aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: use buffer ptr in validate callback api

Browse Source 
Ticket: 5634

Allows to share the same validator functions when only the buffer
id is changing like for urilen, while still accessing the buffer
name for error logs
pull/12931/head
Philippe Antoine 9 months ago committed by Victor Julien
parent 4da69a52fe
commit 5ae215605c
19 changed files with 69 additions and 77 deletions
Show Stats Download Patch File Download Diff File

10
src/detect-engine.c
Unescape Escape View File

@ -1332,8 +1332,9 @@ void DetectEngineBufferRunSetupCallback(const DetectEngineCtx *de_ctx, const int
} }
} }
void DetectBufferTypeRegisterValidateCallback(const char *name, void DetectBufferTypeRegisterValidateCallback(
bool (*ValidateCallback)(const Signature *, const char **sigerror)) const char *name, bool (*ValidateCallback)(const Signature *, const char **sigerror,
const DetectBufferType *))
{ {
BUG_ON(g_buffer_type_reg_closed); BUG_ON(g_buffer_type_reg_closed);
DetectBufferTypeRegister(name); DetectBufferTypeRegister(name);
@ -1346,8 +1347,9 @@ bool DetectEngineBufferRunValidateCallback(
const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror) const DetectEngineCtx *de_ctx, const int id, const Signature *s, const char **sigerror)
{ {
const DetectBufferType *map = DetectEngineBufferTypeGetById(de_ctx, id); const DetectBufferType *map = DetectEngineBufferTypeGetById(de_ctx, id);
if (map && map->ValidateCallback) { // only run validation if the buffer is not transformed
return map->ValidateCallback(s, sigerror); if (map && map->ValidateCallback && map->transforms.cnt == 0) {
return map->ValidateCallback(s, sigerror, map);
} }
return true; return true;
} }

5
src/detect-engine.h
Unescape Escape View File

@ -62,8 +62,9 @@ void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc);
const char *DetectBufferTypeGetDescriptionByName(const char *name); const char *DetectBufferTypeGetDescriptionByName(const char *name);
void DetectBufferTypeRegisterSetupCallback(const char *name, void DetectBufferTypeRegisterSetupCallback(const char *name,
void (*Callback)(const DetectEngineCtx *, Signature *)); void (*Callback)(const DetectEngineCtx *, Signature *));
void DetectBufferTypeRegisterValidateCallback(const char *name, void DetectBufferTypeRegisterValidateCallback(
bool (*ValidateCallback)(const Signature *, const char **sigerror)); const char *name, bool (*ValidateCallback)(const Signature *, const char **sigerror,
const DetectBufferType *));
/* detect engine related buffer funcs */ /* detect engine related buffer funcs */

8
src/detect-http-host.c
Unescape Escape View File

@ -62,7 +62,8 @@ static int DetectHttpHHSetup(DetectEngineCtx *, Signature *, const char *);
#ifdef UNITTESTS #ifdef UNITTESTS
static void DetectHttpHHRegisterTests(void); static void DetectHttpHHRegisterTests(void);
#endif #endif
static bool DetectHttpHostValidateCallback(const Signature *s, const char **sigerror); static bool DetectHttpHostValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int DetectHttpHostSetup(DetectEngineCtx *, Signature *, const char *); static int DetectHttpHostSetup(DetectEngineCtx *, Signature *, const char *);
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, const DetectEngineTransforms *transforms,
@ -180,10 +181,11 @@ static int DetectHttpHHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *
de_ctx, s, arg, DETECT_HTTP_HOST_CM, g_http_host_buffer_id, ALPROTO_HTTP1); de_ctx, s, arg, DETECT_HTTP_HOST_CM, g_http_host_buffer_id, ALPROTO_HTTP1);
} }
static bool DetectHttpHostValidateCallback(const Signature *s, const char **sigerror) static bool DetectHttpHostValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_http_host_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

8
src/detect-http-method.c
Unescape Escape View File

@ -65,7 +65,8 @@ static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, co
void DetectHttpMethodRegisterTests(void); void DetectHttpMethodRegisterTests(void);
#endif #endif
void DetectHttpMethodFree(void *); void DetectHttpMethodFree(void *);
static bool DetectHttpMethodValidateCallback(const Signature *s, const char **sigerror); static bool DetectHttpMethodValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Flow *_f, const DetectEngineTransforms *transforms, Flow *_f,
const uint8_t _flow_flags, void *txv, const int list_id); const uint8_t _flow_flags, void *txv, const int list_id);
@ -162,10 +163,11 @@ static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, co
* \retval 1 valid * \retval 1 valid
* \retval 0 invalid * \retval 0 invalid
*/ */
static bool DetectHttpMethodValidateCallback(const Signature *s, const char **sigerror) static bool DetectHttpMethodValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_http_method_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

5
src/detect-http-protocol.c
Unescape Escape View File

@ -127,11 +127,12 @@ static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
return buffer; return buffer;
} }
static bool DetectHttpProtocolValidateCallback(const Signature *s, const char **sigerror) static bool DetectHttpProtocolValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
#ifdef HAVE_HTP_CONFIG_SET_ALLOW_SPACE_URI #ifdef HAVE_HTP_CONFIG_SET_ALLOW_SPACE_URI
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

6
src/detect-http-raw-header.c
Unescape Escape View File

@ -58,7 +58,8 @@ static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx *de_ctx, Signature *s,
#ifdef UNITTESTS #ifdef UNITTESTS
static void DetectHttpRawHeaderRegisterTests(void); static void DetectHttpRawHeaderRegisterTests(void);
#endif #endif
static bool DetectHttpRawHeaderValidateCallback(const Signature *s, const char **sigerror); static bool DetectHttpRawHeaderValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_http_raw_header_buffer_id = 0; static int g_http_raw_header_buffer_id = 0;
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Flow *_f, const DetectEngineTransforms *transforms, Flow *_f,
@ -166,7 +167,8 @@ static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx *de_ctx, Signature *s,
return 0; return 0;
} }
static bool DetectHttpRawHeaderValidateCallback(const Signature *s, const char **sigerror) static bool DetectHttpRawHeaderValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
if ((s->flags & (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) { if ((s->flags & (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) {
*sigerror = "http_raw_header signature " *sigerror = "http_raw_header signature "

24
src/detect-http-uri.c
Unescape Escape View File

@ -59,9 +59,7 @@
#ifdef UNITTESTS #ifdef UNITTESTS
static void DetectHttpUriRegisterTests(void); static void DetectHttpUriRegisterTests(void);
#endif #endif
static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx, static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx, Signature *s);
Signature *s);
static bool DetectHttpUriValidateCallback(const Signature *s, const char **sigerror);
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t _flow_flags, Flow *_f, const uint8_t _flow_flags,
@ -71,9 +69,7 @@ static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
const int list_id); const int list_id);
static int DetectHttpUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str); static int DetectHttpUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
static int DetectHttpRawUriSetup(DetectEngineCtx *, Signature *, const char *); static int DetectHttpRawUriSetup(DetectEngineCtx *, Signature *, const char *);
static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx, static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx, Signature *s);
Signature *s);
static bool DetectHttpRawUriValidateCallback(const Signature *s, const char **);
static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx, static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t _flow_flags, Flow *_f, const uint8_t _flow_flags,
@ -126,8 +122,7 @@ void DetectHttpUriRegister (void)
DetectBufferTypeRegisterSetupCallback("http_uri", DetectBufferTypeRegisterSetupCallback("http_uri",
DetectHttpUriSetupCallback); DetectHttpUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_uri", DetectBufferTypeRegisterValidateCallback("http_uri", DetectUrilenValidateContent);
DetectHttpUriValidateCallback);
g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri"); g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri");
@ -165,8 +160,7 @@ void DetectHttpUriRegister (void)
DetectBufferTypeRegisterSetupCallback("http_raw_uri", DetectBufferTypeRegisterSetupCallback("http_raw_uri",
DetectHttpRawUriSetupCallback); DetectHttpRawUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_raw_uri", DetectBufferTypeRegisterValidateCallback("http_raw_uri", DetectUrilenValidateContent);
DetectHttpRawUriValidateCallback);
g_http_raw_uri_buffer_id = DetectBufferTypeGetByName("http_raw_uri"); g_http_raw_uri_buffer_id = DetectBufferTypeGetByName("http_raw_uri");
} }
@ -188,11 +182,6 @@ int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
de_ctx, s, str, DETECT_HTTP_URI_CM, g_http_uri_buffer_id, ALPROTO_HTTP1); de_ctx, s, str, DETECT_HTTP_URI_CM, g_http_uri_buffer_id, ALPROTO_HTTP1);
} }
static bool DetectHttpUriValidateCallback(const Signature *s, const char **sigerror)
{
return DetectUrilenValidateContent(s, g_http_uri_buffer_id, sigerror);
}
static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx, static void DetectHttpUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s) Signature *s)
{ {
@ -282,11 +271,6 @@ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, const ch
de_ctx, s, arg, DETECT_HTTP_RAW_URI, g_http_raw_uri_buffer_id, ALPROTO_HTTP1); de_ctx, s, arg, DETECT_HTTP_RAW_URI, g_http_raw_uri_buffer_id, ALPROTO_HTTP1);
} }
static bool DetectHttpRawUriValidateCallback(const Signature *s, const char **sigerror)
{
return DetectUrilenValidateContent(s, g_http_raw_uri_buffer_id, sigerror);
}
static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx, static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s) Signature *s)
{ {

5
src/detect-quic-cyu-hash.c
Unescape Escape View File

@ -82,10 +82,11 @@ static InspectionBuffer *QuicHashGetData(DetectEngineThreadCtx *det_ctx,
SCReturnPtr(buffer, "InspectionBuffer"); SCReturnPtr(buffer, "InspectionBuffer");
} }
static bool DetectQuicHashValidateCallback(const Signature *s, const char **sigerror) static bool DetectQuicHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

5
src/detect-sip-method.c
Unescape Escape View File

@ -69,10 +69,11 @@ static int DetectSipMethodSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
return 0; return 0;
} }
static bool DetectSipMethodValidateCallback(const Signature *s, const char **sigerror) static bool DetectSipMethodValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

8
src/detect-sip-uri.c
Unescape Escape View File

@ -59,11 +59,6 @@
#define BUFFER_DESC "sip request uri" #define BUFFER_DESC "sip request uri"
static int g_buffer_id = 0; static int g_buffer_id = 0;
static bool DetectSipUriValidateCallback(const Signature *s, const char **sigerror)
{
return DetectUrilenValidateContent(s, g_buffer_id, sigerror);
}
static void DetectSipUriSetupCallback(const DetectEngineCtx *de_ctx, static void DetectSipUriSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s) Signature *s)
{ {
@ -121,8 +116,7 @@ void DetectSipUriRegister(void)
DetectBufferTypeRegisterSetupCallback(BUFFER_NAME, DetectBufferTypeRegisterSetupCallback(BUFFER_NAME,
DetectSipUriSetupCallback); DetectSipUriSetupCallback);
DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectUrilenValidateContent);
DetectSipUriValidateCallback);
g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);

5
src/detect-ssh-hassh-server.c
Unescape Escape View File

@ -118,10 +118,11 @@ static int DetectSshHasshServerSetup(DetectEngineCtx *de_ctx, Signature *s, cons
} }
static bool DetectSshHasshServerHashValidateCallback(const Signature *s, const char **sigerror) static bool DetectSshHasshServerHashValidateCallback(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

7
src/detect-ssh-hassh.c
Unescape Escape View File

@ -117,12 +117,11 @@ static int DetectSshHasshSetup(DetectEngineCtx *de_ctx, Signature *s, const char
} }
static bool DetectSshHasshHashValidateCallback(
static bool DetectSshHasshHashValidateCallback(const Signature *s, const Signature *s, const char **sigerror, const DetectBufferType *dbt)
const char **sigerror)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-cert-fingerprint.c
Unescape Escape View File

@ -62,8 +62,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id); void *txv, const int list_id);
static void DetectTlsFingerprintSetupCallback(const DetectEngineCtx *de_ctx, static void DetectTlsFingerprintSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s); Signature *s);
static bool DetectTlsFingerprintValidateCallback(const Signature *s, static bool DetectTlsFingerprintValidateCallback(
const char **sigerror); const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_cert_fingerprint_buffer_id = 0; static int g_tls_cert_fingerprint_buffer_id = 0;
/** /**
@ -159,11 +159,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer; return buffer;
} }
static bool DetectTlsFingerprintValidateCallback(const Signature *s, static bool DetectTlsFingerprintValidateCallback(
const char **sigerror) const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_cert_fingerprint_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-cert-serial.c
Unescape Escape View File

@ -62,8 +62,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id); void *txv, const int list_id);
static void DetectTlsSerialSetupCallback(const DetectEngineCtx *de_ctx, static void DetectTlsSerialSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s); Signature *s);
static bool DetectTlsSerialValidateCallback(const Signature *s, static bool DetectTlsSerialValidateCallback(
const char **sigerror); const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_cert_serial_buffer_id = 0; static int g_tls_cert_serial_buffer_id = 0;
/** /**
@ -157,11 +157,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer; return buffer;
} }
static bool DetectTlsSerialValidateCallback(const Signature *s, static bool DetectTlsSerialValidateCallback(
const char **sigerror) const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_cert_serial_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-ja3-hash.c
Unescape Escape View File

@ -72,8 +72,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id); void *txv, const int list_id);
static void DetectTlsJa3HashSetupCallback(const DetectEngineCtx *de_ctx, static void DetectTlsJa3HashSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s); Signature *s);
static bool DetectTlsJa3HashValidateCallback(const Signature *s, static bool DetectTlsJa3HashValidateCallback(
const char **sigerror); const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_ja3_hash_buffer_id = 0; static int g_tls_ja3_hash_buffer_id = 0;
#endif #endif
@ -178,11 +178,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer; return buffer;
} }
static bool DetectTlsJa3HashValidateCallback(const Signature *s, static bool DetectTlsJa3HashValidateCallback(
const char **sigerror) const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_ja3_hash_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

10
src/detect-tls-ja3s-hash.c
Unescape Escape View File

@ -72,8 +72,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
void *txv, const int list_id); void *txv, const int list_id);
static void DetectTlsJa3SHashSetupCallback(const DetectEngineCtx *de_ctx, static void DetectTlsJa3SHashSetupCallback(const DetectEngineCtx *de_ctx,
Signature *s); Signature *s);
static bool DetectTlsJa3SHashValidateCallback(const Signature *s, static bool DetectTlsJa3SHashValidateCallback(
const char **sigerror); const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_tls_ja3s_hash_buffer_id = 0; static int g_tls_ja3s_hash_buffer_id = 0;
#endif #endif
@ -176,11 +176,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return buffer; return buffer;
} }
static bool DetectTlsJa3SHashValidateCallback(const Signature *s, static bool DetectTlsJa3SHashValidateCallback(
const char **sigerror) const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)g_tls_ja3s_hash_buffer_id) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
const SigMatch *sm = s->init_data->buffers[x].head; const SigMatch *sm = s->init_data->buffers[x].head;
for (; sm != NULL; sm = sm->next) { for (; sm != NULL; sm = sm->next) {

5
src/detect-urilen.c
Unescape Escape View File

@ -214,10 +214,11 @@ void DetectUrilenApplyToContent(Signature *s, int list)
} }
} }
bool DetectUrilenValidateContent(const Signature *s, int list, const char **sigerror) bool DetectUrilenValidateContent(
const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
if (s->init_data->buffers[x].id != (uint32_t)list) if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
continue; continue;
for (const SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) { for (const SigMatch *sm = s->init_data->buffers[x].head; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT) { if (sm->type != DETECT_CONTENT) {

2
src/detect-urilen.h
Unescape Escape View File

@ -24,7 +24,7 @@
#ifndef _DETECT_URILEN_H #ifndef _DETECT_URILEN_H
#define _DETECT_URILEN_H #define _DETECT_URILEN_H
bool DetectUrilenValidateContent(const Signature *s, int list, const char **); bool DetectUrilenValidateContent(const Signature *s, const char **, const DetectBufferType *dbt);
void DetectUrilenApplyToContent(Signature *s, int list); void DetectUrilenApplyToContent(Signature *s, int list);
void DetectUrilenRegister(void); void DetectUrilenRegister(void);

3
src/detect.h
Unescape Escape View File

@ -473,7 +473,8 @@ typedef struct DetectBufferType_ {
bool supports_transforms; bool supports_transforms;
bool multi_instance; /**< buffer supports multiple buffer instances per tx */ bool multi_instance; /**< buffer supports multiple buffer instances per tx */
void (*SetupCallback)(const struct DetectEngineCtx_ *, struct Signature_ *); void (*SetupCallback)(const struct DetectEngineCtx_ *, struct Signature_ *);
bool (*ValidateCallback)(const struct Signature_ *, const char **sigerror); bool (*ValidateCallback)(
const struct Signature_ *, const char **sigerror, const struct DetectBufferType_ *);
DetectEngineTransforms transforms; DetectEngineTransforms transforms;
} DetectBufferType; } DetectBufferType;

Write Preview
Loading…
Cancel
Save