/**
* \test DetectSshVersionTestParse03 is a test to make sure that we
* don't return a ssh_data with an invalid value specified
*/
int DetectSshVersionTestParse03 (void) {
DetectSshVersionData *ssh = NULL;
ssh = DetectSshVersionParse("2_com");
if (ssh != NULL) {
DetectSshVersionFree(ssh);
return 0;
}
ssh = DetectSshVersionParse("");
if (ssh != NULL) {
DetectSshVersionFree(ssh);
return 0;
}
ssh = DetectSshVersionParse(".1");
if (ssh != NULL) {
DetectSshVersionFree(ssh);
return 0;
}
ssh = DetectSshVersionParse("lalala");
if (ssh != NULL) {
DetectSshVersionFree(ssh);
return 0;
}
return 1;
}
/**
* \brief this function is used to add the parsed "id" option
* \brief into the current signature
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param idstr pointer to the user provided "id" option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectSshVersionSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
DetectSshVersionData *ssh = NULL;
SigMatch *sm = NULL;
if (DetectSignatureSetAppProto(s, ALPROTO_SSH) != 0)
return -1;
ssh = DetectSshVersionParse(str);
if (ssh == NULL)
goto error;
/* Okay so far so good, lets get this into a SigMatch
* and put it in the Signature. */
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_AL_SSH_PROTOVERSION;
sm->ctx = (void *)ssh;
SigMatchAppendSMToList(s, sm, g_ssh_banner_list_id);
return 0;
error:
if (ssh != NULL)
DetectSshVersionFree(ssh);
if (sm != NULL)
SCFree(sm);
return -1;
}
/**
* \test DetectSshVersionTestParse02 is a test to make sure that we parse
* the proto version (compatible with proto version 2) correctly
*/
int DetectSshVersionTestParse02 (void) {
DetectSshVersionData *ssh = NULL;
ssh = DetectSshVersionParse("2_compat");
if (ssh->flags & SSH_FLAG_PROTOVERSION_2_COMPAT) {
DetectSshVersionFree(ssh);
return 1;
}
return 0;
}
/**
* \test DetectSshVersionTestParse01 is a test to make sure that we parse
* a proto version correctly
*/
int DetectSshVersionTestParse01 (void) {
DetectSshVersionData *ssh = NULL;
ssh = DetectSshVersionParse("1.0");
if (ssh != NULL && strncmp((char *) ssh->ver, "1.0", 3) == 0) {
DetectSshVersionFree(ssh);
return 1;
}
return 0;
}
/**
* \brief This function is used to parse IPV4 ip_id passed via keyword: "id"
*
* \param idstr Pointer to the user provided id option
*
* \retval id_d pointer to DetectSshVersionData on success
* \retval NULL on failure
*/
DetectSshVersionData *DetectSshVersionParse (char *str)
{
DetectSshVersionData *ssh = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0,
ov, MAX_SUBSTRINGS);
if (ret < 1 || ret > 3) {
SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.protoversion option");
goto error;
}
if (ret > 1) {
const char *str_ptr;
res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error;
}
/* We have a correct id option */
ssh = SCMalloc(sizeof(DetectSshVersionData));
if (ssh == NULL)
goto error;
memset(ssh, 0x00, sizeof(DetectSshVersionData));
/* If we expect a protocol version 2 or 1.99 (considered 2, we
* will compare it with both strings) */
if (strcmp("2_compat", str_ptr) == 0) {
ssh->flags |= SSH_FLAG_PROTOVERSION_2_COMPAT;
SCLogDebug("will look for ssh protocol version 2 (2, 2.0, 1.99 that's considered as 2");
return ssh;
}
ssh->ver = (uint8_t *)SCStrdup((char*)str_ptr);
if (ssh->ver == NULL) {
goto error;
}
ssh->len = strlen((char *) ssh->ver);
SCLogDebug("will look for ssh %s", ssh->ver);
}
return ssh;
error:
if (ssh != NULL)
DetectSshVersionFree(ssh);
return NULL;
}
/**
* \brief this function is used to add the parsed "id" option
* \brief into the current signature
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param idstr pointer to the user provided "id" option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectSshVersionSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
{
DetectSshVersionData *ssh = NULL;
SigMatch *sm = NULL;
ssh = DetectSshVersionParse(str);
if (ssh == NULL)
goto error;
/* Okay so far so good, lets get this into a SigMatch
* and put it in the Signature. */
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_SSH) {
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords.");
goto error;
}
sm->type = DETECT_AL_SSH_PROTOVERSION;
sm->ctx = (void *)ssh;
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH);
s->flags |= SIG_FLAG_APPLAYER;
s->alproto = ALPROTO_SSH;
return 0;
error:
if (ssh != NULL)
DetectSshVersionFree(ssh);
if (sm != NULL)
SCFree(sm);
return -1;
}
