diff --git a/CHANGES b/CHANGES index 38d2a79d57..c02d129dee 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5.1.0-dev.489 | 2022-09-06 07:44:18 -0700 + + * Add is_used attribute to an ID if used in a signature eval statement (Tim Wojtulewicz, Corelight) + 5.1.0-dev.486 | 2022-09-02 13:57:31 -0700 * Update Management framework to new Supervisor::NodeConfig script fields (Christian Kreibich, Corelight) diff --git a/VERSION b/VERSION index bc512b0b9a..73db5d00b2 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -5.1.0-dev.486 +5.1.0-dev.489 diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc index 39d21e9a4b..35eb903f2b 100644 --- a/src/RuleCondition.cc +++ b/src/RuleCondition.cc @@ -180,6 +180,10 @@ RuleConditionEval::RuleConditionEval(const char* func) rules_error("eval function parameters must be a 'signature_state' " "and a 'string' type", func); + + std::vector attrv{make_intrusive(ATTR_IS_USED, nullptr)}; + id->AddAttrs( + make_intrusive(std::move(attrv), id->GetType(), false, id->IsGlobal())); } } diff --git a/testing/btest/Baseline/signatures.signature-cond-used/.stderr b/testing/btest/Baseline/signatures.signature-cond-used/.stderr new file mode 100644 index 0000000000..49d861c74c --- /dev/null +++ b/testing/btest/Baseline/signatures.signature-cond-used/.stderr @@ -0,0 +1 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. diff --git a/testing/btest/Baseline/signatures.signature-cond-used/.stdout b/testing/btest/Baseline/signatures.signature-cond-used/.stdout new file mode 100644 index 0000000000..bdcb875b90 --- /dev/null +++ b/testing/btest/Baseline/signatures.signature-cond-used/.stdout @@ -0,0 +1,3 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +signature_cond, GET /download/CHANGES.bro-aux.txt HTTP/1.1\x0d\x0aUser-Agent: Wget/1.14 (darwin12.2.0)\x0d\x0aAccept: */*\x0d\x0aHost: bro.org\x0d\x0aConnection: Keep-Alive\x0d\x0a\x0d\x0a +signature_match, GET, GET /download/CHANGES.bro-aux.txt HTTP/1.1\x0d\x0aUser-Agent: Wget/1.14 (darwin12.2.0)\x0d\x0aAccept: */*\x0d\x0aHost: bro.org\x0d\x0aConnection: Keep-Alive\x0d\x0a\x0d\x0a diff --git a/testing/btest/signatures/signature-cond-used.zeek b/testing/btest/signatures/signature-cond-used.zeek new file mode 100644 index 0000000000..a93f33596b --- /dev/null +++ b/testing/btest/signatures/signature-cond-used.zeek @@ -0,0 +1,29 @@ +# @TEST-DOC: The function signature_cond used for eval in test.sig should not be reported as unused +# @TEST-EXEC: zeek -b %INPUT -r $TRACES/http/get.trace +# @TEST-EXEC: btest-diff .stderr +# @TEST-EXEC: btest-diff .stdout +module SignatureEvalTest; + +@load-sigs ./test.sig + +event signature_match(state: signature_state, msg: string, data: string) + { + print "signature_match", msg, data; + } + +function signature_cond(state: signature_state, data: string): bool + { + print "signature_cond", data; + return T; + } + + +@TEST-START-FILE test.sig +signature my-first-sig { + ip-proto == tcp + dst-port == 80 + payload /GET/ + event "GET" + eval SignatureEvalTest::signature_cond +} +@TEST-END-FILE