suricata
detect-engine-helper.c
Go to the documentation of this file.
1 /* Copyright (C) 2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-engine.h"
27 #include "detect-engine-helper.h"
28 #include "detect-engine-mpm.h"
30 #include "detect-parse.h"
32 
33 int DetectHelperBufferRegister(const char *name, AppProto alproto, bool toclient, bool toserver)
34 {
35  if (toserver) {
38  }
39  if (toclient) {
42  }
44 }
45 
47  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
48  const int list_id,
49  bool (*GetBuf)(void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len))
50 {
52  if (buffer->inspect == NULL) {
53  const uint8_t *b = NULL;
54  uint32_t b_len = 0;
55 
56  if (!GetBuf(txv, flow_flags, &b, &b_len))
57  return NULL;
58 
60  }
61  return buffer;
62 }
63 
64 int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
65  bool toclient, bool toserver, InspectionBufferGetDataPtr GetData)
66 {
67  if (toserver) {
71  name, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, alproto, 0);
72  }
73  if (toclient) {
77  name, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetData, alproto, 0);
78  }
81 }
82 
83 int DetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
84  bool toclient, bool toserver, InspectionMultiBufferGetDataPtr GetData, int progress)
85 {
86  if (toserver) {
88  name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2, progress);
89  }
90  if (toclient) {
92  name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2, progress);
93  }
97 }
98 
99 int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
100  bool toclient, bool toserver, InspectionMultiBufferGetDataPtr GetData)
101 {
103  name, desc, alproto, toclient, toserver, GetData, 0);
104 }
105 
107 {
109  void *tmp = SCRealloc(
111  if (unlikely(tmp == NULL)) {
112  return -1;
113  }
114  sigmatch_table = tmp;
117  }
118 
120  return DETECT_TBLSIZE_IDX - 1;
121 }
122 
123 int DetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
124 {
125  int keyword_id = SCDetectHelperNewKeywordId();
126  if (keyword_id < 0) {
127  return -1;
128  }
129 
130  sigmatch_table[keyword_id].name = kw->name;
131  sigmatch_table[keyword_id].desc = kw->desc;
132  sigmatch_table[keyword_id].url = kw->url;
133  sigmatch_table[keyword_id].flags = kw->flags;
134  sigmatch_table[keyword_id].AppLayerTxMatch =
135  (int (*)(DetectEngineThreadCtx * det_ctx, Flow * f, uint8_t flags, void *alstate,
136  void *txv, const Signature *s, const SigMatchCtx *ctx)) kw->AppLayerTxMatch;
137  sigmatch_table[keyword_id].Setup =
138  (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
139  sigmatch_table[keyword_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
140 
141  return keyword_id;
142 }
143 
144 void DetectHelperKeywordAliasRegister(int kwid, const char *alias)
145 {
146  sigmatch_table[kwid].alias = alias;
147 }
148 
149 int DetectHelperTransformRegister(const SCTransformTableElmt *kw)
150 {
151  int transform_id = SCDetectHelperNewKeywordId();
152  if (transform_id < 0) {
153  return -1;
154  }
155 
156  sigmatch_table[transform_id].name = kw->name;
157  sigmatch_table[transform_id].desc = kw->desc;
158  sigmatch_table[transform_id].url = kw->url;
159  sigmatch_table[transform_id].flags = kw->flags;
160  sigmatch_table[transform_id].Transform =
161  (void (*)(DetectEngineThreadCtx * det_ctx, InspectionBuffer * buffer, void *options))
162  kw->Transform;
163  sigmatch_table[transform_id].TransformValidate = (bool (*)(
164  const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate;
165  sigmatch_table[transform_id].Setup =
166  (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
167  sigmatch_table[transform_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
168 
169  return transform_id;
170 }
171 
173  const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
174  const int list_id, uint32_t index, MultiGetTxBuffer GetBuf)
175 {
177  if (buffer == NULL) {
178  return NULL;
179  }
180  if (buffer->initialized) {
181  return buffer;
182  }
183 
184  const uint8_t *data = NULL;
185  uint32_t data_len = 0;
186 
187  if (!GetBuf(txv, flow_flags, index, &data, &data_len)) {
189  return NULL;
190  }
191  InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
192  buffer->flags = DETECT_CI_FLAGS_SINGLE;
193  return buffer;
194 }
195 
197 {
198  return buf->inspect;
199 }
200 
202 {
203  return buf->inspect_len;
204 }
SigTableElmt_::url
const char * url
Definition: detect.h:1405
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1404
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:155
SCDetectHelperNewKeywordId
int SCDetectHelperNewKeywordId(void)
Definition: detect-engine-helper.c:106
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2252
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1392
DetectHelperGetMultiData
InspectionBuffer * DetectHelperGetMultiData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, uint32_t index, MultiGetTxBuffer GetBuf)
Definition: detect-engine-helper.c:172
SigTableElmt_::name
const char * name
Definition: detect.h:1402
InspectionBuffer::initialized
bool initialized
Definition: detect.h:384
InspectionBufferSetupAndApplyTransforms
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
Definition: detect-engine.c:1719
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectEngineTransforms
Definition: detect.h:415
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
InspectionMultiBufferGetDataPtr
InspectionBuffer *(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, const uint32_t local_id)
Definition: detect.h:426
InspectionBuffer
Definition: detect.h:380
FrameStreamData::list_id
int list_id
Definition: detect-engine-frame.c:48
Flow_
Flow data structure.
Definition: flow.h:356
InspectionBufferGetDataPtr
InspectionBuffer *(* InspectionBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id)
Definition: detect.h:421
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1396
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:920
DetectBufferTypeSupportsMultiInstance
void DetectBufferTypeSupportsMultiInstance(const char *name)
Definition: detect-engine.c:1107
FrameStreamData::det_ctx
DetectEngineThreadCtx * det_ctx
Definition: detect-engine-frame.c:45
SigTableElmt_::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
Definition: detect.h:1373
InspectionBuffer::flags
uint8_t flags
Definition: detect.h:385
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:271
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1368
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1387
DetectHelperBufferMpmRegister
int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, bool toclient, bool toserver, InspectionBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:64
detect-engine-prefilter.h
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine.c:1578
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1157
DetectAppLayerMultiRegister
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority, int tx_min_progress)
Definition: detect-engine.c:2302
DetectHelperKeywordRegister
int DetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
Definition: detect-engine-helper.c:123
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:270
InspectionBufferSetupMultiEmpty
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
Definition: detect-engine.c:1666
SigTableElmt_::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect.h:1384
MultiGetTxBuffer
bool(* MultiGetTxBuffer)(void *, uint8_t, uint32_t, const uint8_t **, uint32_t *)
Definition: detect-engine-helper.h:38
DetectEngineThreadCtx_
Definition: detect.h:1197
detect-engine-mpm.h
DETECT_TBLSIZE_IDX
int DETECT_TBLSIZE_IDX
Definition: detect-engine-register.c:286
InspectionBufferLength
uint32_t InspectionBufferLength(InspectionBuffer *buf)
Definition: detect-engine-helper.c:201
FrameStreamData::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-frame.c:46
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1547
detect-engine-helper.h
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:151
name
const char * name
Definition: tm-threads.c:2135
DetectHelperMultiBufferMpmRegister
int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, bool toclient, bool toserver, InspectionMultiBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:99
DetectHelperBufferRegister
int DetectHelperBufferRegister(const char *name, AppProto alproto, bool toclient, bool toserver)
Definition: detect-engine-helper.c:33
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
detect-engine-content-inspection.h
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
DETECT_CI_FLAGS_SINGLE
#define DETECT_CI_FLAGS_SINGLE
Definition: detect-engine-content-inspection.h:49
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1093
flags
uint8_t flags
Definition: decode-gre.h:0
SigTableElmt_::alias
const char * alias
Definition: detect.h:1403
suricata-common.h
DETECT_TBLSIZE_STEP
#define DETECT_TBLSIZE_STEP
Definition: detect-engine-register.h:344
DetectHelperMultiBufferProgressMpmRegister
int DetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto, bool toclient, bool toserver, InspectionMultiBufferGetDataPtr GetData, int progress)
Definition: detect-engine-helper.c:83
DetectHelperGetData
InspectionBuffer * DetectHelperGetData(struct DetectEngineThreadCtx_ *det_ctx, const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv, const int list_id, bool(*GetBuf)(void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len))
Definition: detect-engine-helper.c:46
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2209
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:383
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:381
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:285
DetectHelperTransformRegister
int DetectHelperTransformRegister(const SCTransformTableElmt *kw)
Definition: detect-engine-helper.c:149
detect-parse.h
Signature_
Signature container.
Definition: detect.h:669
FrameStreamData::s
const Signature * s
Definition: detect-engine-frame.c:53
InspectionBufferMultipleForListGet
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
Definition: detect-engine.c:1598
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:245
InspectionBufferPtr
const uint8_t * InspectionBufferPtr(InspectionBuffer *buf)
Definition: detect-engine-helper.c:196
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1254
DetectHelperKeywordAliasRegister
void DetectHelperKeywordAliasRegister(int kwid, const char *alias)
Definition: detect-engine-helper.c:144
SigTableElmt_::Transform
void(* Transform)(DetectEngineThreadCtx *, InspectionBuffer *, void *context)
Definition: detect.h:1383
InspectionBufferSetupMulti
void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine.c:1679