Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 17:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix signatures that use identifiers of type table.

Browse source
This commit is contained in:
Jon Siwek 2013-09-05 13:01:40 -05:00
parent eef432561e
commit 4e8ba6eaa2
3 changed files with 18 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/RuleMatcher.cc
View file

@ -1243,15 +1243,16 @@ void id_to_maskedvallist(const char* id, maskedvalue_list* append_to,
if ( v->Type()->Tag() == TYPE_TABLE )
{
val_list* vals = v->AsTableVal()->ConvertToPureList()->Vals();
ListVal* lv = v->AsTableVal()->ConvertToPureList();
val_list* vals = lv->Vals();
loop_over_list(*vals, i )
if ( ! val_to_maskedval((*vals)[i], append_to, prefix_vector) )
{
delete_vals(vals);
{
Unref(lv);
return;
}
}
delete_vals(vals);
Unref(lv);
}
else

1
testing/btest/Baseline/signatures.id-lookup/id.out
View file

@ -1 +1,2 @@
signature_match [orig_h=127.0.0.1, orig_p=30000/udp, resp_h=127.0.0.1, resp_p=13000/udp] - idtable
signature_match [orig_h=127.0.0.1, orig_p=30000/udp, resp_h=127.0.0.1, resp_p=13000/udp] - id

11
testing/btest/signatures/id-lookup.bro
View file

@ -6,10 +6,21 @@ signature id {
ip-proto == udp_proto_number
event "id"
}
signature idtable {
dst-ip == mynets
event "idtable"
}
@TEST-END-FILE
const udp_proto_number = 17;
const mynets: set[subnet] = {
192.168.1.0/24,
10.0.0.0/8,
127.0.0.0/24
};
event signature_match(state: signature_state, msg: string, data: string)
{
print fmt("signature_match %s - %s", state$conn$id, msg);