suricata
detect-bytemath.c
Go to the documentation of this file.
1 /* Copyright (C) 2020-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Jeff Lucovsky <jeff@lucovsky.org>
22  */
23 
24 /*
25  * Refer to the Snort manual, section 3.5.34 for details.
26  */
27 
28 #include "suricata-common.h"
29 #include "threads.h"
30 #include "decode.h"
31 
32 #include "app-layer-parser.h"
33 #include "app-layer-protos.h"
34 
35 #include "detect.h"
36 #include "detect-parse.h"
37 #include "detect-engine.h"
38 #include "detect-engine-buffer.h"
39 #include "detect-engine-mpm.h"
40 #include "detect-engine-state.h"
41 #include "detect-engine-build.h"
42 
43 #include "rust-bindings.h"
44 
45 #include "detect-content.h"
46 #include "detect-pcre.h"
47 #include "detect-byte.h"
48 #include "detect-bytemath.h"
49 
50 #include "flow.h"
51 #include "flow-var.h"
52 #include "flow-util.h"
53 
54 #include "util-byte.h"
55 #include "util-debug.h"
56 #include "util-unittest.h"
57 #include "util-unittest-helper.h"
58 #include "util-spm.h"
59 
60 static int DetectByteMathSetup(DetectEngineCtx *, Signature *, const char *);
61 #ifdef UNITTESTS
62 #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian
63 #define DETECT_BYTEMATH_BASE_DEFAULT (uint8_t) BaseDec
64 
65 static void DetectByteMathRegisterTests(void);
66 #endif
67 static void DetectByteMathFree(DetectEngineCtx *, void *);
68 
69 /**
70  * \brief Registers the keyword handlers for the "byte_math" keyword.
71  */
73 {
74  sigmatch_table[DETECT_BYTEMATH].name = "byte_math";
76  sigmatch_table[DETECT_BYTEMATH].Setup = DetectByteMathSetup;
77  sigmatch_table[DETECT_BYTEMATH].Free = DetectByteMathFree;
78 #ifdef UNITTESTS
79  sigmatch_table[DETECT_BYTEMATH].RegisterTests = DetectByteMathRegisterTests;
80 #endif
81 }
82 
83 static inline bool DetectByteMathValidateNbytesOnly(const DetectByteMathData *data, int32_t nbytes)
84 {
85  return nbytes >= 1 &&
86  (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
87 }
88 
89 int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const DetectByteMathData *data,
90  const Signature *s, const uint8_t *payload, const uint32_t payload_len, uint8_t nbytes,
91  uint64_t rvalue, uint64_t *value, uint8_t endian)
92 {
93  if (payload_len == 0) {
94  return 0;
95  }
96 
97  if (!DetectByteMathValidateNbytesOnly(data, nbytes)) {
98  return 0;
99  }
100 
101  const uint8_t *ptr;
102  int32_t len;
103  uint64_t val;
104  int extbytes;
105 
106  /* Calculate the ptr value for the byte-math op and length remaining in
107  * the packet from that point.
108  */
109  if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
110  SCLogDebug("relative, working with det_ctx->buffer_offset %" PRIu32 ", "
111  "data->offset %" PRIi32 "",
112  det_ctx->buffer_offset, data->offset);
113 
114  ptr = payload + det_ctx->buffer_offset;
115  len = payload_len - det_ctx->buffer_offset;
116 
117  ptr += data->offset;
118  len -= data->offset;
119 
120  /* No match if there is no relative base */
121  if (len <= 0) {
122  return 0;
123  }
124  } else {
125  SCLogDebug("absolute, data->offset %" PRIi32 "", data->offset);
126 
127  ptr = payload + data->offset;
128  len = payload_len - data->offset;
129  }
130 
131  /* Validate that the to-be-extracted is within the packet */
132  if (ptr < payload || nbytes > len) {
133  SCLogDebug("Data not within payload pkt=%p, ptr=%p, len=%" PRIu32 ", nbytes=%d", payload,
134  ptr, len, nbytes);
135  return 0;
136  }
137 
138  /* Extract the byte data */
139  if (data->flags & DETECT_BYTEMATH_FLAG_STRING) {
140  extbytes = ByteExtractStringUint64(&val, data->base, nbytes, (const char *)ptr);
141  if (extbytes <= 0) {
142  if (val == 0) {
143  SCLogDebug("No Numeric value");
144  return 0;
145  } else {
146  SCLogDebug("error extracting %d bytes of string data: %d", nbytes, extbytes);
147  return -1;
148  }
149  }
150  } else {
151  ByteEndian bme = endian;
152  int endianness = (bme == BigEndian) ? BYTE_BIG_ENDIAN : BYTE_LITTLE_ENDIAN;
153  extbytes = ByteExtractUint64(&val, endianness, nbytes, ptr);
154  if (extbytes != nbytes) {
155  SCLogDebug("error extracting %d bytes of numeric data: %d", nbytes, extbytes);
156  return 0;
157  }
158  }
159 
160  BUG_ON(extbytes > len);
161 
162  ptr += extbytes;
163 
164  switch (data->oper) {
165  case OperatorNone:
166  break;
167  case Addition:
168  val += rvalue;
169  break;
170  case Subtraction:
171  val -= rvalue;
172  break;
173  case Division:
174  if (rvalue == 0) {
175  SCLogDebug("avoiding division by zero");
176  return 0;
177  }
178  val /= rvalue;
179  break;
180  case Multiplication:
181  val *= rvalue;
182  break;
183  case LeftShift:
184  if (rvalue < 64) {
185  val <<= rvalue;
186  } else {
187  val = 0;
188  }
189  break;
190  case RightShift:
191  val >>= rvalue;
192  break;
193  }
194 
195  det_ctx->buffer_offset = (uint32_t)(ptr - payload);
196 
197  if (data->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
198  val &= data->bitmask_val;
199  if (val && data->bitmask_shift_count) {
200  val = val >> data->bitmask_shift_count;
201  }
202  }
203 
204  *value = val;
205  return 1;
206 }
207 
208 /**
209  * \internal
210  * \brief Used to parse byte_math arg.
211  *
212  * \param arg The argument to parse.
213  * \param rvalue May be NULL. When non-null, will contain the variable
214  * name of rvalue (iff rvalue is not a scalar value)
215  *
216  * \retval bmd On success an instance containing the parsed data.
217  * On failure, NULL.
218  */
219 static DetectByteMathData *DetectByteMathParse(
220  DetectEngineCtx *de_ctx, const char *arg, char **nbytes, char **rvalue)
221 {
222  DetectByteMathData *bmd;
223  if ((bmd = SCByteMathParse(arg)) == NULL) {
224  SCLogError("invalid bytemath values");
225  return NULL;
226  }
227 
228  if (bmd->nbytes_str) {
229  if (nbytes == NULL) {
230  SCLogError("byte_math supplied with "
231  "var name for nbytes. \"nbytes\" argument supplied to "
232  "this function must be non-NULL");
233  goto error;
234  }
235  *nbytes = SCStrdup(bmd->nbytes_str);
236  if (*nbytes == NULL) {
237  goto error;
238  }
239  }
240 
241  if (bmd->rvalue_str) {
242  if (rvalue == NULL) {
243  SCLogError("byte_math supplied with "
244  "var name for rvalue. \"rvalue\" argument supplied to "
245  "this function must be non-NULL");
246  goto error;
247  }
248  *rvalue = SCStrdup(bmd->rvalue_str);
249  if (*rvalue == NULL) {
250  goto error;
251  }
252  }
253 
254  if (bmd->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
255  if (bmd->bitmask_val) {
256  uint32_t bmask = bmd->bitmask_val;
257  while (!(bmask & 0x1)){
258  bmask = bmask >> 1;
259  bmd->bitmask_shift_count++;
260  }
261  }
262  }
263 
264  return bmd;
265 
266  error:
267  if (bmd != NULL)
268  DetectByteMathFree(de_ctx, bmd);
269  return NULL;
270 }
271 
272 /**
273  * \brief The setup function for the byte_math keyword for a signature.
274  *
275  * \param de_ctx Pointer to the detection engine context.
276  * \param s Pointer to signature for the current Signature being parsed
277  * from the rules.
278  * \param arg Pointer to the string holding the keyword value.
279  *
280  * \retval 0 On success.
281  * \retval -1 On failure.
282  */
283 static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
284 {
285  SigMatch *prev_pm = NULL;
286  DetectByteMathData *data;
287  char *rvalue = NULL;
288  char *nbytes = NULL;
289  int ret = -1;
290 
291  data = DetectByteMathParse(de_ctx, arg, &nbytes, &rvalue);
292  if (data == NULL)
293  goto error;
294 
295  int sm_list;
296  if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
297  if (DetectBufferGetActiveList(de_ctx, s) == -1)
298  goto error;
299 
300  sm_list = s->init_data->list;
301 
302  if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
304  if (!prev_pm) {
305  SCLogError("relative specified without "
306  "previous pattern match");
307  goto error;
308  }
309  }
310  } else if (data->endian == EndianDCE) {
311  if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
316  DETECT_ISDATAAT, -1);
317  if (prev_pm == NULL) {
318  sm_list = DETECT_SM_LIST_PMATCH;
319  } else {
320  sm_list = SigMatchListSMBelongsTo(s, prev_pm);
321  if (sm_list < 0)
322  goto error;
323  }
324  } else {
325  sm_list = DETECT_SM_LIST_PMATCH;
326  }
327 
329  goto error;
330 
331  } else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
335  DETECT_ISDATAAT, -1);
336  if (prev_pm == NULL) {
337  sm_list = DETECT_SM_LIST_PMATCH;
338  } else {
339  sm_list = SigMatchListSMBelongsTo(s, prev_pm);
340  if (sm_list < 0)
341  goto error;
342  }
343 
344  } else {
345  sm_list = DETECT_SM_LIST_PMATCH;
346  }
347 
348  if (data->endian == EndianDCE) {
350  goto error;
351 
352  if ((data->flags & DETECT_BYTEMATH_FLAG_STRING) || (data->base == BaseDec) ||
353  (data->base == BaseHex) || (data->base == BaseOct)) {
354  SCLogError("Invalid option. "
355  "A bytemath keyword with dce holds other invalid modifiers.");
356  goto error;
357  }
358  }
359 
360  if (nbytes != NULL) {
361  DetectByteIndexType index;
362  if (!DetectByteRetrieveSMVar(nbytes, s, &index)) {
363  SCLogError("unknown byte_ keyword var seen in byte_math - %s", nbytes);
364  goto error;
365  }
366  data->nbytes = index;
367  data->flags |= DETECT_BYTEMATH_FLAG_NBYTES_VAR;
368  SCFree(nbytes);
369  nbytes = NULL;
370  }
371 
372  if (rvalue != NULL) {
373  DetectByteIndexType index;
374  if (!DetectByteRetrieveSMVar(rvalue, s, &index)) {
375  SCLogError("unknown byte_ keyword var seen in byte_math - %s", rvalue);
376  goto error;
377  }
378  data->rvalue = index;
379  data->flags |= DETECT_BYTEMATH_FLAG_RVALUE_VAR;
380  SCFree(rvalue);
381  rvalue = NULL;
382  }
383 
384  SigMatch *prev_bmd_sm = DetectGetLastSMByListId(s, sm_list,
385  DETECT_BYTEMATH, -1);
386  if (prev_bmd_sm == NULL) {
387  data->local_id = 0;
388  } else {
389  data->local_id = ((DetectByteMathData *)prev_bmd_sm->ctx)->local_id + 1;
390  }
391  if (data->local_id > de_ctx->byte_extract_max_local_id) {
392  de_ctx->byte_extract_max_local_id = data->local_id;
393  }
394 
395  if (SigMatchAppendSMToList(de_ctx, s, DETECT_BYTEMATH, (SigMatchCtx *)data, sm_list) == NULL) {
396  goto error;
397  }
398 
399  if (!(data->flags & DETECT_BYTEMATH_FLAG_RELATIVE))
400  goto okay;
401 
402  if (prev_pm == NULL)
403  goto okay;
404 
405  if (prev_pm->type == DETECT_CONTENT) {
406  DetectContentData *cd = (DetectContentData *)prev_pm->ctx;
408  } else if (prev_pm->type == DETECT_PCRE) {
409  DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;
411  }
412 
413  okay:
414  return 0;
415 
416  error:
417  if (rvalue)
418  SCFree(rvalue);
419  if (nbytes)
420  SCFree(nbytes);
421  DetectByteMathFree(de_ctx, data);
422  return ret;
423 }
424 
425 /**
426  * \brief Used to free instances of DetectByteMathractData.
427  *
428  * \param ptr Instance of DetectByteMathData to be freed.
429  */
430 static void DetectByteMathFree(DetectEngineCtx *de_ctx, void *ptr)
431 {
432  SCByteMathFree(ptr);
433 }
434 
435 /**
436  * \brief Lookup the SigMatch for a named byte_math variable.
437  *
438  * \param arg The name of the byte_math variable to lookup.
439  * \param s Pointer the signature to look in.
440  *
441  * \retval A pointer to the SigMatch if found, otherwise NULL.
442  */
443 SigMatch *DetectByteMathRetrieveSMVar(const char *arg, const Signature *s)
444 {
445  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
446  SigMatch *sm = s->init_data->buffers[x].head;
447  while (sm != NULL) {
448  if (sm->type == DETECT_BYTEMATH) {
449  const DetectByteMathData *bmd = (const DetectByteMathData *)sm->ctx;
450  if (strcmp(bmd->result, arg) == 0) {
451  SCLogDebug("Retrieved SM for \"%s\"", arg);
452  return sm;
453  }
454  }
455  sm = sm->next;
456  }
457  }
458 
459  for (int list = 0; list < DETECT_SM_LIST_MAX; list++) {
460  SigMatch *sm = s->init_data->smlists[list];
461  while (sm != NULL) {
462  if (sm->type == DETECT_BYTEMATH) {
463  const DetectByteMathData *bmd = (const DetectByteMathData *)sm->ctx;
464  if (strcmp(bmd->result, arg) == 0) {
465  SCLogDebug("Retrieved SM for \"%s\"", arg);
466  return sm;
467  }
468  }
469  sm = sm->next;
470  }
471  }
472 
473  return NULL;
474 }
475 
476 /*************************************Unittests********************************/
477 #ifdef UNITTESTS
478 #include "detect-engine-alert.h"
479 
480 static int DetectByteMathParseTest01(void)
481 {
482 
483  DetectByteMathData *bmd = DetectByteMathParse(NULL,
484  "bytes 4, offset 2, oper +,"
485  "rvalue 10, result bar",
486  NULL, NULL);
487  FAIL_IF(bmd == NULL);
488 
489  FAIL_IF_NOT(bmd->nbytes == 4);
490  FAIL_IF_NOT(bmd->offset == 2);
491  FAIL_IF_NOT(bmd->oper == Addition);
492  FAIL_IF_NOT(bmd->rvalue == 10);
493  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
496 
497  DetectByteMathFree(NULL, bmd);
498 
499  PASS;
500 }
501 
502 static int DetectByteMathParseTest02(void)
503 {
504  /* bytes value invalid */
505  DetectByteMathData *bmd = DetectByteMathParse(NULL,
506  "bytes 257, offset 2, oper +, "
507  "rvalue 39, result bar",
508  NULL, NULL);
509 
510  FAIL_IF_NOT(bmd == NULL);
511 
512  PASS;
513 }
514 
515 static int DetectByteMathParseTest03(void)
516 {
517  /* bytes value invalid */
518  DetectByteMathData *bmd = DetectByteMathParse(NULL,
519  "bytes 11, offset 2, oper +, "
520  "rvalue 39, result bar",
521  NULL, NULL);
522  FAIL_IF_NOT(bmd == NULL);
523 
524  PASS;
525 }
526 
527 static int DetectByteMathParseTest04(void)
528 {
529  /* offset value invalid */
530  DetectByteMathData *bmd = DetectByteMathParse(NULL,
531  "bytes 4, offset 70000, oper +,"
532  " rvalue 39, result bar",
533  NULL, NULL);
534 
535  FAIL_IF_NOT(bmd == NULL);
536 
537  PASS;
538 }
539 
540 static int DetectByteMathParseTest05(void)
541 {
542  /* oper value invalid */
543  DetectByteMathData *bmd = DetectByteMathParse(NULL,
544  "bytes 11, offset 16, oper &,"
545  "rvalue 39, result bar",
546  NULL, NULL);
547  FAIL_IF_NOT(bmd == NULL);
548 
549  PASS;
550 }
551 
552 static int DetectByteMathParseTest06(void)
553 {
554  uint8_t flags = DETECT_BYTEMATH_FLAG_RELATIVE;
555  char *rvalue = NULL;
556 
557  DetectByteMathData *bmd = DetectByteMathParse(NULL,
558  "bytes 4, offset 0, oper +,"
559  "rvalue 248, result var, relative",
560  NULL, &rvalue);
561 
562  FAIL_IF(bmd == NULL);
563  FAIL_IF_NOT(bmd->nbytes == 4);
564  FAIL_IF_NOT(bmd->offset == 0);
565  FAIL_IF_NOT(bmd->oper == Addition);
566  FAIL_IF_NOT(bmd->rvalue == 248);
567  FAIL_IF_NOT(strcmp(bmd->result, "var") == 0);
568  FAIL_IF_NOT(bmd->flags == flags);
571 
572  DetectByteMathFree(NULL, bmd);
573 
574  PASS;
575 }
576 
577 static int DetectByteMathParseTest07(void)
578 {
579  char *rvalue = NULL;
580 
581  DetectByteMathData *bmd = DetectByteMathParse(NULL,
582  "bytes 4, offset 2, oper +,"
583  "rvalue foo, result bar",
584  NULL, &rvalue);
585  FAIL_IF_NOT(rvalue);
586  FAIL_IF_NOT(bmd->nbytes == 4);
587  FAIL_IF_NOT(bmd->offset == 2);
588  FAIL_IF_NOT(bmd->oper == Addition);
589  FAIL_IF_NOT(strcmp(rvalue, "foo") == 0);
590  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
593 
594  DetectByteMathFree(NULL, bmd);
595 
596  SCFree(rvalue);
597 
598  PASS;
599 }
600 
601 static int DetectByteMathParseTest08(void)
602 {
603  /* ensure Parse checks the pointer value when rvalue is a var */
604  DetectByteMathData *bmd = DetectByteMathParse(NULL,
605  "bytes 4, offset 2, oper +,"
606  "rvalue foo, result bar",
607  NULL, NULL);
608  FAIL_IF_NOT(bmd == NULL);
609 
610  PASS;
611 }
612 
613 static int DetectByteMathParseTest09(void)
614 {
615  uint8_t flags = DETECT_BYTEMATH_FLAG_RELATIVE;
616 
617  DetectByteMathData *bmd = DetectByteMathParse(NULL,
618  "bytes 4, offset 2, oper +,"
619  "rvalue 39, result bar, relative",
620  NULL, NULL);
621  FAIL_IF(bmd == NULL);
622 
623  FAIL_IF_NOT(bmd->nbytes == 4);
624  FAIL_IF_NOT(bmd->offset == 2);
625  FAIL_IF_NOT(bmd->oper == Addition);
626  FAIL_IF_NOT(bmd->rvalue == 39);
627  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
628  FAIL_IF_NOT(bmd->flags == flags);
631 
632  DetectByteMathFree(NULL, bmd);
633 
634  PASS;
635 }
636 
637 static int DetectByteMathParseTest10(void)
638 {
639  uint8_t flags = DETECT_BYTEMATH_FLAG_ENDIAN;
640 
641  DetectByteMathData *bmd = DetectByteMathParse(NULL,
642  "bytes 4, offset 2, oper +,"
643  "rvalue 39, result bar, endian"
644  " big",
645  NULL, NULL);
646 
647  FAIL_IF(bmd == NULL);
648  FAIL_IF_NOT(bmd->nbytes == 4);
649  FAIL_IF_NOT(bmd->offset == 2);
650  FAIL_IF_NOT(bmd->oper == Addition);
651  FAIL_IF_NOT(bmd->rvalue == 39);
652  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
653  FAIL_IF_NOT(bmd->flags == flags);
654  FAIL_IF_NOT(bmd->endian == BigEndian);
656 
657  DetectByteMathFree(NULL, bmd);
658 
659  PASS;
660 }
661 
662 static int DetectByteMathParseTest11(void)
663 {
664  uint8_t flags = DETECT_BYTEMATH_FLAG_ENDIAN;
665 
666  DetectByteMathData *bmd = DetectByteMathParse(NULL,
667  "bytes 4, offset 2, oper +, "
668  "rvalue 39, result bar, dce",
669  NULL, NULL);
670 
671  FAIL_IF(bmd == NULL);
672  FAIL_IF_NOT(bmd->nbytes == 4);
673  FAIL_IF_NOT(bmd->offset == 2);
674  FAIL_IF_NOT(bmd->oper == Addition);
675  FAIL_IF_NOT(bmd->rvalue == 39);
676  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
677  FAIL_IF_NOT(bmd->flags == flags);
678  FAIL_IF_NOT(bmd->endian == EndianDCE);
680 
681  DetectByteMathFree(NULL, bmd);
682 
683  PASS;
684 }
685 
686 static int DetectByteMathParseTest12(void)
687 {
688  uint8_t flags = DETECT_BYTEMATH_FLAG_RELATIVE | DETECT_BYTEMATH_FLAG_STRING;
689 
690  DetectByteMathData *bmd = DetectByteMathParse(NULL,
691  "bytes 4, offset 2, oper +,"
692  "rvalue 39, result bar, "
693  "relative, string dec",
694  NULL, NULL);
695 
696  FAIL_IF(bmd == NULL);
697  FAIL_IF_NOT(bmd->nbytes == 4);
698  FAIL_IF_NOT(bmd->offset == 2);
699  FAIL_IF_NOT(bmd->oper == Addition);
700  FAIL_IF_NOT(bmd->rvalue == 39);
701  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
702  FAIL_IF_NOT(bmd->flags == flags);
703  FAIL_IF_NOT(bmd->endian == BigEndian);
704  FAIL_IF_NOT(bmd->base == BaseDec);
705 
706  DetectByteMathFree(NULL, bmd);
707 
708  PASS;
709 }
710 
711 static int DetectByteMathParseTest13(void)
712 {
713  uint8_t flags = DETECT_BYTEMATH_FLAG_STRING |
714  DETECT_BYTEMATH_FLAG_RELATIVE |
715  DETECT_BYTEMATH_FLAG_BITMASK;
716 
717  DetectByteMathData *bmd = DetectByteMathParse(NULL,
718  "bytes 4, offset 2, oper +, "
719  "rvalue 39, result bar, "
720  "relative, string dec, bitmask "
721  "0x8f40",
722  NULL, NULL);
723 
724  FAIL_IF(bmd == NULL);
725  FAIL_IF_NOT(bmd->nbytes == 4);
726  FAIL_IF_NOT(bmd->offset == 2);
727  FAIL_IF_NOT(bmd->oper == Addition);
728  FAIL_IF_NOT(bmd->rvalue == 39);
729  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
730  FAIL_IF_NOT(bmd->bitmask_val == 0x8f40);
731  FAIL_IF_NOT(bmd->bitmask_shift_count == 6);
732  FAIL_IF_NOT(bmd->flags == flags);
733  FAIL_IF_NOT(bmd->endian == BigEndian);
734  FAIL_IF_NOT(bmd->base == BaseDec);
735 
736  DetectByteMathFree(NULL, bmd);
737 
738  PASS;
739 }
740 
741 
742 static int DetectByteMathParseTest14(void)
743 {
744  /* incomplete */
745  DetectByteMathData *bmd = DetectByteMathParse(NULL,
746  "bytes 4, offset 2, oper +,"
747  "rvalue foo",
748  NULL, NULL);
749 
750  FAIL_IF_NOT(bmd == NULL);
751 
752  PASS;
753 }
754 
755 static int DetectByteMathParseTest15(void)
756 {
757 
758  /* incomplete */
759  DetectByteMathData *bmd = DetectByteMathParse(NULL,
760  "bytes 4, offset 2, oper +, "
761  "result bar",
762  NULL, NULL);
763 
764  FAIL_IF_NOT(bmd == NULL);
765 
766  PASS;
767 }
768 
769 static int DetectByteMathParseTest16(void)
770 {
771  uint8_t flags = DETECT_BYTEMATH_FLAG_STRING | DETECT_BYTEMATH_FLAG_RELATIVE |
772  DETECT_BYTEMATH_FLAG_BITMASK;
773 
774  DetectByteMathData *bmd = DetectByteMathParse(NULL,
775  "bytes 4, offset -2, oper +, "
776  "rvalue 39, result bar, "
777  "relative, string dec, bitmask "
778  "0x8f40",
779  NULL, NULL);
780 
781  FAIL_IF(bmd == NULL);
782  FAIL_IF_NOT(bmd->nbytes == 4);
783  FAIL_IF_NOT(bmd->offset == -2);
784  FAIL_IF_NOT(bmd->oper == Addition);
785  FAIL_IF_NOT(bmd->rvalue == 39);
786  FAIL_IF_NOT(strcmp(bmd->result, "bar") == 0);
787  FAIL_IF_NOT(bmd->bitmask_val == 0x8f40);
788  FAIL_IF_NOT(bmd->bitmask_shift_count == 6);
789  FAIL_IF_NOT(bmd->flags == flags);
790  FAIL_IF_NOT(bmd->endian == BigEndian);
791  FAIL_IF_NOT(bmd->base == BaseDec);
792 
793  DetectByteMathFree(NULL, bmd);
794 
795  PASS;
796 }
797 
798 static int DetectByteMathPacket01(void)
799 {
800  uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01,
801  0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
802  0x00, 0x00, 0x6d, 0x00, 0x01, 0x00 };
803  Flow f;
804  void *dns_state = NULL;
805  Packet *p = NULL;
806  Signature *s = NULL;
807  ThreadVars tv;
808  DetectEngineThreadCtx *det_ctx = NULL;
810 
811  memset(&tv, 0, sizeof(ThreadVars));
812  memset(&f, 0, sizeof(Flow));
813 
814  p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_UDP,
815  "192.168.1.5", "192.168.1.1",
816  41424, 53);
817  FAIL_IF_NULL(p);
818 
819  FLOW_INITIALIZE(&f);
820  f.flags |= FLOW_IPV4;
821  f.proto = IPPROTO_UDP;
823 
824  p->flow = &f;
825  p->flags |= PKT_HAS_FLOW;
827  f.alproto = ALPROTO_DNS;
828 
831 
833  de_ctx->flags |= DE_QUIET;
834 
835  /*
836  * byte_extract: Extract 1 byte from offset 0 --> 0x0038
837  * byte_math: Extract 1 byte from offset 2 (0x35)
838  * Add 0x35 + 0x38 = 109 (0x6d)
839  * byte_test: Compare 2 bytes at offset 13 bytes from last
840  * match and compare with 0x6d
841  */
842  s = DetectEngineAppendSig(de_ctx, "alert udp any any -> any any "
843  "(byte_extract: 1, 0, extracted_val, relative;"
844  "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
845  "byte_test: 2, =, var, 13;"
846  "msg:\"Byte extract and byte math with byte test verification\";"
847  "sid:1;)");
848  FAIL_IF_NULL(s);
849 
850  /* this rule should not alert */
851  s = DetectEngineAppendSig(de_ctx, "alert udp any any -> any any "
852  "(byte_extract: 1, 0, extracted_val, relative;"
853  "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
854  "byte_test: 2, !=, var, 13;"
855  "msg:\"Byte extract and byte math with byte test verification\";"
856  "sid:2;)");
857  FAIL_IF_NULL(s);
858 
859  /*
860  * this rule should alert:
861  * compares offset 15 with var ... 1 (offset 15) < 0x6d (var)
862  */
863  s = DetectEngineAppendSig(de_ctx, "alert udp any any -> any any "
864  "(byte_extract: 1, 0, extracted_val, relative;"
865  "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
866  "byte_test: 2, <, var, 15;"
867  "msg:\"Byte extract and byte math with byte test verification\";"
868  "sid:3;)");
869  FAIL_IF_NULL(s);
870 
872  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
873  FAIL_IF_NULL(det_ctx);
874 
875  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS,
876  STREAM_TOSERVER, buf, sizeof(buf));
877  FAIL_IF_NOT(r == 0);
878 
879  dns_state = f.alstate;
880  FAIL_IF_NULL(dns_state);
881 
882  /* do detect */
883  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
884 
885  /* ensure sids 1 & 3 alerted */
887  FAIL_IF(PacketAlertCheck(p, 2));
889 
891  DetectEngineThreadCtxDeinit(&tv, det_ctx);
893 
894  FLOW_DESTROY(&f);
895  UTHFreePacket(p);
896 
897  PASS;
898 }
899 
900 static int DetectByteMathPacket02(void)
901 {
902  uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
903  0x00, 0x70, 0x00, 0x01, 0x00 };
904  Flow f;
905  void *dns_state = NULL;
906  Packet *p = NULL;
907  Signature *s = NULL;
908  ThreadVars tv;
909  DetectEngineThreadCtx *det_ctx = NULL;
911 
912  memset(&tv, 0, sizeof(ThreadVars));
913  memset(&f, 0, sizeof(Flow));
914 
915  p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_UDP, "192.168.1.5", "192.168.1.1", 41424, 53);
916  FAIL_IF_NULL(p);
917 
918  FLOW_INITIALIZE(&f);
919  f.flags |= FLOW_IPV4;
920  f.proto = IPPROTO_UDP;
922 
923  p->flow = &f;
924  p->flags |= PKT_HAS_FLOW;
926  f.alproto = ALPROTO_DNS;
927 
930 
932  de_ctx->flags |= DE_QUIET;
933 
934  /*
935  * byte_extract: Extract 1 byte from offset 0 --> 0x38
936  * byte_math: Extract 1 byte from offset -1 (0x38)
937  * Add 0x38 + 0x38 = 112 (0x70)
938  * byte_test: Compare 2 bytes at offset 13 bytes from last
939  * match and compare with 0x70
940  */
942  "alert udp any any -> any any "
943  "(byte_extract: 1, 0, extracted_val, relative;"
944  "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
945  "byte_test: 2, =, var, 13;"
946  "msg:\"Byte extract and byte math with byte test verification\";"
947  "sid:1;)");
948  FAIL_IF_NULL(s);
949 
950  /* this rule should not alert */
952  "alert udp any any -> any any "
953  "(byte_extract: 1, 0, extracted_val, relative;"
954  "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
955  "byte_test: 2, !=, var, 13;"
956  "msg:\"Byte extract and byte math with byte test verification\";"
957  "sid:2;)");
958  FAIL_IF_NULL(s);
959 
960  /*
961  * this rule should alert:
962  * compares offset 15 with var ... 1 (offset 15) < 0x70 (var)
963  */
965  "alert udp any any -> any any "
966  "(byte_extract: 1, 0, extracted_val, relative;"
967  "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
968  "byte_test: 2, <, var, 15;"
969  "msg:\"Byte extract and byte math with byte test verification\";"
970  "sid:3;)");
971  FAIL_IF_NULL(s);
972 
974  DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
975  FAIL_IF_NULL(det_ctx);
976 
977  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_DNS, STREAM_TOSERVER, buf, sizeof(buf));
978  FAIL_IF_NOT(r == 0);
979 
980  dns_state = f.alstate;
981  FAIL_IF_NULL(dns_state);
982 
983  /* do detect */
984  SigMatchSignatures(&tv, de_ctx, det_ctx, p);
985 
986  /* ensure sids 1 & 3 alerted */
988  FAIL_IF(PacketAlertCheck(p, 2));
990 
992  DetectEngineThreadCtxDeinit(&tv, det_ctx);
994 
995  FLOW_DESTROY(&f);
996  UTHFreePacket(p);
997 
998  PASS;
999 }
1000 
1001 static int DetectByteMathContext01(void)
1002 {
1003  DetectEngineCtx *de_ctx = NULL;
1004  Signature *s = NULL;
1005  SigMatch *sm = NULL;
1006  DetectContentData *cd = NULL;
1007  DetectByteMathData *bmd = NULL;
1008 
1010  FAIL_IF(de_ctx == NULL);
1011 
1012  de_ctx->flags |= DE_QUIET;
1013  s = de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
1014  "(msg:\"Testing bytemath_body\"; "
1015  "content:\"|00 04 93 F3|\"; "
1016  "content:\"|00 00 00 07|\"; distance:4; within:4;"
1017  "byte_math:bytes 4, offset 0, oper +, rvalue "
1018  "248, result var, relative; sid:1;)");
1019 
1020  FAIL_IF(de_ctx->sig_list == NULL);
1021 
1023 
1025  FAIL_IF(sm->type != DETECT_CONTENT);
1026  cd = (DetectContentData *)sm->ctx;
1029  FAIL_IF(cd->content_len != 4);
1030 
1031  sm = sm->next;
1032  FAIL_IF(sm->type != DETECT_CONTENT);
1033  sm = sm->next;
1034  FAIL_IF(sm->type != DETECT_BYTEMATH);
1035 
1036  FAIL_IF(sm->ctx == NULL);
1037 
1038  bmd = (DetectByteMathData *)sm->ctx;
1039  FAIL_IF_NOT(bmd->nbytes == 4);
1040  FAIL_IF_NOT(bmd->offset == 0);
1041  FAIL_IF_NOT(bmd->rvalue == 248);
1042  FAIL_IF_NOT(strcmp(bmd->result, "var") == 0);
1043  FAIL_IF_NOT(bmd->flags == DETECT_BYTEMATH_FLAG_RELATIVE);
1044  FAIL_IF_NOT(bmd->endian == BigEndian);
1045  FAIL_IF_NOT(bmd->oper == Addition);
1046  FAIL_IF_NOT(bmd->base == BaseDec);
1047 
1049 
1050  PASS;
1051 }
1052 
1053 static void DetectByteMathRegisterTests(void)
1054 {
1055  UtRegisterTest("DetectByteMathParseTest01", DetectByteMathParseTest01);
1056  UtRegisterTest("DetectByteMathParseTest02", DetectByteMathParseTest02);
1057  UtRegisterTest("DetectByteMathParseTest03", DetectByteMathParseTest03);
1058  UtRegisterTest("DetectByteMathParseTest04", DetectByteMathParseTest04);
1059  UtRegisterTest("DetectByteMathParseTest05", DetectByteMathParseTest05);
1060  UtRegisterTest("DetectByteMathParseTest06", DetectByteMathParseTest06);
1061  UtRegisterTest("DetectByteMathParseTest07", DetectByteMathParseTest07);
1062  UtRegisterTest("DetectByteMathParseTest08", DetectByteMathParseTest08);
1063  UtRegisterTest("DetectByteMathParseTest09", DetectByteMathParseTest09);
1064  UtRegisterTest("DetectByteMathParseTest10", DetectByteMathParseTest10);
1065  UtRegisterTest("DetectByteMathParseTest11", DetectByteMathParseTest11);
1066  UtRegisterTest("DetectByteMathParseTest12", DetectByteMathParseTest12);
1067  UtRegisterTest("DetectByteMathParseTest13", DetectByteMathParseTest13);
1068  UtRegisterTest("DetectByteMathParseTest14", DetectByteMathParseTest14);
1069  UtRegisterTest("DetectByteMathParseTest15", DetectByteMathParseTest15);
1070  UtRegisterTest("DetectByteMathParseTest16", DetectByteMathParseTest16);
1071  UtRegisterTest("DetectByteMathPacket01", DetectByteMathPacket01);
1072  UtRegisterTest("DetectByteMathPacket02", DetectByteMathPacket02);
1073  UtRegisterTest("DetectByteMathContext01", DetectByteMathContext01);
1074 }
1075 #endif /* UNITTESTS */
util-byte.h
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:66
DetectSignatureSetAppProto
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:2313
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:548
detect-content.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
DetectEngineThreadCtx_::buffer_offset
uint32_t buffer_offset
Definition: detect.h:1247
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:118
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:644
ByteExtractUint64
int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes)
Definition: util-byte.c:122
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:155
PKT_HAS_FLOW
#define PKT_HAS_FLOW
Definition: decode.h:1250
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:44
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1418
flow-util.h
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
SigTableElmt_::name
const char * name
Definition: detect.h:1428
SignatureInitData_::smlists_tail
struct SigMatch_ * smlists_tail[DETECT_SM_LIST_MAX]
Definition: detect.h:646
DETECT_BYTEJUMP
@ DETECT_BYTEJUMP
Definition: detect-engine-register.h:83
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:69
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Flow_::proto
uint8_t proto
Definition: flow.h:378
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:141
Packet_::flags
uint32_t flags
Definition: decode.h:535
threads.h
Flow_
Flow data structure.
Definition: flow.h:356
Flow_::protomap
uint8_t protomap
Definition: flow.h:445
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:931
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2674
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:322
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:233
DE_QUIET
#define DE_QUIET
Definition: detect.h:329
mpm_default_matcher
uint8_t mpm_default_matcher
Definition: util-mpm.c:48
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2347
DetectContentData_
Definition: detect-content.h:93
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:51
ByteExtractStringUint64
int ByteExtractStringUint64(uint64_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:234
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3439
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:523
UTHBuildPacketReal
Packet * UTHBuildPacketReal(uint8_t *payload, uint16_t payload_len, uint8_t ipproto, const char *src, const char *dst, uint16_t sport, uint16_t dport)
UTHBuildPacketReal is a function that create tcp/udp packets for unittests specifying ip and port sou...
Definition: util-unittest-helper.c:260
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1413
detect-pcre.h
DETECT_BYTEMATH_ENDIAN_DEFAULT
#define DETECT_BYTEMATH_ENDIAN_DEFAULT
Definition: detect-bytemath.c:62
FLOW_IPV4
#define FLOW_IPV4
Definition: flow.h:100
DetectByteIndexType
uint8_t DetectByteIndexType
Definition: detect-byte.h:28
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
DetectGetLastSMByListId
SigMatch * DetectGetLastSMByListId(const Signature *s, int list_id,...)
Returns the sm with the largest index (added last) from the list passed to us as an id.
Definition: detect-parse.c:734
FLOW_INITIALIZE
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:38
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1223
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:22
SignatureInitData_::list
int list
Definition: detect.h:630
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3400
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DetectEngineCtx_::mpm_matcher
uint8_t mpm_matcher
Definition: detect.h:934
DetectByteMathRetrieveSMVar
SigMatch * DetectByteMathRetrieveSMVar(const char *arg, const Signature *s)
Lookup the SigMatch for a named byte_math variable.
Definition: detect-bytemath.c:443
SigInit
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:3097
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:359
BYTE_BIG_ENDIAN
#define BYTE_BIG_ENDIAN
Definition: util-byte.h:29
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
Packet_
Definition: decode.h:492
detect-engine-build.h
detect-engine-alert.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:749
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1396
detect-byte.h
DetectEngineCtx_::byte_extract_max_local_id
int32_t byte_extract_max_local_id
Definition: detect.h:1009
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:71
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2129
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:295
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
DETECT_SM_LIST_NOTSET
#define DETECT_SM_LIST_NOTSET
Definition: detect.h:143
DETECT_BYTETEST
@ DETECT_BYTETEST
Definition: detect-engine-register.h:82
BYTE_LITTLE_ENDIAN
#define BYTE_LITTLE_ENDIAN
Definition: util-byte.h:30
Packet_::flow
struct Flow_ * flow
Definition: decode.h:537
DetectByteMathDoMatch
int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const DetectByteMathData *data, const Signature *s, const uint8_t *payload, const uint32_t payload_len, uint8_t nbytes, uint64_t rvalue, uint64_t *value, uint8_t endian)
Definition: detect-bytemath.c:89
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
DetectByteRetrieveSMVar
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index)
Used to retrieve args from BM.
Definition: detect-byte.c:40
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1290
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:357
DETECT_BYTEMATH_BASE_DEFAULT
#define DETECT_BYTEMATH_BASE_DEFAULT
Definition: detect-bytemath.c:63
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3626
util-spm.h
detect-engine-buffer.h
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:940
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
DetectBytemathRegister
void DetectBytemathRegister(void)
Registers the keyword handlers for the "byte_math" keyword.
Definition: detect-bytemath.c:72
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:649
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SigMatchListSMBelongsTo
int SigMatchListSMBelongsTo(const Signature *s, const SigMatch *key_sm)
Definition: detect-parse.c:839
SCFree
#define SCFree(p)
Definition: util-mem.h:61
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:473
Flow_::alstate
void * alstate
Definition: flow.h:479
DETECT_BYTE_EXTRACT
@ DETECT_BYTE_EXTRACT
Definition: detect-engine-register.h:85
Flow_::flags
uint32_t flags
Definition: flow.h:421
detect-parse.h
Signature_
Signature container.
Definition: detect.h:670
SigMatch_
a single match condition for a signature
Definition: detect.h:356
payload_len
uint16_t payload_len
Definition: stream-tcp-private.h:1
DETECT_ISDATAAT
@ DETECT_ISDATAAT
Definition: detect-engine-register.h:93
DETECT_SM_LIST_MAX
@ DETECT_SM_LIST_MAX
Definition: detect.h:134
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2635
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
app-layer-protos.h
DetectPcreData_
Definition: detect-pcre.h:47
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
DETECT_BYTEMATH
@ DETECT_BYTEMATH
Definition: detect-engine-register.h:84
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:640
SigMatchAppendSMToList
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:464
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:933
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:58
flow.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
DetectBufferGetActiveList
int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine-buffer.c:109
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:650
flow-var.h
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:119
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1420
detect-bytemath.h