suricata
detect-priority.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the priority keyword
25  */
26 
27 #include "suricata-common.h"
28 #include "detect.h"
29 #include "detect-parse.h"
30 #include "detect-priority.h"
31 #include "detect-engine.h"
32 #include "detect-engine-mpm.h"
33 #include "util-error.h"
34 #include "util-debug.h"
35 
36 #define PARSE_REGEX "^\\s*(\\d+|\"\\d+\")\\s*$"
37 
38 static DetectParseRegex parse_regex;
39 
40 static int DetectPrioritySetup (DetectEngineCtx *, Signature *, const char *);
41 #ifdef UNITTESTS
42 static void PriorityRegisterTests(void);
43 #endif
44 
45 /**
46  * \brief Registers the handler functions for the "priority" keyword
47  */
48 void DetectPriorityRegister (void)
49 {
50  sigmatch_table[DETECT_PRIORITY].name = "priority";
51  sigmatch_table[DETECT_PRIORITY].desc = "rules with a higher priority will be examined first";
52  sigmatch_table[DETECT_PRIORITY].url = "/rules/meta.html#priority";
53  sigmatch_table[DETECT_PRIORITY].Setup = DetectPrioritySetup;
54 #ifdef UNITTESTS
55  sigmatch_table[DETECT_PRIORITY].RegisterTests = PriorityRegisterTests;
56 #endif
57  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
58 }
59 
60 static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
61 {
62  char copy_str[128] = "";
63  size_t pcre2len;
64 
65  pcre2_match_data *match = NULL;
66  int ret = DetectParsePcreExec(&parse_regex, &match, rawstr, 0, 0);
67  if (ret < 0) {
68  SCLogError("Invalid Priority in Signature "
69  "- %s",
70  rawstr);
71  if (match)
72  pcre2_match_data_free(match);
73  return -1;
74  }
75 
76  pcre2len = sizeof(copy_str);
77  ret = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)copy_str, &pcre2len);
78  if (ret < 0) {
79  SCLogError("pcre2_substring_copy_bynumber failed");
80  pcre2_match_data_free(match);
81  return -1;
82  }
83 
84  pcre2_match_data_free(match);
85  char *endptr = NULL;
86  int prio = (int)strtol(copy_str, &endptr, 10);
87  if (endptr == NULL || *endptr != '\0') {
88  SCLogError("Saw an invalid character as arg "
89  "to priority keyword");
90  return -1;
91  }
92 
93  if (s->init_data->init_flags & SIG_FLAG_INIT_PRIO_EXPLICIT) {
94  SCLogWarning("duplicate priority "
95  "keyword. Using highest priority in the rule");
96  s->prio = MIN(s->prio, prio);
97  } else {
98  s->prio = prio;
99  s->init_data->init_flags |= SIG_FLAG_INIT_PRIO_EXPLICIT;
100  }
101  return 0;
102 }
103 
104 /*------------------------------Unittests-------------------------------------*/
105 
106 #ifdef UNITTESTS
107 
108 static int DetectPriorityTest01(void)
109 {
110  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
111  FAIL_IF_NULL(de_ctx);
112 
113  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
114  "(msg:\"Priority test\"; priority:2; sid:1;)");
115  FAIL_IF_NULL(de_ctx->sig_list);
116 
117  FAIL_IF_NOT(de_ctx->sig_list->prio == 2);
118 
119  DetectEngineCtxFree(de_ctx);
120  PASS;
121 }
122 
123 static int DetectPriorityTest02(void)
124 {
125  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
126  FAIL_IF_NULL(de_ctx);
127 
128  Signature *sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
129  "(msg:\"Priority test\"; priority:1; sid:1;)");
130  FAIL_IF_NULL(sig);
131  FAIL_IF_NOT(sig->prio == 1);
132 
133  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
134  "(msg:\"Priority test\"; priority:boo; sid:2;)");
135  FAIL_IF_NOT_NULL(sig);
136 
137  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
138  "(msg:\"Priority test\"; priority:10boo; sid:3;)");
139  FAIL_IF_NOT_NULL(sig);
140 
141  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
142  "(msg:\"Priority test\"; priority:b10oo; sid:4;)");
143  FAIL_IF_NOT_NULL(sig);
144 
145  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
146  "(msg:\"Priority test\"; priority:boo10; sid:5;)");
147  FAIL_IF_NOT_NULL(sig);
148 
149  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
150  "(msg:\"Priority test\"; priority:-1; sid:6;)");
151  FAIL_IF_NOT_NULL(sig);
152 
153  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
154  "(msg:\"Priority test\"; sid:7;)");
155  FAIL_IF_NULL(sig);
156  FAIL_IF_NOT(sig->prio == 3);
157 
158  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
159  "(msg:\"Priority test\"; priority:5; priority:4; sid:8;)");
160  FAIL_IF_NULL(sig);
161  FAIL_IF_NOT(sig->prio == 4);
162 
163  sig = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
164  "(msg:\"Priority test\"; priority:5; priority:4; "
165  "priority:1; sid:9;)");
166  FAIL_IF_NULL(sig);
167  FAIL_IF_NOT(sig->prio == 1);
168 
169  DetectEngineCtxFree(de_ctx);
170  PASS;
171 }
172 
173 /**
174  * \brief This function registers unit tests for Classification Config API.
175  */
176 static void PriorityRegisterTests(void)
177 {
178  UtRegisterTest("DetectPriorityTest01", DetectPriorityTest01);
179  UtRegisterTest("DetectPriorityTest02", DetectPriorityTest02);
180 }
181 #endif /* UNITTESTS */
SigTableElmt_::url
const char * url
Definition: detect.h:1545
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1544
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:78
detect-priority.h
DetectParseRegex
Definition: detect-parse.h:94
SigTableElmt_::name
const char * name
Definition: detect.h:1542
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:101
SIG_FLAG_INIT_PRIO_EXPLICIT
#define SIG_FLAG_INIT_PRIO_EXPLICIT
Definition: detect.h:302
DetectPriorityRegister
void DetectPriorityRegister(void)
Registers the handler functions for the "priority" keyword.
Definition: detect-priority.c:48
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:995
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2912
MIN
#define MIN(x, y)
Definition: suricata-common.h:413
SignatureInitData_::init_flags
uint32_t init_flags
Definition: detect.h:625
DetectParsePcreExec
int DetectParsePcreExec(DetectParseRegex *parse_regex, pcre2_match_data **match, const char *str, int start_offset, int options)
Definition: detect-parse.c:4019
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3965
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1524
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
util-error.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:4145
detect-engine-mpm.h
detect.h
DETECT_PRIORITY
@ DETECT_PRIORITY
Definition: detect-engine-register.h:29
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:262
SigInit
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:3618
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:775
suricata-common.h
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:1005
Signature_::prio
int prio
Definition: detect.h:744
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
detect-parse.h
Signature_
Signature container.
Definition: detect.h:692
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2873
PARSE_REGEX
#define PARSE_REGEX
Definition: detect-priority.c:36
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1531