aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: Ensure byte* variable usages is for same buffers

Browse Source 
Issue: 7549

Use the active buffer list to fetch SM variables to ensure that they are
part of the same list so a variable created with bytemath or byteextract
will have context when used with bytejump, e.g

Not needed for content modifiers.
pull/13410/head
Jeff Lucovsky 1 year ago committed by Victor Julien
parent f7a05f1e8e
commit cd4e728b77
15 changed files with 30 additions and 23 deletions
Show Stats Download Patch File Download Diff File

5
src/detect-byte-extract.c
Unescape Escape View File

@ -372,7 +372,7 @@ static void DetectByteExtractFree(DetectEngineCtx *de_ctx, void *ptr)
* *
* \retval A pointer to the SigMatch if found, otherwise NULL. * \retval A pointer to the SigMatch if found, otherwise NULL.
*/ */
SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s) SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, int sm_list, const Signature *s)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
SigMatch *sm = s->init_data->buffers[x].head; SigMatch *sm = s->init_data->buffers[x].head;
@ -390,7 +390,8 @@ SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)
for (int list = 0; list < DETECT_SM_LIST_MAX; list++) { for (int list = 0; list < DETECT_SM_LIST_MAX; list++) {
SigMatch *sm = s->init_data->smlists[list]; SigMatch *sm = s->init_data->smlists[list];
while (sm != NULL) { while (sm != NULL) {
if (sm->type == DETECT_BYTE_EXTRACT) { // Make sure that the linked buffers ore on the same list
if (sm->type == DETECT_BYTE_EXTRACT && (sm_list == -1 || sm_list == list)) {
const SCDetectByteExtractData *bed = (const SCDetectByteExtractData *)sm->ctx; const SCDetectByteExtractData *bed = (const SCDetectByteExtractData *)sm->ctx;
if (strcmp(bed->name, arg) == 0) { if (strcmp(bed->name, arg) == 0) {
return sm; return sm;

2
src/detect-byte-extract.h
Unescape Escape View File

@ -26,7 +26,7 @@
void DetectByteExtractRegister(void); void DetectByteExtractRegister(void);
SigMatch *DetectByteExtractRetrieveSMVar(const char *, const Signature *); SigMatch *DetectByteExtractRetrieveSMVar(const char *, int sm_list, const Signature *);
int DetectByteExtractDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *, int DetectByteExtractDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *,
const uint8_t *, uint32_t, uint64_t *, uint8_t); const uint8_t *, uint32_t, uint64_t *, uint8_t);

8
src/detect-byte.c
Unescape Escape View File

@ -32,20 +32,22 @@
* *
* \param arg The name of the variable being sought * \param arg The name of the variable being sought
* \param s The signature to check for the variable * \param s The signature to check for the variable
* \param sm_list The caller's matching buffer
* \param index When found, the value of the slot within the byte vars * \param index When found, the value of the slot within the byte vars
* *
* \retval true A match for the variable was found. * \retval true A match for the variable was found.
* \retval false * \retval false
*/ */
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index) bool DetectByteRetrieveSMVar(
const char *arg, const Signature *s, int sm_list, DetectByteIndexType *index)
{ {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(arg, s); SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(arg, sm_list, s);
if (bed_sm != NULL) { if (bed_sm != NULL) {
*index = ((SCDetectByteExtractData *)bed_sm->ctx)->local_id; *index = ((SCDetectByteExtractData *)bed_sm->ctx)->local_id;
return true; return true;
} }
SigMatch *bmd_sm = DetectByteMathRetrieveSMVar(arg, s); SigMatch *bmd_sm = DetectByteMathRetrieveSMVar(arg, sm_list, s);
if (bmd_sm != NULL) { if (bmd_sm != NULL) {
*index = ((DetectByteMathData *)bmd_sm->ctx)->local_id; *index = ((DetectByteMathData *)bmd_sm->ctx)->local_id;
return true; return true;

2
src/detect-byte.h
Unescape Escape View File

@ -27,6 +27,6 @@
typedef uint8_t DetectByteIndexType; typedef uint8_t DetectByteIndexType;
bool DetectByteRetrieveSMVar(const char *, const Signature *, DetectByteIndexType *); bool DetectByteRetrieveSMVar(const char *, const Signature *, int sm_list, DetectByteIndexType *);
#endif /* SURICATA_DETECT_BYTE_H */ #endif /* SURICATA_DETECT_BYTE_H */

4
src/detect-bytejump.c
Unescape Escape View File

@ -544,7 +544,7 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (nbytes != NULL) { if (nbytes != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(nbytes, s, &index)) { if (!DetectByteRetrieveSMVar(nbytes, s, sm_list, &index)) {
SCLogError("Unknown byte_extract var " SCLogError("Unknown byte_extract var "
"seen in byte_jump - %s", "seen in byte_jump - %s",
nbytes); nbytes);
@ -557,7 +557,7 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (offset != NULL) { if (offset != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(offset, s, &index)) { if (!DetectByteRetrieveSMVar(offset, s, sm_list, &index)) {
SCLogError("Unknown byte_extract var " SCLogError("Unknown byte_extract var "
"seen in byte_jump - %s", "seen in byte_jump - %s",
offset); offset);

9
src/detect-bytemath.c
Unescape Escape View File

@ -359,7 +359,7 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (nbytes != NULL) { if (nbytes != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(nbytes, s, &index)) { if (!DetectByteRetrieveSMVar(nbytes, s, sm_list, &index)) {
SCLogError("unknown byte_ keyword var seen in byte_math - %s", nbytes); SCLogError("unknown byte_ keyword var seen in byte_math - %s", nbytes);
goto error; goto error;
} }
@ -371,7 +371,7 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (rvalue != NULL) { if (rvalue != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(rvalue, s, &index)) { if (!DetectByteRetrieveSMVar(rvalue, s, sm_list, &index)) {
SCLogError("unknown byte_ keyword var seen in byte_math - %s", rvalue); SCLogError("unknown byte_ keyword var seen in byte_math - %s", rvalue);
goto error; goto error;
} }
@ -441,7 +441,7 @@ static void DetectByteMathFree(DetectEngineCtx *de_ctx, void *ptr)
* *
* \retval A pointer to the SigMatch if found, otherwise NULL. * \retval A pointer to the SigMatch if found, otherwise NULL.
*/ */
SigMatch *DetectByteMathRetrieveSMVar(const char *arg, const Signature *s) SigMatch *DetectByteMathRetrieveSMVar(const char *arg, int sm_list, const Signature *s)
{ {
for (uint32_t x = 0; x < s->init_data->buffer_index; x++) { for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
SigMatch *sm = s->init_data->buffers[x].head; SigMatch *sm = s->init_data->buffers[x].head;
@ -460,7 +460,8 @@ SigMatch *DetectByteMathRetrieveSMVar(const char *arg, const Signature *s)
for (int list = 0; list < DETECT_SM_LIST_MAX; list++) { for (int list = 0; list < DETECT_SM_LIST_MAX; list++) {
SigMatch *sm = s->init_data->smlists[list]; SigMatch *sm = s->init_data->smlists[list];
while (sm != NULL) { while (sm != NULL) {
if (sm->type == DETECT_BYTEMATH) { // Make sure that the linked buffers ore on the same list
if (sm->type == DETECT_BYTEMATH && (sm_list == -1 || sm_list == list)) {
const DetectByteMathData *bmd = (const DetectByteMathData *)sm->ctx; const DetectByteMathData *bmd = (const DetectByteMathData *)sm->ctx;
if (strcmp(bmd->result, arg) == 0) { if (strcmp(bmd->result, arg) == 0) {
SCLogDebug("Retrieved SM for \"%s\"", arg); SCLogDebug("Retrieved SM for \"%s\"", arg);

2
src/detect-bytemath.h
Unescape Escape View File

@ -26,7 +26,7 @@
void DetectBytemathRegister(void); void DetectBytemathRegister(void);
SigMatch *DetectByteMathRetrieveSMVar(const char *, const Signature *); SigMatch *DetectByteMathRetrieveSMVar(const char *, int sm_list, const Signature *);
int DetectByteMathDoMatch(DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *, int DetectByteMathDoMatch(DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *,
const uint8_t *, const uint32_t, uint8_t, uint64_t, uint64_t *, uint8_t); const uint8_t *, const uint32_t, uint8_t, uint64_t, uint64_t *, uint8_t);

6
src/detect-bytetest.c
Unescape Escape View File

@ -646,7 +646,7 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (value != NULL) { if (value != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(value, s, &index)) { if (!DetectByteRetrieveSMVar(value, s, sm_list, &index)) {
SCLogError("Unknown byte_extract var " SCLogError("Unknown byte_extract var "
"seen in byte_test - %s", "seen in byte_test - %s",
value); value);
@ -660,7 +660,7 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (offset != NULL) { if (offset != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(offset, s, &index)) { if (!DetectByteRetrieveSMVar(offset, s, sm_list, &index)) {
SCLogError("Unknown byte_extract var " SCLogError("Unknown byte_extract var "
"seen in byte_test - %s", "seen in byte_test - %s",
offset); offset);
@ -674,7 +674,7 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
if (nbytes != NULL) { if (nbytes != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(nbytes, s, &index)) { if (!DetectByteRetrieveSMVar(nbytes, s, sm_list, &index)) {
SCLogError("Unknown byte_extract var " SCLogError("Unknown byte_extract var "
"seen in byte_test - %s", "seen in byte_test - %s",
nbytes); nbytes);

2
src/detect-depth.c
Unescape Escape View File

@ -106,7 +106,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, const char *
} }
if (str[0] != '-' && isalpha((unsigned char)str[0])) { if (str[0] != '-' && isalpha((unsigned char)str[0])) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) { if (!DetectByteRetrieveSMVar(str, s, -1, &index)) {
SCLogError("unknown byte_ keyword var " SCLogError("unknown byte_ keyword var "
"seen in depth - %s.", "seen in depth - %s.",
str); str);

2
src/detect-distance.c
Unescape Escape View File

@ -108,7 +108,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
} }
if (str[0] != '-' && isalpha((unsigned char)str[0])) { if (str[0] != '-' && isalpha((unsigned char)str[0])) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) { if (!DetectByteRetrieveSMVar(str, s, -1, &index)) {
SCLogError("unknown byte_ keyword var " SCLogError("unknown byte_ keyword var "
"seen in distance - %s", "seen in distance - %s",
str); str);

3
src/detect-engine-content-inspection.c
Unescape Escape View File

@ -532,12 +532,15 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
if (bjflags & DETECT_BYTEJUMP_OFFSET_VAR) { if (bjflags & DETECT_BYTEJUMP_OFFSET_VAR) {
offset = det_ctx->byte_values[offset]; offset = det_ctx->byte_values[offset];
SCLogDebug("[BJ] using offset value %d", offset);
} }
if (bjflags & DETECT_BYTEJUMP_NBYTES_VAR) { if (bjflags & DETECT_BYTEJUMP_NBYTES_VAR) {
nbytes = det_ctx->byte_values[bjd->nbytes]; nbytes = det_ctx->byte_values[bjd->nbytes];
SCLogDebug("[BJ] using nbytes value %d [index %d]", nbytes, bjd->nbytes);
} else { } else {
nbytes = bjd->nbytes; nbytes = bjd->nbytes;
SCLogDebug("[BJ] using nbytes value %d [index n/a]", nbytes);
} }
/* if we have dce enabled we will have to use the endianness /* if we have dce enabled we will have to use the endianness

2
src/detect-isdataat.c
Unescape Escape View File

@ -347,7 +347,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isda
if (offset != NULL) { if (offset != NULL) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(offset, s, &index)) { if (!DetectByteRetrieveSMVar(offset, s, -1, &index)) {
SCLogError("Unknown byte_extract var " SCLogError("Unknown byte_extract var "
"seen in isdataat - %s\n", "seen in isdataat - %s\n",
offset); offset);

2
src/detect-offset.c
Unescape Escape View File

@ -92,7 +92,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *offset
} }
if (str[0] != '-' && isalpha((unsigned char)str[0])) { if (str[0] != '-' && isalpha((unsigned char)str[0])) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) { if (!DetectByteRetrieveSMVar(str, s, -1, &index)) {
SCLogError("unknown byte_ keyword var " SCLogError("unknown byte_ keyword var "
"seen in offset - %s.", "seen in offset - %s.",
str); str);

2
src/detect-within.c
Unescape Escape View File

@ -104,7 +104,7 @@ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *
} }
if (str[0] != '-' && isalpha((unsigned char)str[0])) { if (str[0] != '-' && isalpha((unsigned char)str[0])) {
DetectByteIndexType index; DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) { if (!DetectByteRetrieveSMVar(str, s, -1, &index)) {
SCLogError("unknown byte_ keyword var " SCLogError("unknown byte_ keyword var "
"seen in within - %s", "seen in within - %s",
str); str);

2
src/util-lua-bytevarlib.c
Unescape Escape View File

@ -55,7 +55,7 @@ static int LuaBytevarMap(lua_State *L)
} }
DetectByteIndexType idx; DetectByteIndexType idx;
if (!DetectByteRetrieveSMVar(name, s, &idx)) { if (!DetectByteRetrieveSMVar(name, s, -1, &idx)) {
luaL_error(L, "unknown byte_extract or byte_math variable: %s", name); luaL_error(L, "unknown byte_extract or byte_math variable: %s", name);
} }

Write Preview
Loading…
Cancel
Save