From 88e96c9d49855b38db0333309becfa067ba43f25 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 8 Apr 2025 20:19:36 +0200 Subject: [PATCH] detect/domain: move transform fully to rust --- rust/src/detect/transforms/domain.rs | 137 ++++++++++++++ rust/src/detect/transforms/mod.rs | 3 +- rust/src/domain.rs | 48 ----- rust/src/lib.rs | 1 - src/Makefile.am | 2 - src/detect-engine-register.c | 3 +- src/detect-engine-register.h | 2 - src/detect-transform-domain.c | 274 --------------------------- src/detect-transform-domain.h | 30 --- 9 files changed, 140 insertions(+), 360 deletions(-) create mode 100644 rust/src/detect/transforms/domain.rs delete mode 100644 rust/src/domain.rs delete mode 100644 src/detect-transform-domain.c delete mode 100644 src/detect-transform-domain.h diff --git a/rust/src/detect/transforms/domain.rs b/rust/src/detect/transforms/domain.rs new file mode 100644 index 0000000000..347366754c --- /dev/null +++ b/rust/src/detect/transforms/domain.rs @@ -0,0 +1,137 @@ +/* Copyright (C) 2025 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +use super::{ + DetectHelperTransformRegister, DetectSignatureAddTransform, InspectionBufferCheckAndExpand, + InspectionBufferLength, InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt, +}; +use crate::detect::SIGMATCH_NOOPT; +use std::os::raw::{c_int, c_void}; +use std::ptr; + +static mut G_TRANSFORM_DOMAIN_ID: c_int = 0; +static mut G_TRANSFORM_TLD_ID: c_int = 0; + +unsafe extern "C" fn domain_setup( + _de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char, +) -> c_int { + return DetectSignatureAddTransform(s, G_TRANSFORM_DOMAIN_ID, ptr::null_mut()); +} + +fn get_domain(input: &[u8], output: &mut [u8]) -> u32 { + if let Some(domain) = psl::domain(input) { + let domain = domain.as_bytes(); + let len = domain.len(); + output[0..len].copy_from_slice(domain); + return domain.len() as u32; + } + 0 +} + +unsafe extern "C" fn domain_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) { + let input = InspectionBufferPtr(buffer); + let input_len = InspectionBufferLength(buffer); + if input.is_null() || input_len == 0 { + return; + } + let input = build_slice!(input, input_len as usize); + + let output = InspectionBufferCheckAndExpand(buffer, input_len); + if output.is_null() { + // allocation failure + return; + } + let output = std::slice::from_raw_parts_mut(output, input_len as usize); + + let output_len = get_domain(input, output); + + InspectionBufferTruncate(buffer, output_len); +} + +unsafe extern "C" fn tld_setup( + _de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char, +) -> c_int { + return DetectSignatureAddTransform(s, G_TRANSFORM_TLD_ID, ptr::null_mut()); +} + +fn get_tld(input: &[u8], output: &mut [u8]) -> u32 { + if let Some(domain) = psl::domain(input) { + let tldb = domain.suffix().as_bytes(); + let len = tldb.len(); + let domain = tldb; + output[0..len].copy_from_slice(domain); + return domain.len() as u32; + } + 0 +} + +unsafe extern "C" fn tld_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) { + let input = InspectionBufferPtr(buffer); + let input_len = InspectionBufferLength(buffer); + if input.is_null() || input_len == 0 { + return; + } + let input = build_slice!(input, input_len as usize); + + let output = InspectionBufferCheckAndExpand(buffer, input_len); + if output.is_null() { + // allocation failure + return; + } + let output = std::slice::from_raw_parts_mut(output, input_len as usize); + + let output_len = get_tld(input, output); + + InspectionBufferTruncate(buffer, output_len); +} + +#[no_mangle] +pub unsafe extern "C" fn SCDetectTransformDomainRegister() { + let kw = SCTransformTableElmt { + name: b"domain\0".as_ptr() as *const libc::c_char, + desc: b"modify buffer to extract the domain\0".as_ptr() as *const libc::c_char, + url: b"/rules/transforms.html#domain\0".as_ptr() as *const libc::c_char, + Setup: domain_setup, + flags: SIGMATCH_NOOPT, + Transform: domain_transform, + Free: None, + TransformValidate: None, + }; + unsafe { + G_TRANSFORM_DOMAIN_ID = DetectHelperTransformRegister(&kw); + if G_TRANSFORM_DOMAIN_ID < 0 { + SCLogWarning!("Failed registering transform domain"); + } + } + + let kw = SCTransformTableElmt { + name: b"tld\0".as_ptr() as *const libc::c_char, + desc: b"modify buffer to extract the tld\0".as_ptr() as *const libc::c_char, + url: b"/rules/transforms.html#tld\0".as_ptr() as *const libc::c_char, + Setup: tld_setup, + flags: SIGMATCH_NOOPT, + Transform: tld_transform, + Free: None, + TransformValidate: None, + }; + unsafe { + G_TRANSFORM_TLD_ID = DetectHelperTransformRegister(&kw); + if G_TRANSFORM_TLD_ID < 0 { + SCLogWarning!("Failed registering transform tld"); + } + } +} diff --git a/rust/src/detect/transforms/mod.rs b/rust/src/detect/transforms/mod.rs index bb542f485d..56f8494489 100644 --- a/rust/src/detect/transforms/mod.rs +++ b/rust/src/detect/transforms/mod.rs @@ -1,4 +1,4 @@ -/* Copyright (C) 2024 Open Information Security Foundation +/* Copyright (C) 2024-2025 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -21,6 +21,7 @@ use std::os::raw::{c_char, c_int, c_void}; pub mod casechange; pub mod compress_whitespace; +pub mod domain; pub mod dotprefix; pub mod hash; pub mod http_headers; diff --git a/rust/src/domain.rs b/rust/src/domain.rs deleted file mode 100644 index bfdccdc77e..0000000000 --- a/rust/src/domain.rs +++ /dev/null @@ -1,48 +0,0 @@ -/* Copyright (C) 2022 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -use std::ptr; - -#[no_mangle] -pub unsafe extern "C" fn rs_get_domain(input: *const u8, len: u32, output: *mut u8, olen: *mut u64) -> bool { - let slice: &[u8] = std::slice::from_raw_parts(input as *mut u8, len as usize); - let result = psl::domain(slice); - match result { - Some(x) => { - let domain = x.as_bytes(); - ptr::copy(domain.as_ptr(), output, domain.len()); - *olen = domain.len() as u64; - true - }, - None => false - } -} - -#[no_mangle] -pub unsafe extern "C" fn rs_get_tld(input: *const u8, len: u32, output: *mut u8, olen: *mut u64) -> bool { - let slice: &[u8] = std::slice::from_raw_parts(input as *mut u8, len as usize); - let result = psl::domain(slice); - match result { - Some(x) => { - let tld = x.suffix().as_bytes(); - ptr::copy(tld.as_ptr(), output, tld.len()); - *olen = tld.len() as u64; - true - }, - None => false - } -} diff --git a/rust/src/lib.rs b/rust/src/lib.rs index d1908989d8..4c393383a6 100644 --- a/rust/src/lib.rs +++ b/rust/src/lib.rs @@ -138,7 +138,6 @@ pub mod sdp; pub mod ldap; pub mod flow; pub mod direction; -pub mod domain; #[allow(unused_imports)] pub use suricata_lua_sys; diff --git a/src/Makefile.am b/src/Makefile.am index dadd0cf405..5b0fe7506b 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -312,7 +312,6 @@ noinst_HEADERS = \ detect-tls-random.h \ detect-tos.h \ detect-transform-base64.h \ - detect-transform-domain.h \ detect-transform-pcrexform.h \ detect-ttl.h \ detect-udphdr.h \ @@ -900,7 +899,6 @@ libsuricata_c_a_SOURCES = \ detect-tls-random.c \ detect-tos.c \ detect-transform-base64.c \ - detect-transform-domain.c\ detect-transform-pcrexform.c \ detect-ttl.c \ detect-udphdr.c \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 97ef5075d3..aedf50a75d 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -223,7 +223,6 @@ #include "detect-transform-pcrexform.h" #include "detect-transform-base64.h" -#include "detect-transform-domain.h" #include "util-rule-vars.h" @@ -739,7 +738,7 @@ void SigTableSetup(void) DetectTransformToUpperRegister(); DetectTransformHeaderLowercaseRegister(); DetectTransformFromBase64DecodeRegister(); - DetectTransformDomainRegister(); + SCDetectTransformDomainRegister(); DetectFileHandlerRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index dbadd4d206..396783c5a2 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -318,8 +318,6 @@ enum DetectKeywordId { DETECT_TRANSFORM_TOUPPER, DETECT_TRANSFORM_HEADER_LOWERCASE, DETECT_TRANSFORM_FROM_BASE64, - DETECT_TRANSFORM_DOMAIN, - DETECT_TRANSFORM_TLD, DETECT_IKE_EXCH_TYPE, DETECT_IKE_SPI_INITIATOR, diff --git a/src/detect-transform-domain.c b/src/detect-transform-domain.c deleted file mode 100644 index 55bb1e4fdb..0000000000 --- a/src/detect-transform-domain.c +++ /dev/null @@ -1,274 +0,0 @@ -/* Copyright (C) 2022 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Eric Leblond - * - * Implements the domain extraction transformation - */ - -#include "suricata-common.h" - -#include "detect.h" -#include "detect-engine.h" -#include "detect-engine-prefilter.h" -#include "detect-parse.h" -#include "detect-transform-domain.h" -#include "detect-engine-build.h" - -#include "util-unittest.h" -#include "util-print.h" -#include "util-memrchr.h" -#include "util-memcpy.h" -#include "rust.h" - -static int DetectTransformDomainSetup(DetectEngineCtx *, Signature *, const char *); -static int DetectTransformTLDSetup(DetectEngineCtx *, Signature *, const char *); -#ifdef UNITTESTS -static void DetectTransformDomainRegisterTests(void); -static void DetectTransformTLDRegisterTests(void); -#endif -static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options); -static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options); - -void DetectTransformDomainRegister(void) -{ - sigmatch_table[DETECT_TRANSFORM_DOMAIN].name = "domain"; - sigmatch_table[DETECT_TRANSFORM_DOMAIN].desc = "modify buffer to extract the domain"; - sigmatch_table[DETECT_TRANSFORM_DOMAIN].url = "/rules/transforms.html#domain"; - sigmatch_table[DETECT_TRANSFORM_DOMAIN].Transform = TransformDomain; - sigmatch_table[DETECT_TRANSFORM_DOMAIN].Setup = DetectTransformDomainSetup; -#ifdef UNITTESTS - sigmatch_table[DETECT_TRANSFORM_DOMAIN].RegisterTests = DetectTransformDomainRegisterTests; -#endif - sigmatch_table[DETECT_TRANSFORM_DOMAIN].flags |= SIGMATCH_NOOPT; - - sigmatch_table[DETECT_TRANSFORM_TLD].name = "tld"; - sigmatch_table[DETECT_TRANSFORM_TLD].desc = "modify buffer to extract the tld"; - sigmatch_table[DETECT_TRANSFORM_TLD].url = "/rules/transforms.html#tld"; - sigmatch_table[DETECT_TRANSFORM_TLD].Transform = TransformTLD; - sigmatch_table[DETECT_TRANSFORM_TLD].Setup = DetectTransformTLDSetup; -#ifdef UNITTESTS - sigmatch_table[DETECT_TRANSFORM_TLD].RegisterTests = DetectTransformTLDRegisterTests; -#endif - sigmatch_table[DETECT_TRANSFORM_TLD].flags |= SIGMATCH_NOOPT; -} - -/** - * \internal - * \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent - * \param det_ctx detection engine ctx - * \param s signature - * \param nullstr should be null - * \retval 0 ok - * \retval -1 failure - */ -static int DetectTransformDomainSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr) -{ - SCEnter(); - int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_DOMAIN, NULL); - SCReturnInt(r); -} - -/** - * \brief Return the domain, if any, in the last pattern match. - * - */ -static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options) -{ - const size_t input_len = buffer->inspect_len; - uint64_t output_len = 0; - - if (input_len) { - uint8_t output[input_len]; - - bool res = rs_get_domain(buffer->inspect, input_len, output, &output_len); - if (res == true) { - InspectionBufferCopy(buffer, output, output_len); - } - } -} - -/** - * \internal - * \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent - * \param det_ctx detection engine ctx - * \param s signature - * \param nullstr should be null - * \retval 0 ok - * \retval -1 failure - */ -static int DetectTransformTLDSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr) -{ - SCEnter(); - int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_TLD, NULL); - SCReturnInt(r); -} - -/** - * \brief Return the domain, if any, in the last pattern match. - * - */ -static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options) -{ - const size_t input_len = buffer->inspect_len; - uint64_t output_len = 0; - - if (input_len) { - uint8_t output[input_len]; - - bool res = rs_get_tld(buffer->inspect, input_len, output, &output_len); - if (res == true) { - InspectionBufferCopy(buffer, output, output_len); - } - } -} - -#ifdef UNITTESTS -static int DetectTransformDomainTest01(void) -{ - const uint8_t *input = (const uint8_t *)"www.example.com"; - uint32_t input_len = strlen((char *)input); - - const char *result = "example.com"; - uint32_t result_len = strlen((char *)result); - - InspectionBuffer buffer; - InspectionBufferInit(&buffer, input_len); - InspectionBufferSetup(NULL, -1, &buffer, input, input_len); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - TransformDomain(NULL, &buffer, NULL); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - FAIL_IF_NOT(buffer.inspect_len == result_len); - FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0); - InspectionBufferFree(&buffer); - PASS; -} - -static int DetectTransformDomainTest02(void) -{ - const uint8_t *input = (const uint8_t *)"hello.example.co.uk"; - uint32_t input_len = strlen((char *)input); - - const char *result = "example.co.uk"; - uint32_t result_len = strlen((char *)result); - - InspectionBuffer buffer; - InspectionBufferInit(&buffer, input_len); - InspectionBufferSetup(NULL, -1, &buffer, input, input_len); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - TransformDomain(NULL, &buffer, NULL); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - FAIL_IF_NOT(buffer.inspect_len == result_len); - FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0); - InspectionBufferFree(&buffer); - PASS; -} - -static int DetectTransformDomainTest03(void) -{ - const char rule[] = - "alert dns any any -> any any (dns.query; domain; content:\"google.com\"; sid:1;)"; - ThreadVars th_v; - DetectEngineThreadCtx *det_ctx = NULL; - memset(&th_v, 0, sizeof(th_v)); - - DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - FAIL_IF_NULL(de_ctx); - Signature *s = DetectEngineAppendSig(de_ctx, rule); - FAIL_IF_NULL(s); - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - PASS; -} - -static void DetectTransformDomainRegisterTests(void) -{ - UtRegisterTest("DetectTransformDomainTest01", DetectTransformDomainTest01); - UtRegisterTest("DetectTransformDomainTest02", DetectTransformDomainTest02); - UtRegisterTest("DetectTransformDomainTest03", DetectTransformDomainTest03); -} - -static int DetectTransformTLDTest01(void) -{ - const uint8_t *input = (const uint8_t *)"www.example.com"; - uint32_t input_len = strlen((char *)input); - - const char *result = "com"; - uint32_t result_len = strlen((char *)result); - - InspectionBuffer buffer; - InspectionBufferInit(&buffer, input_len); - InspectionBufferSetup(NULL, -1, &buffer, input, input_len); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - TransformTLD(NULL, &buffer, NULL); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - FAIL_IF_NOT(buffer.inspect_len == result_len); - FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0); - InspectionBufferFree(&buffer); - PASS; -} - -static int DetectTransformTLDTest02(void) -{ - const uint8_t *input = (const uint8_t *)"hello.example.co.uk"; - uint32_t input_len = strlen((char *)input); - - const char *result = "co.uk"; - uint32_t result_len = strlen((char *)result); - - InspectionBuffer buffer; - InspectionBufferInit(&buffer, input_len); - InspectionBufferSetup(NULL, -1, &buffer, input, input_len); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - TransformTLD(NULL, &buffer, NULL); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - FAIL_IF_NOT(buffer.inspect_len == result_len); - FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0); - InspectionBufferFree(&buffer); - PASS; -} - -static int DetectTransformTLDTest03(void) -{ - const char rule[] = "alert dns any any -> any any (dns.query; tld; content:\"com\"; sid:1;)"; - ThreadVars th_v; - DetectEngineThreadCtx *det_ctx = NULL; - memset(&th_v, 0, sizeof(th_v)); - - DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - FAIL_IF_NULL(de_ctx); - Signature *s = DetectEngineAppendSig(de_ctx, rule); - FAIL_IF_NULL(s); - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - PASS; -} - -static void DetectTransformTLDRegisterTests(void) -{ - UtRegisterTest("DetectTransformTLDTest01", DetectTransformTLDTest01); - UtRegisterTest("DetectTransformTLDTest02", DetectTransformTLDTest02); - UtRegisterTest("DetectTransformTLDTest03", DetectTransformTLDTest03); -} -#endif diff --git a/src/detect-transform-domain.h b/src/detect-transform-domain.h deleted file mode 100644 index 4b2d7eaee3..0000000000 --- a/src/detect-transform-domain.h +++ /dev/null @@ -1,30 +0,0 @@ -/* Copyright (C) 2022 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Eric Leblond - */ - -#ifndef __DETECT_TRANSFORM_DOMAIN_H__ -#define __DETECT_TRANSFORM_DOMAIN_H__ - -/* prototypes */ -void DetectTransformDomainRegister(void); - -#endif /* __DETECT_TRANSFORM_DOMAIN_H__ */