aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/domain: move transform fully to rust

Browse Source
pull/13003/head
Victor Julien 4 months ago
parent 679d25ccd2
commit 88e96c9d49
9 changed files with 140 additions and 360 deletions
Show Stats Download Patch File Download Diff File

137
rust/src/detect/transforms/domain.rs
Unescape Escape View File

@ -0,0 +1,137 @@
/* Copyright (C) 2025 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
use super::{
DetectHelperTransformRegister, DetectSignatureAddTransform, InspectionBufferCheckAndExpand,
InspectionBufferLength, InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
};
use crate::detect::SIGMATCH_NOOPT;
use std::os::raw::{c_int, c_void};
use std::ptr;
static mut G_TRANSFORM_DOMAIN_ID: c_int = 0;
static mut G_TRANSFORM_TLD_ID: c_int = 0;
unsafe extern "C" fn domain_setup(
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
) -> c_int {
return DetectSignatureAddTransform(s, G_TRANSFORM_DOMAIN_ID, ptr::null_mut());
}
fn get_domain(input: &[u8], output: &mut [u8]) -> u32 {
if let Some(domain) = psl::domain(input) {
let domain = domain.as_bytes();
let len = domain.len();
output[0..len].copy_from_slice(domain);
return domain.len() as u32;
}
0
}
unsafe extern "C" fn domain_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
return;
}
let input = build_slice!(input, input_len as usize);
let output = InspectionBufferCheckAndExpand(buffer, input_len);
if output.is_null() {
// allocation failure
return;
}
let output = std::slice::from_raw_parts_mut(output, input_len as usize);
let output_len = get_domain(input, output);
InspectionBufferTruncate(buffer, output_len);
}
unsafe extern "C" fn tld_setup(
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
) -> c_int {
return DetectSignatureAddTransform(s, G_TRANSFORM_TLD_ID, ptr::null_mut());
}
fn get_tld(input: &[u8], output: &mut [u8]) -> u32 {
if let Some(domain) = psl::domain(input) {
let tldb = domain.suffix().as_bytes();
let len = tldb.len();
let domain = tldb;
output[0..len].copy_from_slice(domain);
return domain.len() as u32;
}
0
}
unsafe extern "C" fn tld_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
return;
}
let input = build_slice!(input, input_len as usize);
let output = InspectionBufferCheckAndExpand(buffer, input_len);
if output.is_null() {
// allocation failure
return;
}
let output = std::slice::from_raw_parts_mut(output, input_len as usize);
let output_len = get_tld(input, output);
InspectionBufferTruncate(buffer, output_len);
}
#[no_mangle]
pub unsafe extern "C" fn SCDetectTransformDomainRegister() {
let kw = SCTransformTableElmt {
name: b"domain\0".as_ptr() as *const libc::c_char,
desc: b"modify buffer to extract the domain\0".as_ptr() as *const libc::c_char,
url: b"/rules/transforms.html#domain\0".as_ptr() as *const libc::c_char,
Setup: domain_setup,
flags: SIGMATCH_NOOPT,
Transform: domain_transform,
Free: None,
TransformValidate: None,
};
unsafe {
G_TRANSFORM_DOMAIN_ID = DetectHelperTransformRegister(&kw);
if G_TRANSFORM_DOMAIN_ID < 0 {
SCLogWarning!("Failed registering transform domain");
}
}
let kw = SCTransformTableElmt {
name: b"tld\0".as_ptr() as *const libc::c_char,
desc: b"modify buffer to extract the tld\0".as_ptr() as *const libc::c_char,
url: b"/rules/transforms.html#tld\0".as_ptr() as *const libc::c_char,
Setup: tld_setup,
flags: SIGMATCH_NOOPT,
Transform: tld_transform,
Free: None,
TransformValidate: None,
};
unsafe {
G_TRANSFORM_TLD_ID = DetectHelperTransformRegister(&kw);
if G_TRANSFORM_TLD_ID < 0 {
SCLogWarning!("Failed registering transform tld");
}
}
}

3
rust/src/detect/transforms/mod.rs
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2024 Open Information Security Foundation
/* Copyright (C) 2024-2025 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
@ -21,6 +21,7 @@ use std::os::raw::{c_char, c_int, c_void};
pub mod casechange;
pub mod compress_whitespace;
pub mod domain;
pub mod dotprefix;
pub mod hash;
pub mod http_headers;

48
rust/src/domain.rs
Unescape Escape View File

@ -1,48 +0,0 @@
/* Copyright (C) 2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
use std::ptr;
#[no_mangle]
pub unsafe extern "C" fn rs_get_domain(input: *const u8, len: u32, output: *mut u8, olen: *mut u64) -> bool {
let slice: &[u8] = std::slice::from_raw_parts(input as *mut u8, len as usize);
let result = psl::domain(slice);
match result {
Some(x) => {
let domain = x.as_bytes();
ptr::copy(domain.as_ptr(), output, domain.len());
*olen = domain.len() as u64;
true
},
None => false
}
}
#[no_mangle]
pub unsafe extern "C" fn rs_get_tld(input: *const u8, len: u32, output: *mut u8, olen: *mut u64) -> bool {
let slice: &[u8] = std::slice::from_raw_parts(input as *mut u8, len as usize);
let result = psl::domain(slice);
match result {
Some(x) => {
let tld = x.suffix().as_bytes();
ptr::copy(tld.as_ptr(), output, tld.len());
*olen = tld.len() as u64;
true
},
None => false
}
}

1
rust/src/lib.rs
Unescape Escape View File

@ -138,7 +138,6 @@ pub mod sdp;
pub mod ldap;
pub mod flow;
pub mod direction;
pub mod domain;
#[allow(unused_imports)]
pub use suricata_lua_sys;

2
src/Makefile.am
Unescape Escape View File

@ -312,7 +312,6 @@ noinst_HEADERS = \
detect-tls-random.h \
detect-tos.h \
detect-transform-base64.h \
detect-transform-domain.h \
detect-transform-pcrexform.h \
detect-ttl.h \
detect-udphdr.h \
@ -900,7 +899,6 @@ libsuricata_c_a_SOURCES = \
detect-tls-random.c \
detect-tos.c \
detect-transform-base64.c \
detect-transform-domain.c\
detect-transform-pcrexform.c \
detect-ttl.c \
detect-udphdr.c \

3
src/detect-engine-register.c
Unescape Escape View File

@ -223,7 +223,6 @@
#include "detect-transform-pcrexform.h"
#include "detect-transform-base64.h"
#include "detect-transform-domain.h"
#include "util-rule-vars.h"
@ -739,7 +738,7 @@ void SigTableSetup(void)
DetectTransformToUpperRegister();
DetectTransformHeaderLowercaseRegister();
DetectTransformFromBase64DecodeRegister();
DetectTransformDomainRegister();
SCDetectTransformDomainRegister();
DetectFileHandlerRegister();

2
src/detect-engine-register.h
Unescape Escape View File

@ -318,8 +318,6 @@ enum DetectKeywordId {
DETECT_TRANSFORM_TOUPPER,
DETECT_TRANSFORM_HEADER_LOWERCASE,
DETECT_TRANSFORM_FROM_BASE64,
DETECT_TRANSFORM_DOMAIN,
DETECT_TRANSFORM_TLD,
DETECT_IKE_EXCH_TYPE,
DETECT_IKE_SPI_INITIATOR,

274
src/detect-transform-domain.c
Unescape Escape View File

@ -1,274 +0,0 @@
/* Copyright (C) 2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Eric Leblond <el@stamus-networks.com>
*
* Implements the domain extraction transformation
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-prefilter.h"
#include "detect-parse.h"
#include "detect-transform-domain.h"
#include "detect-engine-build.h"
#include "util-unittest.h"
#include "util-print.h"
#include "util-memrchr.h"
#include "util-memcpy.h"
#include "rust.h"
static int DetectTransformDomainSetup(DetectEngineCtx *, Signature *, const char *);
static int DetectTransformTLDSetup(DetectEngineCtx *, Signature *, const char *);
#ifdef UNITTESTS
static void DetectTransformDomainRegisterTests(void);
static void DetectTransformTLDRegisterTests(void);
#endif
static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options);
static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options);
void DetectTransformDomainRegister(void)
{
sigmatch_table[DETECT_TRANSFORM_DOMAIN].name = "domain";
sigmatch_table[DETECT_TRANSFORM_DOMAIN].desc = "modify buffer to extract the domain";
sigmatch_table[DETECT_TRANSFORM_DOMAIN].url = "/rules/transforms.html#domain";
sigmatch_table[DETECT_TRANSFORM_DOMAIN].Transform = TransformDomain;
sigmatch_table[DETECT_TRANSFORM_DOMAIN].Setup = DetectTransformDomainSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_TRANSFORM_DOMAIN].RegisterTests = DetectTransformDomainRegisterTests;
#endif
sigmatch_table[DETECT_TRANSFORM_DOMAIN].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TRANSFORM_TLD].name = "tld";
sigmatch_table[DETECT_TRANSFORM_TLD].desc = "modify buffer to extract the tld";
sigmatch_table[DETECT_TRANSFORM_TLD].url = "/rules/transforms.html#tld";
sigmatch_table[DETECT_TRANSFORM_TLD].Transform = TransformTLD;
sigmatch_table[DETECT_TRANSFORM_TLD].Setup = DetectTransformTLDSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_TRANSFORM_TLD].RegisterTests = DetectTransformTLDRegisterTests;
#endif
sigmatch_table[DETECT_TRANSFORM_TLD].flags |= SIGMATCH_NOOPT;
}
/**
* \internal
* \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent
* \param det_ctx detection engine ctx
* \param s signature
* \param nullstr should be null
* \retval 0 ok
* \retval -1 failure
*/
static int DetectTransformDomainSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
{
SCEnter();
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_DOMAIN, NULL);
SCReturnInt(r);
}
/**
* \brief Return the domain, if any, in the last pattern match.
*
*/
static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options)
{
const size_t input_len = buffer->inspect_len;
uint64_t output_len = 0;
if (input_len) {
uint8_t output[input_len];
bool res = rs_get_domain(buffer->inspect, input_len, output, &output_len);
if (res == true) {
InspectionBufferCopy(buffer, output, output_len);
}
}
}
/**
* \internal
* \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent
* \param det_ctx detection engine ctx
* \param s signature
* \param nullstr should be null
* \retval 0 ok
* \retval -1 failure
*/
static int DetectTransformTLDSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
{
SCEnter();
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_TLD, NULL);
SCReturnInt(r);
}
/**
* \brief Return the domain, if any, in the last pattern match.
*
*/
static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options)
{
const size_t input_len = buffer->inspect_len;
uint64_t output_len = 0;
if (input_len) {
uint8_t output[input_len];
bool res = rs_get_tld(buffer->inspect, input_len, output, &output_len);
if (res == true) {
InspectionBufferCopy(buffer, output, output_len);
}
}
}
#ifdef UNITTESTS
static int DetectTransformDomainTest01(void)
{
const uint8_t *input = (const uint8_t *)"www.example.com";
uint32_t input_len = strlen((char *)input);
const char *result = "example.com";
uint32_t result_len = strlen((char *)result);
InspectionBuffer buffer;
InspectionBufferInit(&buffer, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformDomain(NULL, &buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
FAIL_IF_NOT(buffer.inspect_len == result_len);
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
InspectionBufferFree(&buffer);
PASS;
}
static int DetectTransformDomainTest02(void)
{
const uint8_t *input = (const uint8_t *)"hello.example.co.uk";
uint32_t input_len = strlen((char *)input);
const char *result = "example.co.uk";
uint32_t result_len = strlen((char *)result);
InspectionBuffer buffer;
InspectionBufferInit(&buffer, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformDomain(NULL, &buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
FAIL_IF_NOT(buffer.inspect_len == result_len);
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
InspectionBufferFree(&buffer);
PASS;
}
static int DetectTransformDomainTest03(void)
{
const char rule[] =
"alert dns any any -> any any (dns.query; domain; content:\"google.com\"; sid:1;)";
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
memset(&th_v, 0, sizeof(th_v));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
Signature *s = DetectEngineAppendSig(de_ctx, rule);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
}
static void DetectTransformDomainRegisterTests(void)
{
UtRegisterTest("DetectTransformDomainTest01", DetectTransformDomainTest01);
UtRegisterTest("DetectTransformDomainTest02", DetectTransformDomainTest02);
UtRegisterTest("DetectTransformDomainTest03", DetectTransformDomainTest03);
}
static int DetectTransformTLDTest01(void)
{
const uint8_t *input = (const uint8_t *)"www.example.com";
uint32_t input_len = strlen((char *)input);
const char *result = "com";
uint32_t result_len = strlen((char *)result);
InspectionBuffer buffer;
InspectionBufferInit(&buffer, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformTLD(NULL, &buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
FAIL_IF_NOT(buffer.inspect_len == result_len);
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
InspectionBufferFree(&buffer);
PASS;
}
static int DetectTransformTLDTest02(void)
{
const uint8_t *input = (const uint8_t *)"hello.example.co.uk";
uint32_t input_len = strlen((char *)input);
const char *result = "co.uk";
uint32_t result_len = strlen((char *)result);
InspectionBuffer buffer;
InspectionBufferInit(&buffer, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformTLD(NULL, &buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
FAIL_IF_NOT(buffer.inspect_len == result_len);
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
InspectionBufferFree(&buffer);
PASS;
}
static int DetectTransformTLDTest03(void)
{
const char rule[] = "alert dns any any -> any any (dns.query; tld; content:\"com\"; sid:1;)";
ThreadVars th_v;
DetectEngineThreadCtx *det_ctx = NULL;
memset(&th_v, 0, sizeof(th_v));
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
Signature *s = DetectEngineAppendSig(de_ctx, rule);
FAIL_IF_NULL(s);
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
DetectEngineCtxFree(de_ctx);
PASS;
}
static void DetectTransformTLDRegisterTests(void)
{
UtRegisterTest("DetectTransformTLDTest01", DetectTransformTLDTest01);
UtRegisterTest("DetectTransformTLDTest02", DetectTransformTLDTest02);
UtRegisterTest("DetectTransformTLDTest03", DetectTransformTLDTest03);
}
#endif

30
src/detect-transform-domain.h
Unescape Escape View File

@ -1,30 +0,0 @@
/* Copyright (C) 2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Eric Leblond <el@stamus-networks.com>
*/
#ifndef __DETECT_TRANSFORM_DOMAIN_H__
#define __DETECT_TRANSFORM_DOMAIN_H__
/* prototypes */
void DetectTransformDomainRegister(void);
#endif /* __DETECT_TRANSFORM_DOMAIN_H__ */
Write Preview
Loading…
Cancel
Save