suricata
detect-engine-prefilter-common.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
21 
24 
25  uint16_t type; /**< PREFILTER_EXTRA_MATCH_* */
26  uint16_t value;
27 
28  uint32_t cnt;
30 
31 static uint32_t PrefilterPacketHeaderHashFunc(HashListTable *ht, void *data, uint16_t datalen)
32 {
33  PrefilterPacketHeaderCtx *ctx = data;
34  uint64_t hash = ctx->v1.u64[0] + ctx->v1.u64[1] + ctx->type + ctx->value;
35  hash %= ht->array_size;
36  return hash;
37 }
38 
39 static char PrefilterPacketHeaderCompareFunc(void *data1, uint16_t len1,
40  void *data2, uint16_t len2)
41 {
42  PrefilterPacketHeaderHashCtx *ctx1 = data1;
43  PrefilterPacketHeaderHashCtx *ctx2 = data2;
44  return (ctx1->v1.u64[0] == ctx2->v1.u64[0] &&
45  ctx1->v1.u64[1] == ctx2->v1.u64[1] &&
46  ctx1->type == ctx2->type &&
47  ctx1->value == ctx2->value);
48 }
49 
50 static void PrefilterPacketHeaderFreeFunc(void *ptr)
51 {
52  SCFree(ptr);
53 }
54 
55 static void PrefilterPacketHeaderFree(void *pectx)
56 {
57  PrefilterPacketHeaderCtx *ctx = pectx;
58  SCFree(ctx->sigs_array);
59  SCFree(ctx);
60 }
61 
62 static void PrefilterPacketU8HashCtxFree(void *vctx)
63 {
64  PrefilterPacketU8HashCtx *ctx = vctx;
65  int i;
66  for (i = 0; i < 256; i++) {
67  SigsArray *sa = ctx->array[i];
68  if (sa == NULL)
69  continue;
70  SCFree(sa->sigs);
71  SCFree(sa);
72  }
73  SCFree(ctx);
74 }
75 
76 static void GetExtraMatch(const Signature *s, uint16_t *type, uint16_t *value)
77 {
78  if (s->sp != NULL && s->sp->next == NULL && s->sp->port == s->sp->port2 &&
79  !(s->sp->flags & PORT_FLAG_NOT))
80  {
82  *value = s->sp->port;
83  } else if (s->alproto != ALPROTO_UNKNOWN) {
85  *value = s->alproto;
86  } else if (s->dp != NULL && s->dp->next == NULL && s->dp->port == s->dp->port2 &&
87  !(s->dp->flags & PORT_FLAG_NOT))
88  {
90  *value = s->dp->port;
91  }
92 }
93 
94 /** \internal
95  */
96 static int
97 SetupEngineForPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
98  int sm_type, PrefilterPacketHeaderHashCtx *hctx,
99  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
100  void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
101 {
102  Signature *s = NULL;
103  uint32_t sig = 0;
104  uint32_t sig_offset = 0;
105 
107  if (ctx == NULL)
108  return -1;
109 
110  ctx->v1 = hctx->v1;
111  ctx->type = hctx->type;
112  ctx->value = hctx->value;
113 
114  ctx->sigs_cnt = hctx->cnt;
115  ctx->sigs_array = SCCalloc(ctx->sigs_cnt, sizeof(SigIntId));
116  if (ctx->sigs_array == NULL) {
117  SCFree(ctx);
118  return -1;
119  }
120 
121  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
122  s = sgh->init->match_array[sig];
123  if (s == NULL)
124  continue;
125  if (s->init_data->prefilter_sm == NULL || s->init_data->prefilter_sm->type != sm_type)
126  continue;
127 
128  uint16_t type = 0;
129  uint16_t value = 0;
130  GetExtraMatch(s, &type, &value);
131 
132  if (Compare(ctx->v1, s->init_data->prefilter_sm->ctx) &&
133  ctx->type == type && ctx->value == value)
134  {
135  SCLogDebug("appending sid %u on %u", s->id, sig_offset);
136  ctx->sigs_array[sig_offset] = s->num;
137  sig_offset++;
138 
140  }
141  }
142 
143  SCLogDebug("%s: ctx %p extra type %u extra value %u, sig cnt %u",
144  sigmatch_table[sm_type].name, ctx, ctx->type, ctx->value,
145  ctx->sigs_cnt);
146  PrefilterAppendEngine(de_ctx, sgh, Match, ctx,
147  PrefilterPacketHeaderFree, sigmatch_table[sm_type].name);
148  return 0;
149 }
150 
151 /** \internal
152  * \brief apply signature to each value */
153 static void ApplyToU8Hash(PrefilterPacketU8HashCtx *ctx, PrefilterPacketHeaderValue v, Signature *s)
154 {
155  switch (v.u8[0]) {
157  {
158  SigsArray *sa = ctx->array[v.u8[1]];
159  sa->sigs[sa->offset++] = s->num;
160  break;
161  }
163  {
164  uint8_t x = v.u8[1] - 1;
165  do {
166  SigsArray *sa = ctx->array[x];
167  sa->sigs[sa->offset++] = s->num;
168  } while (x--);
169 
170  break;
171  }
173  {
174  int x = v.u8[1] + 1;
175  do {
176  SigsArray *sa = ctx->array[x];
177  sa->sigs[sa->offset++] = s->num;
178  } while (++x < 256);
179 
180  break;
181  }
183  {
184  int x = v.u8[1] + 1;
185  do {
186  SigsArray *sa = ctx->array[x];
187  sa->sigs[sa->offset++] = s->num;
188  } while (++x < v.u8[2]);
189 
190  break;
191  }
192  }
193 }
194 
195 /** \internal
196  * \brief turn values into a u8 hash map
197  * \todo improve error handling
198  * \todo deduplicate sigs arrays
199  */
200 static int
201 SetupEngineForPacketHeaderPrefilterPacketU8HashCtx(DetectEngineCtx *de_ctx,
202  SigGroupHead *sgh, int sm_type, uint32_t *counts,
203  void (*Set)(PrefilterPacketHeaderValue *v, void *),
204  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
205  void (*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
206 {
207  Signature *s = NULL;
208  uint32_t sig = 0;
209  uint32_t cnt = 0;
210 
212  if (ctx == NULL)
213  return -1;
214 
215  int set_cnt = 0;
216  for (int i = 0; i < 256; i++) {
217  if (counts[i] == 0)
218  continue;
219  ctx->array[i] = SCCalloc(1, sizeof(SigsArray));
220  BUG_ON(ctx->array[i] == NULL);
221 
222  ctx->array[i]->cnt = counts[i];
223  ctx->array[i]->sigs = SCCalloc(ctx->array[i]->cnt, sizeof(SigIntId));
224  BUG_ON(ctx->array[i]->sigs == NULL);
225  set_cnt++;
226  }
227  if (set_cnt == 0) {
228  /* not an error */
229  PrefilterPacketU8HashCtxFree(ctx);
230  return 0;
231  }
232 
233  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
234  s = sgh->init->match_array[sig];
235  if (s == NULL)
236  continue;
237  if (s->init_data->prefilter_sm == NULL || s->init_data->prefilter_sm->type != sm_type)
238  continue;
239 
241  memset(&v, 0, sizeof(v));
242  Set(&v, s->init_data->prefilter_sm->ctx);
243 
244  ApplyToU8Hash(ctx, v, s);
246  cnt++;
247  }
248 
249  if (cnt) {
250  PrefilterAppendEngine(de_ctx, sgh, Match, ctx,
251  PrefilterPacketU8HashCtxFree,
252  sigmatch_table[sm_type].name);
253  } else {
254  PrefilterPacketU8HashCtxFree(ctx);
255  }
256  return 0;
257 }
258 
259 /** \internal
260  * \brief setup a engine for each unique value
261  */
262 static void SetupSingle(DetectEngineCtx *de_ctx, HashListTable *hash_table,
263  SigGroupHead *sgh, int sm_type,
264  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
265  void (*Match)(DetectEngineThreadCtx *det_ctx,
266  Packet *p, const void *pectx))
267 {
269  for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
271 
272  SetupEngineForPacketHeader(de_ctx, sgh, sm_type,
273  ctx, Compare, Match);
274  }
275 }
276 
277 /** \internal
278  * \brief setup a single engine with a hash map for u8 values
279  */
280 static void SetupU8Hash(DetectEngineCtx *de_ctx, HashListTable *hash_table,
281  SigGroupHead *sgh, int sm_type,
282  void (*Set)(PrefilterPacketHeaderValue *v, void *),
283  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
284  void (*Match)(DetectEngineThreadCtx *det_ctx,
285  Packet *p, const void *pectx))
286 {
287  uint32_t counts[256];
288  memset(&counts, 0, sizeof(counts));
289 
291  for ( ; hb != NULL; hb = HashListTableGetListNext(hb)) {
293 
294  switch (ctx->v1.u8[0]) {
296  counts[ctx->v1.u8[1]] += ctx->cnt;
297  break;
299  {
300  uint8_t v = ctx->v1.u8[1];
301  while (v > 0) {
302  v--;
303  counts[v] += ctx->cnt;
304  }
305 
306  break;
307  }
309  {
310  uint8_t v = ctx->v1.u8[1];
311  while (v < UINT8_MAX) {
312  v++;
313  counts[v] += ctx->cnt;
314  }
315 
316  break;
317  }
319  {
320  if (ctx->v1.u8[1] < ctx->v1.u8[2]) {
321  // ctx->v1.u8[1] is not UINT8_MAX
322  uint8_t v = ctx->v1.u8[1] + 1;
323  while (v < ctx->v1.u8[2]) {
324  counts[v] += ctx->cnt;
325  v++;
326  }
327  }
328  break;
329  }
330  }
331  }
332 
333  SetupEngineForPacketHeaderPrefilterPacketU8HashCtx(de_ctx, sgh, sm_type,
334  counts, Set, Compare, Match);
335 }
336 
337 static int PrefilterSetupPacketHeaderCommon(DetectEngineCtx *de_ctx,
338  SigGroupHead *sgh, int sm_type,
339  void (*Set)(PrefilterPacketHeaderValue *v, void *),
340  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
341  void (*Match)(DetectEngineThreadCtx *det_ctx,
342  Packet *p, const void *pectx),
343  bool u8hash)
344 {
345  Signature *s = NULL;
346  uint32_t sig = 0;
347 
348  if (sgh == NULL)
349  return 0;
350 
351  /* first count how many engines we will need */
352 
353  HashListTable *hash_table = HashListTableInit(4096,
354  PrefilterPacketHeaderHashFunc,
355  PrefilterPacketHeaderCompareFunc,
356  PrefilterPacketHeaderFreeFunc);
357  if (hash_table == NULL)
358  return -1;
359 
360  for (sig = 0; sig < sgh->init->sig_cnt; sig++) {
361  s = sgh->init->match_array[sig];
362  if (s == NULL)
363  continue;
364  if (s->init_data->prefilter_sm == NULL || s->init_data->prefilter_sm->type != sm_type)
365  continue;
366 
368  memset(&ctx, 0, sizeof(ctx));
369  Set(&ctx.v1, s->init_data->prefilter_sm->ctx);
370 
371  GetExtraMatch(s, &ctx.type, &ctx.value);
372 
373  PrefilterPacketHeaderHashCtx *rctx = HashListTableLookup(hash_table, (void *)&ctx, 0);
374  if (rctx != 0) {
375  rctx->cnt++;
376  } else {
377  PrefilterPacketHeaderHashCtx *actx = SCCalloc(1, sizeof(*actx));
378  if (actx == NULL)
379  goto error;
380 
381  Set(&actx->v1, s->init_data->prefilter_sm->ctx);
382  actx->cnt = 1;
383  actx->type = ctx.type;
384  actx->value = ctx.value;
385 
386  int ret = HashListTableAdd(hash_table, actx, 0);
387  if (ret != 0) {
388  SCFree(actx);
389  goto error;
390  }
391  }
392  }
393 
394  if (!u8hash) {
395  SetupSingle(de_ctx, hash_table, sgh, sm_type, Compare, Match);
396  } else {
397  SetupU8Hash(de_ctx, hash_table, sgh, sm_type, Set, Compare, Match);
398  }
399 
400  HashListTableFree(hash_table);
401  return 0;
402 error:
403  HashListTableFree(hash_table);
404  return -1;
405 }
406 
408  SigGroupHead *sgh, int sm_type,
409  void (*Set)(PrefilterPacketHeaderValue *v, void *),
410  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
411  void (*Match)(DetectEngineThreadCtx *det_ctx,
412  Packet *p, const void *pectx))
413 {
414  return PrefilterSetupPacketHeaderCommon(de_ctx, sgh, sm_type, Set, Compare, Match, true);
415 }
416 
418  SigGroupHead *sgh, int sm_type,
419  void (*Set)(PrefilterPacketHeaderValue *v, void *),
420  bool (*Compare)(PrefilterPacketHeaderValue v, void *),
421  void (*Match)(DetectEngineThreadCtx *det_ctx,
422  Packet *p, const void *pectx))
423 {
424  return PrefilterSetupPacketHeaderCommon(de_ctx, sgh, sm_type, Set, Compare, Match, false);
425 }
PrefilterPacketHeaderHashCtx
struct PrefilterPacketHeaderHashCtx_ PrefilterPacketHeaderHashCtx
HashListTableGetListData
#define HashListTableGetListData(hb)
Definition: util-hashlist.h:59
Signature_::num
SigIntId num
Definition: detect.h:557
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1407
SignatureInitData_::prefilter_sm
SigMatch * prefilter_sm
Definition: detect.h:520
PrefilterPacketU8HashCtx_::array
SigsArray * array[256]
Definition: detect-engine-prefilter-common.h:51
Signature_::alproto
AppProto alproto
Definition: detect.h:550
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DetectPort_::port
uint16_t port
Definition: detect.h:192
PREFILTER_U8HASH_MODE_RA
#define PREFILTER_U8HASH_MODE_RA
Definition: detect-engine-prefilter-common.h:57
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:801
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:41
HashListTableGetListHead
HashListTableBucket * HashListTableGetListHead(HashListTable *ht)
Definition: util-hashlist.c:290
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:22
DetectPort_::next
struct DetectPort_ * next
Definition: detect.h:205
PREFILTER_EXTRA_MATCH_SRCPORT
#define PREFILTER_EXTRA_MATCH_SRCPORT
Definition: detect-engine-prefilter-common.h:30
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:40
HashListTableLookup
void * HashListTableLookup(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:248
DetectPort_::port2
uint16_t port2
Definition: detect.h:193
detect-engine-prefilter.h
SigsArray_::offset
uint32_t offset
Definition: detect-engine-prefilter-common.h:47
DetectPort_::flags
uint8_t flags
Definition: detect.h:195
HashListTableAdd
int HashListTableAdd(HashListTable *ht, void *data, uint16_t datalen)
Definition: util-hashlist.c:116
HashListTable_::array_size
uint32_t array_size
Definition: util-hashlist.h:41
HashListTableGetListNext
#define HashListTableGetListNext(hb)
Definition: util-hashlist.h:58
PrefilterPacketHeaderHashCtx_
Definition: detect-engine-prefilter-common.c:22
HashListTableInit
HashListTable * HashListTableInit(uint32_t size, uint32_t(*Hash)(struct HashListTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hashlist.c:35
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:33
PREFILTER_EXTRA_MATCH_DSTPORT
#define PREFILTER_EXTRA_MATCH_DSTPORT
Definition: detect-engine-prefilter-common.h:31
type
uint8_t type
Definition: decode-icmpv4.h:0
SigGroupHeadInitData_::sig_cnt
SigIntId sig_cnt
Definition: detect.h:1397
PrefilterPacketHeaderCtx_::value
uint16_t value
Definition: detect-engine-prefilter-common.h:37
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1050
PrefilterPacketHeaderCtx_::type
uint16_t type
Definition: detect-engine-prefilter-common.h:36
PrefilterPacketHeaderHashCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.c:23
SigGroupHead_::init
SigGroupHeadInitData * init
Definition: detect.h:1430
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:324
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:281
Signature_::flags
uint32_t flags
Definition: detect.h:547
Packet_
Definition: decode.h:420
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:617
HashListTable_
Definition: util-hashlist.h:37
Signature_::sp
DetectPort * sp
Definition: detect.h:586
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:34
PREFILTER_U8HASH_MODE_EQ
#define PREFILTER_U8HASH_MODE_EQ
Definition: detect-engine-prefilter-common.h:54
SigsArray_::sigs
SigIntId * sigs
Definition: detect-engine-prefilter-common.h:45
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:322
HashListTableFree
void HashListTableFree(HashListTable *ht)
Definition: util-hashlist.c:82
SigGroupHeadInitData_::match_array
Signature ** match_array
Definition: detect.h:1400
SigsArray_
Definition: detect-engine-prefilter-common.h:44
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
PrefilterPacketHeaderValue::u64
uint64_t u64[2]
Definition: detect-engine-prefilter-common.h:25
SigsArray_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.h:46
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
Signature_::dp
DetectPort * dp
Definition: detect.h:586
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Signature_::id
uint32_t id
Definition: detect.h:580
HashListTableBucket_
Definition: util-hashlist.h:28
Signature_
Signature container.
Definition: detect.h:546
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
PREFILTER_U8HASH_MODE_GT
#define PREFILTER_U8HASH_MODE_GT
Definition: detect-engine-prefilter-common.h:56
PORT_FLAG_NOT
#define PORT_FLAG_NOT
Definition: detect.h:187
PrefilterPacketU8HashCtx_
Definition: detect-engine-prefilter-common.h:50
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:21
detect-engine-prefilter-common.h
PrefilterAppendEngine
int PrefilterAppendEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, void(*PrefilterFunc)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx), void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:202
SigIntId
#define SigIntId
Definition: suricata-common.h:296
PrefilterSetupPacketHeaderU8Hash
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:407
PrefilterPacketHeaderHashCtx_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.c:28
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SIG_FLAG_PREFILTER
#define SIG_FLAG_PREFILTER
Definition: detect.h:243
PrefilterPacketHeaderHashCtx_::value
uint16_t value
Definition: detect-engine-prefilter-common.c:26
PREFILTER_EXTRA_MATCH_ALPROTO
#define PREFILTER_EXTRA_MATCH_ALPROTO
Definition: detect-engine-prefilter-common.h:29
PrefilterPacketHeaderHashCtx_::type
uint16_t type
Definition: detect-engine-prefilter-common.c:25
PREFILTER_U8HASH_MODE_LT
#define PREFILTER_U8HASH_MODE_LT
Definition: detect-engine-prefilter-common.h:55