aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/firewall: add default alert signature to policy object

Browse Source 
Now that there is a policy hash, make the alert signature object a
member of that to avoid another hash table lookup.
pull/15846/head
Victor Julien 4 months ago
parent bffea309db
commit 3b6b381f90
5 changed files with 21 additions and 82 deletions
Show Stats Download Patch File Download Diff File

1
src/detect-engine.c
Unescape Escape View File

@ -2919,7 +2919,6 @@ void DetectEngineCtxFree(DetectEngineCtx *de_ctx)
SCFree(de_ctx->fw_policies->pkt_policy_signatures[i]);
}
}
HashTableFree(de_ctx->fw_policies->policy_signatures);
HashTableFree(de_ctx->fw_policies->app_policies);
}
SCFree(de_ctx->fw_policies);

82
src/detect-parse.c
Unescape Escape View File

@ -3970,36 +3970,13 @@ static char AppPolicyCompareFunc(void *data1, uint16_t datalen1, void *data2, ui
static void AppPolicyHashFree(void *data)
{
struct DetectFirewallAppPolicy *p = data;
Signature *s = p->alert_signature;
if (s != NULL) {
SCFree(s->msg);
SCFree(s);
}
SCFree(p);
}
static uint32_t PolicySignatureHashFunc(HashTable *ht, void *data, uint16_t datalen)
{
const Signature *s = data;
const int dir = 1 + (s->flags & SIG_FLAG_TOSERVER) != 0; // 2 for ts, 1 for tc
uint32_t hash = s->alproto * s->app_progress_hook * dir;
hash = hash % ht->array_size;
return hash;
}
static char PolicySignatureCompareFunc(
void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
{
const Signature *s1 = data1;
const Signature *s2 = data2;
if (s1 == NULL || s2 == NULL)
return 0;
return s1->flags == s2->flags && s1->alproto == s2->alproto &&
s1->app_progress_hook == s2->app_progress_hook;
}
static void PolicySignatureHashFree(void *data)
{
Signature *s = data;
SCFree(s->msg);
SCFree(s);
}
const char *ActionScopeToString(enum ActionScope s)
{
@ -4090,9 +4067,7 @@ static int AddPktPolicySignature(struct DetectFirewallPolicies *fw_policies,
return 0;
}
static int AddAppPolicySignature(HashTable *ht, const int direction, const AppProto alproto,
const char *app_name, const uint8_t hook, const char *hookname,
struct DetectFirewallPolicy *pol)
static int AddAppPolicySignature(struct DetectFirewallAppPolicy *pol)
{
Signature *s = SCCalloc(1, sizeof(*s)); // SigAlloc does way more than we need
if (s == NULL)
@ -4104,11 +4079,11 @@ static int AddAppPolicySignature(HashTable *ht, const int direction, const AppPr
SCFree(s);
return -1;
}
s->app_progress_hook = hook;
s->action = pol->action;
s->action_scope = pol->action_scope;
s->alproto = alproto;
s->flags = (direction == STREAM_TOSERVER) ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
s->app_progress_hook = pol->progress;
s->action = pol->policy.action;
s->action_scope = pol->policy.action_scope;
s->alproto = pol->alproto;
s->flags = (pol->direction == STREAM_TOSERVER) ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
s->flags |= SIG_FLAG_FIREWALL;
s->type = SIG_TYPE_APP_TX;
s->detect_table = DETECT_TABLE_APP_FILTER;
@ -4117,11 +4092,7 @@ static int AddAppPolicySignature(HashTable *ht, const int direction, const AppPr
s->gid = 1;
s->prio = 3;
if (HashTableAdd(ht, s, 0) != 0) {
SCFree(s->msg);
SCFree(s);
return -1;
}
pol->alert_signature = s;
SCLogDebug("added to hash");
return 0;
}
@ -4200,8 +4171,7 @@ static int DoParseAppSubStatePolicy(const char *prefix, const AppProto app_proto
/* for policies with an alert action, create a policy sig */
if (r == 1 && app_pol->policy.action & ACTION_ALERT) {
SCLogDebug("adding policy signature");
return AddAppPolicySignature(fw_policies->policy_signatures, direction, app_proto, app_name,
state, hookname, &app_pol->policy);
return AddAppPolicySignature(app_pol);
}
SCLogDebug("r %d", r);
return r;
@ -4290,8 +4260,7 @@ static int DoParseAppPolicy(const char *prefix, const AppProto app_proto, const
/* for policies with an alert action, create a policy sig */
if (r == 1 && app_pol->policy.action & ACTION_ALERT) {
SCLogDebug("adding policy signature");
return AddAppPolicySignature(fw_policies->policy_signatures, direction, app_proto, app_name,
state, hookname, &app_pol->policy);
return AddAppPolicySignature(app_pol);
}
return r;
@ -4303,16 +4272,9 @@ int DetectFirewallInitDefaultPolicies(DetectEngineCtx *de_ctx)
struct DetectFirewallPolicies *fw_policies = SCCalloc(1, sizeof(*fw_policies));
if (fw_policies == NULL)
return -1;
fw_policies->policy_signatures = HashTableInit(
512, PolicySignatureHashFunc, PolicySignatureCompareFunc, PolicySignatureHashFree);
if (fw_policies->policy_signatures == NULL) {
SCFree(fw_policies);
return -1;
}
fw_policies->app_policies =
HashTableInit(512, AppPolicyHashFunc, AppPolicyCompareFunc, AppPolicyHashFree);
if (fw_policies->app_policies == NULL) {
HashTableFree(fw_policies->policy_signatures);
SCFree(fw_policies);
return -1;
}
@ -4450,22 +4412,6 @@ int DetectFirewallLoadDefaultPolicies(DetectEngineCtx *de_ctx)
return 0;
}
Signature *DetectFirewallGetPolicySignature(struct DetectFirewallPolicies *fw_policies,
const AppProto alproto, const int direction, const uint8_t hook)
{
if (fw_policies != NULL && fw_policies->policy_signatures != NULL) {
Signature lookup;
lookup.alproto = alproto;
lookup.flags = SIG_FLAG_FIREWALL |
(direction == STREAM_TOSERVER ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT);
lookup.app_progress_hook = hook;
Signature *s = HashTableLookup(fw_policies->policy_signatures, &lookup, 0);
return s;
}
return NULL;
}
/*
* TESTS
*/

2
src/detect-parse.h
Unescape Escape View File

@ -122,7 +122,5 @@ struct DetectFirewallPolicy;
void DetectFirewallPolicyToString(const struct DetectFirewallPolicy *p, char *out, size_t out_size);
int DetectFirewallInitDefaultPolicies(DetectEngineCtx *);
int DetectFirewallLoadDefaultPolicies(DetectEngineCtx *);
Signature *DetectFirewallGetPolicySignature(struct DetectFirewallPolicies *fw_policies,
const AppProto alproto, const int direction, const uint8_t hook);
#endif /* SURICATA_DETECT_PARSE_H */

12
src/detect.c
Unescape Escape View File

@ -1719,12 +1719,10 @@ struct DetectFirewallAppTxState {
};
static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *det_ctx, Packet *p,
const bool apply_to_packet, const int direction, const uint64_t tx_id,
const AppProto alproto, const uint8_t hook)
const bool apply_to_packet, const uint64_t tx_id, const struct DetectFirewallAppPolicy *ap)
{
if (EngineModeIsFirewall()) {
Signature *s = DetectFirewallGetPolicySignature(
det_ctx->de_ctx->fw_policies, alproto, direction, hook);
const Signature *s = ap->alert_signature;
BUG_ON(s == NULL);
uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
AlertQueueAppendAppTx(det_ctx, s, p, tx_id, alert_flags);
@ -1765,8 +1763,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
}
if (policy->action & ACTION_ALERT) {
DetectRunAppendDefaultAppPolicyAlert(
det_ctx, p, true, direction, tx->tx_id, alproto, progress);
DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx->tx_id, ap);
}
} else if (policy->action & ACTION_ACCEPT) {
/* should the accept be applied to the packet?
@ -1799,8 +1796,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
if (policy->action & ACTION_ALERT) {
SCLogDebug("policy alert, do the append");
DetectRunAppendDefaultAppPolicyAlert(
det_ctx, p, apply_to_packet, direction, tx->tx_id, alproto, progress);
DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx->tx_id, ap);
} else if (apply_to_packet) {
SCLogDebug("default accept: last_tx");
DetectRunAppendDefaultAccept(det_ctx, p);

6
src/detect.h
Unescape Escape View File

@ -940,6 +940,9 @@ struct DetectFirewallAppPolicy {
uint8_t progress;
uint8_t direction;
struct DetectFirewallPolicy policy;
/* signature that will be logged if the policy includes "alert". Will
* be set to NULL if alert is not part of the policy. */
Signature *alert_signature;
};
struct DetectFirewallPolicies {
@ -947,9 +950,6 @@ struct DetectFirewallPolicies {
struct DetectFirewallPolicy pkt[DETECT_FIREWALL_POLICY_SIZE];
Signature *pkt_policy_signatures[DETECT_FIREWALL_POLICY_SIZE];
/* hash table with a Signature object per default policy that has `alert` enabled. */
HashTable *policy_signatures;
/* hash table with policies, hashed by alproto, sub_state, progress and direction */
HashTable *app_policies;
};

Write Preview
Loading…
Cancel
Save