mirror of https://github.com/OISF/suricata
detect/domain: move transform fully to rust
Victor Julien
4 months ago
parent
679d25ccd2
commit
88e96c9d49
@ -0,0 +1,137 @@
|
|||||||
|
/* Copyright (C) 2025 Open Information Security Foundation
|
||||||
|
*
|
||||||
|
* You can copy, redistribute or modify this Program under the terms of
|
||||||
|
* the GNU General Public License version 2 as published by the Free
|
||||||
|
* Software Foundation.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* version 2 along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
* 02110-1301, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
use super::{
|
||||||
|
DetectHelperTransformRegister, DetectSignatureAddTransform, InspectionBufferCheckAndExpand,
|
||||||
|
InspectionBufferLength, InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
|
||||||
|
};
|
||||||
|
use crate::detect::SIGMATCH_NOOPT;
|
||||||
|
use std::os::raw::{c_int, c_void};
|
||||||
|
use std::ptr;
|
||||||
|
|
||||||
|
static mut G_TRANSFORM_DOMAIN_ID: c_int = 0;
|
||||||
|
static mut G_TRANSFORM_TLD_ID: c_int = 0;
|
||||||
|
|
||||||
|
unsafe extern "C" fn domain_setup(
|
||||||
|
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||||
|
) -> c_int {
|
||||||
|
return DetectSignatureAddTransform(s, G_TRANSFORM_DOMAIN_ID, ptr::null_mut());
|
||||||
|
}
|
||||||
|
|
||||||
|
fn get_domain(input: &[u8], output: &mut [u8]) -> u32 {
|
||||||
|
if let Some(domain) = psl::domain(input) {
|
||||||
|
let domain = domain.as_bytes();
|
||||||
|
let len = domain.len();
|
||||||
|
output[0..len].copy_from_slice(domain);
|
||||||
|
return domain.len() as u32;
|
||||||
|
}
|
||||||
|
0
|
||||||
|
}
|
||||||
|
|
||||||
|
unsafe extern "C" fn domain_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
|
||||||
|
let input = InspectionBufferPtr(buffer);
|
||||||
|
let input_len = InspectionBufferLength(buffer);
|
||||||
|
if input.is_null() || input_len == 0 {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let input = build_slice!(input, input_len as usize);
|
||||||
|
|
||||||
|
let output = InspectionBufferCheckAndExpand(buffer, input_len);
|
||||||
|
if output.is_null() {
|
||||||
|
// allocation failure
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let output = std::slice::from_raw_parts_mut(output, input_len as usize);
|
||||||
|
|
||||||
|
let output_len = get_domain(input, output);
|
||||||
|
|
||||||
|
InspectionBufferTruncate(buffer, output_len);
|
||||||
|
}
|
||||||
|
|
||||||
|
unsafe extern "C" fn tld_setup(
|
||||||
|
_de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||||
|
) -> c_int {
|
||||||
|
return DetectSignatureAddTransform(s, G_TRANSFORM_TLD_ID, ptr::null_mut());
|
||||||
|
}
|
||||||
|
|
||||||
|
fn get_tld(input: &[u8], output: &mut [u8]) -> u32 {
|
||||||
|
if let Some(domain) = psl::domain(input) {
|
||||||
|
let tldb = domain.suffix().as_bytes();
|
||||||
|
let len = tldb.len();
|
||||||
|
let domain = tldb;
|
||||||
|
output[0..len].copy_from_slice(domain);
|
||||||
|
return domain.len() as u32;
|
||||||
|
}
|
||||||
|
0
|
||||||
|
}
|
||||||
|
|
||||||
|
unsafe extern "C" fn tld_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
|
||||||
|
let input = InspectionBufferPtr(buffer);
|
||||||
|
let input_len = InspectionBufferLength(buffer);
|
||||||
|
if input.is_null() || input_len == 0 {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let input = build_slice!(input, input_len as usize);
|
||||||
|
|
||||||
|
let output = InspectionBufferCheckAndExpand(buffer, input_len);
|
||||||
|
if output.is_null() {
|
||||||
|
// allocation failure
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
let output = std::slice::from_raw_parts_mut(output, input_len as usize);
|
||||||
|
|
||||||
|
let output_len = get_tld(input, output);
|
||||||
|
|
||||||
|
InspectionBufferTruncate(buffer, output_len);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub unsafe extern "C" fn SCDetectTransformDomainRegister() {
|
||||||
|
let kw = SCTransformTableElmt {
|
||||||
|
name: b"domain\0".as_ptr() as *const libc::c_char,
|
||||||
|
desc: b"modify buffer to extract the domain\0".as_ptr() as *const libc::c_char,
|
||||||
|
url: b"/rules/transforms.html#domain\0".as_ptr() as *const libc::c_char,
|
||||||
|
Setup: domain_setup,
|
||||||
|
flags: SIGMATCH_NOOPT,
|
||||||
|
Transform: domain_transform,
|
||||||
|
Free: None,
|
||||||
|
TransformValidate: None,
|
||||||
|
};
|
||||||
|
unsafe {
|
||||||
|
G_TRANSFORM_DOMAIN_ID = DetectHelperTransformRegister(&kw);
|
||||||
|
if G_TRANSFORM_DOMAIN_ID < 0 {
|
||||||
|
SCLogWarning!("Failed registering transform domain");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
let kw = SCTransformTableElmt {
|
||||||
|
name: b"tld\0".as_ptr() as *const libc::c_char,
|
||||||
|
desc: b"modify buffer to extract the tld\0".as_ptr() as *const libc::c_char,
|
||||||
|
url: b"/rules/transforms.html#tld\0".as_ptr() as *const libc::c_char,
|
||||||
|
Setup: tld_setup,
|
||||||
|
flags: SIGMATCH_NOOPT,
|
||||||
|
Transform: tld_transform,
|
||||||
|
Free: None,
|
||||||
|
TransformValidate: None,
|
||||||
|
};
|
||||||
|
unsafe {
|
||||||
|
G_TRANSFORM_TLD_ID = DetectHelperTransformRegister(&kw);
|
||||||
|
if G_TRANSFORM_TLD_ID < 0 {
|
||||||
|
SCLogWarning!("Failed registering transform tld");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -1,48 +0,0 @@
|
|||||||
/* Copyright (C) 2022 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
use std::ptr;
|
|
||||||
|
|
||||||
#[no_mangle]
|
|
||||||
pub unsafe extern "C" fn rs_get_domain(input: *const u8, len: u32, output: *mut u8, olen: *mut u64) -> bool {
|
|
||||||
let slice: &[u8] = std::slice::from_raw_parts(input as *mut u8, len as usize);
|
|
||||||
let result = psl::domain(slice);
|
|
||||||
match result {
|
|
||||||
Some(x) => {
|
|
||||||
let domain = x.as_bytes();
|
|
||||||
ptr::copy(domain.as_ptr(), output, domain.len());
|
|
||||||
*olen = domain.len() as u64;
|
|
||||||
true
|
|
||||||
},
|
|
||||||
None => false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#[no_mangle]
|
|
||||||
pub unsafe extern "C" fn rs_get_tld(input: *const u8, len: u32, output: *mut u8, olen: *mut u64) -> bool {
|
|
||||||
let slice: &[u8] = std::slice::from_raw_parts(input as *mut u8, len as usize);
|
|
||||||
let result = psl::domain(slice);
|
|
||||||
match result {
|
|
||||||
Some(x) => {
|
|
||||||
let tld = x.suffix().as_bytes();
|
|
||||||
ptr::copy(tld.as_ptr(), output, tld.len());
|
|
||||||
*olen = tld.len() as u64;
|
|
||||||
true
|
|
||||||
},
|
|
||||||
None => false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,274 +0,0 @@
|
|||||||
/* Copyright (C) 2022 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Eric Leblond <el@stamus-networks.com>
|
|
||||||
*
|
|
||||||
* Implements the domain extraction transformation
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include "suricata-common.h"
|
|
||||||
|
|
||||||
#include "detect.h"
|
|
||||||
#include "detect-engine.h"
|
|
||||||
#include "detect-engine-prefilter.h"
|
|
||||||
#include "detect-parse.h"
|
|
||||||
#include "detect-transform-domain.h"
|
|
||||||
#include "detect-engine-build.h"
|
|
||||||
|
|
||||||
#include "util-unittest.h"
|
|
||||||
#include "util-print.h"
|
|
||||||
#include "util-memrchr.h"
|
|
||||||
#include "util-memcpy.h"
|
|
||||||
#include "rust.h"
|
|
||||||
|
|
||||||
static int DetectTransformDomainSetup(DetectEngineCtx *, Signature *, const char *);
|
|
||||||
static int DetectTransformTLDSetup(DetectEngineCtx *, Signature *, const char *);
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static void DetectTransformDomainRegisterTests(void);
|
|
||||||
static void DetectTransformTLDRegisterTests(void);
|
|
||||||
#endif
|
|
||||||
static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options);
|
|
||||||
static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options);
|
|
||||||
|
|
||||||
void DetectTransformDomainRegister(void)
|
|
||||||
{
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].name = "domain";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].desc = "modify buffer to extract the domain";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].url = "/rules/transforms.html#domain";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].Transform = TransformDomain;
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].Setup = DetectTransformDomainSetup;
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].RegisterTests = DetectTransformDomainRegisterTests;
|
|
||||||
#endif
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_DOMAIN].flags |= SIGMATCH_NOOPT;
|
|
||||||
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].name = "tld";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].desc = "modify buffer to extract the tld";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].url = "/rules/transforms.html#tld";
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].Transform = TransformTLD;
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].Setup = DetectTransformTLDSetup;
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].RegisterTests = DetectTransformTLDRegisterTests;
|
|
||||||
#endif
|
|
||||||
sigmatch_table[DETECT_TRANSFORM_TLD].flags |= SIGMATCH_NOOPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \internal
|
|
||||||
* \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent
|
|
||||||
* \param det_ctx detection engine ctx
|
|
||||||
* \param s signature
|
|
||||||
* \param nullstr should be null
|
|
||||||
* \retval 0 ok
|
|
||||||
* \retval -1 failure
|
|
||||||
*/
|
|
||||||
static int DetectTransformDomainSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
|
|
||||||
{
|
|
||||||
SCEnter();
|
|
||||||
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_DOMAIN, NULL);
|
|
||||||
SCReturnInt(r);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \brief Return the domain, if any, in the last pattern match.
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options)
|
|
||||||
{
|
|
||||||
const size_t input_len = buffer->inspect_len;
|
|
||||||
uint64_t output_len = 0;
|
|
||||||
|
|
||||||
if (input_len) {
|
|
||||||
uint8_t output[input_len];
|
|
||||||
|
|
||||||
bool res = rs_get_domain(buffer->inspect, input_len, output, &output_len);
|
|
||||||
if (res == true) {
|
|
||||||
InspectionBufferCopy(buffer, output, output_len);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \internal
|
|
||||||
* \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent
|
|
||||||
* \param det_ctx detection engine ctx
|
|
||||||
* \param s signature
|
|
||||||
* \param nullstr should be null
|
|
||||||
* \retval 0 ok
|
|
||||||
* \retval -1 failure
|
|
||||||
*/
|
|
||||||
static int DetectTransformTLDSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
|
|
||||||
{
|
|
||||||
SCEnter();
|
|
||||||
int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_TLD, NULL);
|
|
||||||
SCReturnInt(r);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \brief Return the domain, if any, in the last pattern match.
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options)
|
|
||||||
{
|
|
||||||
const size_t input_len = buffer->inspect_len;
|
|
||||||
uint64_t output_len = 0;
|
|
||||||
|
|
||||||
if (input_len) {
|
|
||||||
uint8_t output[input_len];
|
|
||||||
|
|
||||||
bool res = rs_get_tld(buffer->inspect, input_len, output, &output_len);
|
|
||||||
if (res == true) {
|
|
||||||
InspectionBufferCopy(buffer, output, output_len);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef UNITTESTS
|
|
||||||
static int DetectTransformDomainTest01(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)"www.example.com";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
const char *result = "example.com";
|
|
||||||
uint32_t result_len = strlen((char *)result);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, input_len);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformDomain(NULL, &buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
FAIL_IF_NOT(buffer.inspect_len == result_len);
|
|
||||||
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int DetectTransformDomainTest02(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)"hello.example.co.uk";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
const char *result = "example.co.uk";
|
|
||||||
uint32_t result_len = strlen((char *)result);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, input_len);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformDomain(NULL, &buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
FAIL_IF_NOT(buffer.inspect_len == result_len);
|
|
||||||
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int DetectTransformDomainTest03(void)
|
|
||||||
{
|
|
||||||
const char rule[] =
|
|
||||||
"alert dns any any -> any any (dns.query; domain; content:\"google.com\"; sid:1;)";
|
|
||||||
ThreadVars th_v;
|
|
||||||
DetectEngineThreadCtx *det_ctx = NULL;
|
|
||||||
memset(&th_v, 0, sizeof(th_v));
|
|
||||||
|
|
||||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
||||||
FAIL_IF_NULL(de_ctx);
|
|
||||||
Signature *s = DetectEngineAppendSig(de_ctx, rule);
|
|
||||||
FAIL_IF_NULL(s);
|
|
||||||
SigGroupBuild(de_ctx);
|
|
||||||
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
||||||
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
||||||
DetectEngineCtxFree(de_ctx);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void DetectTransformDomainRegisterTests(void)
|
|
||||||
{
|
|
||||||
UtRegisterTest("DetectTransformDomainTest01", DetectTransformDomainTest01);
|
|
||||||
UtRegisterTest("DetectTransformDomainTest02", DetectTransformDomainTest02);
|
|
||||||
UtRegisterTest("DetectTransformDomainTest03", DetectTransformDomainTest03);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int DetectTransformTLDTest01(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)"www.example.com";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
const char *result = "com";
|
|
||||||
uint32_t result_len = strlen((char *)result);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, input_len);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformTLD(NULL, &buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
FAIL_IF_NOT(buffer.inspect_len == result_len);
|
|
||||||
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int DetectTransformTLDTest02(void)
|
|
||||||
{
|
|
||||||
const uint8_t *input = (const uint8_t *)"hello.example.co.uk";
|
|
||||||
uint32_t input_len = strlen((char *)input);
|
|
||||||
|
|
||||||
const char *result = "co.uk";
|
|
||||||
uint32_t result_len = strlen((char *)result);
|
|
||||||
|
|
||||||
InspectionBuffer buffer;
|
|
||||||
InspectionBufferInit(&buffer, input_len);
|
|
||||||
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
TransformTLD(NULL, &buffer, NULL);
|
|
||||||
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
|
|
||||||
FAIL_IF_NOT(buffer.inspect_len == result_len);
|
|
||||||
FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
|
|
||||||
InspectionBufferFree(&buffer);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int DetectTransformTLDTest03(void)
|
|
||||||
{
|
|
||||||
const char rule[] = "alert dns any any -> any any (dns.query; tld; content:\"com\"; sid:1;)";
|
|
||||||
ThreadVars th_v;
|
|
||||||
DetectEngineThreadCtx *det_ctx = NULL;
|
|
||||||
memset(&th_v, 0, sizeof(th_v));
|
|
||||||
|
|
||||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
|
||||||
FAIL_IF_NULL(de_ctx);
|
|
||||||
Signature *s = DetectEngineAppendSig(de_ctx, rule);
|
|
||||||
FAIL_IF_NULL(s);
|
|
||||||
SigGroupBuild(de_ctx);
|
|
||||||
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
|
||||||
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
|
||||||
DetectEngineCtxFree(de_ctx);
|
|
||||||
PASS;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void DetectTransformTLDRegisterTests(void)
|
|
||||||
{
|
|
||||||
UtRegisterTest("DetectTransformTLDTest01", DetectTransformTLDTest01);
|
|
||||||
UtRegisterTest("DetectTransformTLDTest02", DetectTransformTLDTest02);
|
|
||||||
UtRegisterTest("DetectTransformTLDTest03", DetectTransformTLDTest03);
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
@ -1,30 +0,0 @@
|
|||||||
/* Copyright (C) 2022 Open Information Security Foundation
|
|
||||||
*
|
|
||||||
* You can copy, redistribute or modify this Program under the terms of
|
|
||||||
* the GNU General Public License version 2 as published by the Free
|
|
||||||
* Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* You should have received a copy of the GNU General Public License
|
|
||||||
* version 2 along with this program; if not, write to the Free Software
|
|
||||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
||||||
* 02110-1301, USA.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/**
|
|
||||||
* \file
|
|
||||||
*
|
|
||||||
* \author Eric Leblond <el@stamus-networks.com>
|
|
||||||
*/
|
|
||||||
|
|
||||||
#ifndef __DETECT_TRANSFORM_DOMAIN_H__
|
|
||||||
#define __DETECT_TRANSFORM_DOMAIN_H__
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
void DetectTransformDomainRegister(void);
|
|
||||||
|
|
||||||
#endif /* __DETECT_TRANSFORM_DOMAIN_H__ */
|
|
||||||
Loading…
Reference in New Issue