From 68017d3fe109083703efae35488e1c0480628fa1 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 30 Jul 2025 16:39:06 +0200 Subject: [PATCH] detect: grow SigTableElmt flags to u32 to be later able to store information about keywords being about integers --- rust/src/detect/mod.rs | 12 ++++++------ rust/sys/src/sys.rs | 4 ++-- src/detect-engine-helper.h | 4 ++-- src/detect-engine-register.c | 2 +- src/detect.h | 26 +++++++++++++------------- 5 files changed, 24 insertions(+), 24 deletions(-) diff --git a/rust/src/detect/mod.rs b/rust/src/detect/mod.rs index d74c5c5a0f..ee92e5646a 100644 --- a/rust/src/detect/mod.rs +++ b/rust/src/detect/mod.rs @@ -74,7 +74,7 @@ pub struct SigTableElmtStickyBuffer { ) -> c_int, } -fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u16) -> u16 { +fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u32) -> u16 { let name = CString::new(kw.name.as_bytes()).unwrap().into_raw(); let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw(); let url = CString::new(kw.url.as_bytes()).unwrap().into_raw(); @@ -125,11 +125,11 @@ pub unsafe extern "C" fn SCDetectSigMatchNamesFree(kw: &mut SCSigTableNamesElmt) } // TODO bindgen these -pub const SIGMATCH_NOOPT: u16 = 1; // BIT_U16(0) in detect.h -pub(crate) const SIGMATCH_OPTIONAL_OPT: u16 = 0x10; // BIT_U16(4) in detect.h -pub(crate) const SIGMATCH_QUOTES_MANDATORY: u16 = 0x40; // BIT_U16(6) in detect.h -pub const SIGMATCH_INFO_STICKY_BUFFER: u16 = 0x200; // BIT_U16(9) -pub const SIGMATCH_INFO_MULTI_BUFFER: u16 = 0x4000; // BIT_U16(14) +pub const SIGMATCH_NOOPT: u32 = 1; // BIT_U16(0) in detect.h +pub(crate) const SIGMATCH_OPTIONAL_OPT: u32 = 0x10; // BIT_U16(4) in detect.h +pub(crate) const SIGMATCH_QUOTES_MANDATORY: u32 = 0x40; // BIT_U16(6) in detect.h +pub const SIGMATCH_INFO_STICKY_BUFFER: u32 = 0x200; // BIT_U16(9) +pub const SIGMATCH_INFO_MULTI_BUFFER: u32 = 0x4000; // BIT_U16(14) #[repr(u8)] #[derive(Copy, Clone, Debug, PartialEq, Eq)] diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs index 15c582ed04..741c292637 100644 --- a/rust/sys/src/sys.rs +++ b/rust/sys/src/sys.rs @@ -283,7 +283,7 @@ pub struct SCSigTableAppLiteElmt { #[doc = " keyword documentation url"] pub url: *const ::std::os::raw::c_char, #[doc = " flags SIGMATCH_*"] - pub flags: u16, + pub flags: u32, #[doc = " function callback to parse and setup keyword in rule"] pub Setup: ::std::option::Option< unsafe extern "C" fn( @@ -315,7 +315,7 @@ pub struct SCTransformTableElmt { pub name: *const ::std::os::raw::c_char, pub desc: *const ::std::os::raw::c_char, pub url: *const ::std::os::raw::c_char, - pub flags: u16, + pub flags: u32, pub Setup: ::std::option::Option< unsafe extern "C" fn( arg1: *mut DetectEngineCtx, diff --git a/src/detect-engine-helper.h b/src/detect-engine-helper.h index 72034fd7b8..f816c6c884 100644 --- a/src/detect-engine-helper.h +++ b/src/detect-engine-helper.h @@ -54,7 +54,7 @@ typedef struct SCSigTableAppLiteElmt { /// keyword documentation url const char *url; /// flags SIGMATCH_* - uint16_t flags; + uint32_t flags; /// function callback to parse and setup keyword in rule int (*Setup)(DetectEngineCtx *, Signature *, const char *); /// function callback to free structure allocated by setup if any @@ -68,7 +68,7 @@ typedef struct SCTransformTableElmt { const char *name; const char *desc; const char *url; - uint16_t flags; + uint32_t flags; int (*Setup)(DetectEngineCtx *, Signature *, const char *); void (*Free)(DetectEngineCtx *, void *); void (*Transform)(DetectEngineThreadCtx *, InspectionBuffer *, void *context); diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index c15cbebb59..f5ffce4d64 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -292,7 +292,7 @@ int DETECT_TBLSIZE_IDX = DETECT_TBLSIZE_STATIC; static void PrintFeatureList(const SigTableElmt *e, char sep) { - const uint16_t flags = e->flags; + const uint32_t flags = e->flags; int prev = 0; if (flags & SIGMATCH_NOOPT) { diff --git a/src/detect.h b/src/detect.h index 8b3622640c..2172d011c5 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1445,7 +1445,7 @@ typedef struct SigTableElmt_ { #ifdef UNITTESTS void (*RegisterTests)(void); #endif - uint16_t flags; + uint32_t flags; /* coccinelle: SigTableElmt:flags:SIGMATCH_ */ /** bitfield of tables supported by this rule: used by DETECT_TABLE_*_FLAG flags. */ @@ -1646,7 +1646,7 @@ typedef struct SigGroupHead_ { } SigGroupHead; /** sigmatch has no options, so the parser shouldn't expect any */ -#define SIGMATCH_NOOPT BIT_U16(0) +#define SIGMATCH_NOOPT BIT_U32(0) /** sigmatch is compatible with a ip only rule */ #define SIGMATCH_IPONLY_COMPAT BIT_U16(1) /** sigmatch is compatible with a decode event only rule */ @@ -1656,32 +1656,32 @@ typedef struct SigGroupHead_ { /** sigmatch may have options, so the parser should be ready to * deal with both cases */ -#define SIGMATCH_OPTIONAL_OPT BIT_U16(4) +#define SIGMATCH_OPTIONAL_OPT BIT_U32(4) /** input may be wrapped in double quotes. They will be stripped before * input data is passed to keyword parser */ -#define SIGMATCH_QUOTES_OPTIONAL BIT_U16(5) +#define SIGMATCH_QUOTES_OPTIONAL BIT_U32(5) /** input MUST be wrapped in double quotes. They will be stripped before * input data is passed to keyword parser. Missing double quotes lead to * error and signature invalidation. */ -#define SIGMATCH_QUOTES_MANDATORY BIT_U16(6) +#define SIGMATCH_QUOTES_MANDATORY BIT_U32(6) /** negation parsing is handled by the rule parser. Signature::init_data::negated * will be set to true or false prior to calling the keyword parser. Exclamation * mark is stripped from the input to the keyword parser. */ -#define SIGMATCH_HANDLE_NEGATION BIT_U16(7) +#define SIGMATCH_HANDLE_NEGATION BIT_U32(7) /** keyword is a content modifier */ -#define SIGMATCH_INFO_CONTENT_MODIFIER BIT_U16(8) +#define SIGMATCH_INFO_CONTENT_MODIFIER BIT_U32(8) /** keyword is a sticky buffer */ -#define SIGMATCH_INFO_STICKY_BUFFER BIT_U16(9) +#define SIGMATCH_INFO_STICKY_BUFFER BIT_U32(9) /** keyword is deprecated: used to suggest an alternative */ -#define SIGMATCH_INFO_DEPRECATED BIT_U16(10) +#define SIGMATCH_INFO_DEPRECATED BIT_U32(10) /** strict parsing is enabled */ -#define SIGMATCH_STRICT_PARSING BIT_U16(11) +#define SIGMATCH_STRICT_PARSING BIT_U32(11) /** keyword supported by firewall rules */ -#define SIGMATCH_SUPPORT_FIREWALL BIT_U16(12) +#define SIGMATCH_SUPPORT_FIREWALL BIT_U32(12) /** keyword supporting setting an optional direction */ -#define SIGMATCH_SUPPORT_DIR BIT_U16(13) +#define SIGMATCH_SUPPORT_DIR BIT_U32(13) /** keyword is a multi buffer */ -#define SIGMATCH_INFO_MULTI_BUFFER BIT_U16(14) +#define SIGMATCH_INFO_MULTI_BUFFER BIT_U32(14) enum DetectEngineTenantSelectors {