aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: use buffer ptr in validate callback api

Browse Source 
Ticket: 5634

Allows to share the same validator functions when only the buffer
id is changing like for urilen, while still accessing the buffer
name for error logs
pull/12931/head
Philippe Antoine 9 months ago committed by Victor Julien
parent 4da69a52fe
commit 5ae215605c
19 changed files with 69 additions and 77 deletions
Show Stats Download Patch File Download Diff File

10
src/detect-engine.c
Unescape Escape View File

@ -1332,8 +1332,9 @@ void DetectEngineBufferRunSetupCallback(const DetectEngineCtx *de_ctx, const int
}
}
void DetectBufferTypeRegisterValidateCallback(const char *name,
bool (*ValidateCallback)(const Signature *, const char **sigerror))
void DetectBufferTypeRegisterValidateCallback(
const char *name, bool (*ValidateCallback)(const Signature *, const char **sigerror,
const DetectBufferType *))
{
BUG_ON(g_buffer_type_reg_closed);
DetectBufferTypeRegister(name);
@ -1346,8 +1347,9 @@ bool DetectEngineBufferRunValidateCallback(
const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
{
const DetectBufferType *map = DetectEngineBufferTypeGetById(de_ctx, id);
if (map && map->ValidateCallback) {
return map->ValidateCallback(s, sigerror);
// only run validation if the buffer is not transformed
if (map && map->ValidateCallback && map->transforms.cnt == 0) {
return map->ValidateCallback(s, sigerror, map);
}
return true;
}

5
src/detect-engine.h
Unescape Escape View File

@ -62,8 +62,9 @@ void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc);
const char *DetectBufferTypeGetDescriptionByName(const char *name);
void DetectBufferTypeRegisterSetupCallback(const char *name,
void (*Callback)(const DetectEngineCtx *, Signature *));
void DetectBufferTypeRegisterValidateCallback(const char *name,
bool (*ValidateCallback)(const Signature *, const char **sigerror));
void DetectBufferTypeRegisterValidateCallback(
const char *name, bool (*ValidateCallback)(const Signature *, const char **sigerror,
const DetectBufferType *));
/* detect engine related buffer funcs */

8
src/detect-http-host.c
Unescape Escape View File

@ -62,7 +62,8 @@ static int DetectHttpHHSetup(DetectEngineCtx *, Signature *, const char *);
#ifdef UNITTESTS
static void DetectHttpHHRegisterTests(void);
#endif
static bool DetectHttpHostValidateCallback(const Signature *s, const char **sigerror);
static bool DetectHttpHostValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int DetectHttpHostSetup(DetectEngineCtx *, Signature *, const char *);
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms,
@ -180,10 +181,11 @@ static int DetectHttpHHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *
de_ctx, s, arg, DETECT_HTTP_HOST_CM, g_http_host_buffer_id, ALPROTO_HTTP1);
}
static bool DetectHttpHostValidateCallback(const Signature *s, const char **sigerror)
static bool DetectHttpHostValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_http_host_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

8
src/detect-http-method.c
Unescape Escape View File

@ -65,7 +65,8 @@ static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, co
void DetectHttpMethodRegisterTests(void);
#endif
void DetectHttpMethodFree(void *);
static bool DetectHttpMethodValidateCallback(const Signature *s, const char **sigerror);
static bool DetectHttpMethodValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Flow *_f,
const uint8_t _flow_flags, void *txv, const int list_id);
@ -162,10 +163,11 @@ static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, co
* \retval 1 valid
* \retval 0 invalid
*/
static bool DetectHttpMethodValidateCallback(const Signature *s, const char **sigerror)
static bool DetectHttpMethodValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_http_method_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

5
src/detect-http-protocol.c
Unescape Escape View File

@ -127,11 +127,12 @@ static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
return buffer;
}
static bool DetectHttpProtocolValidateCallback(const Signature *s, const char **sigerror)
static bool DetectHttpProtocolValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
#ifdef HAVE_HTP_CONFIG_SET_ALLOW_SPACE_URI
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

6
src/detect-http-raw-header.c
Unescape Escape View File

@ -58,7 +58,8 @@ static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx *de_ctx, Signature *s,
#ifdef UNITTESTS
static void DetectHttpRawHeaderRegisterTests(void);
#endif
static bool DetectHttpRawHeaderValidateCallback(const Signature *s, const char **sigerror);
static bool DetectHttpRawHeaderValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_http_raw_header_buffer_id = 0;
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Flow *_f,
@ -166,7 +167,8 @@ static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx *de_ctx, Signature *s,
return 0;
}
static bool DetectHttpRawHeaderValidateCallback(const Signature *s, const char **sigerror)
static bool DetectHttpRawHeaderValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
if ((s->flags & (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) {
*sigerror = "http_raw_header signature "

24
src/detect-http-uri.c
Unescape Escape View File

@ -59,9 +59,7 @@
#ifdef UNITTESTS
static void DetectHttpUriRegisterTests(void);
#endif
static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s);
static bool DetectHttpUriValidateCallback(const Signature *s, const char **sigerror);
static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx, Signature *s);
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t _flow_flags,
@ -71,9 +69,7 @@ static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
const int list_id);
static int DetectHttpUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
static int DetectHttpRawUriSetup(DetectEngineCtx *, Signature *, const char *);
static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s);
static bool DetectHttpRawUriValidateCallback(const Signature *s, const char **);
static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx, Signature *s);
static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t _flow_flags,
@ -126,8 +122,7 @@ void DetectHttpUriRegister (void)
DetectBufferTypeRegisterSetupCallback("http_uri",
DetectHttpUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_uri",
DetectHttpUriValidateCallback);
DetectBufferTypeRegisterValidateCallback("http_uri", DetectUrilenValidateContent);
g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri");
@ -165,8 +160,7 @@ void DetectHttpUriRegister (void)
DetectBufferTypeRegisterSetupCallback("http_raw_uri",
DetectHttpRawUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_raw_uri",
DetectHttpRawUriValidateCallback);
DetectBufferTypeRegisterValidateCallback("http_raw_uri", DetectUrilenValidateContent);
g_http_raw_uri_buffer_id = DetectBufferTypeGetByName("http_raw_uri");
}
@ -188,11 +182,6 @@ int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
de_ctx, s, str, DETECT_HTTP_URI_CM, g_http_uri_buffer_id, ALPROTO_HTTP1);
}
static bool DetectHttpUriValidateCallback(const Signature *s, const char **sigerror)
{
return DetectUrilenValidateContent(s, g_http_uri_buffer_id, sigerror);
}
static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s)
{
@ -282,11 +271,6 @@ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, const ch
de_ctx, s, arg, DETECT_HTTP_RAW_URI, g_http_raw_uri_buffer_id, ALPROTO_HTTP1);
}
static bool DetectHttpRawUriValidateCallback(const Signature *s, const char **sigerror)
{
return DetectUrilenValidateContent(s, g_http_raw_uri_buffer_id, sigerror);
}
static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s)
{

5
src/detect-quic-cyu-hash.c
Unescape Escape View File

@ -82,10 +82,11 @@ static InspectionBuffer *QuicHashGetData(DetectEngineThreadCtx *det_ctx,
SCReturnPtr(buffer, "InspectionBuffer");
}
static bool DetectQuicHashValidateCallback(const Signature *s, const char **sigerror)
static bool DetectQuicHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

5
src/detect-sip-method.c
Unescape Escape View File

@ -69,10 +69,11 @@ static int DetectSipMethodSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
return 0;
}
static bool DetectSipMethodValidateCallback(const Signature *s, const char **sigerror)
static bool DetectSipMethodValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

8
src/detect-sip-uri.c
Unescape Escape View File

@ -59,11 +59,6 @@
#define BUFFER_DESC "sip request uri"
static int g_buffer_id = 0;
static bool DetectSipUriValidateCallback(const Signature *s, const char **sigerror)
{
return DetectUrilenValidateContent(s, g_buffer_id, sigerror);
}
static void DetectSipUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s)
{
@ -121,8 +116,7 @@ void DetectSipUriRegister(void)
DetectBufferTypeRegisterSetupCallback(BUFFER_NAME,
DetectSipUriSetupCallback);
DetectBufferTypeRegisterValidateCallback(BUFFER_NAME,
DetectSipUriValidateCallback);
DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectUrilenValidateContent);
g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);

5
src/detect-ssh-hassh-server.c
Unescape Escape View File

@ -118,10 +118,11 @@ static int DetectSshHasshServerSetup(DetectEngineCtx *de_ctx, Signature *s, cons
}
static bool DetectSshHasshServerHashValidateCallback(const Signature *s, const char **sigerror)
static bool DetectSshHasshServerHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

7
src/detect-ssh-hassh.c
Unescape Escape View File

@ -117,12 +117,11 @@ static int DetectSshHasshSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
static bool DetectSshHasshHashValidateCallback(const Signature *s,
const char **sigerror)
static bool DetectSshHasshHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-cert-fingerprint.c
Unescape Escape View File

@ -62,8 +62,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id);
static void DetectTlsFingerprintSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s);
static bool DetectTlsFingerprintValidateCallback(const Signature *s,
const char **sigerror);
static bool DetectTlsFingerprintValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_cert_fingerprint_buffer_id = 0;
/**
@ -159,11 +159,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer;
}
static bool DetectTlsFingerprintValidateCallback(const Signature *s,
const char **sigerror)
static bool DetectTlsFingerprintValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_cert_fingerprint_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-cert-serial.c
Unescape Escape View File

@ -62,8 +62,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id);
static void DetectTlsSerialSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s);
static bool DetectTlsSerialValidateCallback(const Signature *s,
const char **sigerror);
static bool DetectTlsSerialValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_cert_serial_buffer_id = 0;
/**
@ -157,11 +157,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer;
}
static bool DetectTlsSerialValidateCallback(const Signature *s,
const char **sigerror)
static bool DetectTlsSerialValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_cert_serial_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-ja3-hash.c
Unescape Escape View File

@ -72,8 +72,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id);
static void DetectTlsJa3HashSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s);
static bool DetectTlsJa3HashValidateCallback(const Signature *s,
const char **sigerror);
static bool DetectTlsJa3HashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_ja3_hash_buffer_id = 0;
#endif
@ -178,11 +178,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer;
}
static bool DetectTlsJa3HashValidateCallback(const Signature *s,
const char **sigerror)
static bool DetectTlsJa3HashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_ja3_hash_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-ja3s-hash.c
Unescape Escape View File

@ -72,8 +72,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id);
static void DetectTlsJa3SHashSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s);
static bool DetectTlsJa3SHashValidateCallback(const Signature *s,
const char **sigerror);
static bool DetectTlsJa3SHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_ja3s_hash_buffer_id = 0;
#endif
@ -176,11 +176,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer;
}
static bool DetectTlsJa3SHashValidateCallback(const Signature *s,
const char **sigerror)
static bool DetectTlsJa3SHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_ja3s_hash_buffer_id)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) {

5
src/detect-urilen.c
Unescape Escape View File

@ -214,10 +214,11 @@ void DetectUrilenApplyToContent(Signature *s, int list)
}
}
bool DetectUrilenValidateContent(const Signature *s, int list, const char **sigerror)
bool DetectUrilenValidateContent(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)list)
if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue;
for (const SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT) {

2
src/detect-urilen.h
Unescape Escape View File

@ -24,7 +24,7 @@
#ifndef _DETECT_URILEN_H
#define _DETECT_URILEN_H
bool DetectUrilenValidateContent(const Signature *s, int list, const char **);
bool DetectUrilenValidateContent(const Signature *s, const char **, const DetectBufferType *dbt);
void DetectUrilenApplyToContent(Signature *s, int list);
void DetectUrilenRegister(void);

3
src/detect.h
Unescape Escape View File

@ -473,7 +473,8 @@ typedef struct DetectBufferType_ {
bool supports_transforms;
bool multi_instance; /**< buffer supports multiple buffer instances per tx */
void (*SetupCallback)(const struct DetectEngineCtx_ *, struct Signature_ *);
bool (*ValidateCallback)(const struct Signature_ *, const char **sigerror);
bool (*ValidateCallback)(
const struct Signature_ *, const char **sigerror, const struct DetectBufferType_ *);
DetectEngineTransforms transforms;
} DetectBufferType;

Write Preview
Loading…
Cancel
Save