aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

file_data: smtp file_data to generic file_data

Browse Source 
Generalize the SMTP file_data inspection into a 'files'
file_data inspection that can be used for any protocol
that uses the File API.
pull/3108/head
Victor Julien 9 years ago
parent ccf202a4f0
commit ac0ae2dcd1
10 changed files with 158 additions and 108 deletions
Show Stats Download Patch File Download Diff File

2
src/Makefile.am
Unescape Escape View File

@ -122,7 +122,7 @@ detect-engine-modbus.c detect-engine-modbus.h \
detect-engine-enip.c detect-engine-enip.h \ detect-engine-enip.c detect-engine-enip.h \
detect-engine-event.c detect-engine-event.h \ detect-engine-event.c detect-engine-event.h \
detect-engine-file.c detect-engine-file.h \ detect-engine-file.c detect-engine-file.h \
detect-engine-filedata-smtp.c detect-engine-filedata-smtp.h \ detect-engine-filedata.c detect-engine-filedata.h \
detect-engine-hcbd.c detect-engine-hcbd.h \ detect-engine-hcbd.c detect-engine-hcbd.h \
detect-engine-hcd.c detect-engine-hcd.h \ detect-engine-hcd.c detect-engine-hcd.h \
detect-engine-hhhd.c detect-engine-hhhd.h \ detect-engine-hhhd.c detect-engine-hhhd.h \

165
src/detect-engine-filedata-smtp.c → src/detect-engine-filedata.c
Unescape Escape View File

@ -34,7 +34,7 @@
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "detect-engine-content-inspection.h" #include "detect-engine-content-inspection.h"
#include "detect-engine-prefilter.h" #include "detect-engine-prefilter.h"
#include "detect-engine-filedata-smtp.h" #include "detect-engine-filedata.h"
#include "flow-util.h" #include "flow-util.h"
#include "util-debug.h" #include "util-debug.h"
@ -58,33 +58,33 @@
#define BUFFER_STEP 50 #define BUFFER_STEP 50
static inline int SMTPCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t size) static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t size)
{ {
void *ptmp; void *ptmp;
if (size > det_ctx->smtp_buffers_size) { if (size > det_ctx->file_data_buffers_size) {
ptmp = SCRealloc(det_ctx->smtp, ptmp = SCRealloc(det_ctx->file_data,
(det_ctx->smtp_buffers_size + BUFFER_STEP) * sizeof(FiledataReassembledBody)); (det_ctx->file_data_buffers_size + BUFFER_STEP) * sizeof(FiledataReassembledBody));
if (ptmp == NULL) { if (ptmp == NULL) {
SCFree(det_ctx->smtp); SCFree(det_ctx->file_data);
det_ctx->smtp = NULL; det_ctx->file_data = NULL;
det_ctx->smtp_buffers_size = 0; det_ctx->file_data_buffers_size = 0;
det_ctx->smtp_buffers_list_len = 0; det_ctx->file_data_buffers_list_len = 0;
return -1; return -1;
} }
det_ctx->smtp = ptmp; det_ctx->file_data = ptmp;
memset(det_ctx->smtp + det_ctx->smtp_buffers_size, 0, BUFFER_STEP * sizeof(FiledataReassembledBody)); memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, BUFFER_STEP * sizeof(FiledataReassembledBody));
det_ctx->smtp_buffers_size += BUFFER_STEP; det_ctx->file_data_buffers_size += BUFFER_STEP;
} }
for (int i = det_ctx->smtp_buffers_list_len; i < (size); i++) { for (int i = det_ctx->file_data_buffers_list_len; i < (size); i++) {
det_ctx->smtp[i].buffer_len = 0; det_ctx->file_data[i].buffer_len = 0;
det_ctx->smtp[i].offset = 0; det_ctx->file_data[i].offset = 0;
} }
return 0; return 0;
} }
static const uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id, static const uint8_t *DetectEngineFiledataGetBufferForTX(uint64_t tx_id,
DetectEngineCtx *de_ctx, DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx, DetectEngineThreadCtx *det_ctx,
Flow *f, File *curr_file, Flow *f, File *curr_file,
@ -99,38 +99,43 @@ static const uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
*stream_start_offset = 0; *stream_start_offset = 0;
uint64_t file_size = FileDataSize(curr_file); uint64_t file_size = FileDataSize(curr_file);
if (det_ctx->smtp_buffers_list_len == 0) { const uint32_t content_limit = de_ctx->filedata_config[f->alproto].content_limit;
if (SMTPCreateSpace(det_ctx, 1) < 0) const uint32_t content_inspect_min_size = de_ctx->filedata_config[f->alproto].content_inspect_min_size;
// TODO this is unused, is that right?
//const uint32_t content_inspect_window = de_ctx->filedata_config[f->alproto].content_inspect_window;
if (det_ctx->file_data_buffers_list_len == 0) {
if (FiledataCreateSpace(det_ctx, 1) < 0)
goto end; goto end;
index = 0; index = 0;
if (det_ctx->smtp_buffers_list_len == 0) { if (det_ctx->file_data_buffers_list_len == 0) {
det_ctx->smtp_start_tx_id = tx_id; det_ctx->file_data_start_tx_id = tx_id;
} }
det_ctx->smtp_buffers_list_len++; det_ctx->file_data_buffers_list_len++;
} else { } else {
if ((tx_id - det_ctx->smtp_start_tx_id) < det_ctx->smtp_buffers_list_len) { if ((tx_id - det_ctx->file_data_start_tx_id) < det_ctx->file_data_buffers_list_len) {
if (det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len != 0) { if (det_ctx->file_data[(tx_id - det_ctx->file_data_start_tx_id)].buffer_len != 0) {
*buffer_len = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len; *buffer_len = det_ctx->file_data[(tx_id - det_ctx->file_data_start_tx_id)].buffer_len;
*stream_start_offset = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].offset; *stream_start_offset = det_ctx->file_data[(tx_id - det_ctx->file_data_start_tx_id)].offset;
buffer = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer; buffer = det_ctx->file_data[(tx_id - det_ctx->file_data_start_tx_id)].buffer;
SCReturnPtr(buffer, "uint8_t"); SCReturnPtr(buffer, "uint8_t");
} }
} else { } else {
if (SMTPCreateSpace(det_ctx, (tx_id - det_ctx->smtp_start_tx_id) + 1) < 0) if (FiledataCreateSpace(det_ctx, (tx_id - det_ctx->file_data_start_tx_id) + 1) < 0)
goto end; goto end;
if (det_ctx->smtp_buffers_list_len == 0) { if (det_ctx->file_data_buffers_list_len == 0) {
det_ctx->smtp_start_tx_id = tx_id; det_ctx->file_data_start_tx_id = tx_id;
} }
det_ctx->smtp_buffers_list_len++; det_ctx->file_data_buffers_list_len++;
} }
index = (tx_id - det_ctx->smtp_start_tx_id); index = (tx_id - det_ctx->file_data_start_tx_id);
} }
SCLogDebug("smtp_config.content_limit %u, smtp_config.content_inspect_min_size %u", SCLogDebug("content_limit %u, content_inspect_min_size %u",
smtp_config.content_limit, smtp_config.content_inspect_min_size); content_limit, content_inspect_min_size);
SCLogDebug("file %p size %"PRIu64", state %d", curr_file, file_size, curr_file->state); SCLogDebug("file %p size %"PRIu64", state %d", curr_file, file_size, curr_file->state);
@ -145,8 +150,8 @@ static const uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
goto end; goto end;
} }
if ((smtp_config.content_limit == 0 || file_size < smtp_config.content_limit) && if ((content_limit == 0 || file_size < content_limit) &&
file_size < smtp_config.content_inspect_min_size && file_size < content_inspect_min_size &&
!(flags & STREAM_EOF) && !(curr_file->state > FILE_STATE_OPENED)) { !(flags & STREAM_EOF) && !(curr_file->state > FILE_STATE_OPENED)) {
SCLogDebug("we still haven't seen the entire content. " SCLogDebug("we still haven't seen the entire content. "
"Let's defer content inspection till we see the " "Let's defer content inspection till we see the "
@ -155,50 +160,56 @@ static const uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
} }
StreamingBufferGetDataAtOffset(curr_file->sb, StreamingBufferGetDataAtOffset(curr_file->sb,
&det_ctx->smtp[index].buffer, &det_ctx->smtp[index].buffer_len, &det_ctx->file_data[index].buffer, &det_ctx->file_data[index].buffer_len,
curr_file->content_inspected); curr_file->content_inspected);
det_ctx->smtp[index].offset = curr_file->content_inspected; det_ctx->file_data[index].offset = curr_file->content_inspected;
/* updat inspected tracker */ /* update inspected tracker */
curr_file->content_inspected = FileDataSize(curr_file); curr_file->content_inspected = FileDataSize(curr_file);
SCLogDebug("content_inspected %"PRIu64", offset %"PRIu64, SCLogDebug("content_inspected %"PRIu64", offset %"PRIu64,
curr_file->content_inspected, det_ctx->smtp[index].offset); curr_file->content_inspected, det_ctx->file_data[index].offset);
buffer = det_ctx->smtp[index].buffer; buffer = det_ctx->file_data[index].buffer;
*buffer_len = det_ctx->smtp[index].buffer_len; *buffer_len = det_ctx->file_data[index].buffer_len;
*stream_start_offset = det_ctx->smtp[index].offset; *stream_start_offset = det_ctx->file_data[index].offset;
end: end:
SCLogDebug("buffer %p, len %u", buffer, *buffer_len); SCLogDebug("buffer %p, len %u", buffer, *buffer_len);
SCReturnPtr(buffer, "uint8_t"); SCReturnPtr(buffer, "uint8_t");
} }
int DetectEngineInspectSMTPFiledata(ThreadVars *tv, int DetectEngineInspectFiledata(ThreadVars *tv,
DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
const Signature *s, const SigMatchData *smd, const Signature *s, const SigMatchData *smd,
Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id) Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
{ {
SMTPState *smtp_state = (SMTPState *)alstate;
FileContainer *ffc = smtp_state->files_ts;
int r = 0; int r = 0;
int match = 0; int match = 0;
uint32_t buffer_len = 0; uint32_t buffer_len = 0;
uint32_t stream_start_offset = 0; uint32_t stream_start_offset = 0;
const uint8_t *buffer = 0; const uint8_t *buffer = 0;
if (ffc != NULL) { FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto,
File *file = ffc->head; f->alstate, flags);
for (; file != NULL; file = file->next) { if (ffc == NULL) {
buffer = DetectEngineSMTPGetBufferForTX(tx_id, return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
de_ctx, det_ctx, }
f, file,
flags, File *file = ffc->head;
&buffer_len, for (; file != NULL; file = file->next) {
&stream_start_offset); if (file->txid != tx_id)
continue;
buffer = DetectEngineFiledataGetBufferForTX(tx_id,
de_ctx, det_ctx,
f, file,
flags,
&buffer_len,
&stream_start_offset);
if (buffer_len == 0) if (buffer_len == 0)
goto end; continue;
det_ctx->buffer_offset = 0; det_ctx->buffer_offset = 0;
det_ctx->discontinue_matching = 0; det_ctx->discontinue_matching = 0;
@ -209,43 +220,41 @@ int DetectEngineInspectSMTPFiledata(ThreadVars *tv,
buffer_len, buffer_len,
stream_start_offset, stream_start_offset,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (match == 1) if (match == 1) {
r = 1; r = 1;
break;
} }
} }
end:
if (r == 1) if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH; return DETECT_ENGINE_INSPECT_SIG_MATCH;
else else
return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
} }
void DetectEngineCleanSMTPBuffers(DetectEngineThreadCtx *det_ctx) void DetectEngineCleanFiledataBuffers(DetectEngineThreadCtx *det_ctx)
{ {
if (det_ctx->smtp_buffers_list_len > 0) { if (det_ctx->file_data_buffers_list_len > 0) {
for (int i = 0; i < det_ctx->smtp_buffers_list_len; i++) { for (int i = 0; i < det_ctx->file_data_buffers_list_len; i++) {
det_ctx->smtp[i].buffer_len = 0; det_ctx->file_data[i].buffer_len = 0;
det_ctx->smtp[i].offset = 0; det_ctx->file_data[i].offset = 0;
} }
} }
det_ctx->smtp_buffers_list_len = 0; det_ctx->file_data_buffers_list_len = 0;
det_ctx->smtp_start_tx_id = 0; det_ctx->file_data_start_tx_id = 0;
return; return;
} }
/** \brief SMTP Filedata Mpm prefilter callback /** \brief Filedata Filedata Mpm prefilter callback
* *
* \param det_ctx detection engine thread ctx * \param det_ctx detection engine thread ctx
* \param p packet to inspect * \param p packet to inspect
* \param f flow to inspect * \param f flow to inspect
* \param txv tx to inspect * \param txv tx to inspect
* \param pectx inspection context * \param pectx inspection context
*
* \todo check files against actual tx
*/ */
static void PrefilterTxSmtpFiledata(DetectEngineThreadCtx *det_ctx, void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx,
const void *pectx, const void *pectx,
Packet *p, Flow *f, void *txv, Packet *p, Flow *f, void *txv,
const uint64_t idx, const uint8_t flags) const uint64_t idx, const uint8_t flags)
@ -253,16 +262,19 @@ static void PrefilterTxSmtpFiledata(DetectEngineThreadCtx *det_ctx,
SCEnter(); SCEnter();
const MpmCtx *mpm_ctx = (MpmCtx *)pectx; const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
SMTPState *smtp_state = f->alstate; FileContainer *ffc = AppLayerParserGetFiles(f->proto, f->alproto,
FileContainer *ffc = smtp_state->files_ts; f->alstate, flags);
if (ffc != NULL) { if (ffc != NULL) {
File *file = ffc->head; File *file = ffc->head;
for (; file != NULL; file = file->next) { for (; file != NULL; file = file->next) {
if (file->txid != idx)
continue;
uint32_t buffer_len = 0; uint32_t buffer_len = 0;
uint32_t stream_start_offset = 0; uint32_t stream_start_offset = 0;
const uint8_t *buffer = DetectEngineSMTPGetBufferForTX(idx, const uint8_t *buffer = DetectEngineFiledataGetBufferForTX(idx,
NULL, det_ctx, det_ctx->de_ctx, det_ctx,
f, file, f, file,
flags, flags,
&buffer_len, &buffer_len,
@ -275,15 +287,6 @@ static void PrefilterTxSmtpFiledata(DetectEngineThreadCtx *det_ctx,
} }
} }
int PrefilterTxSmtpFiledataRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
{
SCEnter();
return PrefilterAppendTxEngine(sgh, PrefilterTxSmtpFiledata,
ALPROTO_SMTP, 0,
mpm_ctx, NULL, "file_data (smtp)");
}
#ifdef UNITTESTS #ifdef UNITTESTS
static int DetectEngineSMTPFiledataTest01(void) static int DetectEngineSMTPFiledataTest01(void)

20
src/detect-engine-filedata-smtp.h → src/detect-engine-filedata.h
Unescape Escape View File

@ -20,20 +20,20 @@
* \author Giuseppe Longo <giuseppelng@gmail.com> * \author Giuseppe Longo <giuseppelng@gmail.com>
*/ */
#ifndef __DETECT_ENGINE_FILEDATA_SMTP_H__ #ifndef __DETECT_ENGINE_FILEDATA_H__
#define __DETECT_ENGINE_FILEDATA_SMTP_H__ #define __DETECT_ENGINE_FILEDATA_H__
#include "app-layer-smtp.h" void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx,
const void *pectx,
int PrefilterTxSmtpFiledataRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); Packet *p, Flow *f, void *txv,
const uint64_t idx, const uint8_t flags);
int DetectEngineInspectSMTPFiledata(ThreadVars *tv, int DetectEngineInspectFiledata(ThreadVars *tv,
DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
const Signature *s, const SigMatchData *smd, const Signature *s, const SigMatchData *smd,
Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id);
void DetectEngineCleanSMTPBuffers(DetectEngineThreadCtx *det_ctx); void DetectEngineCleanFiledataBuffers(DetectEngineThreadCtx *det_ctx);
void DetectEngineSMTPFiledataRegisterTests(void); void DetectEngineSMTPFiledataRegisterTests(void);
#endif /* __DETECT_ENGINE_FILEDATA_SMTP_H__ */ #endif /* __DETECT_ENGINE_FILEDATA_H__ */

1
src/detect-engine-mpm.c
Unescape Escape View File

@ -62,7 +62,6 @@
#include "detect-engine-hcbd.h" #include "detect-engine-hcbd.h"
#include "detect-engine-hsbd.h" #include "detect-engine-hsbd.h"
#include "detect-engine-dns.h" #include "detect-engine-dns.h"
#include "detect-engine-filedata-smtp.h"
#include "detect-engine-tls.h" #include "detect-engine-tls.h"
#include "stream.h" #include "stream.h"

2
src/detect-engine-register.c
Unescape Escape View File

@ -54,7 +54,7 @@
#include "detect-tls-cert-serial.h" #include "detect-tls-cert-serial.h"
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "detect-engine-analyzer.h" #include "detect-engine-analyzer.h"
#include "detect-engine-filedata-smtp.h" #include "detect-engine-filedata.h"
#include "detect-http-cookie.h" #include "detect-http-cookie.h"
#include "detect-http-method.h" #include "detect-http-method.h"

8
src/detect-engine.c
Unescape Escape View File

@ -1990,10 +1990,10 @@ static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
SCFree(det_ctx->hcbd); SCFree(det_ctx->hcbd);
} }
/* SMTP */ /* file data */
if (det_ctx->smtp != NULL) { if (det_ctx->file_data != NULL) {
SCLogDebug("det_ctx smtp %u", det_ctx->smtp_buffers_size); SCLogDebug("det_ctx file_data %u", det_ctx->file_data_buffers_size);
SCFree(det_ctx->smtp); SCFree(det_ctx->file_data);
} }
/* Decoded base64 data. */ /* Decoded base64 data. */

46
src/detect-file-data.c
Unescape Escape View File

@ -33,11 +33,13 @@
#include "detect-engine.h" #include "detect-engine.h"
#include "detect-engine-mpm.h" #include "detect-engine-mpm.h"
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-filedata-smtp.h" #include "detect-engine-filedata.h"
#include "detect-engine-hsbd.h" #include "detect-engine-hsbd.h"
#include "detect-file-data.h" #include "detect-file-data.h"
#include "app-layer-smtp.h"
#include "flow.h" #include "flow.h"
#include "flow-var.h" #include "flow-var.h"
#include "flow-util.h" #include "flow-util.h"
@ -52,6 +54,8 @@ static void DetectFiledataRegisterTests(void);
static void DetectFiledataSetupCallback(Signature *s); static void DetectFiledataSetupCallback(Signature *s);
static int g_file_data_buffer_id = 0; static int g_file_data_buffer_id = 0;
static int PrefilterTxSmtpFiledataRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
/** /**
* \brief Registration function for keyword: file_data * \brief Registration function for keyword: file_data
*/ */
@ -76,7 +80,7 @@ void DetectFiledataRegister(void)
DetectEngineInspectHttpServerBody); DetectEngineInspectHttpServerBody);
DetectAppLayerInspectEngineRegister("file_data", DetectAppLayerInspectEngineRegister("file_data",
ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0, ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
DetectEngineInspectSMTPFiledata); DetectEngineInspectFiledata);
DetectBufferTypeRegisterSetupCallback("file_data", DetectBufferTypeRegisterSetupCallback("file_data",
DetectFiledataSetupCallback); DetectFiledataSetupCallback);
@ -87,6 +91,40 @@ void DetectFiledataRegister(void)
g_file_data_buffer_id = DetectBufferTypeGetByName("file_data"); g_file_data_buffer_id = DetectBufferTypeGetByName("file_data");
} }
static int PrefilterTxSmtpFiledataRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
{
SCEnter();
return PrefilterAppendTxEngine(sgh, PrefilterTxFiledata,
ALPROTO_SMTP, 0,
mpm_ctx, NULL, "file_data (smtp)");
}
#define FILEDATA_CONTENT_LIMIT 100000
#define FILEDATA_CONTENT_INSPECT_MIN_SIZE 32768
#define FILEDATA_CONTENT_INSPECT_WINDOW 4096
static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) {
if (de_ctx->filedata_config_initialized)
return;
/* initialize default */
for (int i = 0; i < (int)ALPROTO_MAX; i++) {
de_ctx->filedata_config[i].content_limit = FILEDATA_CONTENT_LIMIT;
de_ctx->filedata_config[i].content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE;
de_ctx->filedata_config[i].content_inspect_window = FILEDATA_CONTENT_INSPECT_WINDOW;
}
/* add protocol specific settings here */
/* SMTP */
de_ctx->filedata_config[ALPROTO_SMTP].content_limit = smtp_config.content_limit;
de_ctx->filedata_config[ALPROTO_SMTP].content_inspect_min_size = smtp_config.content_inspect_min_size;
de_ctx->filedata_config[ALPROTO_SMTP].content_inspect_window = smtp_config.content_inspect_window;
de_ctx->filedata_config_initialized = true;
}
/** /**
* \brief this function is used to parse filedata options * \brief this function is used to parse filedata options
* \brief into the current signature * \brief into the current signature
@ -124,6 +162,8 @@ static int DetectFiledataSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
} }
s->init_data->list = DetectBufferTypeGetByName("file_data"); s->init_data->list = DetectBufferTypeGetByName("file_data");
SetupDetectEngineConfig(de_ctx);
return 0; return 0;
} }

5
src/detect.c
Unescape Escape View File

@ -48,9 +48,10 @@
#include "detect-engine-prefilter.h" #include "detect-engine-prefilter.h"
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "detect-engine-analyzer.h" #include "detect-engine-analyzer.h"
#include "detect-engine-filedata.h"
#include "detect-engine-payload.h" #include "detect-engine-payload.h"
#include "detect-engine-filedata-smtp.h"
#include "detect-engine-event.h" #include "detect-engine-event.h"
#include "detect-engine-hcbd.h" #include "detect-engine-hcbd.h"
#include "detect-engine-hsbd.h" #include "detect-engine-hsbd.h"
@ -947,7 +948,7 @@ end:
DetectEngineCleanHCBDBuffers(det_ctx); DetectEngineCleanHCBDBuffers(det_ctx);
DetectEngineCleanHSBDBuffers(det_ctx); DetectEngineCleanHSBDBuffers(det_ctx);
DetectEngineCleanSMTPBuffers(det_ctx); DetectEngineCleanFiledataBuffers(det_ctx);
} }
} }
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_CLEANUP);

15
src/detect.h
Unescape Escape View File

@ -717,6 +717,13 @@ typedef struct DetectEngineCtx_ {
DetectEngineThreadKeywordCtxItem *keyword_list; DetectEngineThreadKeywordCtxItem *keyword_list;
int keyword_id; int keyword_id;
struct {
uint32_t content_limit;
uint32_t content_inspect_min_size;
uint32_t content_inspect_window;
} filedata_config[ALPROTO_MAX];
bool filedata_config_initialized;
#ifdef PROFILING #ifdef PROFILING
struct SCProfileDetectCtx_ *profile_ctx; struct SCProfileDetectCtx_ *profile_ctx;
struct SCProfileKeywordDetectCtx_ *profile_keyword_ctx; struct SCProfileKeywordDetectCtx_ *profile_keyword_ctx;
@ -850,10 +857,10 @@ typedef struct DetectEngineThreadCtx_ {
uint16_t hcbd_buffers_size; uint16_t hcbd_buffers_size;
uint16_t hcbd_buffers_list_len; uint16_t hcbd_buffers_list_len;
FiledataReassembledBody *smtp; FiledataReassembledBody *file_data;
uint64_t smtp_start_tx_id; uint64_t file_data_start_tx_id;
uint16_t smtp_buffers_size; uint16_t file_data_buffers_size;
uint16_t smtp_buffers_list_len; uint16_t file_data_buffers_list_len;
/** id for alert counter */ /** id for alert counter */
uint16_t counter_alerts; uint16_t counter_alerts;

2
src/runmode-unittests.c
Unescape Escape View File

@ -51,7 +51,7 @@
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "detect-engine-tag.h" #include "detect-engine-tag.h"
#include "detect-engine-modbus.h" #include "detect-engine-modbus.h"
#include "detect-engine-filedata-smtp.h" #include "detect-engine-filedata.h"
#include "detect-fast-pattern.h" #include "detect-fast-pattern.h"
#include "flow.h" #include "flow.h"
#include "flow-timeout.h" #include "flow-timeout.h"

Write Preview
Loading…
Cancel
Save