aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/alert: store sub-state in PacketAlert

Browse Source 
In preparation of being able to log it.
pull/15846/head
Victor Julien 2 weeks ago
parent 17a3e0d44f
commit 7e60c3205e
4 changed files with 35 additions and 24 deletions
Show Stats Download Patch File Download Diff File

1
src/decode.h
Unescape Escape View File

@ -250,6 +250,7 @@ typedef struct PacketAlert_ {
SigIntId iid; /* Internal ID, used for sorting */
uint8_t action; /* Rule or threshold action to be applied to packet */
uint8_t flags;
uint8_t sub_state; /**< tx sub state. 0 if not used. */
const struct Signature_ *s;
uint64_t tx_id; /* Used for sorting */
int64_t frame_id;

21
src/detect-engine-alert.c
Unescape Escape View File

@ -374,8 +374,8 @@ static inline int PacketAlertSetContext(
/** \internal
*/
static inline PacketAlert PacketAlertSet(
DetectEngineThreadCtx *det_ctx, const Signature *s, uint64_t tx_id, uint8_t alert_flags)
static inline PacketAlert PacketAlertSet(DetectEngineThreadCtx *det_ctx, const Signature *s,
uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags)
{
PacketAlert pa;
pa.iid = s->iid;
@ -384,6 +384,7 @@ static inline PacketAlert PacketAlertSet(
pa.flags = alert_flags;
/* Set tx_id if the frame has it */
pa.tx_id = tx_id;
pa.sub_state = sub_state;
pa.frame_id = (alert_flags & PACKET_ALERT_FLAG_FRAME) ? det_ctx->frame_id : 0;
PacketAlertSetContext(det_ctx, &pa, s);
return pa;
@ -393,12 +394,12 @@ static inline PacketAlert PacketAlertSet(
* \brief Append signature to local packet alert queue for later preprocessing
*/
static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags)
const uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags)
{
/* first time we see a drop action signature, set that in the packet */
/* we do that even before inserting into the queue, so we save it even if appending fails */
if (p->alerts.drop.action == 0 && s->action & ACTION_DROP) {
p->alerts.drop = PacketAlertSet(det_ctx, s, tx_id, alert_flags);
p->alerts.drop = PacketAlertSet(det_ctx, s, tx_id, sub_state, alert_flags);
SCLogDebug("sid %u: set PacketAlert drop action. s->iid %" PRIu32 "", s->id, s->iid);
}
@ -411,7 +412,7 @@ static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s,
return;
}
}
det_ctx->alert_queue[pos] = PacketAlertSet(det_ctx, s, tx_id, alert_flags);
det_ctx->alert_queue[pos] = PacketAlertSet(det_ctx, s, tx_id, sub_state, alert_flags);
SCLogDebug("packet %" PRIu64 ": appending sid %" PRIu32 ", s->iid %" PRIu32 " to alert queue",
PcapPacketCntGet(p), s->id, s->iid);
@ -422,10 +423,10 @@ static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s,
* \brief Append signature to local packet alert queue for later preprocessing
*/
void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags)
uint64_t tx_id, uint8_t sub_state, uint8_t alert_flags)
{
alert_flags |= (PACKET_ALERT_FLAG_TX | PACKET_ALERT_FLAG_STATE_MATCH);
return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
return AlertQueueAppend(det_ctx, s, p, tx_id, sub_state, alert_flags);
}
/**
@ -434,10 +435,10 @@ void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, P
* comes from the packet alert path.
*/
void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags)
uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags)
{
alert_flags |= PACKET_ALERT_FLAG_TX;
return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
return AlertQueueAppend(det_ctx, s, p, tx_id, sub_state, alert_flags);
}
/**
@ -446,7 +447,7 @@ void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signa
void AlertQueueAppendPacket(
DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags)
{
return AlertQueueAppend(det_ctx, s, p, PACKET_ALERT_NOTX, alert_flags);
return AlertQueueAppend(det_ctx, s, p, PACKET_ALERT_NOTX, 0, alert_flags);
}
/** \internal

4
src/detect-engine-alert.h
Unescape Escape View File

@ -33,9 +33,9 @@ void AlertQueueFree(DetectEngineThreadCtx *det_ctx);
void AlertQueueAppendPacket(
DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags);
void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags);
uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags);
void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
uint64_t tx_id, uint8_t alert_flags);
uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags);
void PacketAlertFinalize(const DetectEngineCtx *, DetectEngineThreadCtx *, Packet *);
#ifdef UNITTESTS
int PacketAlertCheck(Packet *, uint32_t);

33
src/detect.c
Unescape Escape View File

@ -771,7 +771,7 @@ static void DetectRulePacketAppendAlert(const DetectEngineCtx *de_ctx,
alert_flags |= PACKET_ALERT_FLAG_TX_GUESSED;
}
txd->guessed_applayer_logged++;
AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx_id, alert_flags);
AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx_id, txd->tx_type, alert_flags);
return;
}
}
@ -1719,13 +1719,14 @@ struct DetectFirewallAppTxState {
};
static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *det_ctx, Packet *p,
const bool apply_to_packet, const uint64_t tx_id, const struct DetectFirewallAppPolicy *ap)
const bool apply_to_packet, const DetectTransaction *tx,
const struct DetectFirewallAppPolicy *ap)
{
if (EngineModeIsFirewall()) {
const Signature *s = ap->alert_signature;
BUG_ON(s == NULL);
uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
AlertQueueAppendAppTx(det_ctx, s, p, tx_id, alert_flags);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, alert_flags);
}
}
@ -1763,7 +1764,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
}
if (policy->action & ACTION_ALERT) {
DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx->tx_id, ap);
DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx, ap);
}
} else if (policy->action & ACTION_ACCEPT) {
/* should the accept be applied to the packet?
@ -1796,7 +1797,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
if (policy->action & ACTION_ALERT) {
SCLogDebug("policy alert, do the append");
DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx->tx_id, ap);
DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx, ap);
} else if (apply_to_packet) {
SCLogDebug("default accept: last_tx");
DetectRunAppendDefaultAccept(det_ctx, p);
@ -2221,10 +2222,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
if (fw_accept_to_packet) {
SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
SCLogDebug("accept:(tx|hook): should be applied to the packet");
AlertQueueAppendAppTx(
det_ctx, s, p, tx->tx_id, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type,
PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
} else {
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
}
DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
} else if (s->action & ACTION_DROP) {
@ -2236,10 +2237,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
f->flags |= FLOW_ACTION_BY_FIREWALL;
}
SCLogDebug("append alert");
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
} else {
SCLogDebug("append alert");
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0);
}
}
@ -2615,7 +2616,7 @@ static void DetectRunTx(ThreadVars *tv,
"%p/%" PRIu64 " sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->iid);
if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, 0);
AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, tx.tx_type, 0);
} else {
DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags);
}
@ -2832,7 +2833,15 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin
const uint8_t alert_flags =
(PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
if (frame->flags & FRAME_FLAG_TX_ID_SET) {
AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, alert_flags);
const uint8_t ipproto = p->proto;
uint8_t sub_state = 0;
void *tx = AppLayerParserGetTx(
ipproto, alproto, p->flow->alstate, frame->tx_id);
if (tx) {
AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
sub_state = txd->tx_type;
}
AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, sub_state, alert_flags);
} else {
AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
}

Write Preview
Loading…
Cancel
Save