Fix issues with parsing of raw network and port definitions. (#166)

google · Jun 9, 2021 · b9d2590 · b9d2590
1 parent 725175e
commit b9d2590
Show file tree

Hide file tree

Showing 2 changed files with 114 additions and 4 deletions.
diff --git a/parser.go b/parser.go
@@ -44,6 +44,9 @@ var metaSplitRE = regexp.MustCompile(`,\s*`)
 // nestedNetRE matches nested network groups.
 var nestedNetRE = regexp.MustCompile(`,(!?\[[^]]*\])`)
 
+// portSplitRE splits port lists and ranges for validation.
+var portSplitRE = regexp.MustCompile(`[:,]`)
+
 var appLayerProtocols = []string{
 	"dcerpc",
 	"dhcp",
@@ -514,7 +517,6 @@ func (r *Rule) network(key item, l *lexer) error {
 // Validate that every item is between 1 and 65535.
 func portsValid(p []string) bool {
 	for _, u := range p {
-		// Ignore negations for validation.
 		u = strings.TrimPrefix(u, "!")
 
 		// If this port range is a grouping, check the inner group.
@@ -524,9 +526,11 @@ func portsValid(p []string) bool {
 			}
 			return false
 		}
-		ports := strings.Split(u, ":")
+
+		ports := portSplitRE.Split(u, -1)
 		for _, port := range ports {
-			if port == "any" || strings.HasPrefix(port, "$") {
+			port = strings.TrimPrefix(port, "!")
+			if port == "any" || port == "" || strings.HasPrefix(port, "$") {
 				continue
 			}
 			x, err := strconv.Atoi(port)
@@ -558,7 +562,7 @@ func validNetworks(nets []string) bool {
 	for _, net := range nets {
 		net = strings.TrimPrefix(net, "!")
 		// If this network is a grouping, check the inner group.
-		if strings.HasPrefix(net, "[") {
+		if strings.HasPrefix(net, "[") || strings.Contains(net, ",") {
 			if validNetworks(strings.Split(strings.Trim(net, "[]"), ",")) {
 				continue
 			}

diff --git a/parser_test.go b/parser_test.go
@@ -1909,6 +1909,102 @@ func TestParseRule(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "raw port list",
+			rule: `alert tcp $EXTERNAL_NET [443,465,993,995,25] -> $HOME_NET any (msg:"raw port list"; content:"hi"; sid:12345; rev:1;)`,
+			want: &Rule{
+				Action:   "alert",
+				Protocol: "tcp",
+				Source: Network{
+					Nets:  []string{"$EXTERNAL_NET"},
+					Ports: []string{"443,465,993,995,25"},
+				},
+				Destination: Network{
+					Nets:  []string{"$HOME_NET"},
+					Ports: []string{"any"},
+				},
+				SID:         12345,
+				Revision:    1,
+				Description: "raw port list",
+				Matchers: []orderedMatcher{
+					&Content{
+						Pattern: []byte("hi"),
+					},
+				},
+			},
+		},
+		{
+			name: "raw port list with negations",
+			rule: `alert tcp $EXTERNAL_NET [!21,!22,!23,!2100,!3535] -> $HOME_NET any (msg:"raw port list with negations"; content:"hi"; sid:12345; rev:1;)`,
+			want: &Rule{
+				Action:   "alert",
+				Protocol: "tcp",
+				Source: Network{
+					Nets:  []string{"$EXTERNAL_NET"},
+					Ports: []string{"!21,!22,!23,!2100,!3535"},
+				},
+				Destination: Network{
+					Nets:  []string{"$HOME_NET"},
+					Ports: []string{"any"},
+				},
+				SID:         12345,
+				Revision:    1,
+				Description: "raw port list with negations",
+				Matchers: []orderedMatcher{
+					&Content{
+						Pattern: []byte("hi"),
+					},
+				},
+			},
+		},
+		{
+			name: "raw network list",
+			rule: `alert tcp [174.129.0.0/16,67.202.0.0/18] any -> $HOME_NET any (msg:"raw network list"; content:"hi"; sid:12345; rev:1;)`,
+			want: &Rule{
+				Action:   "alert",
+				Protocol: "tcp",
+				Source: Network{
+					Nets:  []string{"174.129.0.0/16,67.202.0.0/18"},
+					Ports: []string{"any"},
+				},
+				Destination: Network{
+					Nets:  []string{"$HOME_NET"},
+					Ports: []string{"any"},
+				},
+				SID:         12345,
+				Revision:    1,
+				Description: "raw network list",
+				Matchers: []orderedMatcher{
+					&Content{
+						Pattern: []byte("hi"),
+					},
+				},
+			},
+		},
+		{
+			name: "raw network list with negations",
+			rule: `alert tcp [174.129.0.0/16,!67.202.0.0/18] any -> $HOME_NET any (msg:"raw network list"; content:"hi"; sid:12345; rev:1;)`,
+			want: &Rule{
+				Action:   "alert",
+				Protocol: "tcp",
+				Source: Network{
+					Nets:  []string{"174.129.0.0/16,!67.202.0.0/18"},
+					Ports: []string{"any"},
+				},
+				Destination: Network{
+					Nets:  []string{"$HOME_NET"},
+					Ports: []string{"any"},
+				},
+				SID:         12345,
+				Revision:    1,
+				Description: "raw network list",
+				Matchers: []orderedMatcher{
+					&Content{
+						Pattern: []byte("hi"),
+					},
+				},
+			},
+		},
 		// Errors
 		{
 			name:    "invalid action",
@@ -2169,6 +2265,16 @@ func TestPortsValid(t *testing.T) {
 			input: []string{"![25,110,143,465,587,2525]"},
 			want:  true,
 		},
+		{
+			name:  "port list",
+			input: []string{"[443,465,993,995,25]"},
+			want:  true,
+		},
+		{
+			name:  "open upper range",
+			input: []string{"[1024:]"},
+			want:  true,
+		},
 		{
 			name:  "invalid port",
 			input: []string{"8080", "0"},