aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fast pattern support for http_client_body keyword added. Also mpm support for http_client_body added

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 16 years ago committed by Victor Julien
parent c227aeeacb
commit 0aa5cffb12
12 changed files with 2172 additions and 316 deletions
Show Stats Download Patch File Download Diff File

1
src/detect-content.h
Unescape Escape View File

@ -45,6 +45,7 @@
#define DETECT_CONTENT_PACKET_MPM 0x0800
#define DETECT_CONTENT_STREAM_MPM 0x1000
#define DETECT_CONTENT_URI_MPM 0x2000
#define DETECT_CONTENT_HCBD_MPM 0x4000
#define DETECT_CONTENT_IS_SINGLE(c) (!((c)->flags & DETECT_CONTENT_DISTANCE || \
(c)->flags & DETECT_CONTENT_WITHIN || \

14
src/detect-depth.c
Unescape Escape View File

@ -170,6 +170,20 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
case DETECT_AL_HTTP_CLIENT_BODY:
cd = (DetectContentData *)pm->ctx;
if (cd->flags & DETECT_CONTENT_NEGATED) {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
}
}
cd->depth = (uint32_t)atoi(str);
if (cd->depth < cd->content_len) {
cd->depth = cd->content_len;

25
src/detect-distance.c
Unescape Escape View File

@ -155,7 +155,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
SigMatchTransferSigMatchAcrossLists(pm1,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->sm_lists[DETECT_SM_LIST_DMATCH], &s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
&s->sm_lists[DETECT_SM_LIST_DMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
pm = pm1;
} else {
/* within is against pm1, pm = pm1 */
@ -372,6 +373,20 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
}
}
if (cd->flags & DETECT_CONTENT_NEGATED) {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
}
}
cd->flags |= DETECT_CONTENT_DISTANCE;
pm = SigMatchGetLastSMFromLists(s, 2,
@ -382,6 +397,14 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
goto error;
}
cd = (DetectContentData *)pm->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword "
"has a fast_pattern:only; set. You can't "
"have relative keywords around a fast_pattern "
"only content");
goto error;
}
((DetectContentData *)pm->ctx)->flags |= DETECT_CONTENT_RELATIVE_NEXT;
break;

515
src/detect-engine-hcbd.c
Unescape Escape View File

@ -26,6 +26,7 @@
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-parse.h"
#include "detect-engine-state.h"
#include "detect-uricontent.h"
@ -97,6 +98,9 @@ static int DoInspectHttpClientBody(DetectEngineCtx *de_ctx,
DetectContentData *cd = (DetectContentData *)sm->ctx;
SCLogDebug("inspecting content %"PRIu32" payload_len %"PRIu32, cd->id, payload_len);
if (cd->flags & DETECT_CONTENT_HCBD_MPM && !(cd->flags & DETECT_CONTENT_NEGATED))
goto match;
/* rule parsers should take care of this */
BUG_ON(cd->depth != 0 && cd->depth <= cd->offset);
@ -202,7 +206,6 @@ static int DoInspectHttpClientBody(DetectEngineCtx *de_ctx,
}
BUG_ON(sm->next == NULL);
SCLogDebug("uricontent %"PRIu32, cd->id);
/* see if the next payload keywords match. If not, we will
* search for another occurence of this uricontent and see
@ -242,6 +245,102 @@ match:
}
}
/**
* \brief Helps buffer request bodies for different transactions and stores them
* away in detection code. Also calls the mpm on the bodies.
*
* \param det_ctx Detection engine thread ctx.
* \param f Pointer to the flow.
* \param htp_state http state.
* \param call_mpm 1 if we are also to call the mpm no the buffered bodies or
* 0 if we to just buffer the bodies.
*
* \retval cnt The match count from the mpm call. If call_mpm is 0, the retval
* is ignored.
*/
static uint32_t DetectEngineInspectHttpClientBodyMpmInspect(DetectEngineThreadCtx *det_ctx,
Flow *f, HtpState *htp_state,
int call_mpm) {
uint32_t cnt = 0;
size_t idx = 0;
htp_tx_t *tx = NULL;
int i = 0;
for (idx = AppLayerTransactionGetInspectId(f);
i < det_ctx->hcbd_buffers_list_len; idx++, i++) {
/* if the buffer already exists, use it */
if (det_ctx->hcbd_buffers[i] != NULL) {
if (call_mpm) {
cnt += HttpClientBodyPatternSearch(det_ctx,
det_ctx->hcbd_buffers[i],
det_ctx->hcbd_buffers_len[i]);
}
continue;
}
tx = list_get(htp_state->connp->conn->transactions, idx);
tx = list_get(htp_state->connp->conn->transactions, idx);
if (tx == NULL)
continue;
SCHtpTxUserData *htud = (SCHtpTxUserData *)htp_tx_get_user_data(tx);
if (htud == NULL)
continue;
HtpBodyChunk *cur = htud->body.first;
if (htud->body.nchunks == 0) {
SCLogDebug("No http chunks to inspect for this transacation");
continue;
} else {
/* no chunks?!! move on to the next transaction */
if (cur == NULL) {
SCLogDebug("No http chunks to inspect");
continue;
}
/* this applies only for the client request body like the keyword name says */
if (htud->body.operation != HTP_BODY_REQUEST) {
SCLogDebug("htp chunk not a request chunk");
continue;
}
if (htud->content_len != htud->content_len_so_far) {
SCLogDebug("we still haven't seen the entire request body. "
"Let's defer body inspection till we see the "
"entire body.");
continue;
}
uint8_t *chunks_buffer = NULL;
uint32_t chunks_buffer_len = 0;
while (cur != NULL) {
/* \todo Currently we limit the body length we inspect. We
* should change to handling chunks statefully */
if (chunks_buffer_len > 20000)
break;
chunks_buffer_len += cur->len;
if ( (chunks_buffer = SCRealloc(chunks_buffer, chunks_buffer_len)) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memcpy(chunks_buffer + chunks_buffer_len - cur->len, cur->data, cur->len);
cur = cur->next;
}
/* store the buffers. We will need it for further inspection */
det_ctx->hcbd_buffers[i] = chunks_buffer;
det_ctx->hcbd_buffers_len[i] = chunks_buffer_len;
/* carry out the mpm */
if (call_mpm)
cnt += HttpClientBodyPatternSearch(det_ctx, chunks_buffer, chunks_buffer_len);
} /* else - if (htud->body.nchunks == 0) */
} /* for (idx = AppLayerTransactionGetInspectId(f); .. */
SCReturnUInt(cnt);
}
/**
* \brief Do the http_client_body content inspection for a signature.
*
@ -263,6 +362,7 @@ int DetectEngineInspectHttpClientBody(DetectEngineCtx *de_ctx,
SCEnter();
int r = 0;
HtpState *htp_state = NULL;
int i = 0;
htp_state = (HtpState *)alstate;
if (htp_state == NULL) {
@ -278,59 +378,76 @@ int DetectEngineInspectHttpClientBody(DetectEngineCtx *de_ctx,
goto end;
}
size_t idx = 0;
for ( ; idx < list_size(htp_state->connp->conn->transactions); idx++)
{
htp_tx_t *tx = list_get(htp_state->connp->conn->transactions, idx);
if (tx == NULL)
continue;
/* it is either the first entry into this function. If it is not,
* then we just don't have any http transactions */
if (det_ctx->hcbd_buffers_list_len == 0) {
/* get the transaction id */
int tmp_idx = AppLayerTransactionGetInspectId(f);
/* error! get out of here */
if (tmp_idx == -1)
goto end;
SCHtpTxUserData *htud = (SCHtpTxUserData *) htp_tx_get_user_data(tx);
if (htud == NULL)
continue;
/* let's get the transaction count. We need this to hold the client body
* buffer for each transaction */
det_ctx->hcbd_buffers_list_len = list_size(htp_state->connp->conn->transactions) - tmp_idx;
/* no transactions?! cool. get out of here */
if (det_ctx->hcbd_buffers_list_len == 0)
goto end;
HtpBodyChunk *cur = htud->body.first;
/* assign space to hold buffers. Each per transaction */
det_ctx->hcbd_buffers = malloc(det_ctx->hcbd_buffers_list_len * sizeof(uint8_t *));
if (det_ctx->hcbd_buffers == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memset(det_ctx->hcbd_buffers, 0, det_ctx->hcbd_buffers_list_len * sizeof(uint8_t *));
if (htud->body.nchunks == 0) {
SCLogDebug("No http chunks to inspect");
goto end;
} else {
/* no chunks?!! get out of here */
if (cur == NULL) {
SCLogDebug("No http chunks to inspect");
goto end;
}
det_ctx->hcbd_buffers_len = malloc(det_ctx->hcbd_buffers_list_len * sizeof(uint32_t));
if (det_ctx->hcbd_buffers_len == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memset(det_ctx->hcbd_buffers_len, 0, det_ctx->hcbd_buffers_list_len * sizeof(uint32_t));
} /* if (det_ctx->hcbd_buffers_list_len == 0) */
/* this applies only for the client request body like the keyword name says */
if (htud->body.operation != HTP_BODY_REQUEST) {
SCLogDebug("htp chunk not a request chunk");
goto end;
}
if (s->flags & SIG_FLAG_MPM_HCBDCONTENT) {
if (det_ctx->de_mpm_scanned_hcbd == FALSE) {
uint32_t cnt = DetectEngineInspectHttpClientBodyMpmInspect(det_ctx, f, htp_state, 1);
if (cnt <= 0)
det_ctx->de_have_hcbd = FALSE;
if (htud->content_len != htud->content_len_so_far)
continue;
det_ctx->de_mpm_scanned_hcbd = TRUE;
}
} else {
DetectEngineInspectHttpClientBodyMpmInspect(det_ctx, f, htp_state, 0);
}
uint8_t *chunks_buffer = NULL;
uint32_t total_chunks_len = 0;
while (cur != NULL) {
/* \todo Currently we limit the body length we inspect. We
* should change to handling chunks statefully */
if (total_chunks_len > 20000)
break;
total_chunks_len += cur->len;
if ( (chunks_buffer = SCRealloc(chunks_buffer, total_chunks_len)) == NULL) {
return 0;
}
memcpy(chunks_buffer + total_chunks_len - cur->len, cur->data, cur->len);
cur = cur->next;
}
if (det_ctx->de_have_hcbd == FALSE &&
s->flags & SIG_FLAG_MPM_HCBDCONTENT &&
!(s->flags & SIG_FLAG_MPM_HCBDCONTENT_NEG)) {
SCLogDebug("mpm results failure for client_body. Get out of here");
goto end;
}
r = DoInspectHttpClientBody(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH],
chunks_buffer, total_chunks_len);
SCFree(chunks_buffer);
if (r == 1) {
break;
}
if ((s->flags & SIG_FLAG_MPM_HCBDCONTENT) && (det_ctx->de_mpm_scanned_hcbd == TRUE)) {
/* filter out the sig that needs a match, but have no matches */
if (!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_hcbdpattern_id / 8)] & (1 << (s->mpm_hcbdpattern_id % 8))) &&
!(s->flags & SIG_FLAG_MPM_HCBDCONTENT_NEG)) {
goto end;
}
}
for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
uint8_t *hcbd_buffer = det_ctx->hcbd_buffers[i];
uint32_t hcbd_buffer_len = det_ctx->hcbd_buffers_len[i];
if (hcbd_buffer == NULL)
continue;
r = DoInspectHttpClientBody(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH],
hcbd_buffer, hcbd_buffer_len);
if (r == 1) {
break;
}
}
@ -2241,6 +2358,302 @@ end:
return result;
}
static int DetectEngineHttpClientBodyTest17(void)
{
TcpSession ssn;
Packet *p1 = NULL;
ThreadVars th_v;
DetectEngineCtx *de_ctx = NULL;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
uint8_t http1_buf[] = "This is dummy body1";
uint32_t http1_len = sizeof(http1_buf) - 1;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.src.family = AF_INET;
f.dst.family = AF_INET;
p1->flow = &f;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http client body test\"; "
"content:body1; http_client_body; "
"content:bambu; http_client_body; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
/* start the search phase */
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1);
uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len);
if (r != 1) {
printf("expected 1 result, got %"PRIu32": ", r);
goto end;
}
result = 1;
end:
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
SigCleanSignatures(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p1, 1);
return result;
}
static int DetectEngineHttpClientBodyTest18(void)
{
TcpSession ssn;
Packet *p1 = NULL;
ThreadVars th_v;
DetectEngineCtx *de_ctx = NULL;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
uint8_t http1_buf[] = "This is dummy body1";
uint32_t http1_len = sizeof(http1_buf) - 1;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.src.family = AF_INET;
f.dst.family = AF_INET;
p1->flow = &f;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http client body test\"; "
"content:body1; http_client_body; "
"content:bambu; http_client_body; fast_pattern; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
/* start the search phase */
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1);
uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len);
if (r != 0) {
printf("expected 1 result, got %"PRIu32": ", r);
goto end;
}
result = 1;
end:
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
SigCleanSignatures(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p1, 1);
return result;
}
static int DetectEngineHttpClientBodyTest19(void)
{
TcpSession ssn;
Packet *p1 = NULL;
ThreadVars th_v;
DetectEngineCtx *de_ctx = NULL;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
uint8_t http1_buf[] = "This is dummy body1";
uint32_t http1_len = sizeof(http1_buf) - 1;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.src.family = AF_INET;
f.dst.family = AF_INET;
p1->flow = &f;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http client body test\"; "
"content:bambu; http_client_body; "
"content:is; http_client_body; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
/* start the search phase */
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1);
uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len);
if (r != 0) {
printf("expected 1 result, got %"PRIu32": ", r);
goto end;
}
result = 1;
end:
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
SigCleanSignatures(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p1, 1);
return result;
}
static int DetectEngineHttpClientBodyTest20(void)
{
TcpSession ssn;
Packet *p1 = NULL;
ThreadVars th_v;
DetectEngineCtx *de_ctx = NULL;
DetectEngineThreadCtx *det_ctx = NULL;
Flow f;
uint8_t http1_buf[] = "This is dummy body1";
uint32_t http1_len = sizeof(http1_buf) - 1;
int result = 0;
memset(&th_v, 0, sizeof(th_v));
memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn));
p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn;
f.src.family = AF_INET;
f.dst.family = AF_INET;
p1->flow = &f;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW;
f.alproto = ALPROTO_HTTP;
StreamTcpInitConfig(TRUE);
FlowL7DataPtrInit(&f);
de_ctx = DetectEngineCtxInit();
if (de_ctx == NULL)
goto end;
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http client body test\"; "
"content:bambu; http_client_body; "
"content:is; http_client_body; fast_pattern; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
/* start the search phase */
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p1);
uint32_t r = HttpClientBodyPatternSearch(det_ctx, http1_buf, http1_len);
if (r != 2) {
printf("expected 1 result, got %"PRIu32": ", r);
goto end;
}
result = 1;
end:
if (de_ctx != NULL)
SigGroupCleanup(de_ctx);
if (de_ctx != NULL)
SigCleanSignatures(de_ctx);
if (de_ctx != NULL)
DetectEngineCtxFree(de_ctx);
FlowL7DataPtrFree(&f);
StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f);
UTHFreePackets(&p1, 1);
return result;
}
#endif /* UNITTESTS */
void HttpClientBodyRegisterTests(void)
@ -2279,6 +2692,14 @@ void HttpClientBodyRegisterTests(void)
DetectEngineHttpClientBodyTest15, 1);
UtRegisterTest("DetectEngineHttpClientBodyTest16",
DetectEngineHttpClientBodyTest16, 1);
UtRegisterTest("DetectEngineHttpClientBodyTest17",
DetectEngineHttpClientBodyTest17, 1);
UtRegisterTest("DetectEngineHttpClientBodyTest18",
DetectEngineHttpClientBodyTest18, 1);
UtRegisterTest("DetectEngineHttpClientBodyTest19",
DetectEngineHttpClientBodyTest19, 1);
UtRegisterTest("DetectEngineHttpClientBodyTest20",
DetectEngineHttpClientBodyTest20, 1);
#endif /* UNITTESTS */
return;

180
src/detect-engine-mpm.c
Unescape Escape View File

@ -263,6 +263,29 @@ uint32_t UriPatternSearch(DetectEngineThreadCtx *det_ctx,
SCReturnUInt(ret);
}
/** \brief Uri Pattern match -- searches for one pattern per signature.
*
* \param det_ctx detection engine thread ctx
* \param p packet to inspect
*
* \retval ret number of matches
*/
uint32_t HttpClientBodyPatternSearch(DetectEngineThreadCtx *det_ctx,
uint8_t *body, uint32_t body_len)
{
SCEnter();
if (det_ctx->sgh->mpm_hcbd_ctx == NULL)
SCReturnUInt(0);
uint32_t ret;
ret = mpm_table[det_ctx->sgh->mpm_hcbd_ctx->mpm_type].
Search(det_ctx->sgh->mpm_hcbd_ctx, &det_ctx->mtcu,
&det_ctx->pmq, body, body_len);
SCReturnUInt(ret);
}
/** \brief Pattern match -- searches for only one pattern per signature.
*
* \param tv threadvars
@ -557,6 +580,7 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
DetectContentData *cd = NULL;
DetectContentData *ud = NULL;
DetectContentData *hcbd = NULL;
switch (mpm_sm->type) {
case DETECT_CONTENT:
{
@ -588,14 +612,14 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
}
if (SignatureHasStreamContent(s)) {
if (cd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_ctx->mpm_type].
AddPatternNocase(sgh->mpm_ctx,
mpm_table[sgh->mpm_stream_ctx->mpm_type].
AddPatternNocase(sgh->mpm_stream_ctx,
cd->content + cd->fp_chop_offset,
cd->fp_chop_len,
0, 0, cd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_ctx->mpm_type].
AddPattern(sgh->mpm_ctx,
mpm_table[sgh->mpm_stream_ctx->mpm_type].
AddPattern(sgh->mpm_stream_ctx,
cd->content + cd->fp_chop_offset,
cd->fp_chop_len,
0, 0, cd->id, s->num, flags);
@ -611,10 +635,12 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
}
} else {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (SignatureHasPacketContent(s))
cd->flags |= DETECT_CONTENT_PACKET_MPM;
if (SignatureHasStreamContent(s))
cd->flags |= DETECT_CONTENT_STREAM_MPM;
if (DETECT_CONTENT_IS_SINGLE(cd)) {
if (SignatureHasPacketContent(s))
cd->flags |= DETECT_CONTENT_PACKET_MPM;
if (SignatureHasStreamContent(s))
cd->flags |= DETECT_CONTENT_STREAM_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
@ -680,21 +706,23 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "uri" mpm */
if (ud->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_ctx->mpm_type].
AddPatternNocase(sgh->mpm_ctx,
mpm_table[sgh->mpm_uri_ctx->mpm_type].
AddPatternNocase(sgh->mpm_uri_ctx,
ud->content + ud->fp_chop_offset,
ud->fp_chop_len,
0, 0, ud->id, s->num, flags);
} else {
mpm_table[sgh->mpm_ctx->mpm_type].
AddPattern(sgh->mpm_ctx,
mpm_table[sgh->mpm_uri_ctx->mpm_type].
AddPattern(sgh->mpm_uri_ctx,
ud->content + ud->fp_chop_offset,
ud->fp_chop_len,
0, 0, ud->id, s->num, flags);
}
} else {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
ud->flags |= DETECT_CONTENT_URI_MPM;
if (DETECT_CONTENT_IS_SINGLE(ud)) {
ud->flags |= DETECT_CONTENT_URI_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
@ -724,6 +752,60 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
break;
} /* case DETECT_URICONTENT */
case DETECT_AL_HTTP_CLIENT_BODY:
{
hcbd = (DetectContentData *)mpm_sm->ctx;
if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "uri" mpm */
if (hcbd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hcbd_ctx,
hcbd->content + hcbd->fp_chop_offset,
hcbd->fp_chop_len,
0, 0, hcbd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPattern(sgh->mpm_hcbd_ctx,
hcbd->content + hcbd->fp_chop_offset,
hcbd->fp_chop_len,
0, 0, hcbd->id, s->num, flags);
}
} else {
if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
if (DETECT_CONTENT_IS_SINGLE(hcbd)) {
hcbd->flags |= DETECT_CONTENT_HCBD_MPM;
}
/* see if we can bypass the match validation for this pattern */
} else {
if (DETECT_CONTENT_IS_SINGLE(hcbd)) {
hcbd->flags |= DETECT_CONTENT_HCBD_MPM;
}
} /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */
/* add the content to the "packet" mpm */
if (hcbd->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPatternNocase(sgh->mpm_hcbd_ctx,
hcbd->content, hcbd->content_len,
0, 0, hcbd->id, s->num, flags);
} else {
mpm_table[sgh->mpm_hcbd_ctx->mpm_type].
AddPattern(sgh->mpm_hcbd_ctx,
hcbd->content, hcbd->content_len,
0, 0, hcbd->id, s->num, flags);
}
}
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_HCBDCONTENT;
s->mpm_hcbdpattern_id = hcbd->id;
if (hcbd->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_HCBDCONTENT_NEG;
break;
} /* case DETECT_AL_HTTP_CLIENT_BODY */
} /* switch (mpm_sm->type) */
SCLogDebug("%"PRIu32" adding co->id %"PRIu32" to the mpm phase "
@ -1770,6 +1852,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
uint32_t has_co_packet = 0; /**< our sgh has packet payload inspecting content */
uint32_t has_co_stream = 0; /**< our sgh has stream inspecting content */
uint32_t has_co_uri = 0; /**< our sgh has uri inspecting content */
uint32_t has_co_hcbd = 0;
//uint32_t cnt = 0;
uint32_t sig = 0;
@ -1800,6 +1883,10 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
has_co_uri = 1;
}
}
if (s->sm_lists[DETECT_SM_LIST_HCBDMATCH] != NULL) {
has_co_hcbd = 1;
}
}
if (has_co_packet > 0) {
@ -1811,14 +1898,21 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
if (has_co_uri > 0) {
sh->flags |= SIG_GROUP_HAVEURICONTENT;
}
if (has_co_hcbd > 0) {
sh->flags |= SIG_GROUP_HAVEHCBDCONTENT;
}
/* intialize contexes */
if (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) {
if (sh->flags & SIG_GROUP_HAVECONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_packet);
} else {
sh->mpm_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
}
if (sh->mpm_ctx == NULL) {
SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen");
exit(EXIT_FAILURE);
}
#ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_ctx, de_ctx->mpm_matcher, -1);
@ -1827,12 +1921,16 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
#endif
}
if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) {
if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_stream_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_stream);
} else {
sh->mpm_stream_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
}
if (sh->mpm_stream_ctx == NULL) {
SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen");
exit(EXIT_FAILURE);
}
#ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_stream_ctx, de_ctx->mpm_matcher, -1);
@ -1841,12 +1939,16 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
#endif
}
if (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) {
if (sh->flags & SIG_GROUP_HAVEURICONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_uri_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_uri);
} else {
sh->mpm_uri_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
}
if (sh->mpm_uri_ctx == NULL) {
SCLogDebug("sh->mpm_uri_ctx == NULL. This should never happen");
exit(EXIT_FAILURE);
}
#ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_uri_ctx, de_ctx->mpm_matcher, -1);
@ -1855,6 +1957,24 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
#endif
}
if (sh->flags & SIG_GROUP_HAVEHCBDCONTENT) {
if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) {
sh->mpm_hcbd_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hcbd);
} else {
sh->mpm_hcbd_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT);
}
if (sh->mpm_hcbd_ctx == NULL) {
SCLogDebug("sh->mpm_stream_ctx == NULL. This should never happen");
exit(EXIT_FAILURE);
}
#ifndef __SC_CUDA_SUPPORT__
MpmInitCtx(sh->mpm_hcbd_ctx, de_ctx->mpm_matcher, -1);
#else
MpmInitCtx(sh->mpm_hcbd_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle);
#endif
}
/* for each signature in this group do */
//for (sig = 0; sig < sh->sig_cnt; sig++) {
// s = sh->match_array[sig];
@ -1984,9 +2104,10 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
// }
//}
if ( (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) ||
(sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) ||
(sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) ) {
if (sh->flags & SIG_GROUP_HAVECONTENT ||
sh->flags & SIG_GROUP_HAVESTREAMCONTENT ||
sh->flags & SIG_GROUP_HAVEURICONTENT ||
sh->flags & SIG_GROUP_HAVEHCBDCONTENT) {
PatternMatchPreparePopulateMpm(de_ctx, sh);
@ -1996,7 +2117,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
MpmFactoryReClaimMpmCtx(sh->mpm_ctx);
sh->mpm_ctx = NULL;
} else {
if (sh->flags & SIG_GROUP_HAVECONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) {
if (sh->flags & SIG_GROUP_HAVECONTENT) {
if (mpm_table[sh->mpm_ctx->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_ctx->mpm_type].Prepare(sh->mpm_ctx);
}
@ -2007,7 +2128,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
MpmFactoryReClaimMpmCtx(sh->mpm_stream_ctx);
sh->mpm_stream_ctx = NULL;
} else {
if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) {
if (sh->flags & SIG_GROUP_HAVESTREAMCONTENT) {
if (mpm_table[sh->mpm_stream_ctx->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_stream_ctx->mpm_type].Prepare(sh->mpm_stream_ctx);
}
@ -2018,13 +2139,24 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
MpmFactoryReClaimMpmCtx(sh->mpm_uri_ctx);
sh->mpm_uri_ctx = NULL;
} else {
if (sh->flags & SIG_GROUP_HAVEURICONTENT && !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) {
if (sh->flags & SIG_GROUP_HAVEURICONTENT) {
if (mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_uri_ctx->mpm_type].Prepare(sh->mpm_uri_ctx);
}
}
}
}
if (sh->mpm_hcbd_ctx != NULL) {
if (sh->mpm_hcbd_ctx->pattern_cnt == 0) {
MpmFactoryReClaimMpmCtx(sh->mpm_hcbd_ctx);
sh->mpm_hcbd_ctx = NULL;
} else {
if (sh->flags & SIG_GROUP_HAVEHCBDCONTENT) {
if (mpm_table[sh->mpm_hcbd_ctx->mpm_type].Prepare != NULL)
mpm_table[sh->mpm_hcbd_ctx->mpm_type].Prepare(sh->mpm_hcbd_ctx);
}
}
}
} /* if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL) */
} else {
MpmFactoryReClaimMpmCtx(sh->mpm_ctx);
sh->mpm_ctx = NULL;
@ -2032,6 +2164,8 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
sh->mpm_stream_ctx = NULL;
MpmFactoryReClaimMpmCtx(sh->mpm_uri_ctx);
sh->mpm_uri_ctx = NULL;
MpmFactoryReClaimMpmCtx(sh->mpm_hcbd_ctx);
sh->mpm_hcbd_ctx = NULL;
}
///* uricontent */

1
src/detect-engine-mpm.h
Unescape Escape View File

@ -36,6 +36,7 @@ uint16_t PatternMatchDefaultMatcher(void);
uint32_t PacketPatternSearch(ThreadVars *, DetectEngineThreadCtx *, Packet *);
uint32_t UriPatternSearch(DetectEngineThreadCtx *, uint8_t *, uint16_t);
uint32_t StreamPatternSearch(ThreadVars *, DetectEngineThreadCtx *, Packet *, StreamMsg *, uint8_t);
uint32_t HttpClientBodyPatternSearch(DetectEngineThreadCtx *, uint8_t *, uint32_t);
void PacketPatternCleanup(ThreadVars *, DetectEngineThreadCtx *);
void StreamPatternCleanup(ThreadVars *t, DetectEngineThreadCtx *det_ctx, StreamMsg *smsg);

1650
src/detect-fast-pattern.c
View File

File diff suppressed because it is too large Load Diff

8
src/detect-http-client-body.c
Unescape Escape View File

@ -216,14 +216,6 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
if (((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN)
{
SCLogWarning(SC_WARN_COMPATIBILITY,
"http_client_body cannot be used with \"fast_pattern\" currently."
"Unsetting fast_pattern on this modifier. Signature ==> %s", s->sig_str);
((DetectContentData *)sm->ctx)->flags &= ~DETECT_CONTENT_FAST_PATTERN;
}
/* http_client_body should not be used with the rawbytes rule */
if ( ((DetectContentData *)sm->ctx)->flags & DETECT_CONTENT_RAWBYTES) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_client_body rule can not "

14
src/detect-offset.c
Unescape Escape View File

@ -177,6 +177,20 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
case DETECT_AL_HTTP_CLIENT_BODY:
cd = (DetectContentData *)pm->ctx;
if (cd->flags & DETECT_CONTENT_NEGATED) {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
}
}
cd->offset = (uint32_t)atoi(str);
if (cd->depth != 0) {
if (cd->depth < cd->content_len) {

22
src/detect-within.c
Unescape Escape View File

@ -396,6 +396,20 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
goto error;
}
if (cd->flags & DETECT_CONTENT_NEGATED) {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
}
}
cd->flags |= DETECT_CONTENT_WITHIN;
pm = SigMatchGetLastSMFromLists(s, 2,
@ -406,6 +420,14 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
goto error;
}
cd = (DetectContentData *)pm->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword "
"has a fast_pattern:only; set. You can't "
"have relative keywords around a fast_pattern "
"only content");
goto error;
}
((DetectContentData *)pm->ctx)->flags |= DETECT_CONTENT_RELATIVE_NEXT;
break;

23
src/detect.c
Unescape Escape View File

@ -872,6 +872,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
Signature *s = NULL;
SigMatch *sm = NULL;
det_ctx->de_have_hcbd = TRUE;
det_ctx->de_mpm_scanned_hcbd = FALSE;
SCEnter();
/* No need to perform any detection on this packet, if the the given flag is set.*/
@ -1306,6 +1309,17 @@ end:
PacketPatternCleanup(th_v, det_ctx);
//}
if (det_ctx->hcbd_buffers_list_len != 0) {
int i;
for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
if (det_ctx->hcbd_buffers[i] != NULL)
SCFree(det_ctx->hcbd_buffers[i]);
}
SCFree(det_ctx->hcbd_buffers);
det_ctx->hcbd_buffers = NULL;
det_ctx->hcbd_buffers_list_len = 0;
}
/* store the found sgh (or NULL) in the flow to save us from looking it
* up again for the next packet. Also return any stream chunk we processed
* to the pool. */
@ -1717,6 +1731,9 @@ static void SigInitStandardMpmFactoryContexts(DetectEngineCtx *de_ctx)
de_ctx->sgh_mpm_context_stream =
MpmFactoryRegisterMpmCtxProfile("stream",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_hcbd =
MpmFactoryRegisterMpmCtxProfile("hcbd",
MPM_CTX_FACTORY_FLAGS_PREPARE_WITH_SIG_GROUP_BUILD);
de_ctx->sgh_mpm_context_app_proto_detect =
MpmFactoryRegisterMpmCtxProfile("app_proto_detect", 0);
@ -3665,6 +3682,12 @@ int SigGroupBuild (DetectEngineCtx *de_ctx) {
}
//printf("uri- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hcbd);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);
}
//printf("hcbd- %d\n", mpm_ctx->pattern_cnt);
mpm_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_stream);
if (mpm_table[de_ctx->mpm_matcher].Prepare != NULL) {
mpm_table[de_ctx->mpm_matcher].Prepare(mpm_ctx);

35
src/detect.h
Unescape Escape View File

@ -236,8 +236,10 @@ typedef struct DetectPort_ {
#define SIG_FLAG_MPM_STREAM_NEG 0x02000000
#define SIG_FLAG_MPM_URICONTENT 0x04000000
#define SIG_FLAG_MPM_URICONTENT_NEG 0x08000000
#define SIG_FLAG_MPM_HCBDCONTENT 0x10000000
#define SIG_FLAG_MPM_HCBDCONTENT_NEG 0x20000000
#define SIG_FLAG_HAS_NO_PKT_AND_STREAM_CONTENT 0x10000000
#define SIG_FLAG_HAS_NO_PKT_AND_STREAM_CONTENT 0x40000000
/* signature mask flags */
#define SIG_MASK_REQUIRE_PAYLOAD 0x01
@ -353,6 +355,7 @@ typedef struct Signature_ {
*/
/** pattern in the mpm matcher */
PatIntId mpm_uripattern_id;
PatIntId mpm_hcbdpattern_id;
/* the fast pattern added from this signature */
SigMatch *mpm_sm;
@ -615,6 +618,7 @@ typedef struct DetectEngineCtx_ {
int32_t sgh_mpm_context_packet;
int32_t sgh_mpm_context_stream;
int32_t sgh_mpm_context_uri;
int32_t sgh_mpm_context_hcbd;
int32_t sgh_mpm_context_app_proto_detect;
/** sgh for signatures that match against invalid packets. In those cases
@ -658,6 +662,14 @@ typedef struct DetectionEngineThreadCtx_ {
char de_have_httpuri;
char de_mpm_scanned_uri;
/* detectione engine context for hcbd mpm */
char de_have_hcbd;
char de_mpm_scanned_hcbd;
uint8_t **hcbd_buffers;
uint32_t *hcbd_buffers_len;
uint16_t hcbd_buffers_list_len;
/** id for alert counter */
uint16_t counter_alerts;
@ -745,14 +757,15 @@ typedef struct SigTableElmt_ {
char *name;
} SigTableElmt;
#define SIG_GROUP_HAVECONTENT 0x01
#define SIG_GROUP_HAVEURICONTENT 0x02
#define SIG_GROUP_HAVESTREAMCONTENT 0x04
#define SIG_GROUP_HEAD_MPM_COPY 0x08
#define SIG_GROUP_HEAD_MPM_URI_COPY 0x10
#define SIG_GROUP_HEAD_MPM_STREAM_COPY 0x20
#define SIG_GROUP_HEAD_FREE 0x40
#define SIG_GROUP_HEAD_REFERENCED 0x80 /**< sgh is being referenced by others, don't clear */
#define SIG_GROUP_HAVECONTENT 0x0001
#define SIG_GROUP_HAVEURICONTENT 0x0002
#define SIG_GROUP_HAVESTREAMCONTENT 0x0004
#define SIG_GROUP_HAVEHCBDCONTENT 0x0008
#define SIG_GROUP_HEAD_MPM_COPY 0x0010
#define SIG_GROUP_HEAD_MPM_URI_COPY 0x0020
#define SIG_GROUP_HEAD_MPM_STREAM_COPY 0x0040
#define SIG_GROUP_HEAD_FREE 0x0080
#define SIG_GROUP_HEAD_REFERENCED 0x0100 /**< sgh is being referenced by others, don't clear */
typedef struct SigGroupHeadInitData_ {
/* list of content containers
@ -778,8 +791,7 @@ typedef struct SigGroupHeadInitData_ {
/** \brief Container for matching data for a signature group */
typedef struct SigGroupHead_ {
uint8_t flags;
uint8_t pad0;
uint16_t flags;
/* number of sigs in this head */
SigIntId sig_cnt;
@ -795,6 +807,7 @@ typedef struct SigGroupHead_ {
MpmCtx *mpm_ctx;
MpmCtx *mpm_stream_ctx;
MpmCtx *mpm_uri_ctx;
MpmCtx *mpm_hcbd_ctx;
uint16_t mpm_uricontent_maxlen;
uint16_t pad1;
#if __WORDSIZE == 64

Write Preview
Loading…
Cancel
Save