suricata
detect-transform-casechange.c
Go to the documentation of this file.
1 /* Copyright (C) 2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Jeff Lucovsky <jlucovsky@oisf.net>
22  *
23  * Implements case changing transforms
24  */
25 
26 #include "suricata-common.h"
27 #include "detect.h"
28 #include "detect-engine.h"
29 #include "detect-parse.h"
31 
32 /**
33  * \internal
34  * \brief Register the to_lowercase transform
35  * \param det_ctx detection engine ctx
36  * \param s signature
37  * \param optstr options string
38  * \retval 0 ok
39  * \retval -1 failure
40  */
41 static int DetectTransformToLowerSetup(DetectEngineCtx *de_ctx, Signature *s, const char *optstr)
42 {
43  SCEnter();
44 
46 
47  SCReturnInt(r);
48 }
49 
50 /**
51  * \internal
52  * \brief Apply the to_lowercase keyword to the last pattern match
53  * \param buffer Inspection buffer
54  * \param optstr options string
55  */
56 static void DetectTransformToLower(InspectionBuffer *buffer, void *options)
57 {
58  const uint8_t *input = buffer->inspect;
59  const uint32_t input_len = buffer->inspect_len;
60 
61  if (input_len == 0) {
62  return;
63  }
64 
65  uint8_t output[input_len];
66  for (uint32_t i = 0; i < input_len; i++) {
67  output[i] = u8_tolower(input[i]);
68  }
69 
70  InspectionBufferCopy(buffer, output, input_len);
71 }
72 /**
73  * \internal
74  * \brief Register the to_upperrcase transform
75  * \param det_ctx detection engine ctx
76  * \param s signature
77  * \param optstr options string
78  * \retval 0 ok
79  * \retval -1 failure
80  */
81 static int DetectTransformToUpperSetup(DetectEngineCtx *de_ctx, Signature *s, const char *optstr)
82 {
83  SCEnter();
84 
86 
87  SCReturnInt(r);
88 }
89 
90 /**
91  * \internal
92  * \brief Apply the to_uppercase keyword to the last pattern match
93  * \param buffer Inspection buffer
94  * \param optstr options string
95  */
96 static void DetectTransformToUpper(InspectionBuffer *buffer, void *options)
97 {
98  const uint8_t *input = buffer->inspect;
99  const uint32_t input_len = buffer->inspect_len;
100 
101  if (input_len == 0) {
102  return;
103  }
104 
105  uint8_t output[input_len];
106  for (uint32_t i = 0; i < input_len; i++) {
107  output[i] = u8_toupper(input[i]);
108  }
109 
110  InspectionBufferCopy(buffer, output, input_len);
111 }
112 
113 /*
114  * \internal
115  * \brief Check if content is compatible with transform
116  *
117  * If the content contains any lowercase characters, than it is not compatible.
118  */
119 static bool TransformToUpperValidate(const uint8_t *content, uint16_t content_len, void *options)
120 {
121  if (content) {
122  for (uint32_t i = 0; i < content_len; i++) {
123  if (islower(*content++)) {
124  return false;
125  }
126  }
127  }
128  return true;
129 }
130 
131 /*
132  * \internal
133  * \brief Check if content is compatible with transform
134  *
135  * If the content contains any uppercase characters, than it is not compatible.
136  */
137 static bool TransformToLowerValidate(const uint8_t *content, uint16_t content_len, void *options)
138 {
139  if (content) {
140  for (uint32_t i = 0; i < content_len; i++) {
141  if (isupper(*content++)) {
142  return false;
143  }
144  }
145  }
146  return true;
147 }
148 
150 {
151  sigmatch_table[DETECT_TRANSFORM_TOUPPER].name = "to_uppercase";
152  sigmatch_table[DETECT_TRANSFORM_TOUPPER].desc = "convert buffer to uppercase";
153  sigmatch_table[DETECT_TRANSFORM_TOUPPER].url = "/rules/transforms.html#to_uppercase";
154  sigmatch_table[DETECT_TRANSFORM_TOUPPER].Transform = DetectTransformToUpper;
155  sigmatch_table[DETECT_TRANSFORM_TOUPPER].TransformValidate = TransformToUpperValidate;
156  sigmatch_table[DETECT_TRANSFORM_TOUPPER].Setup = DetectTransformToUpperSetup;
158 }
159 
161 {
162  sigmatch_table[DETECT_TRANSFORM_TOLOWER].name = "to_lowercase";
163  sigmatch_table[DETECT_TRANSFORM_TOLOWER].desc = "convert buffer to lowercase";
164  sigmatch_table[DETECT_TRANSFORM_TOLOWER].url = "/rules/transforms.html#to_lowercase";
165  sigmatch_table[DETECT_TRANSFORM_TOLOWER].Transform = DetectTransformToLower;
166  sigmatch_table[DETECT_TRANSFORM_TOLOWER].TransformValidate = TransformToLowerValidate;
167  sigmatch_table[DETECT_TRANSFORM_TOLOWER].Setup = DetectTransformToLowerSetup;
169 }
SigTableElmt_::url
const char * url
Definition: detect.h:1296
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1295
SigTableElmt_::name
const char * name
Definition: detect.h:1293
u8_toupper
#define u8_toupper(c)
Definition: suricata-common.h:437
InspectionBuffer
Definition: detect.h:371
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1287
DETECT_TRANSFORM_TOUPPER
@ DETECT_TRANSFORM_TOUPPER
Definition: detect-engine-register.h:338
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
DetectTransformToLowerRegister
void DetectTransformToLowerRegister(void)
Definition: detect-transform-casechange.c:160
u8_tolower
#define u8_tolower(c)
Definition: suricata-common.h:436
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1278
DETECT_TRANSFORM_TOLOWER
@ DETECT_TRANSFORM_TOLOWER
Definition: detect-engine-register.h:337
SigTableElmt_::TransformValidate
bool(* TransformValidate)(const uint8_t *content, uint16_t content_len, void *context)
Definition: detect.h:1275
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect.h
InspectionBufferCopy
void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len)
Definition: detect-engine.c:1622
detect-transform-casechange.h
suricata-common.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
SigTableElmt_::Transform
void(* Transform)(InspectionBuffer *, void *context)
Definition: detect.h:1274
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:374
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:372
detect-parse.h
Signature_
Signature container.
Definition: detect.h:593
DetectSignatureAddTransform
int DetectSignatureAddTransform(Signature *s, int transform, void *options)
Definition: detect-parse.c:1728
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1473
DetectTransformToUpperRegister
void DetectTransformToUpperRegister(void)
Definition: detect-transform-casechange.c:149
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275