From 2e1003a0268e4250ffe0cba550d08ed973ed13ed Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 24 Jun 2026 20:50:46 +0200 Subject: [PATCH] detect: add debug validation checks Check that sub state handling is correct. --- src/detect-engine-helper.c | 10 ++++++++++ src/detect-engine-mpm.c | 2 ++ src/detect-engine-prefilter.c | 3 +++ src/detect-engine.c | 7 +++++++ 4 files changed, 22 insertions(+) diff --git a/src/detect-engine-helper.c b/src/detect-engine-helper.c index edd8b45069..feac8402ad 100644 --- a/src/detect-engine-helper.c +++ b/src/detect-engine-helper.c @@ -30,10 +30,13 @@ #include "detect-parse.h" #include "detect-engine-content-inspection.h" #include "rust.h" +#include "app-layer-parser.h" +#include "util-validate.h" int SCDetectHelperBufferProgressRegister( const char *name, AppProto alproto, uint8_t direction, uint8_t progress) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto)); if (direction & STREAM_TOSERVER) { DetectAppLayerInspectEngineRegister( name, alproto, SIG_FLAG_TOSERVER, progress, DetectEngineInspectGenericList, NULL); @@ -48,6 +51,7 @@ int SCDetectHelperBufferProgressRegister( int SCDetectHelperBufferProgressRegisterSubState( const char *name, AppProto alproto, uint8_t direction, uint8_t sub_state, uint8_t progress) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0); if (direction & STREAM_TOSERVER) { DetectAppLayerInspectEngineRegisterSubState(name, alproto, SIG_FLAG_TOSERVER, sub_state, (uint8_t)progress, DetectEngineInspectGenericList, NULL); @@ -62,6 +66,7 @@ int SCDetectHelperBufferProgressRegisterSubState( int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto)); if (direction & STREAM_TOSERVER) { DetectAppLayerInspectEngineRegisterSingle( name, alproto, SIG_FLAG_TOSERVER, 0, DetectEngineInspectBufferSingle, GetData); @@ -81,6 +86,7 @@ int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto int SCDetectRegisterMpmGeneric(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionBufferGetDataPtr GetData, uint8_t progress) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto)); if (direction & STREAM_TOSERVER) { DetectAppLayerInspectEngineRegister(name, alproto, SIG_FLAG_TOSERVER, progress, DetectEngineInspectBufferGeneric, GetData); @@ -100,6 +106,7 @@ int SCDetectRegisterMpmGeneric(const char *name, const char *desc, AppProto alpr int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData, uint8_t progress) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto)); if (direction & STREAM_TOSERVER) { DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOSERVER, progress, DetectEngineInspectBufferSingle, GetData); @@ -120,6 +127,7 @@ int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *d AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, uint8_t progress) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto)); if (direction & STREAM_TOSERVER) { DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2); } @@ -135,6 +143,7 @@ int SCDetectHelperMultiBufferProgressMpmRegisterSubState(const char *name, const AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, uint8_t sub_state, uint8_t progress) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0); if (direction & STREAM_TOSERVER) { DetectAppLayerMultiRegisterSubState( name, alproto, SIG_FLAG_TOSERVER, sub_state, progress, GetData, 2); @@ -151,6 +160,7 @@ int SCDetectHelperMultiBufferProgressMpmRegisterSubState(const char *name, const int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto)); return SCDetectHelperMultiBufferProgressMpmRegister(name, desc, alproto, direction, GetData, 0); } diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 7524b6f0fd..1aae1b56a0 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -101,6 +101,8 @@ static void RegisterInternal(const char *name, int direction, int priority, return; } SCLogDebug("%s is enabled", AppProtoToString(alproto)); + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0); + DEBUG_VALIDATE_BUG_ON(!AppLayerParserSupportsSubStates(alproto) && sub_state != 0); BUG_ON(tx_min_progress >= 48); diff --git a/src/detect-engine-prefilter.c b/src/detect-engine-prefilter.c index ab64fc19cd..448172c045 100644 --- a/src/detect-engine-prefilter.c +++ b/src/detect-engine-prefilter.c @@ -126,6 +126,7 @@ void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, } if (engine->ctx.app.tx_min_progress != -1) { + DEBUG_VALIDATE_BUG_ON(engine->alproto == ALPROTO_UNKNOWN); #ifdef DEBUG const char *pname = AppLayerParserGetStateNameById(ipproto, engine->alproto, engine->ctx.app.tx_min_progress, @@ -177,6 +178,7 @@ void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, engine->is_last_for_progress, tx->detect_progress); } } else { + DEBUG_VALIDATE_BUG_ON(engine->alproto != ALPROTO_UNKNOWN); PREFILTER_PROFILING_START(det_ctx); engine->cb.PrefilterTx(det_ctx, engine->pectx, p, p->flow, tx_ptr, tx->tx_id, tx->tx_data_ptr, flow_flags); @@ -367,6 +369,7 @@ int PrefilterAppendTxEngineSubState(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, uint8_t sub_state, const int8_t tx_min_progress, void *pectx, void (*FreeFunc)(void *pectx), const char *name) { + BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0); if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL) return -1; diff --git a/src/detect-engine.c b/src/detect-engine.c index e3320894e6..282814b3f9 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -202,6 +202,11 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp InspectionBufferGetDataPtr GetData, InspectionSingleBufferGetDataPtr GetDataSingle, InspectionMultiBufferGetDataPtr GetMultiData) { + /* ignore special case unknown */ + if (alproto != ALPROTO_UNKNOWN && AppLayerParserIsEnabled(alproto)) { + DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0); + DEBUG_VALIDATE_BUG_ON(!AppLayerParserSupportsSubStates(alproto) && sub_state != 0); + } BUG_ON(progress >= 48); DetectBufferTypeRegister(name); @@ -2232,6 +2237,7 @@ uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineTh void DetectAppLayerMultiRegisterSubState(const char *name, AppProto alproto, uint32_t dir, uint8_t sub_state, uint8_t progress, InspectionMultiBufferGetDataPtr GetData, int priority) { + BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0); AppLayerInspectEngineRegisterInternal(name, alproto, dir, sub_state, progress, DetectEngineInspectMultiBufferGeneric, NULL, NULL, GetData); DetectAppLayerMpmMultiRegisterSubState(name, dir, priority, PrefilterMultiGenericMpmRegister, @@ -2243,6 +2249,7 @@ void DetectAppLayerMultiRegisterSubState(const char *name, AppProto alproto, uin void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, uint8_t progress, InspectionMultiBufferGetDataPtr GetData, int priority) { + BUG_ON(AppLayerParserSupportsSubStates(alproto)); AppLayerInspectEngineRegisterInternal(name, alproto, dir, 0, (uint8_t)progress, DetectEngineInspectMultiBufferGeneric, NULL, NULL, GetData); DetectAppLayerMpmMultiRegister(