43 #include "rust-bindings.h"
62 #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian
63 #define DETECT_BYTEMATH_BASE_DEFAULT (uint8_t) BaseDec
65 static void DetectByteMathRegisterTests(
void);
83 static inline bool DetectByteMathValidateNbytesOnly(
const DetectByteMathData *data, int32_t nbytes)
86 (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
91 uint64_t rvalue, uint64_t *value, uint8_t endian)
97 if (!DetectByteMathValidateNbytesOnly(data, nbytes)) {
109 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
110 SCLogDebug(
"relative, working with det_ctx->buffer_offset %" PRIu32
", "
111 "data->offset %" PRIi32
"",
125 SCLogDebug(
"absolute, data->offset %" PRIi32
"", data->offset);
127 ptr = payload + data->offset;
132 if (ptr < payload || nbytes >
len) {
133 SCLogDebug(
"Data not within payload pkt=%p, ptr=%p, len=%" PRIu32
", nbytes=%d", payload,
139 if (data->flags & DETECT_BYTEMATH_FLAG_STRING) {
146 SCLogDebug(
"error extracting %d bytes of string data: %d", nbytes, extbytes);
151 ByteEndian bme = endian;
154 if (extbytes != nbytes) {
155 SCLogDebug(
"error extracting %d bytes of numeric data: %d", nbytes, extbytes);
164 switch (data->oper) {
197 if (data->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
198 val &= data->bitmask_val;
199 if (val && data->bitmask_shift_count) {
200 val = val >> data->bitmask_shift_count;
219 static DetectByteMathData *DetectByteMathParse(
222 DetectByteMathData *bmd;
223 if ((bmd = SCByteMathParse(arg)) == NULL) {
228 if (bmd->nbytes_str) {
229 if (nbytes == NULL) {
231 "var name for nbytes. \"nbytes\" argument supplied to "
232 "this function must be non-NULL");
235 *nbytes =
SCStrdup(bmd->nbytes_str);
236 if (*nbytes == NULL) {
241 if (bmd->rvalue_str) {
242 if (rvalue == NULL) {
244 "var name for rvalue. \"rvalue\" argument supplied to "
245 "this function must be non-NULL");
248 *rvalue =
SCStrdup(bmd->rvalue_str);
249 if (*rvalue == NULL) {
254 if (bmd->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
255 if (bmd->bitmask_val) {
256 uint32_t bmask = bmd->bitmask_val;
257 while (!(bmask & 0x1)){
259 bmd->bitmask_shift_count++;
268 DetectByteMathFree(
de_ctx, bmd);
286 DetectByteMathData *data;
291 data = DetectByteMathParse(
de_ctx, arg, &nbytes, &rvalue);
302 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
306 "previous pattern match");
310 }
else if (data->endian == EndianDCE) {
311 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
317 if (prev_pm == NULL) {
331 }
else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
336 if (prev_pm == NULL) {
348 if (data->endian == EndianDCE) {
352 if ((data->flags & DETECT_BYTEMATH_FLAG_STRING) || (data->base == BaseDec) ||
353 (data->base == BaseHex) || (data->base == BaseOct)) {
355 "A bytemath keyword with dce holds other invalid modifiers.");
360 if (nbytes != NULL) {
363 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", nbytes);
366 data->nbytes = index;
367 data->flags |= DETECT_BYTEMATH_FLAG_NBYTES_VAR;
372 if (rvalue != NULL) {
375 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", rvalue);
378 data->rvalue = index;
379 data->flags |= DETECT_BYTEMATH_FLAG_RVALUE_VAR;
386 if (prev_bmd_sm == NULL) {
389 data->local_id = ((DetectByteMathData *)prev_bmd_sm->
ctx)->local_id + 1;
399 if (!(data->flags & DETECT_BYTEMATH_FLAG_RELATIVE))
421 DetectByteMathFree(
de_ctx, data);
449 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
450 if (strcmp(bmd->result, arg) == 0) {
463 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
464 if (strcmp(bmd->result, arg) == 0) {
480 static int DetectByteMathParseTest01(
void)
483 DetectByteMathData *bmd = DetectByteMathParse(NULL,
484 "bytes 4, offset 2, oper +,"
485 "rvalue 10, result bar",
497 DetectByteMathFree(NULL, bmd);
502 static int DetectByteMathParseTest02(
void)
505 DetectByteMathData *bmd = DetectByteMathParse(NULL,
506 "bytes 257, offset 2, oper +, "
507 "rvalue 39, result bar",
515 static int DetectByteMathParseTest03(
void)
518 DetectByteMathData *bmd = DetectByteMathParse(NULL,
519 "bytes 11, offset 2, oper +, "
520 "rvalue 39, result bar",
527 static int DetectByteMathParseTest04(
void)
530 DetectByteMathData *bmd = DetectByteMathParse(NULL,
531 "bytes 4, offset 70000, oper +,"
532 " rvalue 39, result bar",
540 static int DetectByteMathParseTest05(
void)
543 DetectByteMathData *bmd = DetectByteMathParse(NULL,
544 "bytes 11, offset 16, oper &,"
545 "rvalue 39, result bar",
552 static int DetectByteMathParseTest06(
void)
554 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
557 DetectByteMathData *bmd = DetectByteMathParse(NULL,
558 "bytes 4, offset 0, oper +,"
559 "rvalue 248, result var, relative",
572 DetectByteMathFree(NULL, bmd);
577 static int DetectByteMathParseTest07(
void)
581 DetectByteMathData *bmd = DetectByteMathParse(NULL,
582 "bytes 4, offset 2, oper +,"
583 "rvalue foo, result bar",
594 DetectByteMathFree(NULL, bmd);
601 static int DetectByteMathParseTest08(
void)
604 DetectByteMathData *bmd = DetectByteMathParse(NULL,
605 "bytes 4, offset 2, oper +,"
606 "rvalue foo, result bar",
613 static int DetectByteMathParseTest09(
void)
615 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
617 DetectByteMathData *bmd = DetectByteMathParse(NULL,
618 "bytes 4, offset 2, oper +,"
619 "rvalue 39, result bar, relative",
632 DetectByteMathFree(NULL, bmd);
637 static int DetectByteMathParseTest10(
void)
639 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
641 DetectByteMathData *bmd = DetectByteMathParse(NULL,
642 "bytes 4, offset 2, oper +,"
643 "rvalue 39, result bar, endian"
657 DetectByteMathFree(NULL, bmd);
662 static int DetectByteMathParseTest11(
void)
664 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
666 DetectByteMathData *bmd = DetectByteMathParse(NULL,
667 "bytes 4, offset 2, oper +, "
668 "rvalue 39, result bar, dce",
681 DetectByteMathFree(NULL, bmd);
686 static int DetectByteMathParseTest12(
void)
688 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE | DETECT_BYTEMATH_FLAG_STRING;
690 DetectByteMathData *bmd = DetectByteMathParse(NULL,
691 "bytes 4, offset 2, oper +,"
692 "rvalue 39, result bar, "
693 "relative, string dec",
706 DetectByteMathFree(NULL, bmd);
711 static int DetectByteMathParseTest13(
void)
713 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING |
714 DETECT_BYTEMATH_FLAG_RELATIVE |
715 DETECT_BYTEMATH_FLAG_BITMASK;
717 DetectByteMathData *bmd = DetectByteMathParse(NULL,
718 "bytes 4, offset 2, oper +, "
719 "rvalue 39, result bar, "
720 "relative, string dec, bitmask "
736 DetectByteMathFree(NULL, bmd);
742 static int DetectByteMathParseTest14(
void)
745 DetectByteMathData *bmd = DetectByteMathParse(NULL,
746 "bytes 4, offset 2, oper +,"
755 static int DetectByteMathParseTest15(
void)
759 DetectByteMathData *bmd = DetectByteMathParse(NULL,
760 "bytes 4, offset 2, oper +, "
769 static int DetectByteMathParseTest16(
void)
771 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING | DETECT_BYTEMATH_FLAG_RELATIVE |
772 DETECT_BYTEMATH_FLAG_BITMASK;
774 DetectByteMathData *bmd = DetectByteMathParse(NULL,
775 "bytes 4, offset -2, oper +, "
776 "rvalue 39, result bar, "
777 "relative, string dec, bitmask "
793 DetectByteMathFree(NULL, bmd);
798 static int DetectByteMathPacket01(
void)
800 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01,
801 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
802 0x00, 0x00, 0x6d, 0x00, 0x01, 0x00 };
804 void *dns_state = NULL;
812 memset(&f, 0,
sizeof(
Flow));
815 "192.168.1.5",
"192.168.1.1",
821 f.
proto = IPPROTO_UDP;
843 "(byte_extract: 1, 0, extracted_val, relative;"
844 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
845 "byte_test: 2, =, var, 13;"
846 "msg:\"Byte extract and byte math with byte test verification\";"
852 "(byte_extract: 1, 0, extracted_val, relative;"
853 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
854 "byte_test: 2, !=, var, 13;"
855 "msg:\"Byte extract and byte math with byte test verification\";"
864 "(byte_extract: 1, 0, extracted_val, relative;"
865 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
866 "byte_test: 2, <, var, 15;"
867 "msg:\"Byte extract and byte math with byte test verification\";"
876 STREAM_TOSERVER, buf,
sizeof(buf));
900 static int DetectByteMathPacket02(
void)
902 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
903 0x00, 0x70, 0x00, 0x01, 0x00 };
905 void *dns_state = NULL;
913 memset(&f, 0,
sizeof(
Flow));
915 p =
UTHBuildPacketReal(buf,
sizeof(buf), IPPROTO_UDP,
"192.168.1.5",
"192.168.1.1", 41424, 53);
920 f.
proto = IPPROTO_UDP;
942 "alert udp any any -> any any "
943 "(byte_extract: 1, 0, extracted_val, relative;"
944 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
945 "byte_test: 2, =, var, 13;"
946 "msg:\"Byte extract and byte math with byte test verification\";"
952 "alert udp any any -> any any "
953 "(byte_extract: 1, 0, extracted_val, relative;"
954 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
955 "byte_test: 2, !=, var, 13;"
956 "msg:\"Byte extract and byte math with byte test verification\";"
965 "alert udp any any -> any any "
966 "(byte_extract: 1, 0, extracted_val, relative;"
967 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
968 "byte_test: 2, <, var, 15;"
969 "msg:\"Byte extract and byte math with byte test verification\";"
1001 static int DetectByteMathContext01(
void)
1007 DetectByteMathData *bmd = NULL;
1014 "(msg:\"Testing bytemath_body\"; "
1015 "content:\"|00 04 93 F3|\"; "
1016 "content:\"|00 00 00 07|\"; distance:4; within:4;"
1017 "byte_math:bytes 4, offset 0, oper +, rvalue "
1018 "248, result var, relative; sid:1;)");
1038 bmd = (DetectByteMathData *)sm->
ctx;
1043 FAIL_IF_NOT(bmd->flags == DETECT_BYTEMATH_FLAG_RELATIVE);
1053 static void DetectByteMathRegisterTests(
void)
1055 UtRegisterTest(
"DetectByteMathParseTest01", DetectByteMathParseTest01);
1056 UtRegisterTest(
"DetectByteMathParseTest02", DetectByteMathParseTest02);
1057 UtRegisterTest(
"DetectByteMathParseTest03", DetectByteMathParseTest03);
1058 UtRegisterTest(
"DetectByteMathParseTest04", DetectByteMathParseTest04);
1059 UtRegisterTest(
"DetectByteMathParseTest05", DetectByteMathParseTest05);
1060 UtRegisterTest(
"DetectByteMathParseTest06", DetectByteMathParseTest06);
1061 UtRegisterTest(
"DetectByteMathParseTest07", DetectByteMathParseTest07);
1062 UtRegisterTest(
"DetectByteMathParseTest08", DetectByteMathParseTest08);
1063 UtRegisterTest(
"DetectByteMathParseTest09", DetectByteMathParseTest09);
1064 UtRegisterTest(
"DetectByteMathParseTest10", DetectByteMathParseTest10);
1065 UtRegisterTest(
"DetectByteMathParseTest11", DetectByteMathParseTest11);
1066 UtRegisterTest(
"DetectByteMathParseTest12", DetectByteMathParseTest12);
1067 UtRegisterTest(
"DetectByteMathParseTest13", DetectByteMathParseTest13);
1068 UtRegisterTest(
"DetectByteMathParseTest14", DetectByteMathParseTest14);
1069 UtRegisterTest(
"DetectByteMathParseTest15", DetectByteMathParseTest15);
1070 UtRegisterTest(
"DetectByteMathParseTest16", DetectByteMathParseTest16);
1071 UtRegisterTest(
"DetectByteMathPacket01", DetectByteMathPacket01);
1072 UtRegisterTest(
"DetectByteMathPacket02", DetectByteMathPacket02);
1073 UtRegisterTest(
"DetectByteMathContext01", DetectByteMathContext01);