.2.1,10.10.10.10]", NULL); if (r == 0) result = 1; @@ -3989,7 +4006,8 @@ static int AddressTestAddressGroupSetup30(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[[1.2.3.4,2.3.4.5],4.3.2.1,[10.10.10.10,11.11.11.11]]"); + int r = DetectAddressParse( + NULL, gh, "[[1.2.3.4,2.3.4.5],4.3.2.1,[10.10.10.10,11.11.11.11]]", NULL); if (r == 0) result = 1; @@ -4004,7 +4022,9 @@ static int AddressTestAddressGroupSetup31(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[[1.2.3.4,[2.3.4.5,3.4.5.6]],4.3.2.1,[10.10.10.10,[11.11.11.11,12.12.12.12]]]"); + int r = DetectAddressParse(NULL, gh, + "[[1.2.3.4,[2.3.4.5,3.4.5.6]],4.3.2.1,[10.10.10.10,[11.11.11.11,12.12.12.12]]]", + NULL); if (r == 0) result = 1; @@ -4019,7 +4039,10 @@ static int AddressTestAddressGroupSetup32(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[[1.2.3.4,[2.3.4.5,[3.4.5.6,4.5.6.7]]],4.3.2.1,[10.10.10.10,[11.11.11.11,[12.12.12.12,13.13.13.13]]]]"); + int r = DetectAddressParse(NULL, gh, + "[[1.2.3.4,[2.3.4.5,[3.4.5.6,4.5.6.7]]],4.3.2.1,[10.10.10.10,[11.11.11.11,[12.12." + "12.12,13.13.13.13]]]]", + NULL); if (r == 0) result = 1; @@ -4034,7 +4057,7 @@ static int AddressTestAddressGroupSetup33(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "![1.1.1.1,[2.2.2.2,[3.3.3.3,4.4.4.4]]]"); + int r = DetectAddressParse(NULL, gh, "![1.1.1.1,[2.2.2.2,[3.3.3.3,4.4.4.4]]]", NULL); if (r == 1) result = 1; @@ -4049,7 +4072,7 @@ static int AddressTestAddressGroupSetup34(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,![1.1.1.1,[1.2.1.1,1.3.1.1]]]"); + int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,![1.1.1.1,[1.2.1.1,1.3.1.1]]]", NULL); if (r == 1) result = 1; @@ -4064,7 +4087,7 @@ static int AddressTestAddressGroupSetup35(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,![1.1.1.1,2.2.2.2]]]"); + int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,![1.1.1.1,2.2.2.2]]]", NULL); if (r == 1) result = 1; @@ -4079,7 +4102,7 @@ static int AddressTestAddressGroupSetup36 (void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,[3.0.0.0/8,!1.1.1.1]]]"); + int r = DetectAddressParse(NULL, gh, "[1.0.0.0/8,[2.0.0.0/8,[3.0.0.0/8,!1.1.1.1]]]", NULL); if (r == 1) result = 1; @@ -4094,7 +4117,7 @@ static int AddressTestAddressGroupSetup37(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[0.0.0.0/0,::/0]"); + int r = DetectAddressParse(NULL, gh, "[0.0.0.0/0,::/0]", NULL); if (r == 0) result = 1; @@ -4113,7 +4136,7 @@ static int AddressTestAddressGroupSetup38(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "![192.168.0.0/16,!192.168.14.0/24]"); + int r = DetectAddressParse(NULL, gh, "![192.168.0.0/16,!192.168.14.0/24]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 3, expectations)) result = 1; @@ -4134,7 +4157,7 @@ static int AddressTestAddressGroupSetup39(void) DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,!192.168.14.0/24]]"); + int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,!192.168.14.0/24]]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 3, expectations)) result = 1; @@ -4154,7 +4177,7 @@ static int AddressTestAddressGroupSetup40(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,[!192.168.14.0/24]]]"); + int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,[!192.168.14.0/24]]]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 3, expectations)) result = 1; @@ -4174,7 +4197,7 @@ static int AddressTestAddressGroupSetup41(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.14.0/24]]]"); + int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.14.0/24]]]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 3, expectations)) result = 1; @@ -4192,7 +4215,7 @@ static int AddressTestAddressGroupSetup42(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[2001::/3]"); + int r = DetectAddressParse(NULL, gh, "[2001::/3]", NULL); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 1, expectations)) result = 1; @@ -4211,7 +4234,7 @@ static int AddressTestAddressGroupSetup43(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[2001::/3,!3000::/5]"); + int r = DetectAddressParse(NULL, gh, "[2001::/3,!3000::/5]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 2, expectations)) result = 1; @@ -4229,7 +4252,7 @@ static int AddressTestAddressGroupSetup44(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "3ffe:ffff:7654:feda:1245:ba98:3210:4562/96"); + int r = DetectAddressParse(NULL, gh, "3ffe:ffff:7654:feda:1245:ba98:3210:4562/96", NULL); if (r == 0) { if (UTHValidateDetectAddressHead(gh, 1, expectations)) result = 1; @@ -4245,7 +4268,7 @@ static int AddressTestAddressGroupSetup45(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[192.168.1.3,!192.168.0.0/16]"); + int r = DetectAddressParse(NULL, gh, "[192.168.1.3,!192.168.0.0/16]", NULL); if (r != 0) { result = 1; } @@ -4265,7 +4288,8 @@ static int AddressTestAddressGroupSetup46(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24]]]"); + int r = DetectAddressParse( + NULL, gh, "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24]]]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 4, expectations)) result = 1; @@ -4288,7 +4312,8 @@ static int AddressTestAddressGroupSetup47(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]]"); + int r = DetectAddressParse(NULL, gh, + "[![192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 5, expectations)) result = 1; @@ -4310,7 +4335,8 @@ static int AddressTestAddressGroupSetup48(void) int result = 0; DetectAddressHead *gh = DetectAddressHeadInit(); if (gh != NULL) { - int r = DetectAddressParse(NULL, gh, "[192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]"); + int r = DetectAddressParse(NULL, gh, + "[192.168.0.0/16,![192.168.1.0/24,192.168.3.0/24],!192.168.5.0/24]", NULL); if (r == 1) { if (UTHValidateDetectAddressHead(gh, 4, expectations)) result = 1; diff --git a/src/detect-engine-address.h b/src/detect-engine-address.h index a98c016f5d73..e97cc4aa07ca 100644 --- a/src/detect-engine-address.h +++ b/src/detect-engine-address.h @@ -27,7 +27,7 @@ DetectAddress *DetectAddressInit(void); void DetectAddressFree(DetectAddress *); DetectAddress *DetectAddressCopy(DetectAddress *); -int DetectAddressParse(const DetectEngineCtx *, DetectAddressHead *, const char *); +int DetectAddressParse(const DetectEngineCtx *, DetectAddressHead *, const char *, bool *); void DetectAddressHeadCleanup(DetectAddressHead *); bool DetectAddressListsAreEqual(DetectAddress *list1, DetectAddress *list2); @@ -45,7 +45,7 @@ void DetectAddressTests(void); int DetectAddressMapInit(DetectEngineCtx *de_ctx); void DetectAddressMapFree(DetectEngineCtx *de_ctx); -const DetectAddressHead *DetectParseAddress(DetectEngineCtx *de_ctx, - const char *string, bool *contains_negation); +const DetectAddressHead *DetectParseAddress( + DetectEngineCtx *de_ctx, const char *string, bool *contains_negation, bool *contains_range); #endif /* SURICATA_DETECT_ADDRESS_H */ diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c index 00ea2b58bb68..9cc14303333b 100644 --- a/src/detect-engine-build.c +++ b/src/detect-engine-build.c @@ -245,6 +245,11 @@ int SignatureIsIPOnly(DetectEngineCtx *de_ctx, const Signature *s) /* Rule is IP only, but contains negated addresses. */ return 2; } + if (s->init_data->src_contains_range || s->init_data->dst_contains_range) { + /* Rule is IP only, but contains range of addresses. */ + return 2; + } + if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("IP-ONLY (%" PRIu32 "): source %s, dest %s", s->id, s->flags & SIG_FLAG_SRC_ANY ? "ANY" : "SET", diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c index 0652c3c751aa..db08c6eca823 100644 --- a/src/detect-engine-frame.c +++ b/src/detect-engine-frame.c @@ -475,7 +475,9 @@ static int FrameStreamDataInspectFunc( // PrintRawDataFp(stdout, data, data_len); // PrintRawDataFp(stdout, data, MIN(64, data_len)); #endif - DEBUG_VALIDATE_BUG_ON(fsd->frame->len > 0 && (int64_t)data_len > fsd->frame->len); + // Only assert if the engine does not have transforms that may grow the buffer + DEBUG_VALIDATE_BUG_ON(fsd->frame->len > 0 && (int64_t)data_len > fsd->frame->len && + engine->sm_list == engine->sm_list_base); const bool match = DetectEngineContentInspection(det_ctx->de_ctx, det_ctx, s, engine->smd, p, p->flow, data, data_len, data_offset, buffer->flags, diff --git a/src/detect-parse.c b/src/detect-parse.c index 87882214daa6..ed399e7c5021 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1111,7 +1111,7 @@ static int SigParseAddress(DetectEngineCtx *de_ctx, s->flags |= SIG_FLAG_SRC_ANY; s->init_data->src = DetectParseAddress(de_ctx, addrstr, - &s->init_data->src_contains_negation); + &s->init_data->src_contains_negation, &s->init_data->src_contains_range); if (s->init_data->src == NULL) goto error; } else { @@ -1119,7 +1119,7 @@ static int SigParseAddress(DetectEngineCtx *de_ctx, s->flags |= SIG_FLAG_DST_ANY; s->init_data->dst = DetectParseAddress(de_ctx, addrstr, - &s->init_data->dst_contains_negation); + &s->init_data->dst_contains_negation, &s->init_data->dst_contains_range); if (s->init_data->dst == NULL) goto error; } @@ -4091,6 +4091,21 @@ int DetectFirewallLoadDefaultPolicies(DetectEngineCtx *de_ctx) } } + /* parse firewall.policies.accept-arp config option */ + char accept_arp_key[128]; + int accept_arp = 0; + if (strlen(de_ctx->config_prefix) > 0) { + snprintf(accept_arp_key, sizeof(accept_arp_key), "%s.firewall.policies.accept-arp", + de_ctx->config_prefix); + } else { + snprintf(accept_arp_key, sizeof(accept_arp_key), "firewall.policies.accept-arp"); + } + if (SCConfGetBool(accept_arp_key, &accept_arp) == 1) { + de_ctx->fw_accept_arp = accept_arp ? true : false; + } else { + de_ctx->fw_accept_arp = false; + } + return 0; } diff --git a/src/detect.c b/src/detect.c index c88cd56835b5..a5d018564fc5 100644 --- a/src/detect.c +++ b/src/detect.c @@ -685,6 +685,12 @@ static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx, const bool final) { DEBUG_VALIDATE_BUG_ON(de_ctx->fw_policies == NULL); + /* Accept ARP packets if configured, overriding default drop policy */ + if (de_ctx->fw_accept_arp && PacketIsARP(p)) { + SCLogDebug("packet %" PRIu64 ": accept ARP per config fw_accept_arp", p->pcap_cnt); + p->action |= ACTION_ACCEPT; + return p->action; + } const struct DetectFirewallPolicy *pol = &de_ctx->fw_policies->pkt[policy]; if (pol->action & ACTION_DROP) { SCLogDebug( diff --git a/src/detect.h b/src/detect.h index aec4758796f0..74e13f72f9b6 100644 --- a/src/detect.h +++ b/src/detect.h @@ -160,6 +160,7 @@ enum { }; #define ADDRESS_FLAG_NOT 0x01 /**< address is negated */ +#define ADDRESS_FLAG_RANGE 0x02 /**< address has range */ /** \brief address structure for use in the detection engine. * @@ -183,6 +184,8 @@ typedef struct DetectAddress_ { typedef struct DetectAddressHead_ { DetectAddress *ipv4_head; DetectAddress *ipv6_head; + + bool contains_range; } DetectAddressHead; @@ -604,6 +607,9 @@ typedef struct SignatureInitData_ { * skip it for ip-only */ bool src_contains_negation; bool dst_contains_negation; + /* see if the address contains range and skip it from iponly engine */ + bool src_contains_range; + bool dst_contains_range; /** see if any of the sigmatches supports an enabled prefilter */ bool has_possible_prefilter; @@ -1015,6 +1021,9 @@ typedef struct DetectEngineCtx_ { /* force app-layer tx finding for alerts with signatures not having app-layer keywords */ bool guess_applayer; + /** accept ARP packets in firewall mode when default policy would drop */ + bool fw_accept_arp; + /* registration id for per thread ctx for the filemagic/file.magic keywords */ int filemagic_thread_ctx_id; diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index 66628563c2f9..cfb646f19351 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -244,8 +244,8 @@ static int SetupSuppressRule(DetectEngineCtx *de_ctx, uint32_t id, uint32_t gid, orig_de->seconds = parsed_seconds; orig_de->new_action = parsed_new_action; orig_de->timeout = parsed_timeout; - if (DetectAddressParse((const DetectEngineCtx *)de_ctx, &orig_de->addrs, (char *)th_ip) < - 0) { + if (DetectAddressParse( + (const DetectEngineCtx *)de_ctx, &orig_de->addrs, (char *)th_ip, NULL) < 0) { SCLogError("failed to parse %s", th_ip); goto error; }