suricata
detect-gid.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Breno Silva <breno.silva@gmail.com>
22  *
23  * Implements the gid keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "detect.h"
30 #include "detect-engine.h"
31 #include "detect-parse.h"
32 #include "flow-var.h"
33 #include "decode-events.h"
34 
35 #include "detect-gid.h"
36 #include "util-unittest.h"
37 #include "util-debug.h"
38 
39 static int DetectGidSetup (DetectEngineCtx *, Signature *, const char *);
40 #ifdef UNITTESTS
41 static void GidRegisterTests(void);
42 #endif
43 
44 /**
45  * \brief Registration function for gid: keyword
46  */
47 
48 void DetectGidRegister (void)
49 {
51  sigmatch_table[DETECT_GID].desc = "give different groups of signatures another id value";
52  sigmatch_table[DETECT_GID].url = "/rules/meta.html#gid-group-id";
54  sigmatch_table[DETECT_GID].Setup = DetectGidSetup;
56 #ifdef UNITTESTS
57  sigmatch_table[DETECT_GID].RegisterTests = GidRegisterTests;
58 #endif
59 }
60 
61 /**
62  * \internal
63  * \brief this function is used to add the parsed gid into the current signature
64  *
65  * \param de_ctx pointer to the Detection Engine Context
66  * \param s pointer to the Current Signature
67  * \param rawstr pointer to the user provided gid options
68  *
69  * \retval 0 on Success
70  * \retval -1 on Failure
71  */
72 static int DetectGidSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
73 {
74  unsigned long gid = 0;
75  char *endptr = NULL;
76  gid = strtoul(rawstr, &endptr, 10);
77  if (endptr == NULL || *endptr != '\0') {
78  SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid character as arg "
79  "to gid keyword");
80  goto error;
81  }
82  if (gid >= UINT_MAX) {
83  SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "gid value to high, max %u", UINT_MAX);
84  goto error;
85  }
86 
87  s->gid = (uint32_t)gid;
88 
89  return 0;
90 
91  error:
92  return -1;
93 }
94 
95 /*
96  * ONLY TESTS BELOW THIS COMMENT
97  */
98 
99 #ifdef UNITTESTS
100 /**
101  * \test GidTestParse01 is a test for a valid gid value
102  *
103  * \retval 1 on succces
104  * \retval 0 on failure
105  */
106 static int GidTestParse01 (void)
107 {
108  int result = 0;
109  Signature *s = NULL;
110 
112  if (de_ctx == NULL)
113  goto end;
114 
115  s = DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:1;)");
116  if (s == NULL || s->gid != 1)
117  goto end;
118 
119  result = 1;
120 end:
121  if (de_ctx != NULL)
123  return result;
124 }
125 
126 /**
127  * \test GidTestParse02 is a test for an invalid gid value
128  *
129  * \retval 1 on succces
130  * \retval 0 on failure
131  */
132 static int GidTestParse02 (void)
133 {
134  int result = 0;
135 
137  if (de_ctx == NULL)
138  goto end;
139 
140  if (DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:a;)") != NULL)
141  goto end;
142 
143  result = 1;
144 end:
145  if (de_ctx != NULL)
147  return result;
148 }
149 
150 /**
151  * \test Test a gid consisting of a single quote.
152  *
153  * \retval 1 on succces
154  * \retval 0 on failure
155  */
156 static int GidTestParse03 (void)
157 {
158  int result = 0;
159 
161  if (de_ctx == NULL)
162  goto end;
163 
165  "alert tcp any any -> any any (content:\"ABC\"; gid:\";)") != NULL)
166  goto end;
167 
168  result = 1;
169 end:
170  if (de_ctx != NULL)
172  return result;
173 }
174 
175 /**
176  * \brief this function registers unit tests for Gid
177  */
178 static void GidRegisterTests(void)
179 {
180  UtRegisterTest("GidTestParse01", GidTestParse01);
181  UtRegisterTest("GidTestParse02", GidTestParse02);
182  UtRegisterTest("GidTestParse03", GidTestParse03);
183 }
184 #endif /* UNITTESTS */
SigTableElmt_::url
const char * url
Definition: detect.h:1214
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1213
detect-gid.h
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1201
SigTableElmt_::name
const char * name
Definition: detect.h:1211
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectGidRegister
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:48
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
DETECT_GID
@ DETECT_GID
Definition: detect-engine-register.h:102
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2093
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
util-unittest.h
Signature_::gid
uint32_t gid
Definition: detect.h:562
decode.h
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
detect.h
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1179
decode-events.h
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2361
suricata-common.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2048
suricata.h
SC_ERR_INVALID_NUMERIC_VALUE
@ SC_ERR_INVALID_NUMERIC_VALUE
Definition: util-error.h:90
flow-var.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1203