suricata
detect-engine-helper.c
Go to the documentation of this file.
1 /* Copyright (C) 2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-engine.h"
27 #include "detect-engine-helper.h"
28 #include "detect-engine-mpm.h"
30 #include "detect-parse.h"
32 #include "rust.h"
33 
34 int SCDetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction)
35 {
36  if (direction & STREAM_TOSERVER) {
39  }
40  if (direction & STREAM_TOCLIENT) {
43  }
45 }
46 
47 int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
48  uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
49 {
50  if (direction & STREAM_TOSERVER) {
54  name, SIG_FLAG_TOSERVER, 2, PrefilterSingleMpmRegister, GetData, alproto, 0);
55  }
56  if (direction & STREAM_TOCLIENT) {
60  name, SIG_FLAG_TOCLIENT, 2, PrefilterSingleMpmRegister, GetData, alproto, 0);
61  }
64 }
65 
66 int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
67  AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
68 {
69  if (direction & STREAM_TOSERVER) {
70  DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);
71  }
72  if (direction & STREAM_TOCLIENT) {
73  DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2);
74  }
78 }
79 
80 int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
81  uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
82 {
83  return SCDetectHelperMultiBufferProgressMpmRegister(name, desc, alproto, direction, GetData, 0);
84 }
85 
87 {
89  void *tmp = SCRealloc(
91  if (unlikely(tmp == NULL)) {
92  return -1;
93  }
94  sigmatch_table = tmp;
97  }
98 
100  return DETECT_TBLSIZE_IDX - 1;
101 }
102 
104 {
105  int keyword_id = SCDetectHelperNewKeywordId();
106  if (keyword_id < 0) {
107  return -1;
108  }
109 
110  sigmatch_table[keyword_id].name = kw->name;
111  sigmatch_table[keyword_id].desc = kw->desc;
112  sigmatch_table[keyword_id].url = kw->url;
113  sigmatch_table[keyword_id].flags = kw->flags;
114  sigmatch_table[keyword_id].AppLayerTxMatch =
115  (int (*)(DetectEngineThreadCtx * det_ctx, Flow * f, uint8_t flags, void *alstate,
116  void *txv, const Signature *s, const SigMatchCtx *ctx)) kw->AppLayerTxMatch;
117  sigmatch_table[keyword_id].Setup =
118  (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
119  sigmatch_table[keyword_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
120 
121  return (uint16_t)keyword_id;
122 }
123 
124 void SCDetectHelperKeywordAliasRegister(uint16_t kwid, const char *alias)
125 {
126  sigmatch_table[kwid].alias = alias;
127 }
128 
130 {
131  int transform_id = SCDetectHelperNewKeywordId();
132  if (transform_id < 0) {
133  return -1;
134  }
135 
136  sigmatch_table[transform_id].name = kw->name;
137  sigmatch_table[transform_id].desc = kw->desc;
138  sigmatch_table[transform_id].url = kw->url;
139  sigmatch_table[transform_id].flags = kw->flags;
140  sigmatch_table[transform_id].Transform =
141  (void (*)(DetectEngineThreadCtx * det_ctx, InspectionBuffer * buffer, void *options))
142  kw->Transform;
143  sigmatch_table[transform_id].TransformValidate = (bool (*)(
144  const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate;
145  sigmatch_table[transform_id].Setup =
146  (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
147  sigmatch_table[transform_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
148  sigmatch_table[transform_id].TransformId =
149  (void (*)(const uint8_t **id_data, uint32_t *length, void *context))kw->TransformId;
150 
151  return transform_id;
152 }
SCSigTableAppLiteElmt::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
function callback to match on an app-layer transaction
Definition: detect-engine-helper.h:63
SigTableElmt_::url
const char * url
Definition: detect.h:1422
detect-engine.h
SCSigTableAppLiteElmt::url
const char * url
keyword documentation url
Definition: detect-engine-helper.h:55
SCSigTableAppLiteElmt::name
const char * name
keyword name
Definition: detect-engine-helper.h:51
SigTableElmt_::desc
const char * desc
Definition: detect.h:1421
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SCDetectHelperNewKeywordId
int SCDetectHelperNewKeywordId(void)
Definition: detect-engine-helper.c:86
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1409
SigTableElmt_::name
const char * name
Definition: detect.h:1419
DetectEngineInspectBufferSingle
uint8_t DetectEngineInspectBufferSingle(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:1975
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
DetectAppLayerInspectEngineRegisterSingle
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
Definition: detect-engine.c:271
PrefilterSingleMpmRegister
int PrefilterSingleMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1605
SCTransformTableElmt::url
const char * url
Definition: detect-engine-helper.h:70
SCTransformTableElmt::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect-engine-helper.h:75
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
InspectionBuffer
Definition: detect-engine-inspect-buffer.h:34
SCTransformTableElmt::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect-engine-helper.h:72
SCTransformTableElmt
Definition: detect-engine-helper.h:67
Flow_
Flow data structure.
Definition: flow.h:356
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1413
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:919
SCDetectHelperMultiBufferProgressMpmRegister
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
Definition: detect-engine-helper.c:66
DetectBufferTypeSupportsMultiInstance
void DetectBufferTypeSupportsMultiInstance(const char *name)
Definition: detect-engine.c:1206
SCDetectHelperKeywordAliasRegister
void SCDetectHelperKeywordAliasRegister(uint16_t kwid, const char *alias)
Definition: detect-engine-helper.c:124
FrameStreamData::det_ctx
DetectEngineThreadCtx * det_ctx
Definition: detect-engine-frame.c:45
SigTableElmt_::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
Definition: detect.h:1387
rust.h
SCTransformTableElmt::TransformId
void(* TransformId)(const uint8_t **id_data, uint32_t *id_length, void *context)
Definition: detect-engine-helper.h:76
SCDetectHelperBufferMpmRegister
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:47
SCSigTableAppLiteElmt::desc
const char * desc
keyword description
Definition: detect-engine-helper.h:53
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:272
SigTableElmt_
element in sigmatch type table.
Definition: detect.h:1382
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1404
SCTransformTableElmt::desc
const char * desc
Definition: detect-engine-helper.h:69
SCDetectHelperBufferRegister
int SCDetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction)
Definition: detect-engine-helper.c:34
SCTransformTableElmt::name
const char * name
Definition: detect-engine-helper.h:68
detect-engine-prefilter.h
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1256
SCSigTableAppLiteElmt
App-layer light version of SigTableElmt.
Definition: detect-engine-helper.h:49
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:271
SigTableElmt_::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect.h:1398
DetectEngineThreadCtx_
Definition: detect.h:1211
SCDetectHelperTransformRegister
int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw)
Definition: detect-engine-helper.c:129
detect-engine-mpm.h
DETECT_TBLSIZE_IDX
int DETECT_TBLSIZE_IDX
Definition: detect-engine-register.c:291
InspectionSingleBufferGetDataPtr
bool(* InspectionSingleBufferGetDataPtr)(const void *txv, const uint8_t flow_flags, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:45
detect-engine-helper.h
SCSigTableAppLiteElmt::Free
void(* Free)(DetectEngineCtx *, void *)
function callback to free structure allocated by setup if any
Definition: detect-engine-helper.h:61
SCDetectHelperKeywordRegister
uint16_t SCDetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
Definition: detect-engine-helper.c:103
name
const char * name
Definition: tm-threads.c:2123
InspectionMultiBufferGetDataPtr
bool(* InspectionMultiBufferGetDataPtr)(struct DetectEngineThreadCtx_ *det_ctx, const void *txv, const uint8_t flow_flags, uint32_t local_id, const uint8_t **buf, uint32_t *buf_len)
Definition: detect-engine-helper.h:42
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
detect-engine-content-inspection.h
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:352
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1192
flags
uint8_t flags
Definition: decode-gre.h:0
SCSigTableAppLiteElmt::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
function callback to parse and setup keyword in rule
Definition: detect-engine-helper.h:59
SigTableElmt_::alias
const char * alias
Definition: detect.h:1420
DetectAppLayerMpmRegisterSingle
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
Definition: detect-engine-mpm.c:162
suricata-common.h
DETECT_TBLSIZE_STEP
#define DETECT_TBLSIZE_STEP
Definition: detect-engine-register.h:349
SCDetectHelperMultiBufferMpmRegister
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:80
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:1933
DETECT_TBLSIZE
int DETECT_TBLSIZE
Definition: detect-engine-register.c:290
detect-parse.h
Signature_
Signature container.
Definition: detect.h:657
SCSigTableAppLiteElmt::flags
uint16_t flags
flags SIGMATCH_*
Definition: detect-engine-helper.h:57
SCTransformTableElmt::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect-engine-helper.h:73
FrameStreamData::s
const Signature * s
Definition: detect-engine-frame.c:53
SCTransformTableElmt::flags
uint16_t flags
Definition: detect-engine-helper.h:71
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:249
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1353
DetectAppLayerMultiRegister
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority)
Definition: detect-engine.c:2086
SigTableElmt_::Transform
void(* Transform)(DetectEngineThreadCtx *, InspectionBuffer *, void *context)
Definition: detect.h:1397
SigTableElmt_::TransformId
void(* TransformId)(const uint8_t **data, uint32_t *length, void *context)
Definition: detect.h:1401
SCTransformTableElmt::Transform
void(* Transform)(DetectEngineThreadCtx *, InspectionBuffer *, void *context)
Definition: detect-engine-helper.h:74