mirror of https://github.com/OISF/suricata
transforms: move hash transforms to rust
md5, sha1 and sha256 Ticket: 7229pull/12094/head
Philippe Antoine
9 months ago
committed by
Victor Julien
parent
71da38e702
commit
0e5b49d20f
@ -0,0 +1,239 @@
|
|||||||
|
/* Copyright (C) 2024 Open Information Security Foundation
|
||||||
|
*
|
||||||
|
* You can copy, redistribute or modify this Program under the terms of
|
||||||
|
* the GNU General Public License version 2 as published by the Free
|
||||||
|
* Software Foundation.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* version 2 along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
* 02110-1301, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
use super::{
|
||||||
|
DetectHelperTransformRegister, DetectSignatureAddTransform, InspectionBufferCheckAndExpand,
|
||||||
|
InspectionBufferLength, InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
|
||||||
|
};
|
||||||
|
use crate::detect::SIGMATCH_NOOPT;
|
||||||
|
use crate::ffi::hashing::{G_DISABLE_HASHING, SC_SHA1_LEN, SC_SHA256_LEN};
|
||||||
|
use digest::{Digest, Update};
|
||||||
|
use md5::Md5;
|
||||||
|
use sha1::Sha1;
|
||||||
|
use sha2::Sha256;
|
||||||
|
|
||||||
|
use std::os::raw::{c_int, c_void};
|
||||||
|
use std::ptr;
|
||||||
|
|
||||||
|
static mut G_TRANSFORM_MD5_ID: c_int = 0;
|
||||||
|
static mut G_TRANSFORM_SHA1_ID: c_int = 0;
|
||||||
|
static mut G_TRANSFORM_SHA256_ID: c_int = 0;
|
||||||
|
|
||||||
|
const SC_MD5_LEN: usize = 16;
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
unsafe extern "C" fn md5_setup(
|
||||||
|
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||||
|
) -> c_int {
|
||||||
|
if unsafe { G_DISABLE_HASHING } {
|
||||||
|
SCLogError!("MD5 hashing has been disabled, needed for to_md5 keyword");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
return DetectSignatureAddTransform(s, G_TRANSFORM_MD5_ID, ptr::null_mut());
|
||||||
|
}
|
||||||
|
|
||||||
|
fn md5_transform_do(input: &[u8], output: &mut [u8]) {
|
||||||
|
Md5::new().chain(input).finalize_into(output.into());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
unsafe extern "C" fn md5_transform(buffer: *mut c_void, _ctx: *mut c_void) {
|
||||||
|
let input = InspectionBufferPtr(buffer);
|
||||||
|
let input_len = InspectionBufferLength(buffer);
|
||||||
|
if input.is_null() || input_len == 0 {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let input = build_slice!(input, input_len as usize);
|
||||||
|
|
||||||
|
let output = InspectionBufferCheckAndExpand(buffer, SC_MD5_LEN as u32);
|
||||||
|
if output.is_null() {
|
||||||
|
// allocation failure
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let output = std::slice::from_raw_parts_mut(output, SC_MD5_LEN);
|
||||||
|
|
||||||
|
md5_transform_do(input, output);
|
||||||
|
|
||||||
|
InspectionBufferTruncate(buffer, SC_MD5_LEN as u32);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub unsafe extern "C" fn DetectTransformMd5Register() {
|
||||||
|
let kw = SCTransformTableElmt {
|
||||||
|
name: b"to_md5\0".as_ptr() as *const libc::c_char,
|
||||||
|
desc: b"convert to md5 hash of the buffer\0".as_ptr() as *const libc::c_char,
|
||||||
|
url: b"/rules/transforms.html#to-md5\0".as_ptr() as *const libc::c_char,
|
||||||
|
Setup: md5_setup,
|
||||||
|
flags: SIGMATCH_NOOPT,
|
||||||
|
Transform: md5_transform,
|
||||||
|
Free: None,
|
||||||
|
TransformValidate: None,
|
||||||
|
};
|
||||||
|
unsafe {
|
||||||
|
G_TRANSFORM_MD5_ID = DetectHelperTransformRegister(&kw);
|
||||||
|
if G_TRANSFORM_MD5_ID < 0 {
|
||||||
|
SCLogWarning!("Failed registering transform md5");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
unsafe extern "C" fn sha1_setup(
|
||||||
|
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||||
|
) -> c_int {
|
||||||
|
if unsafe { G_DISABLE_HASHING } {
|
||||||
|
SCLogError!("SHA1 hashing has been disabled, needed for to_sha1 keyword");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
return DetectSignatureAddTransform(s, G_TRANSFORM_SHA1_ID, ptr::null_mut());
|
||||||
|
}
|
||||||
|
|
||||||
|
fn sha1_transform_do(input: &[u8], output: &mut [u8]) {
|
||||||
|
Sha1::new().chain(input).finalize_into(output.into());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
unsafe extern "C" fn sha1_transform(buffer: *mut c_void, _ctx: *mut c_void) {
|
||||||
|
let input = InspectionBufferPtr(buffer);
|
||||||
|
let input_len = InspectionBufferLength(buffer);
|
||||||
|
if input.is_null() || input_len == 0 {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let input = build_slice!(input, input_len as usize);
|
||||||
|
|
||||||
|
let output = InspectionBufferCheckAndExpand(buffer, SC_SHA1_LEN as u32);
|
||||||
|
if output.is_null() {
|
||||||
|
// allocation failure
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let output = std::slice::from_raw_parts_mut(output, SC_SHA1_LEN);
|
||||||
|
|
||||||
|
sha1_transform_do(input, output);
|
||||||
|
|
||||||
|
InspectionBufferTruncate(buffer, SC_SHA1_LEN as u32);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub unsafe extern "C" fn DetectTransformSha1Register() {
|
||||||
|
let kw = SCTransformTableElmt {
|
||||||
|
name: b"to_sha1\0".as_ptr() as *const libc::c_char,
|
||||||
|
desc: b"convert to sha1 hash of the buffer\0".as_ptr() as *const libc::c_char,
|
||||||
|
url: b"/rules/transforms.html#to-sha1\0".as_ptr() as *const libc::c_char,
|
||||||
|
Setup: sha1_setup,
|
||||||
|
flags: SIGMATCH_NOOPT,
|
||||||
|
Transform: sha1_transform,
|
||||||
|
Free: None,
|
||||||
|
TransformValidate: None,
|
||||||
|
};
|
||||||
|
unsafe {
|
||||||
|
G_TRANSFORM_SHA1_ID = DetectHelperTransformRegister(&kw);
|
||||||
|
if G_TRANSFORM_SHA1_ID < 0 {
|
||||||
|
SCLogWarning!("Failed registering transform sha1");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
unsafe extern "C" fn sha256_setup(
|
||||||
|
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||||
|
) -> c_int {
|
||||||
|
if unsafe { G_DISABLE_HASHING } {
|
||||||
|
SCLogError!("SHA256 hashing has been disabled, needed for to_sha256 keyword");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
return DetectSignatureAddTransform(s, G_TRANSFORM_SHA256_ID, ptr::null_mut());
|
||||||
|
}
|
||||||
|
|
||||||
|
fn sha256_transform_do(input: &[u8], output: &mut [u8]) {
|
||||||
|
Sha256::new().chain(input).finalize_into(output.into());
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
unsafe extern "C" fn sha256_transform(buffer: *mut c_void, _ctx: *mut c_void) {
|
||||||
|
let input = InspectionBufferPtr(buffer);
|
||||||
|
let input_len = InspectionBufferLength(buffer);
|
||||||
|
if input.is_null() || input_len == 0 {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let input = build_slice!(input, input_len as usize);
|
||||||
|
|
||||||
|
let output = InspectionBufferCheckAndExpand(buffer, SC_SHA256_LEN as u32);
|
||||||
|
if output.is_null() {
|
||||||
|
// allocation failure
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let output = std::slice::from_raw_parts_mut(output, SC_SHA256_LEN);
|
||||||
|
|
||||||
|
sha256_transform_do(input, output);
|
||||||
|
|
||||||
|
InspectionBufferTruncate(buffer, SC_SHA256_LEN as u32);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub unsafe extern "C" fn DetectTransformSha256Register() {
|
||||||
|
let kw = SCTransformTableElmt {
|
||||||
|
name: b"to_sha256\0".as_ptr() as *const libc::c_char,
|
||||||
|
desc: b"convert to sha256 hash of the buffer\0".as_ptr() as *const libc::c_char,
|
||||||
|
url: b"/rules/transforms.html#to-sha256\0".as_ptr() as *const libc::c_char,
|
||||||
|
Setup: sha256_setup,
|
||||||
|
flags: SIGMATCH_NOOPT,
|
||||||
|
Transform: sha256_transform,
|
||||||
|
Free: None,
|
||||||
|
TransformValidate: None,
|
||||||
|
};
|
||||||
|
unsafe {
|
||||||
|
G_TRANSFORM_SHA256_ID = DetectHelperTransformRegister(&kw);
|
||||||
|
if G_TRANSFORM_SHA256_ID < 0 {
|
||||||
|
SCLogWarning!("Failed registering transform sha256");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[cfg(test)]
|
||||||
|
mod tests {
|
||||||
|
use super::*;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_md5_transform() {
|
||||||
|
let buf = b" A B C D ";
|
||||||
|
let mut out = vec![0; SC_MD5_LEN];
|
||||||
|
md5_transform_do(buf, &mut out);
|
||||||
|
assert_eq!(
|
||||||
|
out,
|
||||||
|
b"\xe0\x59\xf8\x30\x43\x69\x58\xb6\x45\x82\x8c\xc2\x33\xc2\x47\x13"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_sha1_transform() {
|
||||||
|
let buf = b" A B C D ";
|
||||||
|
let mut out = vec![0; SC_SHA1_LEN];
|
||||||
|
sha1_transform_do(buf, &mut out);
|
||||||
|
assert_eq!(
|
||||||
|
out,
|
||||||
|
b"\xc8\xdc\x44\x97\xf7\xe0\x55\xf8\x6b\x88\x90\x52\x08\x2c\x0c\x7b\xdc\xc9\xc8\x89"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_sha256_transform() {
|
||||||
|
let buf = b" A B C D ";
|
||||||
|
let mut out = vec![0; SC_SHA256_LEN];
|
||||||
|
sha256_transform_do(buf, &mut out);
|
||||||
|
assert_eq!(out, b"\xd6\xbf\x7d\x8d\x69\x53\x02\x4d\x0d\x84\x5c\x99\x9b\xae\x93\xcc\xac\x68\xea\xab\x9a\xc9\x77\xd0\xfd\x30\x6a\xf5\x9a\x3d\xe4\x3a");
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -1,115 +0,0 @@
|
|||||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Victor Julien <victor@inliniac.net>
|
|
||||||
*
|
|
||||||
* Implements the to_md5 transformation keyword
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "suricata-common.h"
|
|
||||||
|
|
||||||
#include "detect.h"
|
|
||||||
#include "detect-engine.h"
|
|
||||||
#include "detect-engine-prefilter.h"
|
|
||||||
#include "detect-parse.h"
|
|
||||||
#include "detect-transform-md5.h"
|
|
||||||
|
|
||||||
#include "util-unittest.h"
|
|
||||||
#include "util-print.h"
|
|
||||||
#include "rust.h"
|
|
||||||
|
|
||||||
static int DetectTransformToMd5Setup (DetectEngineCtx *, Signature *, const char *);
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static void DetectTransformToMd5RegisterTests(void);
|
|
||||||
#endif
|
|
||||||
static void TransformToMd5(InspectionBuffer *buffer, void *options);
|
|
||||||
|
|
||||||
void DetectTransformMd5Register(void)
|
|
||||||
{
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].name = "to_md5";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].desc =
|
|
||||||
"convert to md5 hash of the buffer";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].url =
|
|
||||||
"/rules/transforms.html#to-md5";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].Setup =
|
|
||||||
DetectTransformToMd5Setup;
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].Transform =
|
|
||||||
TransformToMd5;
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].RegisterTests =
|
|
||||||
DetectTransformToMd5RegisterTests;
|
|
||||||
#endif
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_MD5].flags |= SIGMATCH_NOOPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \internal
|
|
||||||
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent
|
|
||||||
* \param det_ctx detection engine ctx
|
|
||||||
* \param s signature
|
|
||||||
* \param nullstr should be null
|
|
||||||
* \retval 0 ok
|
|
||||||
* \retval -1 failure
|
|
||||||
*/
|
|
||||||
static int DetectTransformToMd5Setup (DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
|
|
||||||
{
|
|
||||||
SCEnter();
|
|
||||||
if (g_disable_hashing) {
|
|
||||||
SCLogError("MD5 hashing has been disabled, "
|
|
||||||
"needed for to_md5 keyword");
|
|
||||||
SCReturnInt(-1);
|
|
||||||
}
|
|
||||||
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_MD5, NULL);
|
|
||||||
SCReturnInt(r);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void TransformToMd5(InspectionBuffer *buffer, void *options)
|
|
||||||
{
|
|
||||||
const uint8_t *input = buffer->inspect;
|
|
||||||
const uint32_t input_len = buffer->inspect_len;
|
|
||||||
uint8_t output[SC_MD5_LEN];
|
|
||||||
|
|
||||||
//PrintRawDataFp(stdout, input, input_len);
|
|
||||||
SCMd5HashBuffer(input, input_len, output, sizeof(output));
|
|
||||||
InspectionBufferCopy(buffer, output, sizeof(output));
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static int DetectTransformToMd5Test01(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)" A B C D ";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, 8);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformToMd5(&buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void DetectTransformToMd5RegisterTests(void)
|
|
||||||
{
|
|
||||||
UtRegisterTest("DetectTransformToMd5Test01",
|
|
||||||
DetectTransformToMd5Test01);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
@ -1,30 +0,0 @@
|
|||||||
/* Copyright (C) 2017 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Victor Julien <victor@inliniac.net>
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef SURICATA_DETECT_TRANSFORM_MD5_H
|
|
||||||
#define SURICATA_DETECT_TRANSFORM_MD5_H
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
void DetectTransformMd5Register (void);
|
|
||||||
|
|
||||||
#endif /* SURICATA_DETECT_TRANSFORM_MD5_H */
|
|
||||||
@ -1,116 +0,0 @@
|
|||||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Victor Julien <victor@inliniac.net>
|
|
||||||
*
|
|
||||||
* Implements the sha1 transformation keyword
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "suricata-common.h"
|
|
||||||
|
|
||||||
#include "detect.h"
|
|
||||||
#include "detect-engine.h"
|
|
||||||
#include "detect-engine-prefilter.h"
|
|
||||||
#include "detect-parse.h"
|
|
||||||
#include "detect-transform-sha1.h"
|
|
||||||
|
|
||||||
#include "util-unittest.h"
|
|
||||||
#include "util-print.h"
|
|
||||||
|
|
||||||
#include "rust.h"
|
|
||||||
|
|
||||||
static int DetectTransformToSha1Setup (DetectEngineCtx *, Signature *, const char *);
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static void DetectTransformToSha1RegisterTests(void);
|
|
||||||
#endif
|
|
||||||
static void TransformToSha1(InspectionBuffer *buffer, void *options);
|
|
||||||
|
|
||||||
void DetectTransformSha1Register(void)
|
|
||||||
{
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].name = "to_sha1";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].desc =
|
|
||||||
"convert to sha1 hash of the buffer";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].url =
|
|
||||||
"/rules/transforms.html#to-sha1";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].Setup =
|
|
||||||
DetectTransformToSha1Setup;
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].Transform =
|
|
||||||
TransformToSha1;
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].RegisterTests =
|
|
||||||
DetectTransformToSha1RegisterTests;
|
|
||||||
#endif
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA1].flags |= SIGMATCH_NOOPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \internal
|
|
||||||
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent
|
|
||||||
* \param det_ctx detection engine ctx
|
|
||||||
* \param s signature
|
|
||||||
* \param nullstr should be null
|
|
||||||
* \retval 0 ok
|
|
||||||
* \retval -1 failure
|
|
||||||
*/
|
|
||||||
static int DetectTransformToSha1Setup (DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
|
|
||||||
{
|
|
||||||
SCEnter();
|
|
||||||
if (g_disable_hashing) {
|
|
||||||
SCLogError("SHA1 hashing has been disabled, "
|
|
||||||
"needed for to_sha1 keyword");
|
|
||||||
SCReturnInt(-1);
|
|
||||||
}
|
|
||||||
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_SHA1, NULL);
|
|
||||||
SCReturnInt(r);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void TransformToSha1(InspectionBuffer *buffer, void *options)
|
|
||||||
{
|
|
||||||
const uint8_t *input = buffer->inspect;
|
|
||||||
const uint32_t input_len = buffer->inspect_len;
|
|
||||||
uint8_t output[SC_SHA1_LEN];
|
|
||||||
|
|
||||||
//PrintRawDataFp(stdout, input, input_len);
|
|
||||||
SCSha1HashBuffer(input, input_len, output, sizeof(output));
|
|
||||||
InspectionBufferCopy(buffer, output, sizeof(output));
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static int DetectTransformToSha1Test01(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)" A B C D ";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, 8);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformToSha1(&buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void DetectTransformToSha1RegisterTests(void)
|
|
||||||
{
|
|
||||||
UtRegisterTest("DetectTransformToSha1Test01",
|
|
||||||
DetectTransformToSha1Test01);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
@ -1,30 +0,0 @@
|
|||||||
/* Copyright (C) 2017 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Victor Julien <victor@inliniac.net>
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef SURICATA_DETECT_TRANSFORM_SHA1_H
|
|
||||||
#define SURICATA_DETECT_TRANSFORM_SHA1_H
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
void DetectTransformSha1Register (void);
|
|
||||||
|
|
||||||
#endif /* SURICATA_DETECT_TRANSFORM_SHA1_H */
|
|
||||||
@ -1,116 +0,0 @@
|
|||||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Victor Julien <victor@inliniac.net>
|
|
||||||
*
|
|
||||||
* Implements the nocase keyword
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "suricata-common.h"
|
|
||||||
|
|
||||||
#include "detect.h"
|
|
||||||
#include "detect-engine.h"
|
|
||||||
#include "detect-engine-prefilter.h"
|
|
||||||
#include "detect-parse.h"
|
|
||||||
#include "detect-transform-sha256.h"
|
|
||||||
|
|
||||||
#include "util-unittest.h"
|
|
||||||
#include "util-print.h"
|
|
||||||
|
|
||||||
#include "rust.h"
|
|
||||||
|
|
||||||
static int DetectTransformToSha256Setup (DetectEngineCtx *, Signature *, const char *);
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static void DetectTransformToSha256RegisterTests(void);
|
|
||||||
#endif
|
|
||||||
static void TransformToSha256(InspectionBuffer *buffer, void *options);
|
|
||||||
|
|
||||||
void DetectTransformSha256Register(void)
|
|
||||||
{
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].name = "to_sha256";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].desc =
|
|
||||||
"convert to sha256 hash of the buffer";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].url =
|
|
||||||
"/rules/transforms.html#to-sha256";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].Setup =
|
|
||||||
DetectTransformToSha256Setup;
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].Transform =
|
|
||||||
TransformToSha256;
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].RegisterTests =
|
|
||||||
DetectTransformToSha256RegisterTests;
|
|
||||||
#endif
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_SHA256].flags |= SIGMATCH_NOOPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \internal
|
|
||||||
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent
|
|
||||||
* \param det_ctx detection engine ctx
|
|
||||||
* \param s signature
|
|
||||||
* \param nullstr should be null
|
|
||||||
* \retval 0 ok
|
|
||||||
* \retval -1 failure
|
|
||||||
*/
|
|
||||||
static int DetectTransformToSha256Setup (DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
|
|
||||||
{
|
|
||||||
SCEnter();
|
|
||||||
if (g_disable_hashing) {
|
|
||||||
SCLogError("SHA256 hashing has been disabled, "
|
|
||||||
"needed for to_sha256 keyword");
|
|
||||||
SCReturnInt(-1);
|
|
||||||
}
|
|
||||||
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_SHA256, NULL);
|
|
||||||
SCReturnInt(r);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void TransformToSha256(InspectionBuffer *buffer, void *options)
|
|
||||||
{
|
|
||||||
const uint8_t *input = buffer->inspect;
|
|
||||||
const uint32_t input_len = buffer->inspect_len;
|
|
||||||
uint8_t output[SC_SHA256_LEN];
|
|
||||||
|
|
||||||
//PrintRawDataFp(stdout, input, input_len);
|
|
||||||
SCSha256HashBuffer(input, input_len, output, sizeof(output));
|
|
||||||
InspectionBufferCopy(buffer, output, sizeof(output));
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static int DetectTransformToSha256Test01(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)" A B C D ";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, 8);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformToSha256(&buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void DetectTransformToSha256RegisterTests(void)
|
|
||||||
{
|
|
||||||
UtRegisterTest("DetectTransformToSha256Test01",
|
|
||||||
DetectTransformToSha256Test01);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
@ -1,30 +0,0 @@
|
|||||||
/* Copyright (C) 2017 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Victor Julien <victor@inliniac.net>
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef SURICATA_DETECT_TRANSFORM_SHA256_H
|
|
||||||
#define SURICATA_DETECT_TRANSFORM_SHA256_H
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
void DetectTransformSha256Register (void);
|
|
||||||
|
|
||||||
#endif /* SURICATA_DETECT_TRANSFORM_SHA256_H */
|
|
||||||
Loading…
Reference in New Issue