Project

General

Profile

Download (5.86 KB)

Bug #455 » 0001-bug-455-Warn-users-on-signature-event-vars-having-pr.patch

Anoop Saldanha, 06/29/2012 12:24 PM

View differences:

src/util-error.c
CASE_CODE (SC_ERR_MEM_BUFFER_API);
CASE_CODE (SC_ERR_INVALID_MD5);
CASE_CODE (SC_ERR_NO_MD5_SUPPORT);
CASE_CODE (SC_ERR_EVENT_ENGINE);
default:
return "UNKNOWN_ERROR";
}
src/util-error.h
SC_ERR_MEM_BUFFER_API,
SC_ERR_INVALID_MD5,
SC_ERR_NO_MD5_SUPPORT,
SC_ERR_EVENT_ENGINE,
} SCError;
const char *SCErrorToString(SCError);
src/util-threshold-config.c
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
if (m != NULL) {
SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has "
"an event var set. The signature event var is "
"given precedence over the threshold.conf one. "
"We'll change this in the future though.", id);
goto end;
}
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
if (m != NULL) {
SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has "
"an event var set. The signature event var is "
"given precedence over the threshold.conf one. "
"We'll change this in the future though.", id);
goto end;
}
de = SCMalloc(sizeof(DetectThresholdData));
if (de == NULL)
......
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
if (m != NULL) {
SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has "
"an event var set. The signature event var is "
"given precedence over the threshold.conf one. "
"We'll change this in the future though.", id);
goto end;
}
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
if (m != NULL) {
SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has "
"an event var set. The signature event var is "
"given precedence over the threshold.conf one. "
"We'll change this in the future though.", id);
goto end;
}
de = SCMalloc(sizeof(DetectThresholdData));
if (de == NULL)
......
}
s = ns;
}
} else if (id > 0 && gid == 0) {
SCLogError(SC_ERR_INVALID_VALUE, "Can't use a event config that has "
"sid > 0 and gid == 0. Killing engine. Please fix this "
"in your threshold.conf file");
exit(EXIT_FAILURE);
} else {
sig = SigFindSignatureBySidGid(de_ctx,id,gid);
......
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
if (m != NULL) {
SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has "
"an event var set. The signature event var is "
"given precedence over the threshold.conf one. "
"We'll change this in the future though.", id);
goto end;
}
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_DETECTION_FILTER, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
if (m != NULL) {
SCLogWarning(SC_ERR_EVENT_ENGINE, "signature sid:%"PRIu32 " has "
"an event var set. The signature event var is "
"given precedence over the threshold.conf one. "
"We'll change this in the future though.", id);
goto end;
}
de = SCMalloc(sizeof(DetectThresholdData));
if (de == NULL)
(4-4/4)