suricata
detect-transform-strip-pseudo-headers.c
Go to the documentation of this file.
1 /* Copyright (C) 2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <contact@catenacyber.fr>
22  *
23  * Implements the strip_pseudo_headers transform keyword with option support
24  */
25 
26 #include "suricata-common.h"
27 #include "detect.h"
28 #include "detect-engine.h"
29 #include "detect-parse.h"
31 
32 /**
33  * \internal
34  * \brief Apply the strip_pseudo_headers keyword to the last pattern match
35  * \param det_ctx detection engine ctx
36  * \param s signature
37  * \param optstr options string
38  * \retval 0 ok
39  * \retval -1 failure
40  */
41 static int DetectTransformStripPseudoHeadersSetup(
42  DetectEngineCtx *de_ctx, Signature *s, const char *optstr)
43 {
44  SCEnter();
46  SCReturnInt(r);
47 }
48 
49 static void DetectTransformStripPseudoHeaders(InspectionBuffer *buffer, void *options)
50 {
51  const uint8_t *input = buffer->inspect;
52  const uint32_t input_len = buffer->inspect_len;
53  if (input_len == 0) {
54  return;
55  }
56  uint8_t output[input_len];
57 
58  bool new_line = true;
59  bool pseudo = false;
60  uint32_t j = 0;
61  for (uint32_t i = 0; i < input_len; i++) {
62  if (new_line) {
63  if (input[i] == ':') {
64  pseudo = true;
65  }
66  if (input[i] != '\r' && input[i] != '\n') {
67  new_line = false;
68  }
69  } else {
70  if (input[i] == '\n') {
71  new_line = true;
72  if (!pseudo) {
73  output[j] = input[i];
74  j++;
75  }
76  pseudo = false;
77  continue;
78  }
79  }
80  if (!pseudo) {
81  output[j] = input[i];
82  j++;
83  }
84  }
85  InspectionBufferCopy(buffer, output, j);
86 }
87 
89 {
92  "modify buffer via stripping pseudo headers";
94  "/rules/transforms.html#strip_pseudo_headers";
96  DetectTransformStripPseudoHeaders;
98  DetectTransformStripPseudoHeadersSetup;
100 }
SigTableElmt_::url
const char * url
Definition: detect.h:1296
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1295
SigTableElmt_::name
const char * name
Definition: detect.h:1293
InspectionBuffer
Definition: detect.h:371
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1287
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1278
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect.h
detect-transform-strip-pseudo-headers.h
DETECT_TRANSFORM_STRIP_PSEUDO_HEADERS
@ DETECT_TRANSFORM_STRIP_PSEUDO_HEADERS
Definition: detect-engine-register.h:329
InspectionBufferCopy
void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len)
Definition: detect-engine.c:1622
suricata-common.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
SigTableElmt_::Transform
void(* Transform)(InspectionBuffer *, void *context)
Definition: detect.h:1274
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:374
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:372
DetectTransformStripPseudoHeadersRegister
void DetectTransformStripPseudoHeadersRegister(void)
Definition: detect-transform-strip-pseudo-headers.c:88
detect-parse.h
Signature_
Signature container.
Definition: detect.h:593
DetectSignatureAddTransform
int DetectSignatureAddTransform(Signature *s, int transform, void *options)
Definition: detect-parse.c:1728
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1473
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275