Changeset 1655

Timestamp:

11/12/06 14:11:14 (2 years ago)

Author:

mbr

Message:

bugfix for negative port and integer range matches, simplified calling convention for check_sig_int_range() to just pass in the signature hash key (from there the start, end, and negative keys are inferred)

Files:

• psad/branches/sigdevel/psad (modified) (25 diffs)

psad/branches/sigdevel/psad

@@ -1595 +1595 @@
-                            ### normal match on the starting port value
-                            next SP_S unless $pkt_hr->{'sp'} >= $sp_s;
-                        } else {
-                            ### negative match on the starting port value
-                            next SP_S unless $pkt_hr->{'sp'} < $sp_s;
-                        }
-
@@ -1607 +1604 @@
-                            } else {
-                                ### negative match on the ending port value
-
+
+
+
-                            }
-
@@ -1618 +1617 @@
-                                if ($dp_type eq 'norm') {
-                                    next DP_S unless $pkt_hr->{'dp'} >= $dp_s;
-                                } else {
-                                    next DP_S unless $pkt_hr->{'dp'} < $dp_s;
-                                }
-
@@ -1626 +1623 @@
-                                        next DP_E unless $pkt_hr->{'dp'} <= $dp_e;
-                                    } else {
-
+
+
+
+
-                                    }
-
@@ -1701 +1701 @@
-    }
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    ### matched the signature
@@ -1718 +1723 @@
-    my ($pkt_hr, $sig_hr) = @_;
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-
-    ### matched the signature
@@ -1732 +1741 @@
-    my ($pkt_hr, $sig_hr) = @_;
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    ### matched the signature
@@ -1749 +1764 @@
-    my ($pkt_hr, $sig_hr) = @_;
-
-range_match('ttl', $pkt_hr->{'ttl'}
-range_match('id', $pkt_hr->{'ip_id'}
+sig_int_range($pkt_hr->{'ttl'}, 'ttl'
+sig_int_range($pkt_hr->{'ip_id'}, 'id'
-
-    if ($pkt_hr->{'proto'} =~ m|\d|) {
-range_match('ip_proto'
-$pkt_hr->{'proto'}
+sig_int_range($pkt_hr->{'proto'}
+    'ip_proto'
-    }
-
@@ -1760 +1775 @@
-}
-
-range_match
-keyword, $pkt_val
+sig_int_range
+pkt_val, $keyword
-
-    ### if the Snort signature does not have this keyword then
@@ -1768 +1783 @@
-
-    if ($sig_hr->{"${keyword}_neg"}) {
-$pkt_val > $sig_hr->{"${keyword}_s"};
-return 0 if $pkt_val < $sig_hr->{"${keyword}_e"}
+($pkt_val <= $sig_hr->{"${keyword}_e"}
+    and $pkt_val >= $sig_hr->{"${keyword}_s"})
-    } else {
+        ### normal match
-        return 0 if $pkt_val < $sig_hr->{"${keyword}_s"};
-        return 0 if $pkt_val > $sig_hr->{"${keyword}_e"};
@@ -3198 +3214 @@
-
-            ### assign the source and destination port ranges
-
-
-
-
+
+
-
-        } else {
@@ -3264 +3278 @@
-        if ($rule_options =~ /[\s;]psad_dsize:\s*(.+?)\s*;/i) {
-            $sig{'psad_dsize'} = $1;
-
-
+
-        }
-
@@ -3271 +3284 @@
-        if ($rule_options =~ /[\s;]dsize:\s*(.+?)\s*;/i) {
-            $sig{'dsize'} = $1;
-
-
+
-        }
-
@@ -3278 +3290 @@
-        if ($rule_options =~ /[\s;]ttl:\s*(.+?)\s*;/i) {
-            $sig{'ttl'} = $1;
-
-
+
-        }
-
@@ -3285 +3296 @@
-        if ($rule_options =~ /[\s;]id:\s*(.+?)\s*;/i) {
-            $sig{'id'} = $1;
-
-
+
-        }
-
@@ -3328 +3338 @@
-            if ($rule_options =~ /[\s;]seq:\s*(.+?)\s*;/i) {
-                $sig{'seq'} = $1;
-
-
+
-                        4294967296, $line_num);
-            }
@@ -3336 +3345 @@
-            if ($rule_options =~ /[\s;]ack:\s*(.+?)\s*;/i) {
-                $sig{'ack'} = $1;
-
-
+
-                        4294967296, $line_num);
-            }
@@ -3344 +3352 @@
-            if ($rule_options =~ /[\s;]window:\s*(.+?)\s*;/i) {
-                $sig{'window'} = $1;
-
-
+
-                        65535, $line_num);
-            }
@@ -3355 +3362 @@
-            if ($rule_options =~ /[\s;]itype:\s*(.+?)\s*;/i) {
-                $sig{'itype'} = $1;
-
-
+
-                        255, $line_num);
-            }
-            if ($rule_options =~ /[\s;]icode:\s*(.+?)\s*;/i) {
-                $sig{'icode'} = $1;
-
-
+
-                        255, $line_num);
-            }
@@ -3368 +3373 @@
-                $sig{'icmp_seq'} = $1;
-                &build_sig_int_range(\%sig, 'icmp_seq',
-                        'icmp_seq_s', 'icmp_seq_e', 'icmp_seq_neg',
-                        1, 255, $line_num);
-            }
@@ -3382 +3386 @@
-                $sig{'ip_proto'} = $1;
-                &build_sig_int_range(\%sig, 'ip_proto',
-                        'ip_proto_s', 'ip_proto_e', 'ip_proto_neg',
-                        1, 255, $line_num);
-            }
@@ -3422 +3425 @@
-        print STDERR "[+] Main signatures hash:\n";
-        print STDERR Dumper \%sig_search;
+        print STDERR Dumper \%sigs;
-    }
-    &Psad::psyslog('psad', "imported $sig_ctr psad Snort signatures")
@@ -3514 +3518 @@
-
-sub build_sig_int_range() {
-
-
-
-
+
+
+
+
+
+
+
-
-    ### resolve any embedded vars
@@ -3527 +3534 @@
-        if (defined $config{$sub_var}) {
-            $val =~ s|\$\w+|$config{$sub_var}|;
-field_key
+keyword
-        } else {
-            die qq|[*] import_signatures(): sub-var "$sub_var" at line: |,
@@ -3549 +3556 @@
-        $sig_hr->{$start_key} = $1;
-        $sig_hr->{$end_key}   = $2;
+    } elsif ($val =~ m|^\s*\<=\s*(\d+)|) {
+        $sig_hr->{$end_key} = $1;
-    } elsif ($val =~ m|^\s*\<\s*(\d+)|) {
-        $sig_hr->{$end_key} = $1-1;
+    } elsif ($val =~ m|^\s*\>=\s*(\d+)|) {
+        $sig_hr->{$start_key} = $1;
-    } elsif ($val =~ m|^\s*\>\s*(\d+)|) {
-        $sig_hr->{$start_key} = $1+1;