[PATCH 2/4] ids-functions.pl: Add function to get the provider by a given rule id

[Stefan Schantl <stefan.schantl@ipfire.org>]

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 config/cfgroot/ids-functions.pl | 80 +++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index bede5fca0..0271ef4fc 100644
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -1829,4 +1829,84 @@ sub generate_report_generator_config() {
 	close(FILE);
 }
 
+#
+## Function to get the provider handle by a given rule sid.
+#
+sub get_provider_by_sid ($) {
+	my ($sid) = @_;
+
+	# Get all known ruleset providers.
+	my @ruleset_providers = &get_ruleset_providers();
+
+	# Temporary hash to store found ranges.
+	my %tmphash = ();
+	my @tmparray;
+
+	# Loop through the array of known providers.
+	foreach my $provider (@ruleset_providers) {
+		# Skip provider if no sid range is specified.
+		next unless ($IDS::Ruleset::Providers{$provider}{"sid_range"});
+
+		# Grab and the dereference the sid range.
+		my @sid_range = @{ $IDS::Ruleset::Providers{$provider}{"sid_range"} };
+
+		# Check if the given sid is in the range of the current processed provider.
+		next unless (&is_sid_in_range($sid, \@sid_range));
+
+		# Assign some nice human-readable values.
+		my $start = $sid_range[0];
+		my $end = $sid_range[1];
+
+		# Calculate the sid range.
+		my $range = $end - $start;
+
+		# Assign the found provider and it's range to the temporary hash.
+		$tmphash{$range} = $provider;
+	}
+
+	# Sort the ranges of the found providers and store them in a temporary
+	# array - This is neccessary in case more than one range has been found.
+	@tmparray = sort (keys %tmphash);
+
+	# Return if nothing has been found.
+	return unless(@tmparray);
+
+	# The first element of the temporary array contains our smalles sid range
+	# which the given sid has to belong - grab the stored handle.
+	my $handle = $tmphash{$tmparray[0]};
+
+	# Return the obtained handle.
+	return $handle;
+}
+
+#
+## Function to check if a given single sid is in a given range.
+#
+sub is_sid_in_range($\@) {
+	my ($sid, $range_ref) = @_;
+
+	# Deref the array ref and assig to array.
+	my @range = @{ $range_ref };
+
+	# Assign some nice human-readable values.
+	my $range_start = $range[0];
+	my $range_stop = $range[1];
+
+	# Early exit in case the range has been passed the
+	# wrong way around.
+	return undef if ($range_start > $range_stop);
+
+	# Return if the given sid is lower than the start one.
+	return if ($sid < $range_start);
+
+	# Return if the given sid is higher than the max range.
+	return if ($sid > $range_stop);
+
+	# Return True if the given sid is lower or equals the max range.
+	return 1 if ($sid <= $range_stop);
+
+	# If we got here, something strange happend.
+	return undef;
+}
+
 1;
-- 
2.47.3