aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/content: refactor limit propagation

Browse Source
pull/8624/head
Victor Julien 3 years ago
parent 8831ae9be7
commit 33bee20d3d
1 changed files with 164 additions and 160 deletions
Show Stats Download Patch File Download Diff File

54
src/detect-content.c
Unescape Escape View File

@ -501,16 +501,12 @@ bool DetectContentPMATCHValidateCallback(const Signature *s)
* cannot set a depth, but we can set an offset of 'offset:1;'. This will
* make the mpm a bit more precise.
*/
void DetectContentPropagateLimits(Signature *s)
static void PropagateLimits(Signature *s, SigMatch *sm_head)
{
#define VALIDATE(e) \
if (!(e)) { \
return; \
}
BUG_ON(s == NULL || s->init_data == NULL);
uint32_t list = 0;
for (list = 0; list < s->init_data->smlists_array_size; list++) {
uint16_t offset = 0;
uint16_t offset_plus_pat = 0;
uint16_t depth = 0;
@ -520,12 +516,12 @@ void DetectContentPropagateLimits(Signature *s)
bool has_ends_with = false;
uint16_t ends_with_depth = 0;
SigMatch *sm = s->init_data->smlists[list];
for ( ; sm != NULL; sm = sm->next) {
for (SigMatch *sm = sm_head; sm != NULL; sm = sm->next) {
switch (sm->type) {
case DETECT_CONTENT: {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if ((cd->flags & (DETECT_CONTENT_DEPTH|DETECT_CONTENT_OFFSET|DETECT_CONTENT_WITHIN|DETECT_CONTENT_DISTANCE)) == 0) {
if ((cd->flags & (DETECT_CONTENT_DEPTH | DETECT_CONTENT_OFFSET |
DETECT_CONTENT_WITHIN | DETECT_CONTENT_DISTANCE)) == 0) {
offset = depth = 0;
offset_plus_pat = cd->content_len;
SCLogDebug("reset");
@ -545,8 +541,10 @@ void DetectContentPropagateLimits(Signature *s)
has_active_depth_chain = true;
}
SCLogDebug("sm %p depth %u offset %u distance %d within %d", sm, cd->depth, cd->offset, cd->distance, cd->within);
SCLogDebug("stored: offset %u depth %u offset_plus_pat %u", offset, depth, offset_plus_pat);
SCLogDebug("sm %p depth %u offset %u distance %d within %d", sm, cd->depth,
cd->offset, cd->distance, cd->within);
SCLogDebug("stored: offset %u depth %u offset_plus_pat %u", offset, depth,
offset_plus_pat);
if ((cd->flags & (DETECT_DEPTH | DETECT_CONTENT_WITHIN)) == 0) {
if (depth)
@ -562,22 +560,20 @@ void DetectContentPropagateLimits(Signature *s)
SCLogDebug("stored: offset %u depth %u offset_plus_pat %u "
"has_active_depth_chain %s",
offset, depth, offset_plus_pat,
has_active_depth_chain ? "true" : "false");
offset, depth, offset_plus_pat, has_active_depth_chain ? "true" : "false");
if (cd->flags & DETECT_CONTENT_DISTANCE && cd->distance >= 0) {
VALIDATE((uint32_t)offset_plus_pat + cd->distance <= UINT16_MAX);
offset = cd->offset = (uint16_t)(offset_plus_pat + cd->distance);
SCLogDebug("updated content to have offset %u", cd->offset);
}
if (has_active_depth_chain) {
if (offset_plus_pat && cd->flags & DETECT_CONTENT_WITHIN &&
cd->within >= 0) {
if (offset_plus_pat && cd->flags & DETECT_CONTENT_WITHIN && cd->within >= 0) {
if (depth && depth > offset_plus_pat) {
int32_t dist = 0;
if (cd->flags & DETECT_CONTENT_DISTANCE && cd->distance > 0) {
dist = cd->distance;
SCLogDebug("distance to add: %u. depth + dist %u", dist,
depth + dist);
SCLogDebug(
"distance to add: %u. depth + dist %u", dist, depth + dist);
}
SCLogDebug("depth %u + cd->within %u", depth, cd->within);
VALIDATE(depth + cd->within + dist >= 0 &&
@ -585,8 +581,7 @@ void DetectContentPropagateLimits(Signature *s)
depth = cd->depth = (uint16_t)(depth + cd->within + dist);
} else {
SCLogDebug("offset %u + cd->within %u", offset, cd->within);
VALIDATE(depth + cd->within >= 0 &&
depth + cd->within <= UINT16_MAX);
VALIDATE(depth + cd->within >= 0 && depth + cd->within <= UINT16_MAX);
depth = cd->depth = (uint16_t)(offset + cd->within);
}
SCLogDebug("updated content to have depth %u", cd->depth);
@ -623,8 +618,12 @@ void DetectContentPropagateLimits(Signature *s)
}
}
if ((cd->flags & (DETECT_CONTENT_DEPTH|DETECT_CONTENT_OFFSET|DETECT_CONTENT_WITHIN|DETECT_CONTENT_DISTANCE)) == (DETECT_CONTENT_DISTANCE|DETECT_CONTENT_WITHIN) ||
(cd->flags & (DETECT_CONTENT_DEPTH|DETECT_CONTENT_OFFSET|DETECT_CONTENT_WITHIN|DETECT_CONTENT_DISTANCE)) == (DETECT_CONTENT_DISTANCE)) {
if ((cd->flags & (DETECT_CONTENT_DEPTH | DETECT_CONTENT_OFFSET |
DETECT_CONTENT_WITHIN | DETECT_CONTENT_DISTANCE)) ==
(DETECT_CONTENT_DISTANCE | DETECT_CONTENT_WITHIN) ||
(cd->flags & (DETECT_CONTENT_DEPTH | DETECT_CONTENT_OFFSET |
DETECT_CONTENT_WITHIN | DETECT_CONTENT_DISTANCE)) ==
(DETECT_CONTENT_DISTANCE)) {
if (cd->distance >= 0) {
// only distance
VALIDATE((uint32_t)offset_plus_pat + cd->distance <= UINT16_MAX);
@ -667,18 +666,16 @@ void DetectContentPropagateLimits(Signature *s)
has_active_depth_chain = false;
break;
}
default: {
default:
SCLogDebug("keyword not supported, reset offset_plus_pat & offset");
offset_plus_pat = offset = depth = 0;
has_active_depth_chain = false;
break;
}
}
}
/* apply anchored 'ends with' as depth to all patterns */
if (has_depth && has_ends_with) {
sm = s->init_data->smlists[list];
for ( ; sm != NULL; sm = sm->next) {
for (SigMatch *sm = sm_head; sm != NULL; sm = sm->next) {
switch (sm->type) {
case DETECT_CONTENT: {
DetectContentData *cd = (DetectContentData *)sm->ctx;
@ -692,10 +689,17 @@ void DetectContentPropagateLimits(Signature *s)
}
}
}
}
#undef VALIDATE
}
void DetectContentPropagateLimits(Signature *s)
{
for (uint32_t list = 0; list < s->init_data->smlists_array_size; list++) {
SigMatch *sm = s->init_data->smlists[list];
PropagateLimits(s, sm);
}
}
static inline bool NeedsAsHex(uint8_t c)
{
if (!isprint(c))

Write Preview
Loading…
Cancel
Save