42 #include "rust-bindings.h"
61 static void DetectByteMathRegisterTests(
void);
65 #define DETECT_BYTEMATH_ENDIAN_DEFAULT (uint8_t) BigEndian
66 #define DETECT_BYTEMATH_BASE_DEFAULT (uint8_t) BaseDec
81 static inline bool DetectByteMathValidateNbytesOnly(
const DetectByteMathData *data, int32_t nbytes)
84 (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
89 uint64_t rvalue, uint64_t *value, uint8_t endian)
95 if (!DetectByteMathValidateNbytesOnly(data, nbytes)) {
107 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
108 SCLogDebug(
"relative, working with det_ctx->buffer_offset %" PRIu32
", "
109 "data->offset %" PRIi32
"",
123 SCLogDebug(
"absolute, data->offset %" PRIi32
"", data->offset);
125 ptr = payload + data->offset;
130 if (ptr < payload || nbytes >
len) {
131 SCLogDebug(
"Data not within payload pkt=%p, ptr=%p, len=%" PRIu32
", nbytes=%d", payload,
137 if (data->flags & DETECT_BYTEMATH_FLAG_STRING) {
144 SCLogDebug(
"error extracting %d bytes of string data: %d", nbytes, extbytes);
149 ByteMathEndian bme = endian;
152 if (extbytes != nbytes) {
153 SCLogDebug(
"error extracting %d bytes of numeric data: %d", nbytes, extbytes);
162 switch (data->oper) {
195 if (data->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
196 val &= data->bitmask_val;
197 if (val && data->bitmask_shift_count) {
198 val = val >> data->bitmask_shift_count;
217 static DetectByteMathData *DetectByteMathParse(
220 DetectByteMathData *bmd;
221 if ((bmd = ScByteMathParse(arg)) == NULL) {
226 if (bmd->nbytes_str) {
227 if (nbytes == NULL) {
229 "var name for nbytes. \"nbytes\" argument supplied to "
230 "this function must be non-NULL");
233 *nbytes =
SCStrdup(bmd->nbytes_str);
234 if (*nbytes == NULL) {
239 if (bmd->rvalue_str) {
240 if (rvalue == NULL) {
242 "var name for rvalue. \"rvalue\" argument supplied to "
243 "this function must be non-NULL");
246 *rvalue =
SCStrdup(bmd->rvalue_str);
247 if (*rvalue == NULL) {
252 if (bmd->flags & DETECT_BYTEMATH_FLAG_BITMASK) {
253 if (bmd->bitmask_val) {
254 uint32_t bmask = bmd->bitmask_val;
255 while (!(bmask & 0x1)){
257 bmd->bitmask_shift_count++;
266 DetectByteMathFree(
de_ctx, bmd);
284 DetectByteMathData *data;
289 data = DetectByteMathParse(
de_ctx, arg, &nbytes, &rvalue);
300 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
304 "previous pattern match");
308 }
else if (data->endian == EndianDCE) {
309 if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
315 if (prev_pm == NULL) {
329 }
else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
334 if (prev_pm == NULL) {
346 if (data->endian == EndianDCE) {
350 if ((data->flags & DETECT_BYTEMATH_FLAG_STRING) || (data->base == BaseDec) ||
351 (data->base == BaseHex) || (data->base == BaseOct)) {
353 "A bytemath keyword with dce holds other invalid modifiers.");
358 if (nbytes != NULL) {
361 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", nbytes);
364 data->nbytes = index;
365 data->flags |= DETECT_BYTEMATH_FLAG_NBYTES_VAR;
370 if (rvalue != NULL) {
373 SCLogError(
"unknown byte_ keyword var seen in byte_math - %s", rvalue);
376 data->rvalue = index;
377 data->flags |= DETECT_BYTEMATH_FLAG_RVALUE_VAR;
384 if (prev_bmd_sm == NULL) {
387 data->local_id = ((DetectByteMathData *)prev_bmd_sm->
ctx)->local_id + 1;
397 if (!(data->flags & DETECT_BYTEMATH_FLAG_RELATIVE))
419 DetectByteMathFree(
de_ctx, data);
447 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
448 if (strcmp(bmd->result, arg) == 0) {
461 const DetectByteMathData *bmd = (
const DetectByteMathData *)sm->
ctx;
462 if (strcmp(bmd->result, arg) == 0) {
478 static int DetectByteMathParseTest01(
void)
481 DetectByteMathData *bmd = DetectByteMathParse(NULL,
482 "bytes 4, offset 2, oper +,"
483 "rvalue 10, result bar",
495 DetectByteMathFree(NULL, bmd);
500 static int DetectByteMathParseTest02(
void)
503 DetectByteMathData *bmd = DetectByteMathParse(NULL,
504 "bytes 257, offset 2, oper +, "
505 "rvalue 39, result bar",
513 static int DetectByteMathParseTest03(
void)
516 DetectByteMathData *bmd = DetectByteMathParse(NULL,
517 "bytes 11, offset 2, oper +, "
518 "rvalue 39, result bar",
525 static int DetectByteMathParseTest04(
void)
528 DetectByteMathData *bmd = DetectByteMathParse(NULL,
529 "bytes 4, offset 70000, oper +,"
530 " rvalue 39, result bar",
538 static int DetectByteMathParseTest05(
void)
541 DetectByteMathData *bmd = DetectByteMathParse(NULL,
542 "bytes 11, offset 16, oper &,"
543 "rvalue 39, result bar",
550 static int DetectByteMathParseTest06(
void)
552 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
555 DetectByteMathData *bmd = DetectByteMathParse(NULL,
556 "bytes 4, offset 0, oper +,"
557 "rvalue 248, result var, relative",
570 DetectByteMathFree(NULL, bmd);
575 static int DetectByteMathParseTest07(
void)
579 DetectByteMathData *bmd = DetectByteMathParse(NULL,
580 "bytes 4, offset 2, oper +,"
581 "rvalue foo, result bar",
592 DetectByteMathFree(NULL, bmd);
599 static int DetectByteMathParseTest08(
void)
602 DetectByteMathData *bmd = DetectByteMathParse(NULL,
603 "bytes 4, offset 2, oper +,"
604 "rvalue foo, result bar",
611 static int DetectByteMathParseTest09(
void)
613 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE;
615 DetectByteMathData *bmd = DetectByteMathParse(NULL,
616 "bytes 4, offset 2, oper +,"
617 "rvalue 39, result bar, relative",
630 DetectByteMathFree(NULL, bmd);
635 static int DetectByteMathParseTest10(
void)
637 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
639 DetectByteMathData *bmd = DetectByteMathParse(NULL,
640 "bytes 4, offset 2, oper +,"
641 "rvalue 39, result bar, endian"
655 DetectByteMathFree(NULL, bmd);
660 static int DetectByteMathParseTest11(
void)
662 uint8_t
flags = DETECT_BYTEMATH_FLAG_ENDIAN;
664 DetectByteMathData *bmd = DetectByteMathParse(NULL,
665 "bytes 4, offset 2, oper +, "
666 "rvalue 39, result bar, dce",
679 DetectByteMathFree(NULL, bmd);
684 static int DetectByteMathParseTest12(
void)
686 uint8_t
flags = DETECT_BYTEMATH_FLAG_RELATIVE | DETECT_BYTEMATH_FLAG_STRING;
688 DetectByteMathData *bmd = DetectByteMathParse(NULL,
689 "bytes 4, offset 2, oper +,"
690 "rvalue 39, result bar, "
691 "relative, string dec",
704 DetectByteMathFree(NULL, bmd);
709 static int DetectByteMathParseTest13(
void)
711 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING |
712 DETECT_BYTEMATH_FLAG_RELATIVE |
713 DETECT_BYTEMATH_FLAG_BITMASK;
715 DetectByteMathData *bmd = DetectByteMathParse(NULL,
716 "bytes 4, offset 2, oper +, "
717 "rvalue 39, result bar, "
718 "relative, string dec, bitmask "
734 DetectByteMathFree(NULL, bmd);
740 static int DetectByteMathParseTest14(
void)
743 DetectByteMathData *bmd = DetectByteMathParse(NULL,
744 "bytes 4, offset 2, oper +,"
753 static int DetectByteMathParseTest15(
void)
757 DetectByteMathData *bmd = DetectByteMathParse(NULL,
758 "bytes 4, offset 2, oper +, "
767 static int DetectByteMathParseTest16(
void)
769 uint8_t
flags = DETECT_BYTEMATH_FLAG_STRING | DETECT_BYTEMATH_FLAG_RELATIVE |
770 DETECT_BYTEMATH_FLAG_BITMASK;
772 DetectByteMathData *bmd = DetectByteMathParse(NULL,
773 "bytes 4, offset -2, oper +, "
774 "rvalue 39, result bar, "
775 "relative, string dec, bitmask "
791 DetectByteMathFree(NULL, bmd);
796 static int DetectByteMathPacket01(
void)
798 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01,
799 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
800 0x00, 0x00, 0x6d, 0x00, 0x01, 0x00 };
802 void *dns_state = NULL;
810 memset(&f, 0,
sizeof(
Flow));
813 "192.168.1.5",
"192.168.1.1",
819 f.
proto = IPPROTO_UDP;
841 "(byte_extract: 1, 0, extracted_val, relative;"
842 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
843 "byte_test: 2, =, var, 13;"
844 "msg:\"Byte extract and byte math with byte test verification\";"
850 "(byte_extract: 1, 0, extracted_val, relative;"
851 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
852 "byte_test: 2, !=, var, 13;"
853 "msg:\"Byte extract and byte math with byte test verification\";"
862 "(byte_extract: 1, 0, extracted_val, relative;"
863 "byte_math: bytes 1, offset 1, oper +, rvalue extracted_val, result var;"
864 "byte_test: 2, <, var, 15;"
865 "msg:\"Byte extract and byte math with byte test verification\";"
874 STREAM_TOSERVER, buf,
sizeof(buf));
898 static int DetectByteMathPacket02(
void)
900 uint8_t buf[] = { 0x38, 0x35, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
901 0x00, 0x70, 0x00, 0x01, 0x00 };
903 void *dns_state = NULL;
911 memset(&f, 0,
sizeof(
Flow));
913 p =
UTHBuildPacketReal(buf,
sizeof(buf), IPPROTO_UDP,
"192.168.1.5",
"192.168.1.1", 41424, 53);
918 f.
proto = IPPROTO_UDP;
940 "alert udp any any -> any any "
941 "(byte_extract: 1, 0, extracted_val, relative;"
942 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
943 "byte_test: 2, =, var, 13;"
944 "msg:\"Byte extract and byte math with byte test verification\";"
950 "alert udp any any -> any any "
951 "(byte_extract: 1, 0, extracted_val, relative;"
952 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
953 "byte_test: 2, !=, var, 13;"
954 "msg:\"Byte extract and byte math with byte test verification\";"
963 "alert udp any any -> any any "
964 "(byte_extract: 1, 0, extracted_val, relative;"
965 "byte_math: bytes 1, offset -1, oper +, rvalue extracted_val, result var, relative;"
966 "byte_test: 2, <, var, 15;"
967 "msg:\"Byte extract and byte math with byte test verification\";"
999 static int DetectByteMathContext01(
void)
1005 DetectByteMathData *bmd = NULL;
1012 "(msg:\"Testing bytemath_body\"; "
1013 "content:\"|00 04 93 F3|\"; "
1014 "content:\"|00 00 00 07|\"; distance:4; within:4;"
1015 "byte_math:bytes 4, offset 0, oper +, rvalue "
1016 "248, result var, relative; sid:1;)");
1036 bmd = (DetectByteMathData *)sm->
ctx;
1041 FAIL_IF_NOT(bmd->flags == DETECT_BYTEMATH_FLAG_RELATIVE);
1051 static void DetectByteMathRegisterTests(
void)
1053 UtRegisterTest(
"DetectByteMathParseTest01", DetectByteMathParseTest01);
1054 UtRegisterTest(
"DetectByteMathParseTest02", DetectByteMathParseTest02);
1055 UtRegisterTest(
"DetectByteMathParseTest03", DetectByteMathParseTest03);
1056 UtRegisterTest(
"DetectByteMathParseTest04", DetectByteMathParseTest04);
1057 UtRegisterTest(
"DetectByteMathParseTest05", DetectByteMathParseTest05);
1058 UtRegisterTest(
"DetectByteMathParseTest06", DetectByteMathParseTest06);
1059 UtRegisterTest(
"DetectByteMathParseTest07", DetectByteMathParseTest07);
1060 UtRegisterTest(
"DetectByteMathParseTest08", DetectByteMathParseTest08);
1061 UtRegisterTest(
"DetectByteMathParseTest09", DetectByteMathParseTest09);
1062 UtRegisterTest(
"DetectByteMathParseTest10", DetectByteMathParseTest10);
1063 UtRegisterTest(
"DetectByteMathParseTest11", DetectByteMathParseTest11);
1064 UtRegisterTest(
"DetectByteMathParseTest12", DetectByteMathParseTest12);
1065 UtRegisterTest(
"DetectByteMathParseTest13", DetectByteMathParseTest13);
1066 UtRegisterTest(
"DetectByteMathParseTest14", DetectByteMathParseTest14);
1067 UtRegisterTest(
"DetectByteMathParseTest15", DetectByteMathParseTest15);
1068 UtRegisterTest(
"DetectByteMathParseTest16", DetectByteMathParseTest16);
1069 UtRegisterTest(
"DetectByteMathPacket01", DetectByteMathPacket01);
1070 UtRegisterTest(
"DetectByteMathPacket02", DetectByteMathPacket02);
1071 UtRegisterTest(
"DetectByteMathContext01", DetectByteMathContext01);