diff --git a/scripts/setup-simple-detect2.sh b/scripts/setup-simple-detect2.sh index 3dd62fd12d..7790de0cde 100755 --- a/scripts/setup-simple-detect2.sh +++ b/scripts/setup-simple-detect2.sh @@ -78,18 +78,6 @@ if [ -e $FILE_C ] || [ -e $FILE_H ]; then exit 1 fi -FILE_C="tests/detect-${LC}.c" -if [ ! -e tests/detect-template2.c ]; then - Usage - echo "ERROR: input file tests/detect-template.c is missing" - exit 1 -fi -if [ -e $FILE_C ]; then - Usage - echo "ERROR: file $FILE_C already exist, won't overwrite" - exit 1 -fi - FILE_C="detect-${LC}.c" FILE_H="detect-${LC}.h" cp detect-template2.c $FILE_C @@ -114,14 +102,5 @@ sed -i "s/#include \"detect-template2.h\"/#include \"detect-template2.h\"\\n#inc # add reg func to detect-engine-register.c sed -i "s/DetectTemplate2Register();/DetectTemplate2Register();\\n Detect${NR}Register();/g" detect-engine-register.c -# tests file -FILE_C="tests/detect-${LC}.c" -cp tests/detect-template2.c $FILE_C - -# search and replaces -sed -i "s/TEMPLATE2/${UC}/g" $FILE_C -sed -i "s/Template2/${NR}/g" $FILE_C -sed -i "s/template2/${LC}/g" $FILE_C - Done exit 0 diff --git a/src/Makefile.am b/src/Makefile.am index 34b8bae4c2..325d8a8d85 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1235,7 +1235,6 @@ EXTRA_DIST = \ tests/detect-ssl-state.c \ tests/detect-ssl-version.c \ tests/detect-template-buffer.c \ - tests/detect-template2.c \ tests/detect-tls-cert-fingerprint.c \ tests/detect-tls-cert-issuer.c \ tests/detect-tls-cert-serial.c \ diff --git a/src/detect-template2.c b/src/detect-template2.c index 2b20d31ee9..7b554599a3 100644 --- a/src/detect-template2.c +++ b/src/detect-template2.c @@ -28,15 +28,10 @@ #include "detect.h" #include "detect-parse.h" #include "detect-engine-prefilter-common.h" +#include "detect-engine-uint.h" #include "detect-template2.h" -/** - * \brief Regex for parsing our options - */ -#define PARSE_REGEX "^\\s*([0-9]*)?\\s*([<>=-]+)?\\s*([0-9]+)?\\s*$" - -static DetectParseRegex parse_regex; /* prototypes */ static int DetectTemplate2Match (DetectEngineThreadCtx *, Packet *, @@ -61,38 +56,20 @@ void DetectTemplate2Register(void) sigmatch_table[DETECT_TEMPLATE2].Match = DetectTemplate2Match; sigmatch_table[DETECT_TEMPLATE2].Setup = DetectTemplate2Setup; sigmatch_table[DETECT_TEMPLATE2].Free = DetectTemplate2Free; -#ifdef UNITTESTS - sigmatch_table[DETECT_TEMPLATE2].RegisterTests = DetectTemplate2RegisterTests; -#endif sigmatch_table[DETECT_TEMPLATE2].SupportsPrefilter = PrefilterTemplate2IsPrefilterable; sigmatch_table[DETECT_TEMPLATE2].SetupPrefilter = PrefilterSetupTemplate2; - DetectSetupParseRegexes(PARSE_REGEX, &parse_regex); return; } -static inline int Template2Match(const uint8_t parg, const uint8_t mode, - const uint8_t darg1, const uint8_t darg2) -{ - if (mode == DETECT_TEMPLATE2_EQ && parg == darg1) - return 1; - else if (mode == DETECT_TEMPLATE2_LT && parg < darg1) - return 1; - else if (mode == DETECT_TEMPLATE2_GT && parg > darg1) - return 1; - else if (mode == DETECT_TEMPLATE2_RA && (parg > darg1 && parg < darg2)) - return 1; - - return 0; -} - /** - * \brief This function is used to match TEMPLATE2 rule option on a packet with those passed via template2: + * \brief This function is used to match TEMPLATE2 rule option on a packet with those passed via + * template2: * * \param t pointer to thread vars * \param det_ctx pointer to the pattern matcher thread * \param p pointer to the current packet - * \param m pointer to the sigmatch that we will cast into DetectTemplate2Data + * \param m pointer to the sigmatch that we will cast into DetectU8Data * * \retval 0 no match * \retval 1 match @@ -115,171 +92,8 @@ static int DetectTemplate2Match (DetectEngineThreadCtx *det_ctx, Packet *p, return 0; } - const DetectTemplate2Data *template2d = (const DetectTemplate2Data *)ctx; - return Template2Match(ptemplate2, template2d->mode, template2d->arg1, template2d->arg2); -} - -/** - * \brief This function is used to parse template2 options passed via template2: keyword - * - * \param template2str Pointer to the user provided template2 options - * - * \retval template2d pointer to DetectTemplate2Data on success - * \retval NULL on failure - */ - -static DetectTemplate2Data *DetectTemplate2Parse (const char *template2str) -{ - DetectTemplate2Data *template2d = NULL; - char *arg1 = NULL; - char *arg2 = NULL; - char *arg3 = NULL; - int ret = 0, res = 0; - size_t pcre2_len; - - ret = DetectParsePcreExec(&parse_regex, template2str, 0, 0); - if (ret < 2 || ret > 4) { - SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 "", ret); - goto error; - } - const char *str_ptr; - - res = pcre2_substring_get_bynumber(parse_regex.match, 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre2_substring_get_bynumber failed"); - goto error; - } - arg1 = (char *) str_ptr; - SCLogDebug("Arg1 \"%s\"", arg1); - - if (ret >= 3) { - res = pcre2_substring_get_bynumber( - parse_regex.match, 2, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre2_substring_get_bynumber failed"); - goto error; - } - arg2 = (char *) str_ptr; - SCLogDebug("Arg2 \"%s\"", arg2); - - if (ret >= 4) { - res = pcre2_substring_get_bynumber( - parse_regex.match, 3, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len); - if (res < 0) { - SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre2_substring_get_bynumber failed"); - goto error; - } - arg3 = (char *) str_ptr; - SCLogDebug("Arg3 \"%s\"", arg3); - } - } - - template2d = SCMalloc(sizeof (DetectTemplate2Data)); - if (unlikely(template2d == NULL)) - goto error; - template2d->arg1 = 0; - template2d->arg2 = 0; - - if (arg2 != NULL) { - /*set the values*/ - switch(arg2[0]) { - case '<': - if (arg3 == NULL) - goto error; - - template2d->mode = DETECT_TEMPLATE2_LT; - if (StringParseUint8(&template2d->arg1, 10, 0, (const char *)arg3) < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid first arg:" - " \"%s\"", arg3); - goto error; - } - SCLogDebug("template2 is %"PRIu8"",template2d->arg1); - if (strlen(arg1) > 0) - goto error; - - break; - case '>': - if (arg3 == NULL) - goto error; - - template2d->mode = DETECT_TEMPLATE2_GT; - if (StringParseUint8(&template2d->arg1, 10, 0, (const char *)arg3) < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid first arg:" - " \"%s\"", arg3); - goto error; - } - SCLogDebug("template2 is %"PRIu8"",template2d->arg1); - if (strlen(arg1) > 0) - goto error; - - break; - case '-': - if (arg1 == NULL || strlen(arg1)== 0) - goto error; - if (arg3 == NULL || strlen(arg3)== 0) - goto error; - - template2d->mode = DETECT_TEMPLATE2_RA; - if (StringParseUint8(&template2d->arg1, 10, 0, (const char *)arg1) < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid first arg:" - " \"%s\"", arg1); - goto error; - } - if (StringParseUint8(&template2d->arg2, 10, 0, (const char *)arg3) < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid second arg:" - " \"%s\"", arg3); - goto error; - } - SCLogDebug("template2 is %"PRIu8" to %"PRIu8"",template2d->arg1, template2d->arg2); - if (template2d->arg1 >= template2d->arg2) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid template2 range. "); - goto error; - } - break; - default: - template2d->mode = DETECT_TEMPLATE2_EQ; - - if ((arg2 != NULL && strlen(arg2) > 0) || - (arg3 != NULL && strlen(arg3) > 0) || - (arg1 == NULL ||strlen(arg1) == 0)) - goto error; - - if (StringParseUint8(&template2d->arg1, 10, 0, (const char *)arg1) < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid first arg:" - " \"%s\"", arg1); - goto error; - } - break; - } - } else { - template2d->mode = DETECT_TEMPLATE2_EQ; - - if ((arg3 != NULL && strlen(arg3) > 0) || - (arg1 == NULL ||strlen(arg1) == 0)) - goto error; - - if (StringParseUint8(&template2d->arg1, 10, 0, (const char *)arg1) < 0) { - SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid first arg:" - " \"%s\"", arg1); - goto error; - } - } - - pcre2_substring_free((PCRE2_UCHAR8 *)arg1); - pcre2_substring_free((PCRE2_UCHAR8 *)arg2); - pcre2_substring_free((PCRE2_UCHAR8 *)arg3); - return template2d; - -error: - if (template2d) - SCFree(template2d); - if (arg1) - pcre2_substring_free((PCRE2_UCHAR8 *)arg1); - if (arg2) - pcre2_substring_free((PCRE2_UCHAR8 *)arg2); - if (arg3) - pcre2_substring_free((PCRE2_UCHAR8 *)arg3); - return NULL; + const DetectU8Data *template2d = (const DetectU8Data *)ctx; + return DetectU8Match(ptemplate2, template2d); } /** @@ -294,7 +108,7 @@ error: */ static int DetectTemplate2Setup (DetectEngineCtx *de_ctx, Signature *s, const char *template2str) { - DetectTemplate2Data *template2d = DetectTemplate2Parse(template2str); + DetectU8Data *template2d = DetectU8Parse(template2str); if (template2d == NULL) return -1; @@ -314,14 +128,13 @@ static int DetectTemplate2Setup (DetectEngineCtx *de_ctx, Signature *s, const ch } /** - * \brief this function will free memory associated with DetectTemplate2Data + * \brief this function will free memory associated with DetectU8Data * - * \param ptr pointer to DetectTemplate2Data + * \param ptr pointer to DetectU8Data */ void DetectTemplate2Free(DetectEngineCtx *de_ctx, void *ptr) { - DetectTemplate2Data *template2d = (DetectTemplate2Data *)ptr; - SCFree(template2d); + rs_detect_u8_free(ptr); } /* prefilter code */ @@ -350,41 +163,22 @@ PrefilterPacketTemplate2Match(DetectEngineThreadCtx *det_ctx, Packet *p, const v if (!PrefilterPacketHeaderExtraMatch(ctx, p)) return; + DetectU8Data du8; + du8.mode = ctx->v1.u8[0]; + du8.arg1 = ctx->v1.u8[1]; + du8.arg2 = ctx->v1.u8[2]; /* if we match, add all the sigs that use this prefilter. This means * that these will be inspected further */ - if (Template2Match(ptemplate2, ctx->v1.u8[0], ctx->v1.u8[1], ctx->v1.u8[2])) - { + if (DetectU8Match(ptemplate2, &du8)) { SCLogDebug("packet matches template2/hl %u", ptemplate2); PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt); } } -static void -PrefilterPacketTemplate2Set(PrefilterPacketHeaderValue *v, void *smctx) -{ - const DetectTemplate2Data *a = smctx; - v->u8[0] = a->mode; - v->u8[1] = a->arg1; - v->u8[2] = a->arg2; -} - -static bool -PrefilterPacketTemplate2Compare(PrefilterPacketHeaderValue v, void *smctx) -{ - const DetectTemplate2Data *a = smctx; - if (v.u8[0] == a->mode && - v.u8[1] == a->arg1 && - v.u8[2] == a->arg2) - return true; - return false; -} - static int PrefilterSetupTemplate2(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { - return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_TEMPLATE2, - PrefilterPacketTemplate2Set, - PrefilterPacketTemplate2Compare, - PrefilterPacketTemplate2Match); + return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_TEMPLATE2, PrefilterPacketU8Set, + PrefilterPacketU8Compare, PrefilterPacketTemplate2Match); } static bool PrefilterTemplate2IsPrefilterable(const Signature *s) @@ -398,8 +192,3 @@ static bool PrefilterTemplate2IsPrefilterable(const Signature *s) } return false; } - -#ifdef UNITTESTS -#include "tests/detect-template2.c" -#endif - diff --git a/src/detect-template2.h b/src/detect-template2.h index e4f8d20bdb..b7ea8af34a 100644 --- a/src/detect-template2.h +++ b/src/detect-template2.h @@ -24,17 +24,6 @@ #ifndef _DETECT_TEMPLATE2_H #define _DETECT_TEMPLATE2_H -#define DETECT_TEMPLATE2_LT 0 /**< "less than" operator */ -#define DETECT_TEMPLATE2_EQ 1 /**< "equals" operator (default) */ -#define DETECT_TEMPLATE2_GT 2 /**< "greater than" operator */ -#define DETECT_TEMPLATE2_RA 3 /**< "range" operator */ - -typedef struct DetectTemplate2Data_ { - uint8_t arg1; /**< first arg value in the signature*/ - uint8_t arg2; /**< second arg value in the signature, in case of range - operator*/ - uint8_t mode; /**< operator used in the signature */ -} DetectTemplate2Data; void DetectTemplate2Register(void); diff --git a/src/tests/detect-template2.c b/src/tests/detect-template2.c deleted file mode 100644 index 7cf086247b..0000000000 --- a/src/tests/detect-template2.c +++ /dev/null @@ -1,155 +0,0 @@ -/* Copyright (C) 2007-2018 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -#include "../suricata-common.h" - -#include "../detect.h" -#include "../detect-parse.h" -#include "../detect-engine-prefilter-common.h" - -#include "../detect-template2.h" - -#include "../util-unittest.h" - -/** - * \test DetectTemplate2ParseTest01 is a test for setting up an valid template2 value. - */ - -static int DetectTemplate2ParseTest01 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse("10"); - - FAIL_IF_NULL(template2d); - FAIL_IF_NOT(template2d->arg1 == 10); - FAIL_IF_NOT(template2d->mode == DETECT_TEMPLATE2_EQ); - - DetectTemplate2Free(NULL, template2d); - - PASS; -} - -/** - * \test DetectTemplate2ParseTest02 is a test for setting up an valid template2 value with - * "<" operator. - */ - -static int DetectTemplate2ParseTest02 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse("<10"); - - FAIL_IF_NULL(template2d); - FAIL_IF_NOT(template2d->arg1 == 10); - FAIL_IF_NOT(template2d->mode == DETECT_TEMPLATE2_LT); - - DetectTemplate2Free(NULL, template2d); - - PASS; -} - -/** - * \test DetectTemplate2ParseTest03 is a test for setting up an valid template2 values with - * "-" operator. - */ - -static int DetectTemplate2ParseTest03 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse("1-2"); - - FAIL_IF_NULL(template2d); - FAIL_IF_NOT(template2d->arg1 == 1); - FAIL_IF_NOT(template2d->mode == DETECT_TEMPLATE2_RA); - - DetectTemplate2Free(NULL, template2d); - - PASS; -} - -/** - * \test DetectTemplate2ParseTest04 is a test for setting up an valid template2 value with - * ">" operator and include spaces around the given values. - */ - -static int DetectTemplate2ParseTest04 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse(" > 10 "); - - FAIL_IF_NULL(template2d); - FAIL_IF_NOT(template2d->arg1 == 10); - FAIL_IF_NOT(template2d->mode == DETECT_TEMPLATE2_GT); - - DetectTemplate2Free(NULL, template2d); - - PASS; -} - -/** - * \test DetectTemplate2ParseTest05 is a test for setting up an valid template2 values with - * "-" operator and include spaces around the given values. - */ - -static int DetectTemplate2ParseTest05 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse(" 1 - 2 "); - - FAIL_IF_NULL(template2d); - FAIL_IF_NOT(template2d->arg1 == 1); - FAIL_IF_NOT(template2d->arg2 == 2); - FAIL_IF_NOT(template2d->mode == DETECT_TEMPLATE2_RA); - - DetectTemplate2Free(NULL, template2d); - - PASS; -} - -/** - * \test DetectTemplate2ParseTest06 is a test for setting up an valid template2 values with - * invalid "=" operator and include spaces around the given values. - */ - -static int DetectTemplate2ParseTest06 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse(" 1 = 2 "); - FAIL_IF_NOT_NULL(template2d); - PASS; -} - -/** - * \test DetectTemplate2ParseTest07 is a test for setting up an valid template2 values with - * invalid "<>" operator and include spaces around the given values. - */ - -static int DetectTemplate2ParseTest07 (void) -{ - DetectTemplate2Data *template2d = DetectTemplate2Parse(" 1<>2 "); - FAIL_IF_NOT_NULL(template2d); - PASS; -} - -/** - * \brief this function registers unit tests for DetectTemplate2 - */ -void DetectTemplate2RegisterTests(void) -{ - UtRegisterTest("DetectTemplate2ParseTest01", DetectTemplate2ParseTest01); - UtRegisterTest("DetectTemplate2ParseTest02", DetectTemplate2ParseTest02); - UtRegisterTest("DetectTemplate2ParseTest03", DetectTemplate2ParseTest03); - UtRegisterTest("DetectTemplate2ParseTest04", DetectTemplate2ParseTest04); - UtRegisterTest("DetectTemplate2ParseTest05", DetectTemplate2ParseTest05); - UtRegisterTest("DetectTemplate2ParseTest06", DetectTemplate2ParseTest06); - UtRegisterTest("DetectTemplate2ParseTest07", DetectTemplate2ParseTest07); -} -