From c57e1425f5594e28c662bc4359487bba0a8e8bf6 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 17 Jan 2025 14:46:07 -0600 Subject: [PATCH] detect: split new keyword id from registration Split DetectHelperKeywordRegister into 2 functions, one for acquiring a new keyword ID, and another to perform the registration. This makes it easier to do the traditional C keyword initialization with a dynamic ID. --- src/detect-engine-helper.c | 63 +++++++++++++++++++++----------------- src/detect-engine-helper.h | 2 ++ 2 files changed, 37 insertions(+), 28 deletions(-) diff --git a/src/detect-engine-helper.c b/src/detect-engine-helper.c index 5337f95969..8c9cce7a04 100644 --- a/src/detect-engine-helper.c +++ b/src/detect-engine-helper.c @@ -94,7 +94,7 @@ int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppPr return DetectBufferTypeGetByName(name); } -int DetectHelperKeywordRegister(const SCSigTableElmt *kw) +int SCDetectHelperNewKeywordId(void) { if (DETECT_TBLSIZE_IDX >= DETECT_TBLSIZE) { void *tmp = SCRealloc( @@ -103,48 +103,55 @@ int DetectHelperKeywordRegister(const SCSigTableElmt *kw) return -1; } sigmatch_table = tmp; + memset(&sigmatch_table[DETECT_TBLSIZE], 0, DETECT_TBLSIZE_STEP * sizeof(SigTableElmt)); DETECT_TBLSIZE += DETECT_TBLSIZE_STEP; } - sigmatch_table[DETECT_TBLSIZE_IDX].name = kw->name; - sigmatch_table[DETECT_TBLSIZE_IDX].desc = kw->desc; - sigmatch_table[DETECT_TBLSIZE_IDX].url = kw->url; - sigmatch_table[DETECT_TBLSIZE_IDX].flags = kw->flags; - sigmatch_table[DETECT_TBLSIZE_IDX].AppLayerTxMatch = + DETECT_TBLSIZE_IDX++; + return DETECT_TBLSIZE_IDX - 1; +} + +int DetectHelperKeywordRegister(const SCSigTableElmt *kw) +{ + int keyword_id = SCDetectHelperNewKeywordId(); + if (keyword_id < 0) { + return -1; + } + + sigmatch_table[keyword_id].name = kw->name; + sigmatch_table[keyword_id].desc = kw->desc; + sigmatch_table[keyword_id].url = kw->url; + sigmatch_table[keyword_id].flags = kw->flags; + sigmatch_table[keyword_id].AppLayerTxMatch = (int (*)(DetectEngineThreadCtx * det_ctx, Flow * f, uint8_t flags, void *alstate, void *txv, const Signature *s, const SigMatchCtx *ctx)) kw->AppLayerTxMatch; - sigmatch_table[DETECT_TBLSIZE_IDX].Setup = + sigmatch_table[keyword_id].Setup = (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup; - sigmatch_table[DETECT_TBLSIZE_IDX].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free; - DETECT_TBLSIZE_IDX++; - return DETECT_TBLSIZE_IDX - 1; + sigmatch_table[keyword_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free; + + return keyword_id; } int DetectHelperTransformRegister(const SCTransformTableElmt *kw) { - if (DETECT_TBLSIZE_IDX >= DETECT_TBLSIZE) { - void *tmp = SCRealloc( - sigmatch_table, (DETECT_TBLSIZE + DETECT_TBLSIZE_STEP) * sizeof(SigTableElmt)); - if (unlikely(tmp == NULL)) { - return -1; - } - sigmatch_table = tmp; - DETECT_TBLSIZE += DETECT_TBLSIZE_STEP; + int transform_id = SCDetectHelperNewKeywordId(); + if (transform_id < 0) { + return -1; } - sigmatch_table[DETECT_TBLSIZE_IDX].name = kw->name; - sigmatch_table[DETECT_TBLSIZE_IDX].desc = kw->desc; - sigmatch_table[DETECT_TBLSIZE_IDX].url = kw->url; - sigmatch_table[DETECT_TBLSIZE_IDX].flags = kw->flags; - sigmatch_table[DETECT_TBLSIZE_IDX].Transform = + sigmatch_table[transform_id].name = kw->name; + sigmatch_table[transform_id].desc = kw->desc; + sigmatch_table[transform_id].url = kw->url; + sigmatch_table[transform_id].flags = kw->flags; + sigmatch_table[transform_id].Transform = (void (*)(InspectionBuffer * buffer, void *options)) kw->Transform; - sigmatch_table[DETECT_TBLSIZE_IDX].TransformValidate = (bool (*)( + sigmatch_table[transform_id].TransformValidate = (bool (*)( const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate; - sigmatch_table[DETECT_TBLSIZE_IDX].Setup = + sigmatch_table[transform_id].Setup = (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup; - sigmatch_table[DETECT_TBLSIZE_IDX].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free; - DETECT_TBLSIZE_IDX++; - return DETECT_TBLSIZE_IDX - 1; + sigmatch_table[transform_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free; + + return transform_id; } InspectionBuffer *DetectHelperGetMultiData(struct DetectEngineThreadCtx_ *det_ctx, diff --git a/src/detect-engine-helper.h b/src/detect-engine-helper.h index 39fa632ed2..7c80444308 100644 --- a/src/detect-engine-helper.h +++ b/src/detect-engine-helper.h @@ -28,6 +28,8 @@ #include "detect.h" #include "rust.h" +int SCDetectHelperNewKeywordId(void); + int DetectHelperKeywordRegister(const SCSigTableElmt *kw); int DetectHelperBufferRegister(const char *name, AppProto alproto, bool toclient, bool toserver);