aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/alert: split append func per packet/tx

Browse Source
pull/15789/head
Victor Julien 4 months ago
parent 74bc0feb1a
commit 695c9d8d20
4 changed files with 63 additions and 26 deletions
Show Stats Download Patch File Download Diff File

35
src/detect-engine-alert.c
Unescape Escape View File

@ -392,8 +392,8 @@ static inline PacketAlert PacketAlertSet(
/**
* \brief Append signature to local packet alert queue for later preprocessing
*/
void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id,
uint8_t alert_flags)
static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags)
{
/* first time we see a drop action signature, set that in the packet */
/* we do that even before inserting into the queue, so we save it even if appending fails */
@ -418,6 +418,37 @@ void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet
det_ctx->alert_queue_size++;
}
/**
* \brief Append signature to local packet alert queue for later preprocessing
*/
void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags)
{
alert_flags |= (PACKET_ALERT_FLAG_TX | PACKET_ALERT_FLAG_STATE_MATCH);
return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
}
/**
* \brief Append signature to local packet alert queue for later preprocessing
* This does not automatically set PACKET_ALERT_FLAG_STATE_MATCH as this
* comes from the packet alert path.
*/
void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags)
{
alert_flags |= PACKET_ALERT_FLAG_TX;
return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
}
/**
* \brief Append signature to local packet alert queue for later preprocessing
*/
void AlertQueueAppendPacket(
DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags)
{
return AlertQueueAppend(det_ctx, s, p, PACKET_ALERT_NOTX, alert_flags);
}
/** \internal
* \brief sort helper for sorting alerts by priority
*

8
src/detect-engine-alert.h
Unescape Escape View File

@ -30,8 +30,12 @@
void AlertQueueInit(DetectEngineThreadCtx *det_ctx);
void AlertQueueFree(DetectEngineThreadCtx *det_ctx);
void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id,
uint8_t alert_flags);
void AlertQueueAppendPacket(
DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags);
void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags);
void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags);
void PacketAlertFinalize(const DetectEngineCtx *, DetectEngineThreadCtx *, Packet *);
#ifdef UNITTESTS
int PacketAlertCheck(Packet *, uint32_t);

2
src/detect-engine-iponly.c
Unescape Escape View File

@ -1113,7 +1113,7 @@ void IPOnlyMatchPacket(ThreadVars *tv, const DetectEngineCtx *de_ctx,
}
}
}
AlertQueueAppend(det_ctx, s, p, 0, 0);
AlertQueueAppendPacket(det_ctx, s, p, 0);
}
}
}

44
src/detect.c
Unescape Escape View File

@ -739,7 +739,7 @@ static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx,
}
Signature *s = de_ctx->fw_policies->pkt_policy_signatures[policy];
if (s != NULL) {
AlertQueueAppend(det_ctx, s, p, 0, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
AlertQueueAppendPacket(det_ctx, s, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
}
return p->action;
}
@ -875,7 +875,11 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
}
}
}
AlertQueueAppend(det_ctx, s, p, txid, alert_flags);
if (alert_flags & PACKET_ALERT_FLAG_TX) {
AlertQueueAppendAppTx(det_ctx, s, p, txid, alert_flags);
} else {
AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
}
if (det_ctx->post_rule_work_queue.len > 0) {
/* run post match prefilter engines on work queue */
@ -1668,8 +1672,7 @@ static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *d
det_ctx->de_ctx->fw_policies, alproto, direction, hook);
BUG_ON(s == NULL);
uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
alert_flags |= PACKET_ALERT_FLAG_TX;
AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
AlertQueueAppendAppTx(det_ctx, s, p, tx_id, alert_flags);
}
}
@ -2002,7 +2005,7 @@ static void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet
default_accept.flags = SIG_FLAG_FIREWALL;
default_accept.detect_table =
DETECT_TABLE_APP_FILTER; // TODO review, hope this makes it last in sorting
AlertQueueAppend(det_ctx, &default_accept, p, 0, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
AlertQueueAppendPacket(det_ctx, &default_accept, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
}
/** \internal
@ -2156,8 +2159,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Flow *f, Packet *p,
const uint8_t flow_flags)
{
uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX);
if (s->action & ACTION_ACCEPT) {
/* add alert now, as ApplyAccept may also trigger
* policy matches that could add alerts. */
SCLogDebug("append alert");
/* see if we need to apply tx/hook accept to the packet. This can be needed
* when we've completed the inspection so far for an incomplete tx, and an
* accept:tx or accept:hook is the last match.*/
@ -2165,14 +2170,11 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
if (fw_accept_to_packet) {
SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
SCLogDebug("accept:(tx|hook): should be applied to the packet");
alert_flags |= PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET;
AlertQueueAppendAppTx(
det_ctx, s, p, tx->tx_id, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
} else {
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
}
SCLogDebug("append alert");
/* add alert now, as ApplyAccept may also trigger
* policy matches that could add alerts. */
AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
} else if (s->action & ACTION_DROP) {
SCLogDebug("drop packet because of rule with drop action");
@ -2183,10 +2185,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
f->flags |= FLOW_ACTION_BY_FIREWALL;
}
SCLogDebug("append alert");
AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
} else {
SCLogDebug("append alert");
AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
}
}
@ -2559,8 +2561,7 @@ static void DetectRunTx(ThreadVars *tv,
"%p/%" PRIu64 " sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->iid);
if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
AlertQueueAppend(det_ctx, s, p, tx.tx_id,
(PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX));
AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, 0);
} else {
DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags);
}
@ -2763,15 +2764,16 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin
if (r) {
/* match */
DetectRunPostMatch(tv, det_ctx, p, s);
uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
det_ctx->frame_id = frame->id;
SCLogDebug(
"%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->iid);
const uint8_t alert_flags =
(PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
if (frame->flags & FRAME_FLAG_TX_ID_SET) {
alert_flags |= PACKET_ALERT_FLAG_TX;
AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, alert_flags);
} else {
AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
}
AlertQueueAppend(det_ctx, s, p, frame->tx_id, alert_flags);
}
}
DetectVarProcessList(det_ctx, p->flow, p);

Write Preview
Loading…
Cancel
Save