aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: introduce DetectAppLayerInspectEngineRegister2

Browse Source 
Function to register a app engine with two progresses
pull/16407/head
Philippe Antoine 9 months ago
parent 0c6bf15378
commit cee2b848e8
2 changed files with 57 additions and 12 deletions
Show Stats Download Patch File Download Diff File

65
src/detect-engine.c
Unescape Escape View File

@ -198,8 +198,9 @@ void DetectPktInspectEngineRegister(const char *name,
*
* \note errors are fatal */
static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alproto, uint32_t dir,
uint8_t sub_state, uint8_t progress, InspectEngineFuncPtr Callback,
InspectionBufferGetDataPtr GetData, InspectionSingleBufferGetDataPtr GetDataSingle,
uint8_t sub_state, uint8_t min_progress, uint8_t max_progress,
InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData,
InspectionSingleBufferGetDataPtr GetDataSingle,
InspectionMultiBufferGetDataPtr GetMultiData)
{
/* ignore special case unknown */
@ -207,7 +208,8 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
DEBUG_VALIDATE_BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0);
DEBUG_VALIDATE_BUG_ON(!AppLayerParserSupportsSubStates(alproto) && sub_state != 0);
}
BUG_ON(progress >= APP_LAYER_MAX_PROGRESS);
BUG_ON(max_progress >= APP_LAYER_MAX_PROGRESS);
BUG_ON(max_progress < min_progress);
DetectBufferTypeRegister(name);
const int sm_list = DetectBufferTypeGetByName(name);
@ -217,8 +219,8 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
SCLogDebug("name %s id %d", name, sm_list);
if ((alproto == ALPROTO_FAILED) || (!(dir == SIG_FLAG_TOSERVER || dir == SIG_FLAG_TOCLIENT)) ||
(sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (progress >= 48) ||
(Callback == NULL)) {
(sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
(max_progress >= APP_LAYER_MAX_PROGRESS) || (Callback == NULL)) {
SCLogError("Invalid arguments");
BUG_ON(1);
} else if (Callback == DetectEngineInspectBufferGeneric && GetData == NULL) {
@ -251,8 +253,8 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
new_engine->sm_list = (uint16_t)sm_list;
new_engine->sm_list_base = (uint16_t)sm_list;
new_engine->sub_state = sub_state;
new_engine->min_progress = progress;
new_engine->max_progress = progress;
new_engine->min_progress = min_progress;
new_engine->max_progress = max_progress;
new_engine->v2.Callback = Callback;
if (Callback == DetectEngineInspectBufferGeneric) {
new_engine->v2.GetData = GetData;
@ -274,6 +276,45 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
}
}
/**
* \brief register an app-layer inspect engine with a min and max progress
*
* \param name the buffer name
* \param alproto app-layer protocol
* \param dir direction
* \param progress1 first progress to run the engine
* \param progress2 second progress where we can run the engine
* \param Callback callback function, can be generic DetectEngineInspectBufferGeneric
* \param GetData seconday callback in case of use of DetectEngineInspectBufferGeneric
*/
void DetectAppLayerInspectEngineRegister2(const char *name, AppProto alproto, uint32_t dir,
uint8_t progress1, uint8_t progress2, InspectEngineFuncPtr Callback,
InspectionBufferGetDataPtr GetData)
{
/* before adding, check that we don't add a duplicate entry, which will
* propagate all the way into the packet runtime if allowed. */
DetectEngineAppInspectionEngine *t = g_app_inspect_engines;
if (progress1 >= progress2) {
FatalError(
"Bad order for progresses for %s : %d should be > %d", name, progress1, progress2);
}
while (t != NULL) {
const uint32_t t_direction = t->dir == 0 ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
const int sm_list = DetectBufferTypeGetByName(name);
if (t->sm_list == sm_list && t->alproto == alproto && t_direction == dir &&
t->min_progress == progress1 && t->v2.Callback == Callback &&
t->v2.GetData == GetData) {
DEBUG_VALIDATE_BUG_ON(1);
return;
}
t = t->next;
}
AppLayerInspectEngineRegisterInternal(
name, alproto, dir, 0, progress1, progress2, Callback, GetData, NULL, NULL);
}
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir,
uint8_t progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
{
@ -294,7 +335,7 @@ void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uin
}
AppLayerInspectEngineRegisterInternal(
name, alproto, dir, 0, (uint8_t)progress, Callback, GetData, NULL, NULL);
name, alproto, dir, 0, progress, progress, Callback, GetData, NULL, NULL);
}
void DetectAppLayerInspectEngineRegisterSubState(const char *name, AppProto alproto, uint32_t dir,
@ -318,7 +359,7 @@ void DetectAppLayerInspectEngineRegisterSubState(const char *name, AppProto alpr
}
AppLayerInspectEngineRegisterInternal(
name, alproto, dir, sub_state, progress, Callback, GetData, NULL, NULL);
name, alproto, dir, sub_state, progress, progress, Callback, GetData, NULL, NULL);
}
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir,
uint8_t progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
@ -340,7 +381,7 @@ void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alprot
}
AppLayerInspectEngineRegisterInternal(
name, alproto, dir, 0, (uint8_t)progress, Callback, NULL, GetData, NULL);
name, alproto, dir, 0, progress, progress, Callback, NULL, GetData, NULL);
}
/* copy an inspect engine with transforms to a new list id. */
@ -2339,7 +2380,7 @@ void DetectAppLayerMultiRegisterSubState(const char *name, AppProto alproto, uin
uint8_t sub_state, uint8_t progress, InspectionMultiBufferGetDataPtr GetData, int priority)
{
BUG_ON(AppLayerParserSupportsSubStates(alproto) && sub_state == 0);
AppLayerInspectEngineRegisterInternal(name, alproto, dir, sub_state, progress,
AppLayerInspectEngineRegisterInternal(name, alproto, dir, sub_state, progress, progress,
DetectEngineInspectMultiBufferGeneric, NULL, NULL, GetData);
DetectAppLayerMpmMultiRegisterSubState(name, dir, priority, PrefilterMultiGenericMpmRegister,
GetData, alproto, sub_state, progress);
@ -2351,7 +2392,7 @@ void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t di
InspectionMultiBufferGetDataPtr GetData, int priority)
{
BUG_ON(AppLayerParserSupportsSubStates(alproto));
AppLayerInspectEngineRegisterInternal(name, alproto, dir, 0, (uint8_t)progress,
AppLayerInspectEngineRegisterInternal(name, alproto, dir, 0, progress, progress,
DetectEngineInspectMultiBufferGeneric, NULL, NULL, GetData);
DetectAppLayerMpmMultiRegister(
name, dir, priority, PrefilterMultiGenericMpmRegister, GetData, alproto, progress);

4
src/detect-engine.h
Unescape Escape View File

@ -172,6 +172,10 @@ void DetectAppLayerInspectEngineRegisterSubState(const char *name, AppProto alpr
uint8_t type, uint8_t progress, InspectEngineFuncPtr Callback2,
InspectionBufferGetDataPtr GetData);
void DetectAppLayerInspectEngineRegister2(const char *name, AppProto alproto, uint32_t dir,
uint8_t progress1, uint8_t progress2, InspectEngineFuncPtr Callback2,
InspectionBufferGetDataPtr GetData);
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir,
uint8_t progress, InspectEngineFuncPtr Callback2, InspectionSingleBufferGetDataPtr GetData);

Write Preview
Loading…
Cancel
Save