43 #include "rust-bindings.h"
62 #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian
63 #define DETECT_BYTEMATH_BASE_DEFAULT (uint8_t) BaseDec
65 static void DetectByteMathRegisterTests(
void);
83 static inline bool DetectByteMathValidateNbytesOnly(
const DetectByteMathData *data, int32_t nbytes)
86 (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
91 uint64_t rvalue, uint64_t *value, uint8_t endian)
97 if (!DetectByteMathValidateNbytesOnly(data, nbytes)) {
109 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
110 SCLogDebug(
"relative, working with det_ctx->buffer_offset %" PRIu32
", "
111 "data->offset %" PRIi32
"",
125 SCLogDebug(
"absolute, data->offset %" PRIi32
"", data->offset);
127 ptr = payload + data->offset;
132 if (ptr < payload || nbytes >
len) {
133 SCLogDebug(
"Data not within payload pkt=%p, ptr=%p, len=%" PRIu32
", nbytes=%d", payload,
139 if (data->flags & DETECT_BYTEMATH_FLAG_STRING) {
146 SCLogDebug(
"error extracting %d bytes of string data: %d", nbytes, extbytes);
151 ByteEndian bme = endian;
154 if (extbytes != nbytes) {
155 SCLogDebug(
"error extracting %d bytes of numeric data: %d", nbytes, extbytes);
164 switch (data->oper) {
197 if (data->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
198 val &= data->bitmask_val;
199 if (val && data->bitmask_shift_count) {
200 val = val >> data->bitmask_shift_count;
219 static DetectByteMathData *DetectByteMathParse(
222 DetectByteMathData *bmd;
223 if ((bmd = SCByteMathParse(arg)) == NULL) {
228 if (bmd->nbytes_str) {
229 if (nbytes == NULL) {
231 "var name for nbytes. \"nbytes\" argument supplied to "
232 "this function must be non-NULL");
235 *nbytes =
SCStrdup(bmd->nbytes_str);
236 if (*nbytes == NULL) {
241 if (bmd->rvalue_str) {
242 if (rvalue == NULL) {
244 "var name for rvalue. \"rvalue\" argument supplied to "
245 "this function must be non-NULL");
248 *rvalue =
SCStrdup(bmd->rvalue_str);
249 if (*rvalue == NULL) {
254 if (bmd->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
255 if (bmd->bitmask_val) {
256 uint32_t bmask = bmd->bitmask_val;
257 while (!(bmask & 0x1)){
259 bmd->bitmask_shift_count++;
268 DetectByteMathFree(
de_ctx, bmd);
286 DetectByteMathData *data;
291 data = DetectByteMathParse(
de_ctx, arg, &nbytes, &rvalue);
302 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
306 "previous pattern match");
310 }
else if (data->endian == EndianDCE) {
311 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
317 if (prev_pm == NULL) {
331 }
else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
336 if (prev_pm == NULL) {
348 if (data->endian == EndianDCE) {
352 if ((data->flags & DETECT_BYTEMATH_FLAG_STRING) || (data->base == BaseDec) ||
353 (data->base == BaseHex) || (data->base == BaseOct)) {
355 "A bytemath keyword with dce holds other invalid modifiers.");
360 if (nbytes != NULL) {
363 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", nbytes);
366 data->nbytes = index;
367 data->flags |= DETECT_BYTEMATH_FLAG_NBYTES_VAR;
372 if (rvalue != NULL) {
375 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", rvalue);
378 data->rvalue = index;
379 data->flags |= DETECT_BYTEMATH_FLAG_RVALUE_VAR;
386 if (prev_bmd_sm == NULL) {
389 data->local_id = ((DetectByteMathData *)prev_bmd_sm->
ctx)->local_id + 1;
400 if (!(data->flags & DETECT_BYTEMATH_FLAG_RELATIVE))
422 DetectByteMathFree(
de_ctx, data);
450 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
451 if (strcmp(bmd->result, arg) == 0) {
464 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
465 if (strcmp(bmd->result, arg) == 0) {
481 static int DetectByteMathParseTest01(
void)
484 DetectByteMathData *bmd = DetectByteMathParse(NULL,
485 "bytes 4, offset 2, oper +,"
486 "rvalue 10, result bar",
498 DetectByteMathFree(NULL, bmd);
503 static int DetectByteMathParseTest02(
void)
506 DetectByteMathData *bmd = DetectByteMathParse(NULL,
507 "bytes 257, offset 2, oper +, "
508 "rvalue 39, result bar",
516 static int DetectByteMathParseTest03(
void)
519 DetectByteMathData *bmd = DetectByteMathParse(NULL,
520 "bytes 11, offset 2, oper +, "
521 "rvalue 39, result bar",
528 static int DetectByteMathParseTest04(
void)
531 DetectByteMathData *bmd = DetectByteMathParse(NULL,
532 "bytes 4, offset 70000, oper +,"
533 " rvalue 39, result bar",
541 static int DetectByteMathParseTest05(
void)
544 DetectByteMathData *bmd = DetectByteMathParse(NULL,
545 "bytes 11, offset 16, oper &,"
546 "rvalue 39, result bar",
553 static int DetectByteMathParseTest06(
void)
555 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
558 DetectByteMathData *bmd = DetectByteMathParse(NULL,
559 "bytes 4, offset 0, oper +,"
560 "rvalue 248, result var, relative",
573 DetectByteMathFree(NULL, bmd);
578 static int DetectByteMathParseTest07(
void)
582 DetectByteMathData *bmd = DetectByteMathParse(NULL,
583 "bytes 4, offset 2, oper +,"
584 "rvalue foo, result bar",
595 DetectByteMathFree(NULL, bmd);
602 static int DetectByteMathParseTest08(
void)
605 DetectByteMathData *bmd = DetectByteMathParse(NULL,
606 "bytes 4, offset 2, oper +,"
607 "rvalue foo, result bar",
614 static int DetectByteMathParseTest09(
void)
616 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
618 DetectByteMathData *bmd = DetectByteMathParse(NULL,
619 "bytes 4, offset 2, oper +,"
620 "rvalue 39, result bar, relative",
633 DetectByteMathFree(NULL, bmd);
638 static int DetectByteMathParseTest10(
void)
640 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
642 DetectByteMathData *bmd = DetectByteMathParse(NULL,
643 "bytes 4, offset 2, oper +,"
644 "rvalue 39, result bar, endian"
658 DetectByteMathFree(NULL, bmd);
663 static int DetectByteMathParseTest11(
void)
665 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
667 DetectByteMathData *bmd = DetectByteMathParse(NULL,
668 "bytes 4, offset 2, oper +, "
669 "rvalue 39, result bar, dce",
682 DetectByteMathFree(NULL, bmd);
687 static int DetectByteMathParseTest12(
void)
689 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE | DETECT_BYTEMATH_FLAG_STRING;
691 DetectByteMathData *bmd = DetectByteMathParse(NULL,
692 "bytes 4, offset 2, oper +,"
693 "rvalue 39, result bar, "
694 "relative, string dec",
707 DetectByteMathFree(NULL, bmd);
712 static int DetectByteMathParseTest13(
void)
714 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING |
715 DETECT_BYTEMATH_FLAG_RELATIVE |
716 DETECT_BYTEMATH_FLAG_BITMASK;
718 DetectByteMathData *bmd = DetectByteMathParse(NULL,
719 "bytes 4, offset 2, oper +, "
720 "rvalue 39, result bar, "
721 "relative, string dec, bitmask "
737 DetectByteMathFree(NULL, bmd);
743 static int DetectByteMathParseTest14(
void)
746 DetectByteMathData *bmd = DetectByteMathParse(NULL,
747 "bytes 4, offset 2, oper +,"
756 static int DetectByteMathParseTest15(
void)
760 DetectByteMathData *bmd = DetectByteMathParse(NULL,
761 "bytes 4, offset 2, oper +, "
770 static int DetectByteMathParseTest16(
void)
772 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING | DETECT_BYTEMATH_FLAG_RELATIVE |
773 DETECT_BYTEMATH_FLAG_BITMASK;
775 DetectByteMathData *bmd = DetectByteMathParse(NULL,
776 "bytes 4, offset -2, oper +, "
777 "rvalue 39, result bar, "
778 "relative, string dec, bitmask "
794 DetectByteMathFree(NULL, bmd);
799 static int DetectByteMathPacket01(
void)
801 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01,
802 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
803 0x00, 0x00, 0x6d, 0x00, 0x01, 0x00 };
805 void *dns_state = NULL;
813 memset(&f, 0,
sizeof(
Flow));
816 "192.168.1.5",
"192.168.1.1",
822 f.
proto = IPPROTO_UDP;
844 "(byte_extract: 1, 0, extracted_val, relative;"
845 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
846 "byte_test: 2, =, var, 13;"
847 "msg:\"Byte extract and byte math with byte test verification\";"
853 "(byte_extract: 1, 0, extracted_val, relative;"
854 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
855 "byte_test: 2, !=, var, 13;"
856 "msg:\"Byte extract and byte math with byte test verification\";"
865 "(byte_extract: 1, 0, extracted_val, relative;"
866 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
867 "byte_test: 2, <, var, 15;"
868 "msg:\"Byte extract and byte math with byte test verification\";"
877 STREAM_TOSERVER, buf,
sizeof(buf));
901 static int DetectByteMathPacket02(
void)
903 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
904 0x00, 0x70, 0x00, 0x01, 0x00 };
906 void *dns_state = NULL;
914 memset(&f, 0,
sizeof(
Flow));
916 p =
UTHBuildPacketReal(buf,
sizeof(buf), IPPROTO_UDP,
"192.168.1.5",
"192.168.1.1", 41424, 53);
921 f.
proto = IPPROTO_UDP;
943 "alert udp any any -> any any "
944 "(byte_extract: 1, 0, extracted_val, relative;"
945 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
946 "byte_test: 2, =, var, 13;"
947 "msg:\"Byte extract and byte math with byte test verification\";"
953 "alert udp any any -> any any "
954 "(byte_extract: 1, 0, extracted_val, relative;"
955 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
956 "byte_test: 2, !=, var, 13;"
957 "msg:\"Byte extract and byte math with byte test verification\";"
966 "alert udp any any -> any any "
967 "(byte_extract: 1, 0, extracted_val, relative;"
968 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
969 "byte_test: 2, <, var, 15;"
970 "msg:\"Byte extract and byte math with byte test verification\";"
1002 static int DetectByteMathContext01(
void)
1008 DetectByteMathData *bmd = NULL;
1015 "(msg:\"Testing bytemath_body\"; "
1016 "content:\"|00 04 93 F3|\"; "
1017 "content:\"|00 00 00 07|\"; distance:4; within:4;"
1018 "byte_math:bytes 4, offset 0, oper +, rvalue "
1019 "248, result var, relative; sid:1;)");
1039 bmd = (DetectByteMathData *)sm->
ctx;
1044 FAIL_IF_NOT(bmd->flags == DETECT_BYTEMATH_FLAG_RELATIVE);
1054 static void DetectByteMathRegisterTests(
void)
1056 UtRegisterTest(
"DetectByteMathParseTest01", DetectByteMathParseTest01);
1057 UtRegisterTest(
"DetectByteMathParseTest02", DetectByteMathParseTest02);
1058 UtRegisterTest(
"DetectByteMathParseTest03", DetectByteMathParseTest03);
1059 UtRegisterTest(
"DetectByteMathParseTest04", DetectByteMathParseTest04);
1060 UtRegisterTest(
"DetectByteMathParseTest05", DetectByteMathParseTest05);
1061 UtRegisterTest(
"DetectByteMathParseTest06", DetectByteMathParseTest06);
1062 UtRegisterTest(
"DetectByteMathParseTest07", DetectByteMathParseTest07);
1063 UtRegisterTest(
"DetectByteMathParseTest08", DetectByteMathParseTest08);
1064 UtRegisterTest(
"DetectByteMathParseTest09", DetectByteMathParseTest09);
1065 UtRegisterTest(
"DetectByteMathParseTest10", DetectByteMathParseTest10);
1066 UtRegisterTest(
"DetectByteMathParseTest11", DetectByteMathParseTest11);
1067 UtRegisterTest(
"DetectByteMathParseTest12", DetectByteMathParseTest12);
1068 UtRegisterTest(
"DetectByteMathParseTest13", DetectByteMathParseTest13);
1069 UtRegisterTest(
"DetectByteMathParseTest14", DetectByteMathParseTest14);
1070 UtRegisterTest(
"DetectByteMathParseTest15", DetectByteMathParseTest15);
1071 UtRegisterTest(
"DetectByteMathParseTest16", DetectByteMathParseTest16);
1072 UtRegisterTest(
"DetectByteMathPacket01", DetectByteMathPacket01);
1073 UtRegisterTest(
"DetectByteMathPacket02", DetectByteMathPacket02);
1074 UtRegisterTest(
"DetectByteMathContext01", DetectByteMathContext01);