From 7e60c3205ea331eeb0fbf289dd49a1d5411a92fe Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 26 Jun 2026 12:21:02 +0200 Subject: [PATCH] detect/alert: store sub-state in PacketAlert In preparation of being able to log it. --- src/decode.h | 1 + src/detect-engine-alert.c | 21 +++++++++++---------- src/detect-engine-alert.h | 4 ++-- src/detect.c | 33 +++++++++++++++++++++------------ 4 files changed, 35 insertions(+), 24 deletions(-) diff --git a/src/decode.h b/src/decode.h index b44906d06a..c7e8e31d98 100644 --- a/src/decode.h +++ b/src/decode.h @@ -250,6 +250,7 @@ typedef struct PacketAlert_ { SigIntId iid; /* Internal ID, used for sorting */ uint8_t action; /* Rule or threshold action to be applied to packet */ uint8_t flags; + uint8_t sub_state; /**< tx sub state. 0 if not used. */ const struct Signature_ *s; uint64_t tx_id; /* Used for sorting */ int64_t frame_id; diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index 8bab2ff3c6..38d262c364 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -374,8 +374,8 @@ static inline int PacketAlertSetContext( /** \internal */ -static inline PacketAlert PacketAlertSet( - DetectEngineThreadCtx *det_ctx, const Signature *s, uint64_t tx_id, uint8_t alert_flags) +static inline PacketAlert PacketAlertSet(DetectEngineThreadCtx *det_ctx, const Signature *s, + uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags) { PacketAlert pa; pa.iid = s->iid; @@ -384,6 +384,7 @@ static inline PacketAlert PacketAlertSet( pa.flags = alert_flags; /* Set tx_id if the frame has it */ pa.tx_id = tx_id; + pa.sub_state = sub_state; pa.frame_id = (alert_flags & PACKET_ALERT_FLAG_FRAME) ? det_ctx->frame_id : 0; PacketAlertSetContext(det_ctx, &pa, s); return pa; @@ -393,12 +394,12 @@ static inline PacketAlert PacketAlertSet( * \brief Append signature to local packet alert queue for later preprocessing */ static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, - uint64_t tx_id, uint8_t alert_flags) + const uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags) { /* first time we see a drop action signature, set that in the packet */ /* we do that even before inserting into the queue, so we save it even if appending fails */ if (p->alerts.drop.action == 0 && s->action & ACTION_DROP) { - p->alerts.drop = PacketAlertSet(det_ctx, s, tx_id, alert_flags); + p->alerts.drop = PacketAlertSet(det_ctx, s, tx_id, sub_state, alert_flags); SCLogDebug("sid %u: set PacketAlert drop action. s->iid %" PRIu32 "", s->id, s->iid); } @@ -411,7 +412,7 @@ static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, return; } } - det_ctx->alert_queue[pos] = PacketAlertSet(det_ctx, s, tx_id, alert_flags); + det_ctx->alert_queue[pos] = PacketAlertSet(det_ctx, s, tx_id, sub_state, alert_flags); SCLogDebug("packet %" PRIu64 ": appending sid %" PRIu32 ", s->iid %" PRIu32 " to alert queue", PcapPacketCntGet(p), s->id, s->iid); @@ -422,10 +423,10 @@ static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, * \brief Append signature to local packet alert queue for later preprocessing */ void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, - uint64_t tx_id, uint8_t alert_flags) + uint64_t tx_id, uint8_t sub_state, uint8_t alert_flags) { alert_flags |= (PACKET_ALERT_FLAG_TX | PACKET_ALERT_FLAG_STATE_MATCH); - return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags); + return AlertQueueAppend(det_ctx, s, p, tx_id, sub_state, alert_flags); } /** @@ -434,10 +435,10 @@ void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, P * comes from the packet alert path. */ void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, - uint64_t tx_id, uint8_t alert_flags) + uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags) { alert_flags |= PACKET_ALERT_FLAG_TX; - return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags); + return AlertQueueAppend(det_ctx, s, p, tx_id, sub_state, alert_flags); } /** @@ -446,7 +447,7 @@ void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signa void AlertQueueAppendPacket( DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags) { - return AlertQueueAppend(det_ctx, s, p, PACKET_ALERT_NOTX, alert_flags); + return AlertQueueAppend(det_ctx, s, p, PACKET_ALERT_NOTX, 0, alert_flags); } /** \internal diff --git a/src/detect-engine-alert.h b/src/detect-engine-alert.h index 259444d5e9..63bed72057 100644 --- a/src/detect-engine-alert.h +++ b/src/detect-engine-alert.h @@ -33,9 +33,9 @@ void AlertQueueFree(DetectEngineThreadCtx *det_ctx); void AlertQueueAppendPacket( DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags); void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, - uint64_t tx_id, uint8_t alert_flags); + uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags); void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, - uint64_t tx_id, uint8_t alert_flags); + uint64_t tx_id, const uint8_t sub_state, uint8_t alert_flags); void PacketAlertFinalize(const DetectEngineCtx *, DetectEngineThreadCtx *, Packet *); #ifdef UNITTESTS int PacketAlertCheck(Packet *, uint32_t); diff --git a/src/detect.c b/src/detect.c index 96ce6c1ef8..713a069bd0 100644 --- a/src/detect.c +++ b/src/detect.c @@ -771,7 +771,7 @@ static void DetectRulePacketAppendAlert(const DetectEngineCtx *de_ctx, alert_flags |= PACKET_ALERT_FLAG_TX_GUESSED; } txd->guessed_applayer_logged++; - AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx_id, alert_flags); + AlertQueueAppendAppTxFromPacket(det_ctx, s, p, tx_id, txd->tx_type, alert_flags); return; } } @@ -1719,13 +1719,14 @@ struct DetectFirewallAppTxState { }; static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *det_ctx, Packet *p, - const bool apply_to_packet, const uint64_t tx_id, const struct DetectFirewallAppPolicy *ap) + const bool apply_to_packet, const DetectTransaction *tx, + const struct DetectFirewallAppPolicy *ap) { if (EngineModeIsFirewall()) { const Signature *s = ap->alert_signature; BUG_ON(s == NULL); uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0; - AlertQueueAppendAppTx(det_ctx, s, p, tx_id, alert_flags); + AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, alert_flags); } } @@ -1763,7 +1764,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy( p->flow->flags |= FLOW_ACTION_BY_FIREWALL; } if (policy->action & ACTION_ALERT) { - DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx->tx_id, ap); + DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx, ap); } } else if (policy->action & ACTION_ACCEPT) { /* should the accept be applied to the packet? @@ -1796,7 +1797,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy( if (policy->action & ACTION_ALERT) { SCLogDebug("policy alert, do the append"); - DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx->tx_id, ap); + DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx, ap); } else if (apply_to_packet) { SCLogDebug("default accept: last_tx"); DetectRunAppendDefaultAccept(det_ctx, p); @@ -2221,10 +2222,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con if (fw_accept_to_packet) { SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p)); SCLogDebug("accept:(tx|hook): should be applied to the packet"); - AlertQueueAppendAppTx( - det_ctx, s, p, tx->tx_id, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET); + AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, + PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET); } else { - AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0); + AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0); } DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state); } else if (s->action & ACTION_DROP) { @@ -2236,10 +2237,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con f->flags |= FLOW_ACTION_BY_FIREWALL; } SCLogDebug("append alert"); - AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0); + AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0); } else { SCLogDebug("append alert"); - AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0); + AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, tx->tx_type, 0); } } @@ -2615,7 +2616,7 @@ static void DetectRunTx(ThreadVars *tv, "%p/%" PRIu64 " sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->iid); if ((s->flags & SIG_FLAG_FIREWALL) == 0) { - AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, 0); + AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, tx.tx_type, 0); } else { DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags); } @@ -2832,7 +2833,15 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin const uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME); if (frame->flags & FRAME_FLAG_TX_ID_SET) { - AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, alert_flags); + const uint8_t ipproto = p->proto; + uint8_t sub_state = 0; + void *tx = AppLayerParserGetTx( + ipproto, alproto, p->flow->alstate, frame->tx_id); + if (tx) { + AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx); + sub_state = txd->tx_type; + } + AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, sub_state, alert_flags); } else { AlertQueueAppendPacket(det_ctx, s, p, alert_flags); }