61 #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian
62 #define DETECT_BYTEMATH_BASE_DEFAULT (uint8_t) BaseDec
64 static void DetectByteMathRegisterTests(
void);
82 static inline bool DetectByteMathValidateNbytesOnly(
const DetectByteMathData *data, int32_t nbytes)
85 (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
90 uint64_t rvalue, uint64_t *value, uint8_t endian)
96 if (!DetectByteMathValidateNbytesOnly(data, nbytes)) {
108 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
109 SCLogDebug(
"relative, working with det_ctx->buffer_offset %" PRIu32
", "
110 "data->offset %" PRIi32
"",
124 SCLogDebug(
"absolute, data->offset %" PRIi32
"", data->offset);
126 ptr = payload + data->offset;
131 if (ptr < payload || nbytes >
len) {
132 SCLogDebug(
"Data not within payload pkt=%p, ptr=%p, len=%" PRIu32
", nbytes=%d", payload,
138 if (data->flags & DETECT_BYTEMATH_FLAG_STRING) {
145 SCLogDebug(
"error extracting %d bytes of string data: %d", nbytes, extbytes);
150 ByteEndian bme = endian;
153 if (extbytes != nbytes) {
154 SCLogDebug(
"error extracting %d bytes of numeric data: %d", nbytes, extbytes);
163 switch (data->oper) {
196 if (data->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
197 val &= data->bitmask_val;
198 if (val && data->bitmask_shift_count) {
199 val = val >> data->bitmask_shift_count;
218 static DetectByteMathData *DetectByteMathParse(
221 DetectByteMathData *bmd;
222 if ((bmd = SCByteMathParse(arg)) == NULL) {
227 if (bmd->nbytes_str) {
228 if (nbytes == NULL) {
230 "var name for nbytes. \"nbytes\" argument supplied to "
231 "this function must be non-NULL");
234 *nbytes =
SCStrdup(bmd->nbytes_str);
235 if (*nbytes == NULL) {
240 if (bmd->rvalue_str) {
241 if (rvalue == NULL) {
243 "var name for rvalue. \"rvalue\" argument supplied to "
244 "this function must be non-NULL");
247 *rvalue =
SCStrdup(bmd->rvalue_str);
248 if (*rvalue == NULL) {
253 if (bmd->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
254 if (bmd->bitmask_val) {
255 uint32_t bmask = bmd->bitmask_val;
256 while (!(bmask & 0x1)){
258 bmd->bitmask_shift_count++;
267 DetectByteMathFree(
de_ctx, bmd);
285 DetectByteMathData *data;
290 data = DetectByteMathParse(
de_ctx, arg, &nbytes, &rvalue);
301 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
305 "previous pattern match");
309 }
else if (data->endian == EndianDCE) {
310 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
316 if (prev_pm == NULL) {
330 }
else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
335 if (prev_pm == NULL) {
347 if (data->endian == EndianDCE) {
351 if ((data->flags & DETECT_BYTEMATH_FLAG_STRING) || (data->base == BaseDec) ||
352 (data->base == BaseHex) || (data->base == BaseOct)) {
354 "A bytemath keyword with dce holds other invalid modifiers.");
359 if (nbytes != NULL) {
362 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", nbytes);
365 data->nbytes = index;
366 data->flags |= DETECT_BYTEMATH_FLAG_NBYTES_VAR;
371 if (rvalue != NULL) {
374 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", rvalue);
377 data->rvalue = index;
378 data->flags |= DETECT_BYTEMATH_FLAG_RVALUE_VAR;
385 if (prev_bmd_sm == NULL) {
388 data->local_id = ((DetectByteMathData *)prev_bmd_sm->
ctx)->local_id + 1;
399 if (!(data->flags & DETECT_BYTEMATH_FLAG_RELATIVE))
421 DetectByteMathFree(
de_ctx, data);
449 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
450 if (strcmp(bmd->result, arg) == 0) {
464 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
465 if (strcmp(bmd->result, arg) == 0) {
481 static int DetectByteMathParseTest01(
void)
484 DetectByteMathData *bmd = DetectByteMathParse(NULL,
485 "bytes 4, offset 2, oper +,"
486 "rvalue 10, result bar",
498 DetectByteMathFree(NULL, bmd);
503 static int DetectByteMathParseTest02(
void)
506 DetectByteMathData *bmd = DetectByteMathParse(NULL,
507 "bytes 257, offset 2, oper +, "
508 "rvalue 39, result bar",
516 static int DetectByteMathParseTest03(
void)
519 DetectByteMathData *bmd = DetectByteMathParse(NULL,
520 "bytes 11, offset 2, oper +, "
521 "rvalue 39, result bar",
528 static int DetectByteMathParseTest04(
void)
531 DetectByteMathData *bmd = DetectByteMathParse(NULL,
532 "bytes 4, offset 70000, oper +,"
533 " rvalue 39, result bar",
541 static int DetectByteMathParseTest05(
void)
544 DetectByteMathData *bmd = DetectByteMathParse(NULL,
545 "bytes 11, offset 16, oper &,"
546 "rvalue 39, result bar",
553 static int DetectByteMathParseTest06(
void)
555 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
558 DetectByteMathData *bmd = DetectByteMathParse(NULL,
559 "bytes 4, offset 0, oper +,"
560 "rvalue 248, result var, relative",
573 DetectByteMathFree(NULL, bmd);
578 static int DetectByteMathParseTest07(
void)
582 DetectByteMathData *bmd = DetectByteMathParse(NULL,
583 "bytes 4, offset 2, oper +,"
584 "rvalue foo, result bar",
595 DetectByteMathFree(NULL, bmd);
602 static int DetectByteMathParseTest08(
void)
605 DetectByteMathData *bmd = DetectByteMathParse(NULL,
606 "bytes 4, offset 2, oper +,"
607 "rvalue foo, result bar",
614 static int DetectByteMathParseTest09(
void)
616 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
618 DetectByteMathData *bmd = DetectByteMathParse(NULL,
619 "bytes 4, offset 2, oper +,"
620 "rvalue 39, result bar, relative",
633 DetectByteMathFree(NULL, bmd);
638 static int DetectByteMathParseTest10(
void)
640 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
642 DetectByteMathData *bmd = DetectByteMathParse(NULL,
643 "bytes 4, offset 2, oper +,"
644 "rvalue 39, result bar, endian"
658 DetectByteMathFree(NULL, bmd);
663 static int DetectByteMathParseTest11(
void)
665 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
667 DetectByteMathData *bmd = DetectByteMathParse(NULL,
668 "bytes 4, offset 2, oper +, "
669 "rvalue 39, result bar, dce",
682 DetectByteMathFree(NULL, bmd);
687 static int DetectByteMathParseTest12(
void)
689 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE | DETECT_BYTEMATH_FLAG_STRING;
691 DetectByteMathData *bmd = DetectByteMathParse(NULL,
692 "bytes 4, offset 2, oper +,"
693 "rvalue 39, result bar, "
694 "relative, string dec",
707 DetectByteMathFree(NULL, bmd);
712 static int DetectByteMathParseTest13(
void)
714 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING |
715 DETECT_BYTEMATH_FLAG_RELATIVE |
716 DETECT_BYTEMATH_FLAG_BITMASK;
718 DetectByteMathData *bmd = DetectByteMathParse(NULL,
719 "bytes 4, offset 2, oper +, "
720 "rvalue 39, result bar, "
721 "relative, string dec, bitmask "
737 DetectByteMathFree(NULL, bmd);
743 static int DetectByteMathParseTest14(
void)
746 DetectByteMathData *bmd = DetectByteMathParse(NULL,
747 "bytes 4, offset 2, oper +,"
756 static int DetectByteMathParseTest15(
void)
760 DetectByteMathData *bmd = DetectByteMathParse(NULL,
761 "bytes 4, offset 2, oper +, "
770 static int DetectByteMathParseTest16(
void)
772 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING | DETECT_BYTEMATH_FLAG_RELATIVE |
773 DETECT_BYTEMATH_FLAG_BITMASK;
775 DetectByteMathData *bmd = DetectByteMathParse(NULL,
776 "bytes 4, offset -2, oper +, "
777 "rvalue 39, result bar, "
778 "relative, string dec, bitmask "
794 DetectByteMathFree(NULL, bmd);
799 static int DetectByteMathPacket01(
void)
801 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01,
802 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
803 0x00, 0x00, 0x6d, 0x00, 0x01, 0x00 };
805 void *dns_state = NULL;
813 memset(&f, 0,
sizeof(
Flow));
816 "192.168.1.5",
"192.168.1.1",
822 f.
proto = IPPROTO_UDP;
844 "(byte_extract: 1, 0, extracted_val, relative;"
845 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
846 "byte_test: 2, =, var, 13;"
847 "msg:\"Byte extract and byte math with byte test verification\";"
853 "(byte_extract: 1, 0, extracted_val, relative;"
854 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
855 "byte_test: 2, !=, var, 13;"
856 "msg:\"Byte extract and byte math with byte test verification\";"
865 "(byte_extract: 1, 0, extracted_val, relative;"
866 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
867 "byte_test: 2, <, var, 15;"
868 "msg:\"Byte extract and byte math with byte test verification\";"
877 STREAM_TOSERVER, buf,
sizeof(buf));
901 static int DetectByteMathPacket02(
void)
903 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
904 0x00, 0x70, 0x00, 0x01, 0x00 };
906 void *dns_state = NULL;
914 memset(&f, 0,
sizeof(
Flow));
916 p =
UTHBuildPacketReal(buf,
sizeof(buf), IPPROTO_UDP,
"192.168.1.5",
"192.168.1.1", 41424, 53);
921 f.
proto = IPPROTO_UDP;
943 "alert udp any any -> any any "
944 "(byte_extract: 1, 0, extracted_val, relative;"
945 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
946 "byte_test: 2, =, var, 13;"
947 "msg:\"Byte extract and byte math with byte test verification\";"
953 "alert udp any any -> any any "
954 "(byte_extract: 1, 0, extracted_val, relative;"
955 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
956 "byte_test: 2, !=, var, 13;"
957 "msg:\"Byte extract and byte math with byte test verification\";"
966 "alert udp any any -> any any "
967 "(byte_extract: 1, 0, extracted_val, relative;"
968 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
969 "byte_test: 2, <, var, 15;"
970 "msg:\"Byte extract and byte math with byte test verification\";"
1002 static int DetectByteMathContext01(
void)
1008 DetectByteMathData *bmd = NULL;
1015 "(msg:\"Testing bytemath_body\"; "
1016 "content:\"|00 04 93 F3|\"; "
1017 "content:\"|00 00 00 07|\"; distance:4; within:4;"
1018 "byte_math:bytes 4, offset 0, oper +, rvalue "
1019 "248, result var, relative; sid:1;)");
1039 bmd = (DetectByteMathData *)sm->
ctx;
1044 FAIL_IF_NOT(bmd->flags == DETECT_BYTEMATH_FLAG_RELATIVE);
1054 static void DetectByteMathRegisterTests(
void)
1056 UtRegisterTest(
"DetectByteMathParseTest01", DetectByteMathParseTest01);
1057 UtRegisterTest(
"DetectByteMathParseTest02", DetectByteMathParseTest02);
1058 UtRegisterTest(
"DetectByteMathParseTest03", DetectByteMathParseTest03);
1059 UtRegisterTest(
"DetectByteMathParseTest04", DetectByteMathParseTest04);
1060 UtRegisterTest(
"DetectByteMathParseTest05", DetectByteMathParseTest05);
1061 UtRegisterTest(
"DetectByteMathParseTest06", DetectByteMathParseTest06);
1062 UtRegisterTest(
"DetectByteMathParseTest07", DetectByteMathParseTest07);
1063 UtRegisterTest(
"DetectByteMathParseTest08", DetectByteMathParseTest08);
1064 UtRegisterTest(
"DetectByteMathParseTest09", DetectByteMathParseTest09);
1065 UtRegisterTest(
"DetectByteMathParseTest10", DetectByteMathParseTest10);
1066 UtRegisterTest(
"DetectByteMathParseTest11", DetectByteMathParseTest11);
1067 UtRegisterTest(
"DetectByteMathParseTest12", DetectByteMathParseTest12);
1068 UtRegisterTest(
"DetectByteMathParseTest13", DetectByteMathParseTest13);
1069 UtRegisterTest(
"DetectByteMathParseTest14", DetectByteMathParseTest14);
1070 UtRegisterTest(
"DetectByteMathParseTest15", DetectByteMathParseTest15);
1071 UtRegisterTest(
"DetectByteMathParseTest16", DetectByteMathParseTest16);
1072 UtRegisterTest(
"DetectByteMathPacket01", DetectByteMathPacket01);
1073 UtRegisterTest(
"DetectByteMathPacket02", DetectByteMathPacket02);
1074 UtRegisterTest(
"DetectByteMathContext01", DetectByteMathContext01);