suricata
detect-gid.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Breno Silva <breno.silva@gmail.com>
22  *
23  * Implements the gid keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "decode.h"
29 #include "detect.h"
30 #include "detect-engine.h"
31 #include "detect-parse.h"
32 #include "flow-var.h"
33 #include "decode-events.h"
34 
35 #include "detect-gid.h"
36 #include "util-byte.h"
37 #include "util-unittest.h"
38 #include "util-debug.h"
39 
40 static int DetectGidSetup (DetectEngineCtx *, Signature *, const char *);
41 #ifdef UNITTESTS
42 static void GidRegisterTests(void);
43 #endif
44 
45 /**
46  * \brief Registration function for gid: keyword
47  */
48 
49 void DetectGidRegister (void)
50 {
52  sigmatch_table[DETECT_GID].desc = "give different groups of signatures another id value";
53  sigmatch_table[DETECT_GID].url = "/rules/meta.html#gid-group-id";
55  sigmatch_table[DETECT_GID].Setup = DetectGidSetup;
57 #ifdef UNITTESTS
58  sigmatch_table[DETECT_GID].RegisterTests = GidRegisterTests;
59 #endif
60 }
61 
62 /**
63  * \internal
64  * \brief this function is used to add the parsed gid into the current signature
65  *
66  * \param de_ctx pointer to the Detection Engine Context
67  * \param s pointer to the Current Signature
68  * \param rawstr pointer to the user provided gid options
69  *
70  * \retval 0 on Success
71  * \retval -1 on Failure
72  */
73 static int DetectGidSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
74 {
75  uint32_t gid = 0;
76  if (ByteExtractStringUint32(&gid, 10, strlen(rawstr), rawstr) <= 0) {
77  SCLogError("invalid input as arg to gid keyword");
78  goto error;
79  }
80 
81  s->gid = gid;
82 
83  return 0;
84 
85  error:
86  return -1;
87 }
88 
89 /*
90  * ONLY TESTS BELOW THIS COMMENT
91  */
92 
93 #ifdef UNITTESTS
94 /**
95  * \test GidTestParse01 is a test for a valid gid value
96  */
97 static int GidTestParse01 (void)
98 {
101 
102  Signature *s =
103  DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:1;)");
104 
105  FAIL_IF_NULL(s);
106  FAIL_IF(s->gid != 1);
107 
109  PASS;
110 }
111 
112 /**
113  * \test GidTestParse02 is a test for an invalid gid value
114  */
115 static int GidTestParse02 (void)
116 {
119 
121  DetectEngineAppendSig(de_ctx, "alert tcp 1.2.3.4 any -> any any (sid:1; gid:a;)"));
122 
124  PASS;
125 }
126 
127 /**
128  * \test Test a gid consisting of a single quote.
129  */
130 static int GidTestParse03 (void)
131 {
134 
136  de_ctx, "alert tcp any any -> any any (content:\"ABC\"; gid:\";)"));
137 
139  PASS;
140 }
141 
142 /**
143  * \brief this function registers unit tests for Gid
144  */
145 static void GidRegisterTests(void)
146 {
147  UtRegisterTest("GidTestParse01", GidTestParse01);
148  UtRegisterTest("GidTestParse02", GidTestParse02);
149  UtRegisterTest("GidTestParse03", GidTestParse03);
150 }
151 #endif /* UNITTESTS */
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1462
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1461
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
detect-gid.h
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1446
SigTableElmt_::name
const char * name
Definition: detect.h:1459
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DetectGidRegister
void DetectGidRegister(void)
Registration function for gid: keyword.
Definition: detect-gid.c:49
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DETECT_GID
@ DETECT_GID
Definition: detect-engine-register.h:123
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2641
ByteExtractStringUint32
int ByteExtractStringUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:239
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3437
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1441
util-unittest.h
Signature_::gid
uint32_t gid
Definition: detect.h:714
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
detect.h
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1421
decode-events.h
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:267
detect-parse.h
Signature_
Signature container.
Definition: detect.h:668
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2602
suricata.h
flow-var.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1448