From 61cb2abc8d3dab3e17663a0db21d2d910bd0bdbe Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 19 Dec 2014 17:40:36 +0100 Subject: [PATCH] ippair: xbit implementation detect xbits for ippair: initial implementation --- src/Makefile.am | 2 + src/detect-xbits.c | 513 ++++++++++++++++++++++++++++++++++++++++ src/detect-xbits.h | 49 ++++ src/detect.c | 2 + src/detect.h | 2 + src/ippair-bit.c | 489 ++++++++++++++++++++++++++++++++++++++ src/ippair-bit.h | 52 ++++ src/runmode-unittests.c | 2 + src/suricata.c | 3 + src/util-var.c | 8 + 10 files changed, 1122 insertions(+) create mode 100644 src/detect-xbits.c create mode 100644 src/detect-xbits.h create mode 100644 src/ippair-bit.c create mode 100644 src/ippair-bit.h diff --git a/src/Makefile.am b/src/Makefile.am index 11d3268799..01c94375b4 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -198,6 +198,7 @@ detect-urilen.c detect-urilen.h \ detect-window.c detect-window.h \ detect-within.c detect-within.h \ detect-modbus.c detect-modbus.h \ +detect-xbits.c detect-xbits.h \ flow-bit.c flow-bit.h \ flow.c flow.h \ flow-hash.c flow-hash.h \ @@ -213,6 +214,7 @@ host-queue.c host-queue.h \ host-storage.c host-storage.h \ host-timeout.c host-timeout.h \ ippair.c ippair.h \ +ippair-bit.c ippair-bit.h \ ippair-queue.c ippair-queue.h \ ippair-storage.c ippair-storage.h \ ippair-timeout.c ippair-timeout.h \ diff --git a/src/detect-xbits.c b/src/detect-xbits.c new file mode 100644 index 0000000000..28f05c201f --- /dev/null +++ b/src/detect-xbits.c @@ -0,0 +1,513 @@ +/* Copyright (C) 2007-2010 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + * + * Implements the xbits keyword + */ + +#include "suricata-common.h" +#include "decode.h" +#include "detect.h" +#include "threads.h" +#include "flow.h" +#include "flow-util.h" +#include "detect-xbits.h" +#include "util-spm.h" + +#include "detect-engine-sigorder.h" + +#include "app-layer-parser.h" + +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "detect-engine-state.h" + +#include "flow-bit.h" +#include "host-bit.h" +#include "ippair-bit.h" +#include "util-var-name.h" +#include "util-unittest.h" +#include "util-debug.h" + +/* + xbits:set,bitname,track ip_pair + */ + +#define PARSE_REGEX "([a-z]+)(?:,([^,]+))?(?:,(?:track\\s+([^,]+)))" +static pcre *parse_regex; +static pcre_extra *parse_regex_study; + +int DetectXbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); +static int DetectXbitSetup (DetectEngineCtx *, Signature *, char *); +void DetectXbitFree (void *); +void XBitsRegisterTests(void); + +void DetectXbitsRegister (void) +{ + sigmatch_table[DETECT_XBITS].name = "xbits"; + sigmatch_table[DETECT_XBITS].desc = "operate on bits"; +// sigmatch_table[DETECT_XBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flowbits"; + sigmatch_table[DETECT_XBITS].Match = DetectXbitMatch; + sigmatch_table[DETECT_XBITS].Setup = DetectXbitSetup; + sigmatch_table[DETECT_XBITS].Free = DetectXbitFree; + sigmatch_table[DETECT_XBITS].RegisterTests = XBitsRegisterTests; + /* this is compatible to ip-only signatures */ + sigmatch_table[DETECT_XBITS].flags |= SIGMATCH_IPONLY_COMPAT; + + const char *eb; + int eo; + int opts = 0; + + parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); + if(parse_regex == NULL) + { + SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if(eb != NULL) + { + SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); + goto error; + } + + return; + +error: + return; +} + +static int DetectIPPairbitMatchToggle (Packet *p, const DetectXbitsData *fd) +{ + IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 0; + + IPPairBitToggle(pair,fd->idx); + IPPairRelease(pair); + return 1; +} + +/* return true even if bit not found */ +static int DetectIPPairbitMatchUnset (Packet *p, const DetectXbitsData *fd) +{ + IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 1; + + IPPairBitUnset(pair,fd->idx); + IPPairRelease(pair); + return 1; +} + +static int DetectIPPairbitMatchSet (Packet *p, const DetectXbitsData *fd) +{ + IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 0; + + IPPairBitSet(pair,fd->idx); + IPPairRelease(pair); + return 1; +} + +static int DetectIPPairbitMatchIsset (Packet *p, const DetectXbitsData *fd) +{ + int r = 0; + IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 0; + + r = IPPairBitIsset(pair,fd->idx); + IPPairRelease(pair); + return r; +} + +static int DetectIPPairbitMatchIsnotset (Packet *p, const DetectXbitsData *fd) +{ + int r = 0; + IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 1; + + r = IPPairBitIsnotset(pair,fd->idx); + IPPairRelease(pair); + return r; +} + +/* + * returns 0: no match + * 1: match + * -1: error + */ + +int DetectXbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) +{ + const DetectXbitsData *fd = (const DetectXbitsData *)ctx; + if (fd == NULL) + return 0; + + switch (fd->cmd) { + case DETECT_XBITS_CMD_ISSET: + return DetectIPPairbitMatchIsset(p,fd); + case DETECT_XBITS_CMD_ISNOTSET: + return DetectIPPairbitMatchIsnotset(p,fd); + case DETECT_XBITS_CMD_SET: + return DetectIPPairbitMatchSet(p,fd); + case DETECT_XBITS_CMD_UNSET: + return DetectIPPairbitMatchUnset(p,fd); + case DETECT_XBITS_CMD_TOGGLE: + return DetectIPPairbitMatchToggle(p,fd); + default: + SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown cmd %" PRIu32 "", fd->cmd); + return 0; + } + + return 0; +} + +int DetectXbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) +{ + DetectXbitsData *cd = NULL; + SigMatch *sm = NULL; + uint8_t fb_cmd = 0; + uint8_t hb_dir = 0; +#define MAX_SUBSTRINGS 30 + int ret = 0, res = 0; + int ov[MAX_SUBSTRINGS]; + char fb_cmd_str[16] = "", fb_name[256] = ""; + char hb_dir_str[16] = ""; + + ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); + if (ret != 2 && ret != 3 && ret != 4) { + SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for hostbits.", rawstr); + return -1; + } + SCLogDebug("ret %d, %s", ret, rawstr); + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, fb_cmd_str, sizeof(fb_cmd_str)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + return -1; + } + + if (ret >= 3) { + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, fb_name, sizeof(fb_name)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + goto error; + } + if (ret >= 4) { + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, hb_dir_str, sizeof(hb_dir_str)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + goto error; + } + SCLogDebug("hb_dir_str %s", hb_dir_str); + if (strlen(hb_dir_str) > 0) { + if (strcmp(hb_dir_str, "ip_src") == 0) + hb_dir = DETECT_XBITS_TRACK_IPSRC; + else if (strcmp(hb_dir_str, "ip_dst") == 0) + hb_dir = DETECT_XBITS_TRACK_IPDST; + else if (strcmp(hb_dir_str, "ip_pair") == 0) { + hb_dir = DETECT_XBITS_TRACK_IPPAIR; + } else { + // TODO + goto error; + } + } + } + } + + if (strcmp(fb_cmd_str,"noalert") == 0) { + fb_cmd = DETECT_XBITS_CMD_NOALERT; + } else if (strcmp(fb_cmd_str,"isset") == 0) { + fb_cmd = DETECT_XBITS_CMD_ISSET; + } else if (strcmp(fb_cmd_str,"isnotset") == 0) { + fb_cmd = DETECT_XBITS_CMD_ISNOTSET; + } else if (strcmp(fb_cmd_str,"set") == 0) { + fb_cmd = DETECT_XBITS_CMD_SET; + } else if (strcmp(fb_cmd_str,"unset") == 0) { + fb_cmd = DETECT_XBITS_CMD_UNSET; + } else if (strcmp(fb_cmd_str,"toggle") == 0) { + fb_cmd = DETECT_XBITS_CMD_TOGGLE; + } else { + SCLogError(SC_ERR_UNKNOWN_VALUE, "ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str); + goto error; + } + + switch (fb_cmd) { + case DETECT_XBITS_CMD_NOALERT: + if (strlen(fb_name) != 0) + goto error; + s->flags |= SIG_FLAG_NOALERT; + return 0; + case DETECT_XBITS_CMD_ISNOTSET: + case DETECT_XBITS_CMD_ISSET: + case DETECT_XBITS_CMD_SET: + case DETECT_XBITS_CMD_UNSET: + case DETECT_XBITS_CMD_TOGGLE: + default: + if (strlen(fb_name) == 0) + goto error; + break; + } + + cd = SCMalloc(sizeof(DetectXbitsData)); + if (unlikely(cd == NULL)) + goto error; + + cd->idx = VariableNameGetIdx(de_ctx, fb_name, DETECT_XBITS); + cd->cmd = fb_cmd; + cd->tracker = hb_dir; + + SCLogDebug("idx %" PRIu32 ", cmd %s, name %s", + cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)"); + + /* Okay so far so good, lets get this into a SigMatch + * and put it in the Signature. */ + sm = SigMatchAlloc(); + if (sm == NULL) + goto error; + + sm->type = DETECT_XBITS; + sm->ctx = (void *)cd; + + switch (fb_cmd) { + case DETECT_XBITS_CMD_NOALERT: + /* nothing to do */ + break; + + case DETECT_XBITS_CMD_ISNOTSET: + case DETECT_XBITS_CMD_ISSET: + /* checks, so packet list */ + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); + break; + + case DETECT_XBITS_CMD_SET: + case DETECT_XBITS_CMD_UNSET: + case DETECT_XBITS_CMD_TOGGLE: + /* modifiers, only run when entire sig has matched */ + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); + break; + } + + return 0; + +error: + if (cd != NULL) + SCFree(cd); + if (sm != NULL) + SCFree(sm); + return -1; +} + +void DetectXbitFree (void *ptr) +{ + DetectXbitsData *fd = (DetectXbitsData *)ptr; + + if (fd == NULL) + return; + + SCFree(fd); +} + +#ifdef UNITTESTS + +static void XBitsTestSetup(void) +{ + StorageInit(); + HostBitInitCtx(); + IPPairBitInitCtx(); + StorageFinalize(); + HostInitConfig(TRUE); + IPPairInitConfig(TRUE); +} + +static void XBitsTestShutdown(void) +{ + HostCleanup(); + IPPairCleanup(); + StorageCleanup(); +} + +/** + * \test HostBitsTestSig01 is a test for a valid noalert flowbits option + * + * \retval 1 on succces + * \retval 0 on failure + */ + +static int XBitsTestSig01(void) +{ + uint8_t *buf = (uint8_t *) + "GET /one/ HTTP/1.1\r\n" + "Host: one.example.org\r\n" + "\r\n"; + uint16_t buflen = strlen((char *)buf); + Packet *p = SCMalloc(SIZE_OF_PACKET); + if (unlikely(p == NULL)) + return 0; + Signature *s = NULL; + ThreadVars th_v; + DetectEngineThreadCtx *det_ctx = NULL; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + memset(&th_v, 0, sizeof(th_v)); + memset(p, 0, SIZE_OF_PACKET); + p->src.family = AF_INET; + p->dst.family = AF_INET; + p->payload = buf; + p->payload_len = buflen; + p->proto = IPPROTO_TCP; + + XBitsTestSetup(); + + de_ctx = DetectEngineCtxInit(); + + if (de_ctx == NULL) { + printf("bad de_ctx: "); + goto end; + } + + de_ctx->flags |= DE_QUIET; + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:1;)"); + if (s == NULL) { + printf("bad sig: "); + goto end; + } + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + + result = 1; + +end: + if (de_ctx != NULL) { + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + } + + if (det_ctx != NULL) { + DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + } + + if (de_ctx != NULL) { + DetectEngineCtxFree(de_ctx); + } + + XBitsTestShutdown(); + + SCFree(p); + return result; +} + +/** + * \test various options + * + * \retval 1 on succces + * \retval 0 on failure + */ + +static int XBitsTestSig02(void) +{ + Signature *s = NULL; + ThreadVars th_v; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + int error_count = 0; + + memset(&th_v, 0, sizeof(th_v)); + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) { + goto end; + } + + de_ctx->flags |= DE_QUIET; + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:isset,abc,track ip_src; content:\"GET \"; sid:1;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:isnotset,abc,track ip_dst; content:\"GET \"; sid:2;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:3;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:unset,abc,track ip_src; content:\"GET \"; sid:4;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:toggle,abc,track ip_dst; content:\"GET \"; sid:5;)"); + if (s == NULL) { + error_count++; + } + + if (error_count != 0) + goto end; + + result = 1; + + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +end: + if (de_ctx != NULL) { + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + } + + return result; +} + +#endif /* UNITTESTS */ + +/** + * \brief this function registers unit tests for XBits + */ +void XBitsRegisterTests(void) +{ +#ifdef UNITTESTS + UtRegisterTest("XBitsTestSig01", XBitsTestSig01, 1); + UtRegisterTest("XBitsTestSig02", XBitsTestSig02, 1); +#endif /* UNITTESTS */ +} diff --git a/src/detect-xbits.h b/src/detect-xbits.h new file mode 100644 index 0000000000..e01d8c330a --- /dev/null +++ b/src/detect-xbits.h @@ -0,0 +1,49 @@ +/* Copyright (C) 2007-2014 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + */ + +#ifndef __DETECT_XBITS_H__ +#define __DETECT_XBITS_H__ + +#define DETECT_XBITS_CMD_SET 0 +#define DETECT_XBITS_CMD_TOGGLE 1 +#define DETECT_XBITS_CMD_UNSET 2 +#define DETECT_XBITS_CMD_ISNOTSET 3 +#define DETECT_XBITS_CMD_ISSET 4 +#define DETECT_XBITS_CMD_NOALERT 5 +#define DETECT_XBITS_CMD_MAX 6 + +#define DETECT_XBITS_TRACK_IPSRC 0 +#define DETECT_XBITS_TRACK_IPDST 1 +#define DETECT_XBITS_TRACK_IPPAIR 2 +#define DETECT_XBITS_TRACK_FLOW 3 + +typedef struct DetectXbitsData_ { + uint16_t idx; + uint8_t cmd; + uint8_t tracker; +} DetectXbitsData; + +/* prototypes */ +void DetectXbitsRegister (void); + +#endif /* __DETECT_XBITS_H__ */ diff --git a/src/detect.c b/src/detect.c index 0082969a06..e27e57b26d 100644 --- a/src/detect.c +++ b/src/detect.c @@ -109,6 +109,7 @@ #include "detect-noalert.h" #include "detect-flowbits.h" #include "detect-hostbits.h" +#include "detect-xbits.h" #include "detect-csum.h" #include "detect-stream_size.h" #include "detect-engine-sigorder.h" @@ -5004,6 +5005,7 @@ void SigTableSetup(void) DetectNoalertRegister(); DetectFlowbitsRegister(); DetectHostbitsRegister(); + DetectXbitsRegister(); DetectEngineEventRegister(); DetectIpOptsRegister(); DetectFlagsRegister(); diff --git a/src/detect.h b/src/detect.h index 775fe2eeaa..295950295d 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1184,6 +1184,8 @@ enum { DETECT_AL_DNS_QUERY, DETECT_AL_MODBUS, + DETECT_XBITS, + /* make sure this stays last */ DETECT_TBLSIZE, }; diff --git a/src/ippair-bit.c b/src/ippair-bit.c new file mode 100644 index 0000000000..0a38568786 --- /dev/null +++ b/src/ippair-bit.c @@ -0,0 +1,489 @@ +/* Copyright (C) 2014 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + * + * Implements per ippair bits. Actually, not a bit, + * but called that way because of Snort's flowbits. + * It's a binary storage. + * + * \todo move away from a linked list implementation + * \todo use different datatypes, such as string, int, etc. + */ + +#include "suricata-common.h" +#include "threads.h" +#include "ippair-bit.h" +#include "ippair.h" +#include "detect.h" +#include "util-var.h" +#include "util-debug.h" +#include "util-unittest.h" +#include "ippair-storage.h" + +static int ippair_bit_id = -1; /**< IPPair storage id for bits */ + +void XBitFreeAll(void *store) { + GenericVar *gv = store; + GenericVarFree(gv); +} + +void IPPairBitInitCtx(void) +{ + ippair_bit_id = IPPairStorageRegister("bit", sizeof(void *), NULL, XBitFreeAll); + if (ippair_bit_id == -1) { + SCLogError(SC_ERR_IPPAIR_INIT, "Can't initiate ippair storage for bits"); + exit(EXIT_FAILURE); + } +} + +/* lock before using this */ +int IPPairHasBits(IPPair *ippair) +{ + if (ippair == NULL) + return 0; + return IPPairGetStorageById(ippair, ippair_bit_id) ? 1 : 0; +} + +/* get the bit with idx from the ippair */ +static XBit *IPPairBitGet(IPPair *h, uint16_t idx) +{ + GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); + for ( ; gv != NULL; gv = gv->next) { + if (gv->type == DETECT_XBITS && gv->idx == idx) { + return (XBit *)gv; + } + } + + return NULL; +} + +/* add a flowbit to the flow */ +static void IPPairBitAdd(IPPair *h, uint16_t idx) +{ + XBit *fb = IPPairBitGet(h, idx); + if (fb == NULL) { + fb = SCMalloc(sizeof(XBit)); + if (unlikely(fb == NULL)) + return; + + fb->type = DETECT_XBITS; + fb->idx = idx; + fb->next = NULL; + + GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); + GenericVarAppend(&gv, (GenericVar *)fb); + IPPairSetStorageById(h, ippair_bit_id, gv); + } +} + +static void IPPairBitRemove(IPPair *h, uint16_t idx) +{ + XBit *fb = IPPairBitGet(h, idx); + if (fb == NULL) + return; + + GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id); + if (gv) { + GenericVarRemove(&gv, (GenericVar *)fb); + IPPairSetStorageById(h, ippair_bit_id, gv); + } +} + +void IPPairBitSet(IPPair *h, uint16_t idx) +{ + XBit *fb = IPPairBitGet(h, idx); + if (fb == NULL) { + IPPairBitAdd(h, idx); + } +} + +void IPPairBitUnset(IPPair *h, uint16_t idx) +{ + XBit *fb = IPPairBitGet(h, idx); + if (fb != NULL) { + IPPairBitRemove(h, idx); + } +} + +void IPPairBitToggle(IPPair *h, uint16_t idx) +{ + XBit *fb = IPPairBitGet(h, idx); + if (fb != NULL) { + IPPairBitRemove(h, idx); + } else { + IPPairBitAdd(h, idx); + } +} + +int IPPairBitIsset(IPPair *h, uint16_t idx) +{ + int r = 0; + + XBit *fb = IPPairBitGet(h, idx); + if (fb != NULL) { + r = 1; + } + return r; +} + +int IPPairBitIsnotset(IPPair *h, uint16_t idx) +{ + int r = 0; + + XBit *fb = IPPairBitGet(h, idx); + if (fb == NULL) { + r = 1; + } + + return r; +} + +void XBitFree(XBit *fb) +{ + if (fb == NULL) + return; + + SCFree(fb); +} + + +/* TESTS */ +#ifdef UNITTESTS +static int IPPairBitTest01 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + + XBit *fb = IPPairBitGet(h,0); + if (fb != NULL) + ret = 1; + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest02 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + XBit *fb = IPPairBitGet(h,0); + if (fb == NULL) + ret = 1; + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest03 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + + XBit *fb = IPPairBitGet(h,0); + if (fb == NULL) { + printf("fb == NULL although it was just added: "); + goto end; + } + + IPPairBitRemove(h, 0); + + fb = IPPairBitGet(h,0); + if (fb != NULL) { + printf("fb != NULL although it was just removed: "); + goto end; + } else { + ret = 1; + } + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest04 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,0); + if (fb != NULL) + ret = 1; + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest05 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,1); + if (fb != NULL) + ret = 1; + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest06 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,2); + if (fb != NULL) + ret = 1; + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest07 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,3); + if (fb != NULL) + ret = 1; + + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest08 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,0); + if (fb == NULL) + goto end; + + IPPairBitRemove(h,0); + + fb = IPPairBitGet(h,0); + if (fb != NULL) { + printf("fb != NULL even though it was removed: "); + goto end; + } + + ret = 1; + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest09 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,1); + if (fb == NULL) + goto end; + + IPPairBitRemove(h,1); + + fb = IPPairBitGet(h,1); + if (fb != NULL) { + printf("fb != NULL even though it was removed: "); + goto end; + } + + ret = 1; + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest10 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,2); + if (fb == NULL) + goto end; + + IPPairBitRemove(h,2); + + fb = IPPairBitGet(h,2); + if (fb != NULL) { + printf("fb != NULL even though it was removed: "); + goto end; + } + + ret = 1; + IPPairFree(h); +end: + IPPairCleanup(); + return ret; +} + +static int IPPairBitTest11 (void) +{ + int ret = 0; + + IPPairInitConfig(TRUE); + IPPair *h = IPPairAlloc(); + if (h == NULL) + goto end; + + IPPairBitAdd(h, 0); + IPPairBitAdd(h, 1); + IPPairBitAdd(h, 2); + IPPairBitAdd(h, 3); + + XBit *fb = IPPairBitGet(h,3); + if (fb == NULL) + goto end; + + IPPairBitRemove(h,3); + + fb = IPPairBitGet(h,3); + if (fb != NULL) { + printf("fb != NULL even though it was removed: "); + goto end; + } + + ret = 1; + IPPairFree(h); +end: + IPPairCleanup(); + ret = 1; + return ret; +} + +#endif /* UNITTESTS */ + +void IPPairBitRegisterTests(void) +{ +#ifdef UNITTESTS + UtRegisterTest("IPPairBitTest01", IPPairBitTest01, 1); + UtRegisterTest("IPPairBitTest02", IPPairBitTest02, 1); + UtRegisterTest("IPPairBitTest03", IPPairBitTest03, 1); + UtRegisterTest("IPPairBitTest04", IPPairBitTest04, 1); + UtRegisterTest("IPPairBitTest05", IPPairBitTest05, 1); + UtRegisterTest("IPPairBitTest06", IPPairBitTest06, 1); + UtRegisterTest("IPPairBitTest07", IPPairBitTest07, 1); + UtRegisterTest("IPPairBitTest08", IPPairBitTest08, 1); + UtRegisterTest("IPPairBitTest09", IPPairBitTest09, 1); + UtRegisterTest("IPPairBitTest10", IPPairBitTest10, 1); + UtRegisterTest("IPPairBitTest11", IPPairBitTest11, 1); +#endif /* UNITTESTS */ +} diff --git a/src/ippair-bit.h b/src/ippair-bit.h new file mode 100644 index 0000000000..43019c920e --- /dev/null +++ b/src/ippair-bit.h @@ -0,0 +1,52 @@ +/* Copyright (C) 2007-2010 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien + */ + +#ifndef __IPPAIR_BIT_H__ +#define __IPPAIR_BIT_H__ + +#include "ippair.h" +#include "util-var.h" + +typedef struct XBit_ { + uint8_t type; /* type, DETECT_XBITS in this case */ + uint16_t idx; /* name idx */ + GenericVar *next; /* right now just implement this as a list, + * in the long run we have think of something + * faster. */ +} XBit; + +void XBitFree(XBit *fb); + +void IPPairBitInitCtx(void); +void IPPairBitFree(XBit *); +void IPPairBitRegisterTests(void); + +int IPPairHasIPPairBits(IPPair *host); + +void IPPairBitSet(IPPair *, uint16_t); +void IPPairBitUnset(IPPair *, uint16_t); +void IPPairBitToggle(IPPair *, uint16_t); +int IPPairBitIsset(IPPair *, uint16_t); +int IPPairBitIsnotset(IPPair *, uint16_t); + +#endif /* __IPPAIR_BIT_H__ */ diff --git a/src/runmode-unittests.c b/src/runmode-unittests.c index 1252dd9752..e7a8b34d27 100644 --- a/src/runmode-unittests.c +++ b/src/runmode-unittests.c @@ -62,6 +62,7 @@ #include "host.h" #include "host-bit.h" #include "ippair.h" +#include "ippair-bit.h" #include "unix-manager.h" #include "app-layer-detect-proto.h" @@ -198,6 +199,7 @@ void RunUnittests(int list_unittests, char *regex_arg) MpmRegisterTests(); FlowBitRegisterTests(); HostBitRegisterTests(); + IPPairBitRegisterTests(); SCPerfRegisterTests(); DecodePPPRegisterTests(); DecodeVLANRegisterTests(); diff --git a/src/suricata.c b/src/suricata.c index a6e022b5ce..5918708b8a 100644 --- a/src/suricata.c +++ b/src/suricata.c @@ -133,6 +133,8 @@ #include "host-bit.h" #include "ippair.h" +#include "ippair-bit.h" + #include "host.h" #include "unix-manager.h" @@ -2099,6 +2101,7 @@ static int PostConfLoadedSetup(SCInstance *suri) TagInitCtx(); ThresholdInit(); HostBitInitCtx(); + IPPairBitInitCtx(); if (DetectAddressTestConfVars() < 0) { SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, diff --git a/src/util-var.c b/src/util-var.c index b84f191187..fb0b1f4a99 100644 --- a/src/util-var.c +++ b/src/util-var.c @@ -32,6 +32,7 @@ #include "flow-bit.h" #include "pkt-var.h" #include "host-bit.h" +#include "ippair-bit.h" #include "util-debug.h" @@ -58,6 +59,13 @@ void GenericVarFree(GenericVar *gv) HostBitFree(fb); break; } + case DETECT_XBITS: + { + XBit *fb = (XBit *)gv; + //printf("GenericVarFree: fb %p, removing\n", fb); + XBitFree(fb); + break; + } case DETECT_FLOWVAR: { FlowVar *fv = (FlowVar *)gv;