detect: fix heap overflow issue with buffer setup

In some cases, the InspectionBufferGet function would be followed by
a failure to set the buffer up, for example due to a HTTP body limit
not yet being reached. Yet each call to InspectionBufferGet would lead
to the matching list_id to be added to the
DetectEngineThreadCtx::inspect.to_clear_queue. This array is sized to
add each list only once, but in this case the same id could be added
multiple times, potentially overflowing the array.
pull/5840/head
Victor Julien 5 years ago
parent 17a38f1823
commit 13cebb1857

@ -79,7 +79,7 @@ static InspectionBuffer *GetSMBData(DetectEngineThreadCtx *det_ctx,
return NULL;
SCLogDebug("have data!");
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;
@ -105,7 +105,7 @@ static InspectionBuffer *GetDCEData(DetectEngineThreadCtx *det_ctx,
} else {
buffer->flags |= DETECT_CI_FLAGS_DCE_BE;
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -170,7 +170,7 @@ static InspectionBuffer *GetDNP3Data(DetectEngineThreadCtx *det_ctx,
return NULL;
SCLogDebug("tx %p data %p data_len %u", tx, data, data_len);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -91,7 +91,7 @@ static InspectionBuffer *DnsQueryGetData(DetectEngineThreadCtx *det_ctx,
&data, &data_len) == 0) {
return NULL;
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -996,11 +996,7 @@ void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
InspectionBuffer *InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
{
InspectionBuffer *buffer = &det_ctx->inspect.buffers[list_id];
if (buffer->inspect == NULL) {
det_ctx->inspect.to_clear_queue[det_ctx->inspect.to_clear_idx++] = list_id;
}
return buffer;
return &det_ctx->inspect.buffers[list_id];
}
/** \brief for a InspectionBufferMultipleForList get a InspectionBuffer
@ -1053,8 +1049,15 @@ void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size)
}
/** \brief setup the buffer with our initial data */
void InspectionBufferSetup(InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
{
if (buffer->inspect == NULL) {
#ifdef UNITTESTS
if (det_ctx && list_id != -1)
#endif
det_ctx->inspect.to_clear_queue[det_ctx->inspect.to_clear_idx++] = list_id;
}
buffer->inspect = buffer->orig = data;
buffer->inspect_len = buffer->orig_len = data_len;
buffer->len = 0;

@ -29,7 +29,8 @@
#include "flow-private.h"
void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size);
void InspectionBufferSetup(InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len);
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len);
void InspectionBufferFree(InspectionBuffer *buffer);
void InspectionBufferCheckAndExpand(InspectionBuffer *buffer, uint32_t min_size);
void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len);

@ -405,7 +405,7 @@ static InspectionBuffer *HttpServerBodyGetDataCallback(DetectEngineThreadCtx *de
StreamingBufferGetDataAtOffset(body->sb,
&data, &data_len, offset);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
buffer->inspect_offset = offset;
/* built-in 'transformation' */
@ -483,7 +483,7 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
StreamingBufferGetDataAtOffset(cur_file->sb,
&data, &data_len,
cur_file->content_inspected);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
SCLogDebug("[list %d] [before] buffer offset %" PRIu64 "; buffer len %" PRIu32
"; data_len %" PRIu32 "; file_size %" PRIu64,
list_id, buffer->inspect_offset, buffer->inspect_len, data_len, file_size);

@ -461,7 +461,7 @@ static InspectionBuffer *FilemagicGetDataCallback(DetectEngineThreadCtx *det_ctx
const uint8_t *data = (const uint8_t *)cur_file->magic;
uint32_t data_len = (uint32_t)strlen(cur_file->magic);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -367,7 +367,7 @@ static InspectionBuffer *FilenameGetDataCallback(DetectEngineThreadCtx *det_ctx,
const uint8_t *data = cur_file->name;
uint32_t data_len = cur_file->name_len;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -257,7 +257,7 @@ static InspectionBuffer *HttpClientBodyGetDataCallback(DetectEngineThreadCtx *de
StreamingBufferGetDataAtOffset(body->sb,
&data, &data_len, offset);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
buffer->inspect_offset = offset;

@ -182,7 +182,7 @@ static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(h->value);
const uint8_t *data = bstr_ptr(h->value);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
@ -210,7 +210,7 @@ static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(h->value);
const uint8_t *data = bstr_ptr(h->value);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -189,7 +189,7 @@ static void PrefilterTxHttpRequestHeaderNames(DetectEngineThreadCtx *det_ctx,
return;
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, ctx->transforms);
}
@ -267,7 +267,7 @@ static void PrefilterTxHttpResponseHeaderNames(DetectEngineThreadCtx *det_ctx,
return;
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, ctx->transforms);
}
@ -332,7 +332,7 @@ static int InspectEngineHttpHeaderNames(
goto end;
}
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -176,7 +176,7 @@ static int DetectEngineInspectBufferHttpHeader(
goto end;
}
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
@ -243,7 +243,7 @@ static void PrefilterMpmHttpHeader(DetectEngineThreadCtx *det_ctx,
return;
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, ctx->transforms);
}

@ -74,7 +74,7 @@ static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(h->value);
const uint8_t *data = bstr_ptr(h->value);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
@ -107,7 +107,7 @@ static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(h->value);
const uint8_t *data = bstr_ptr(h->value);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -233,7 +233,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->request_hostname);
const uint8_t *data = bstr_ptr(tx->request_hostname);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
@ -306,7 +306,7 @@ static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
data_len = bstr_len(tx->parsed_uri->hostname);
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -201,7 +201,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->request_method);
const uint8_t *data = bstr_ptr(tx->request_method);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -109,7 +109,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -189,7 +189,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = ts ?
tx_ud->request_headers_raw_len : tx_ud->response_headers_raw_len;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -139,7 +139,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->request_line);
const uint8_t *data = bstr_ptr(tx->request_line);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -138,7 +138,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->response_line);
const uint8_t *data = bstr_ptr(tx->response_line);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -190,7 +190,7 @@ static void PrefilterTxHttpRequestStart(DetectEngineThreadCtx *det_ctx,
return;
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, ctx->transforms);
}
@ -264,7 +264,7 @@ static void PrefilterTxHttpResponseStart(DetectEngineThreadCtx *det_ctx,
return;
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, ctx->transforms);
}
@ -329,7 +329,7 @@ static int InspectEngineHttpStart(
goto end;
}
/* setup buffer and apply transforms */
InspectionBufferSetup(buffer, rawdata, rawdata_len);
InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -163,7 +163,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->response_status);
const uint8_t *data = bstr_ptr(tx->response_status);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -163,7 +163,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->response_message);
const uint8_t *data = bstr_ptr(tx->response_message);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -169,7 +169,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(h->value);
const uint8_t *data = bstr_ptr(h->value);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -228,7 +228,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx_ud->request_uri_normalized);
const uint8_t *data = bstr_ptr(tx_ud->request_uri_normalized);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
@ -298,7 +298,7 @@ static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = bstr_len(tx->request_uri);
const uint8_t *data = bstr_ptr(tx->request_uri);
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -706,7 +706,7 @@ static InspectionBuffer *GetHttp2HNameData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");
@ -840,7 +840,7 @@ static InspectionBuffer *GetHttp2HeaderData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -112,7 +112,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = hlen;
const uint8_t *data = (const uint8_t *)p->icmpv4h;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -118,7 +118,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = hlen;
const uint8_t *data = (const uint8_t *)p->icmpv6h;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -117,7 +117,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = hlen;
const uint8_t *data = (const uint8_t *)p->ip4h;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -118,7 +118,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = hlen;
const uint8_t *data = (const uint8_t *)p->ip6h;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -76,7 +76,7 @@ static InspectionBuffer *GetKrb5CNameData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -76,7 +76,7 @@ static InspectionBuffer *GetKrb5SNameData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -83,7 +83,7 @@ static InspectionBuffer *MQTTSubscribeTopicGetData(DetectEngineThreadCtx *det_ct
return NULL;
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -83,7 +83,7 @@ static InspectionBuffer *MQTTUnsubscribeTopicGetData(DetectEngineThreadCtx *det_
return NULL;
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -82,7 +82,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -115,7 +115,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -85,7 +85,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return NULL;
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -86,7 +86,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -86,7 +86,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -88,7 +88,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -88,7 +88,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -98,7 +98,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -69,7 +69,7 @@ static InspectionBuffer *GetNamedPipeData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;
@ -132,7 +132,7 @@ static InspectionBuffer *GetShareData(DetectEngineThreadCtx *det_ctx,
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetup(buffer, b, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}
return buffer;

@ -104,7 +104,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, hassh, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, hasshServer, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, hasshServer, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, hassh, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, hassh, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -74,7 +74,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, protocol, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, protocol, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -74,7 +74,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, software, b_len);
InspectionBufferSetup(det_ctx, list_id, buffer, software, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -119,7 +119,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = hlen;
const uint8_t *data = (const uint8_t *)p->tcph;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -133,7 +133,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
return NULL; /* no buffer */
}
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -141,7 +141,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->server_connp.cert0_fingerprint);
const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_fingerprint;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -131,7 +131,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->server_connp.cert0_issuerdn);
const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_issuerdn;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -140,7 +140,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->server_connp.cert0_serial);
const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_serial;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -130,7 +130,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->server_connp.cert0_subject);
const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_subject;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -158,8 +158,8 @@ static InspectionBuffer *TlsCertsGetData(DetectEngineThreadCtx *det_ctx,
return NULL;
}
InspectionBufferSetup(buffer, cbdata->cert->cert_data,
cbdata->cert->cert_len);
InspectionBufferSetup(
det_ctx, list_id, buffer, cbdata->cert->cert_data, cbdata->cert->cert_len);
InspectionBufferApplyTransforms(buffer, transforms);
SCReturnPtr(buffer, "InspectionBuffer");

@ -153,7 +153,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->client_connp.ja3_hash);
const uint8_t *data = (uint8_t *)ssl_state->client_connp.ja3_hash;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -143,7 +143,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->client_connp.ja3_str->data);
const uint8_t *data = (uint8_t *)ssl_state->client_connp.ja3_str->data;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -151,7 +151,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->server_connp.ja3_hash);
const uint8_t *data = (uint8_t *)ssl_state->server_connp.ja3_hash;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -142,7 +142,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->server_connp.ja3_str->data);
const uint8_t *data = (uint8_t *)ssl_state->server_connp.ja3_str->data;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -129,7 +129,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = strlen(ssl_state->client_connp.sni);
const uint8_t *data = (uint8_t *)ssl_state->client_connp.sni;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

@ -161,7 +161,7 @@ static int DetectTransformCompressWhitespaceTest01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 9);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformCompressWhitespace(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -176,7 +176,7 @@ static int DetectTransformCompressWhitespaceTest02(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 9);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformDoubleWhitespace(&buffer);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -195,7 +195,7 @@ static int DetectTransformCompressWhitespaceTest03(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 10);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
FAIL_IF(TransformCompressWhitespaceValidate(buffer.inspect, buffer.inspect_len, NULL));
PASS;
@ -208,7 +208,7 @@ static int DetectTransformCompressWhitespaceTest04(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 9);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
TransformDoubleWhitespace(&buffer);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
FAIL_IF(TransformCompressWhitespaceValidate(buffer.inspect, buffer.inspect_len, NULL));

@ -128,7 +128,7 @@ static int DetectTransformDotPrefixTest01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, input_len);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformDotPrefix(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -148,7 +148,7 @@ static int DetectTransformDotPrefixTest02(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, input_len);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformDotPrefix(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -182,4 +182,4 @@ static void DetectTransformDotPrefixRegisterTests(void)
UtRegisterTest("DetectTransformDotPrefixTest02", DetectTransformDotPrefixTest02);
UtRegisterTest("DetectTransformDotPrefixTest03", DetectTransformDotPrefixTest03);
}
#endif
#endif

@ -99,7 +99,7 @@ static int DetectTransformToMd5Test01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 8);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformToMd5(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -112,4 +112,4 @@ static void DetectTransformToMd5RegisterTests(void)
UtRegisterTest("DetectTransformToMd5Test01",
DetectTransformToMd5Test01);
}
#endif
#endif

@ -100,7 +100,7 @@ static int DetectTransformToSha1Test01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 8);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformToSha1(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);

@ -100,7 +100,7 @@ static int DetectTransformToSha256Test01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 8);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformToSha256(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -113,4 +113,4 @@ static void DetectTransformToSha256RegisterTests(void)
UtRegisterTest("DetectTransformToSha256Test01",
DetectTransformToSha256Test01);
}
#endif
#endif

@ -148,7 +148,7 @@ static int DetectTransformStripWhitespaceTest01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 8);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformStripWhitespace(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -163,7 +163,7 @@ static int DetectTransformStripWhitespaceTest02(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 8);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformDoubleWhitespace(&buffer);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@ -202,4 +202,4 @@ static void DetectTransformStripWhitespaceRegisterTests(void)
UtRegisterTest("DetectTransformStripWhitespaceTest03",
DetectTransformStripWhitespaceTest03);
}
#endif
#endif

@ -136,7 +136,7 @@ static int DetectTransformUrlDecodeTest01(void)
InspectionBuffer buffer;
InspectionBufferInit(&buffer, 8);
InspectionBufferSetup(&buffer, input, input_len);
InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
TransformUrlDecode(&buffer, NULL);
PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);

@ -114,7 +114,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const uint32_t data_len = UDP_HEADER_LEN;
const uint8_t *data = (const uint8_t *)p->udph;
InspectionBufferSetup(buffer, data, data_len);
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
}

Loading…
Cancel
Save