Skip to content

Commit

Permalink
detect-parse: parse sid in pre-scan
Browse files Browse the repository at this point in the history
During the pre-scan for "requires", also parse the SID if possible. If
the rule fails high level parsing (syntax), the SID will not be
parsed.

But every keyword other than "sid" and "requires" should expect to be
provided with a parsed sid.
  • Loading branch information
jasonish authored and victorjulien committed Dec 19, 2023
1 parent 435c031 commit 71bbba9
Showing 1 changed file with 12 additions and 8 deletions.
20 changes: 12 additions & 8 deletions src/detect-parse.c
Original file line number Diff line number Diff line change
Expand Up @@ -900,10 +900,11 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
}
optname = optstr;

if (requires) {
if (strcmp(optname, "requires")) {
goto finish;
}
/* Check for options that are only to be processed during the
* first "requires" pass. */
bool requires_only = strcmp(optname, "requires") == 0 || strcmp(optname, "sid") == 0;
if ((requires && !requires_only) || (!requires && requires_only)) {
goto finish;
}

/* Call option parsing */
Expand Down Expand Up @@ -2137,10 +2138,7 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
AppLayerHtpNeedFileInspection();
}
}
if (s->id == 0) {
SCLogError("Signature missing required value \"sid\".");
SCReturnInt(0);
}

SCReturnInt(1);
}

Expand Down Expand Up @@ -2181,6 +2179,12 @@ static Signature *SigInitHelper(DetectEngineCtx *de_ctx, const char *sigstr,
goto error;
}

/* Check for a SID before continuuing. */
if (sig->id == 0) {
SCLogError("Signature missing required value \"sid\".");
goto error;
}

/* Now completely parse the rule. */
ret = SigParse(de_ctx, sig, sigstr, dir, &parser, false);
BUG_ON(ret == -4);
Expand Down

0 comments on commit 71bbba9

Please sign in to comment.