Go to the documentation of this file.
28 #define BASE64_DECODE_MAX 65535
36 static const char decode_pattern[] =
"\\s*(bytes\\s+(\\d+),?)?"
37 "\\s*(offset\\s+(\\d+),?)?"
45 static void DetectBase64DecodeRegisterTests(
void);
52 "Decodes base64 encoded data.";
54 "/rules/base64-keywords.html#base64-decode";
59 DetectBase64DecodeRegisterTests;
73 printf(
"Input data:\n");
86 payload = payload + data->
offset;
93 printf(
"Decoding:\n");
97 uint32_t consumed = 0, num_decoded = 0;
99 decode_len, &consumed, &num_decoded, Base64ModeRFC4648);
101 SCLogDebug(
"Decoded %d bytes from base64 data.",
105 printf(
"Decoded data:\n");
114 static int DetectBase64DecodeParse(
const char *
str, uint32_t *bytes,
115 uint32_t *
offset, uint8_t *relative)
117 const char *bytes_str = NULL;
118 const char *offset_str = NULL;
119 const char *relative_str = NULL;
126 pcre2_match_data *match = NULL;
134 if (pcre2_substring_get_bynumber(match, 2, (PCRE2_UCHAR8 **)&bytes_str, &pcre2_len) == 0) {
136 SCLogError(
"Bad value for bytes: \"%s\"", bytes_str);
143 if (pcre2_substring_get_bynumber(match, 4, (PCRE2_UCHAR8 **)&offset_str, &pcre2_len) == 0) {
145 SCLogError(
"Bad value for offset: \"%s\"", offset_str);
152 if (pcre2_substring_get_bynumber(match, 5, (PCRE2_UCHAR8 **)&relative_str, &pcre2_len) ==
154 if (strcmp(relative_str,
"relative") == 0) {
158 SCLogError(
"Invalid argument: \"%s\"", relative_str);
166 pcre2_match_data_free(match);
171 if (bytes_str != NULL) {
172 pcre2_substring_free((PCRE2_UCHAR8 *)bytes_str);
174 if (offset_str != NULL) {
175 pcre2_substring_free((PCRE2_UCHAR8 *)offset_str);
177 if (relative_str != NULL) {
178 pcre2_substring_free((PCRE2_UCHAR8 *)relative_str);
181 pcre2_match_data_free(match);
191 uint8_t relative = 0;
197 if (!DetectBase64DecodeParse(
str, &bytes, &
offset, &relative)) {
237 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
266 static int g_http_header_buffer_id = 0;
268 static int DetectBase64TestDecodeParse(
void)
273 uint8_t relative = 0;
275 if (!DetectBase64DecodeParse(
"bytes 1", &bytes, &
offset, &relative)) {
278 if (bytes != 1 ||
offset != 0 || relative != 0) {
282 if (!DetectBase64DecodeParse(
"offset 9", &bytes, &
offset, &relative)) {
285 if (bytes != 0 ||
offset != 9 || relative != 0) {
289 if (!DetectBase64DecodeParse(
"relative", &bytes, &
offset, &relative)) {
292 if (bytes != 0 ||
offset != 0 || relative != 1) {
296 if (!DetectBase64DecodeParse(
"bytes 1, offset 2", &bytes, &
offset,
300 if (bytes != 1 ||
offset != 2 || relative != 0) {
304 if (!DetectBase64DecodeParse(
"bytes 1, offset 2, relative", &bytes, &
offset,
308 if (bytes != 1 ||
offset != 2 || relative != 1) {
312 if (!DetectBase64DecodeParse(
"offset 2, relative", &bytes, &
offset,
316 if (bytes != 0 ||
offset != 2 || relative != 1) {
321 if (DetectBase64DecodeParse(
"bytes 1, offset 2, relatve", &bytes, &
offset,
327 if (DetectBase64DecodeParse(
"byts 1, offset 2, relatve", &bytes, &
offset,
333 if (DetectBase64DecodeParse(
"bytes 1, offst 2, relatve", &bytes, &
offset,
339 if (DetectBase64DecodeParse(
"", &bytes, &
offset, &relative)) {
351 static int DetectBase64DecodeTestSetup(
void)
357 "base64_decode; content:\"content\"; "
366 static int DetectBase64DecodeTestDecode(
void)
374 uint8_t payload[] = {
375 'S',
'G',
'V',
's',
'b',
'G',
'8',
'g',
376 'V',
'2',
'9',
'y',
'b',
'G',
'Q',
'=',
379 memset(&
tv, 0,
sizeof(
tv));
386 "alert tcp any any -> any any (msg:\"base64 test\"; "
407 if (det_ctx != NULL) {
421 static int DetectBase64DecodeTestDecodeWithOffset(
void)
429 uint8_t payload[] = {
430 'a',
'a',
'a',
'a',
'a',
'a',
'a',
'a',
431 'S',
'G',
'V',
's',
'b',
'G',
'8',
'g',
432 'V',
'2',
'9',
'y',
'b',
'G',
'Q',
'=',
434 char decoded[] =
"Hello World";
436 memset(&
tv, 0,
sizeof(
tv));
443 "alert tcp any any -> any any (msg:\"base64 test\"; "
444 "base64_decode: offset 8; "
467 if (det_ctx != NULL) {
481 static int DetectBase64DecodeTestDecodeLargeOffset(
void)
489 uint8_t payload[] = {
490 'S',
'G',
'V',
's',
'b',
'G',
'8',
'g',
491 'V',
'2',
'9',
'y',
'b',
'G',
'Q',
'=',
494 memset(&
tv, 0,
sizeof(
tv));
502 "alert tcp any any -> any any (msg:\"base64 test\"; "
503 "base64_decode: bytes 16, offset 32; "
523 if (det_ctx != NULL) {
537 static int DetectBase64DecodeTestDecodeRelative(
void)
545 uint8_t payload[] = {
546 'a',
'a',
'a',
'a',
'a',
'a',
'a',
'a',
547 'S',
'G',
'V',
's',
'b',
'G',
'8',
'g',
548 'V',
'2',
'9',
'y',
'b',
'G',
'Q',
'=',
550 char decoded[] =
"Hello World";
552 memset(&
tv, 0,
sizeof(
tv));
559 "alert tcp any any -> any any (msg:\"base64 test\"; "
560 "content:\"aaaaaaaa\"; "
561 "base64_decode: relative; "
584 if (det_ctx != NULL) {
598 static void DetectBase64DecodeRegisterTests(
void)
602 UtRegisterTest(
"DetectBase64TestDecodeParse", DetectBase64TestDecodeParse);
603 UtRegisterTest(
"DetectBase64DecodeTestSetup", DetectBase64DecodeTestSetup);
605 DetectBase64DecodeTestDecode);
607 DetectBase64DecodeTestDecodeWithOffset);
609 DetectBase64DecodeTestDecodeLargeOffset);
611 DetectBase64DecodeTestDecodeRelative);
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
SigTableElmt * sigmatch_table
void(* Free)(DetectEngineCtx *, void *)
struct SigMatch_ * smlists_tail[DETECT_SM_LIST_MAX]
int DetectBase64DecodeDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, const uint8_t *payload, uint32_t payload_len)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
int DetectParsePcreExec(DetectParseRegex *parse_regex, pcre2_match_data **match, const char *str, int start_offset, int options)
struct DetectBase64Decode_ DetectBase64Decode
void SigCleanSignatures(DetectEngineCtx *de_ctx)
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
int DetectBufferTypeGetByName(const char *name)
Base64Ecode DecodeBase64(uint8_t *dest, uint32_t dest_size, const uint8_t *src, uint32_t len, uint32_t *consumed_bytes, uint32_t *decoded_bytes, DetectBase64Mode mode)
Decodes a base64-encoded string buffer into an ascii-encoded byte buffer.
#define PASS
Pass the test.
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Per thread variable structure.
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
int SigGroupCleanup(DetectEngineCtx *de_ctx)
#define BASE64_DECODE_MAX
SignatureInitData * init_data
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
#define DETECT_SM_LIST_NOTSET
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
#define SIGMATCH_OPTIONAL_OPT
#define SCLogError(...)
Macro used to log ERROR messages.
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
int base64_decoded_len_max
a single match condition for a signature
DetectEngineCtx * DetectEngineCtxInit(void)
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
void DetectBase64DecodeRegister(void)
uint32_t base64_decode_max_len
void(* RegisterTests)(void)