detect/bytemath: pass match ctx directly

Adjust includes to enable this.
pull/9999/head
Victor Julien 3 years ago committed by Victor Julien
parent e2fbcf9654
commit 53591702aa

@ -22,10 +22,11 @@
*/ */
#include "suricata-common.h" #include "suricata-common.h"
#include "rust.h"
#include "detect-byte.h" #include "detect-byte.h"
#include "detect-byte-extract.h" #include "detect-byte-extract.h"
#include "detect-bytemath.h" #include "detect-bytemath.h"
#include "rust.h"
/** /**
* \brief Used to retrieve args from BM. * \brief Used to retrieve args from BM.
* *

@ -29,21 +29,23 @@
#include "threads.h" #include "threads.h"
#include "decode.h" #include "decode.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "detect.h" #include "detect.h"
#include "detect-parse.h" #include "detect-parse.h"
#include "detect-engine.h" #include "detect-engine.h"
#include "detect-engine-mpm.h" #include "detect-engine-mpm.h"
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "detect-engine-build.h" #include "detect-engine-build.h"
#include "rust-bindings.h"
#include "detect-content.h" #include "detect-content.h"
#include "detect-pcre.h" #include "detect-pcre.h"
#include "detect-byte.h" #include "detect-byte.h"
#include "detect-bytemath.h" #include "detect-bytemath.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "rust-bindings.h"
#include "flow.h" #include "flow.h"
#include "flow-var.h" #include "flow-var.h"
#include "flow-util.h" #include "flow-util.h"
@ -82,11 +84,10 @@ static inline bool DetectByteMathValidateNbytesOnly(const DetectByteMathData *da
(((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4)); (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
} }
int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const SigMatchData *smd, int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const DetectByteMathData *data,
const Signature *s, const uint8_t *payload, uint16_t payload_len, uint8_t nbytes, const Signature *s, const uint8_t *payload, uint16_t payload_len, uint8_t nbytes,
uint64_t rvalue, uint64_t *value, uint8_t endian) uint64_t rvalue, uint64_t *value, uint8_t endian)
{ {
const DetectByteMathData *data = (DetectByteMathData *)smd->ctx;
if (payload_len == 0) { if (payload_len == 0) {
return 0; return 0;
} }

@ -27,7 +27,7 @@
void DetectBytemathRegister(void); void DetectBytemathRegister(void);
SigMatch *DetectByteMathRetrieveSMVar(const char *, const Signature *); SigMatch *DetectByteMathRetrieveSMVar(const char *, const Signature *);
int DetectByteMathDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *, int DetectByteMathDoMatch(DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *,
const uint8_t *, uint16_t, uint8_t, uint64_t, uint64_t *, uint8_t); const uint8_t *, uint16_t, uint8_t, uint64_t, uint64_t *, uint8_t);
#endif /* __DETECT_BYTEMATH_H__ */ #endif /* __DETECT_BYTEMATH_H__ */

@ -25,12 +25,14 @@
#include "suricata-common.h" #include "suricata-common.h"
#include "suricata.h" #include "suricata.h"
#include "decode.h" #include "decode.h"
#include "detect.h" #include "detect.h"
#include "detect-engine.h" #include "detect-engine.h"
#include "detect-parse.h" #include "detect-parse.h"
#include "rust.h"
#include "detect-asn1.h" #include "detect-asn1.h"
#include "detect-content.h" #include "detect-content.h"
#include "detect-pcre.h" #include "detect-pcre.h"
@ -60,8 +62,6 @@
#include "util-unittest-helper.h" #include "util-unittest-helper.h"
#include "util-profiling.h" #include "util-profiling.h"
#include "rust.h"
#ifdef HAVE_LUA #ifdef HAVE_LUA
#include "util-lua.h" #include "util-lua.h"
#endif #endif
@ -569,17 +569,16 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
} else if (smd->type == DETECT_BYTEMATH) { } else if (smd->type == DETECT_BYTEMATH) {
DetectByteMathData *bmd = (DetectByteMathData *)smd->ctx; const DetectByteMathData *bmd = (const DetectByteMathData *)smd->ctx;
uint8_t endian = bmd->endian; uint8_t endian = bmd->endian;
/* if we have dce enabled we will have to use the endianness /* if we have dce enabled we will have to use the endianness
* specified by the dce header */ * specified by the dce header */
if ((bmd->flags & DETECT_BYTEMATH_FLAG_ENDIAN) && endian == (int)EndianDCE && if ((bmd->flags & DETECT_BYTEMATH_FLAG_ENDIAN) && endian == (int)EndianDCE &&
flags & (DETECT_CI_FLAGS_DCE_LE | DETECT_CI_FLAGS_DCE_BE)) { flags & (DETECT_CI_FLAGS_DCE_LE | DETECT_CI_FLAGS_DCE_BE)) {
/* enable the endianness flag temporarily. once we are done /* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/ * processing we reset the flags to the original value*/
endian |= (uint8_t)((flags & DETECT_CI_FLAGS_DCE_LE) ? LittleEndian : BigEndian); endian = (uint8_t)((flags & DETECT_CI_FLAGS_DCE_LE) ? LittleEndian : BigEndian);
} }
uint64_t rvalue; uint64_t rvalue;
if (bmd->flags & DETECT_BYTEMATH_FLAG_RVALUE_VAR) { if (bmd->flags & DETECT_BYTEMATH_FLAG_RVALUE_VAR) {
@ -596,7 +595,7 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
} }
DEBUG_VALIDATE_BUG_ON(buffer_len > UINT16_MAX); DEBUG_VALIDATE_BUG_ON(buffer_len > UINT16_MAX);
if (DetectByteMathDoMatch(det_ctx, smd, s, buffer, (uint16_t)buffer_len, nbytes, rvalue, if (DetectByteMathDoMatch(det_ctx, bmd, s, buffer, (uint16_t)buffer_len, nbytes, rvalue,
&det_ctx->byte_values[bmd->local_id], endian) != 1) { &det_ctx->byte_values[bmd->local_id], endian) != 1) {
goto no_match; goto no_match;
} }

@ -43,6 +43,8 @@
#include "detect-engine-threshold.h" #include "detect-engine-threshold.h"
#include "detect-engine-prefilter.h" #include "detect-engine-prefilter.h"
#include "rust.h"
#include "detect-engine-payload.h" #include "detect-engine-payload.h"
#include "detect-engine-dcepayload.h" #include "detect-engine-dcepayload.h"
#include "detect-dns-opcode.h" #include "detect-dns-opcode.h"

Loading…
Cancel
Save