suricata
detect-engine-helper.c
Go to the documentation of this file.
1 /* Copyright (C) 2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-engine.h"
27 #include "detect-engine-helper.h"
28 #include "detect-engine-mpm.h"
30 #include "detect-parse.h"
32 
33 int DetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction)
34 {
35  if (direction & STREAM_TOSERVER) {
38  }
39  if (direction & STREAM_TOCLIENT) {
42  }
44 }
45 
47  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
48  const int list_id,
49  bool (*GetBuf)(void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len))
50 {
52  if (buffer->inspect == NULL) {
53  const uint8_t *b = NULL;
54  uint32_t b_len = 0;
55 
56  if (!GetBuf(txv, flow_flags, &b, &b_len))
57  return NULL;
58 
60  }
61  return buffer;
62 }
63 
64 int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
65  uint8_t direction, InspectionBufferGetDataPtr GetData)
66 {
67  if (direction & STREAM_TOSERVER) {
71  name, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, alproto, 0);
72  }
73  if (direction & STREAM_TOCLIENT) {
77  name, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetData, alproto, 0);
78  }
81 }
82 
83 int DetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
84  uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
85 {
86  if (direction & STREAM_TOSERVER) {
87  DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);
88  }
89  if (direction & STREAM_TOCLIENT) {
90  DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2);
91  }
95 }
96 
97 int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
98  uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
99 {
100  return DetectHelperMultiBufferProgressMpmRegister(name, desc, alproto, direction, GetData, 0);
101 }
102 
104 {
106  void *tmp = SCRealloc(
108  if (unlikely(tmp == NULL)) {
109  return -1;
110  }
111  sigmatch_table = tmp;
114  }
115 
117  return DETECT_TBLSIZE_IDX - 1;
118 }
119 
120 int DetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
121 {
122  int keyword_id = SCDetectHelperNewKeywordId();
123  if (keyword_id < 0) {
124  return -1;
125  }
126 
127  sigmatch_table[keyword_id].name = kw->name;
128  sigmatch_table[keyword_id].desc = kw->desc;
129  sigmatch_table[keyword_id].url = kw->url;
130  sigmatch_table[keyword_id].flags = kw->flags;
131  sigmatch_table[keyword_id].AppLayerTxMatch =
132  (int (*)(DetectEngineThreadCtx * det_ctx, Flow * f, uint8_t flags, void *alstate,
133  void *txv, const Signature *s, const SigMatchCtx *ctx)) kw->AppLayerTxMatch;
134  sigmatch_table[keyword_id].Setup =
135  (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
136  sigmatch_table[keyword_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
137 
138  return keyword_id;
139 }
140 
141 void DetectHelperKeywordAliasRegister(int kwid, const char *alias)
142 {
143  sigmatch_table[kwid].alias = alias;
144 }
145 
146 int DetectHelperTransformRegister(const SCTransformTableElmt *kw)
147 {
148  int transform_id = SCDetectHelperNewKeywordId();
149  if (transform_id < 0) {
150  return -1;
151  }
152 
153  sigmatch_table[transform_id].name = kw->name;
154  sigmatch_table[transform_id].desc = kw->desc;
155  sigmatch_table[transform_id].url = kw->url;
156  sigmatch_table[transform_id].flags = kw->flags;
157  sigmatch_table[transform_id].Transform =
158  (void (*)(DetectEngineThreadCtx * det_ctx, InspectionBuffer * buffer, void *options))
159  kw->Transform;
160  sigmatch_table[transform_id].TransformValidate = (bool (*)(
161  const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate;
162  sigmatch_table[transform_id].Setup =
163  (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
164  sigmatch_table[transform_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
165 
166  return transform_id;
167 }
168 
170 {
171  return buf->inspect;
172 }
173 
175 {
176  return buf->inspect_len;
177 }
SigTableElmt_::url
const char * url
Definition: detect.h:1431
detect-engine.h
DetectHelperMultiBufferProgressMpmRegister
int DetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
Definition: detect-engine-helper.c:83
SigTableElmt_::desc
const char * desc
Definition: detect.h:1430
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:155
SCDetectHelperNewKeywordId
int SCDetectHelperNewKeywordId(void)
Definition: detect-engine-helper.c:103
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2103
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1418
SigTableElmt_::name
const char * name
Definition: detect.h:1428
InspectionBufferSetupAndApplyTransforms
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
Definition: detect-engine.c:1570
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectEngineTransforms
Definition: detect.h:415
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
InspectionBuffer
Definition: detect.h:380
FrameStreamData::list_id
int list_id
Definition: detect-engine-frame.c:48
Flow_
Flow data structure.
Definition: flow.h:356
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:421
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1422
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:931
DetectBufferTypeSupportsMultiInstance
void DetectBufferTypeSupportsMultiInstance(const char *name)
Definition: detect-engine.c:1107
FrameStreamData::det_ctx
DetectEngineThreadCtx * det_ctx
Definition: detect-engine-frame.c:45
SigTableElmt_::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
Definition: detect.h:1399
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:271
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1394
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1413
detect-engine-prefilter.h
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine.c:1429
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1157
DetectHelperBufferRegister
int DetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction)
Definition: detect-engine-helper.c:33
DetectHelperKeywordRegister
int DetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
Definition: detect-engine-helper.c:120
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:270
SigTableElmt_::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect.h:1410
DetectEngineThreadCtx_
Definition: detect.h:1223
detect-engine-mpm.h
DETECT_TBLSIZE_IDX
int DETECT_TBLSIZE_IDX
Definition: detect-engine-register.c:287
InspectionBufferLength
uint32_t InspectionBufferLength(InspectionBuffer *buf)
Definition: detect-engine-helper.c:174
FrameStreamData::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-frame.c:46
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1547
DetectHelperBufferMpmRegister
int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:64
detect-engine-helper.h
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:151
InspectionMultiBufferGetDataPtr
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
Definition: detect.h:427
name
const char * name
Definition: tm-threads.c:2123
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
detect-engine-content-inspection.h
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1093
flags
uint8_t flags
Definition: decode-gre.h:0
SigTableElmt_::alias
const char * alias
Definition: detect.h:1429
suricata-common.h
DETECT_TBLSIZE_STEP
#define DETECT_TBLSIZE_STEP
Definition: detect-engine-register.h:345
DetectHelperGetData
InspectionBuffer * DetectHelperGetData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, bool(*GetBuf)(void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len))
Definition: detect-engine-helper.c:46
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2060
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:383
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:381
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:286
DetectHelperTransformRegister
int DetectHelperTransformRegister(const SCTransformTableElmt *kw)
Definition: detect-engine-helper.c:146
detect-parse.h
Signature_
Signature container.
Definition: detect.h:670
FrameStreamData::s
const Signature * s
Definition: detect-engine-frame.c:53
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:245
DetectHelperMultiBufferMpmRegister
int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:97
InspectionBufferPtr
const uint8_t * InspectionBufferPtr(InspectionBuffer *buf)
Definition: detect-engine-helper.c:169
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1254
DetectAppLayerMultiRegister
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority)
Definition: detect-engine.c:2153
DetectHelperKeywordAliasRegister
void DetectHelperKeywordAliasRegister(int kwid, const char *alias)
Definition: detect-engine-helper.c:141
SigTableElmt_::Transform
void(* Transform)(DetectEngineThreadCtx *, InspectionBuffer *, void *context)
Definition: detect.h:1409