From 6eeab37ab3fb6d62ff13c57ddb8de85baff21200 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 11 Jan 2012 14:24:09 +0100 Subject: [PATCH] Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well. --- src/detect-flowbits.c | 20 ++++++++++++++++++-- src/detect-flowint.c | 19 ++++++++++++++++++- src/detect-parse.c | 26 ++++++++++++++++++++++++++ src/detect-parse.h | 1 + src/detect.c | 27 ++++++++++++++++++++++++--- src/detect.h | 2 ++ 6 files changed, 89 insertions(+), 6 deletions(-) diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c index 86b62c860f..d5d04d1c25 100644 --- a/src/detect-flowbits.c +++ b/src/detect-flowbits.c @@ -208,7 +208,7 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) goto error; } - switch(fb_cmd) { + switch (fb_cmd) { case DETECT_FLOWBITS_CMD_NOALERT: if(fb_name != NULL) goto error; @@ -249,7 +249,23 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) sm->type = DETECT_FLOWBITS; sm->ctx = (void *)cd; - SigMatchAppendPacket(s, sm); + switch (fb_cmd) { + case DETECT_FLOWBITS_CMD_NOALERT: + /* nothing to do */ + break; + + case DETECT_FLOWBITS_CMD_ISNOTSET: + case DETECT_FLOWBITS_CMD_ISSET: + /* checks, so packet list */ + SigMatchAppendPacket(s, sm); + + case DETECT_FLOWBITS_CMD_SET: + case DETECT_FLOWBITS_CMD_UNSET: + case DETECT_FLOWBITS_CMD_TOGGLE: + /* modifiers, only run when entire sig has matched */ + SigMatchAppendPostMatch(s, sm); + break; + } return 0; diff --git a/src/detect-flowint.c b/src/detect-flowint.c index 4771eade12..95ec405920 100644 --- a/src/detect-flowint.c +++ b/src/detect-flowint.c @@ -375,7 +375,24 @@ static int DetectFlowintSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawst sm->type = DETECT_FLOWINT; sm->ctx = (void *)sfd; - SigMatchAppendPacket(s, sm); + switch (sfd->modifier) { + case FLOWINT_MODIFIER_SET: + case FLOWINT_MODIFIER_ADD: + case FLOWINT_MODIFIER_SUB: + SigMatchAppendPostMatch(s, sm); + break; + + case FLOWINT_MODIFIER_LT: + case FLOWINT_MODIFIER_LE: + case FLOWINT_MODIFIER_NE: + case FLOWINT_MODIFIER_EQ: + case FLOWINT_MODIFIER_GE: + case FLOWINT_MODIFIER_GT: + case FLOWINT_MODIFIER_ISSET: + case FLOWINT_MODIFIER_NOTSET: + SigMatchAppendPacket(s, sm); + break; + } return 0; diff --git a/src/detect-parse.c b/src/detect-parse.c index 11dfa7b16a..9c52c50e37 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -327,6 +327,32 @@ void SigMatchAppendPacket(Signature *s, SigMatch *new) { s->sm_cnt++; } +/** \brief Append a sig match to the signatures post-match list + * + * \param s signature + * \param new sigmatch to append + */ +void SigMatchAppendPostMatch(Signature *s, SigMatch *new) { + if (s->sm_lists[DETECT_SM_LIST_POSTMATCH] == NULL) { + s->sm_lists[DETECT_SM_LIST_POSTMATCH] = new; + s->sm_lists_tail[DETECT_SM_LIST_POSTMATCH] = new; + new->next = NULL; + new->prev = NULL; + } else { + SigMatch *cur = s->sm_lists[DETECT_SM_LIST_POSTMATCH]; + + for ( ; cur->next != NULL; cur = cur->next); + + cur->next = new; + new->next = NULL; + new->prev = cur; + s->sm_lists_tail[DETECT_SM_LIST_POSTMATCH] = new; + } + + new->idx = s->sm_cnt; + s->sm_cnt++; +} + /** \brief Pull a content 'old' from the pmatch list, append 'new' to amatch list. * Used for replacing contents that have http_cookie, etc modifiers. */ diff --git a/src/detect-parse.h b/src/detect-parse.h index 39bce5443e..b15654b4e4 100644 --- a/src/detect-parse.h +++ b/src/detect-parse.h @@ -60,6 +60,7 @@ void SigMatchReplaceContentToUricontent(Signature *, SigMatch *, SigMatch *); void SigMatchAppendPayload(Signature *, SigMatch *); void SigMatchAppendDcePayload(Signature *, SigMatch *); void SigMatchAppendPacket(Signature *, SigMatch *); +void SigMatchAppendPostMatch(Signature *, SigMatch *); void SigMatchAppendUricontent(Signature *, SigMatch *); void SigMatchAppendAppLayer(Signature *, SigMatch *); void SigMatchAppendTag(Signature *, SigMatch *); diff --git a/src/detect.c b/src/detect.c index daa1f92ed5..6188a3c766 100644 --- a/src/detect.c +++ b/src/detect.c @@ -944,6 +944,28 @@ static void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx, #endif } +static int SigMatchSignaturesRunPostMatch(ThreadVars *tv, + DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p, + Signature *s) +{ + /* run the packet match functions */ + if (s->sm_lists[DETECT_SM_LIST_POSTMATCH] != NULL) { + SigMatch *sm = s->sm_lists[DETECT_SM_LIST_POSTMATCH]; + + SCLogDebug("running match functions, sm %p", sm); + + for ( ; sm != NULL; sm = sm->next) { + (void)sigmatch_table[sm->type].Match(tv, det_ctx, p, s, sm); + } + } + + DetectReplaceExecute(p, det_ctx->replist); + det_ctx->replist = NULL; + DetectFilestorePostMatch(tv, det_ctx,p); + + return 1; +} + /** * \brief Get the SigGroupHead for a packet. * @@ -1638,9 +1660,8 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* match! */ fmatch = 1; - DetectReplaceExecute(p, det_ctx->replist); - det_ctx->replist = NULL; - DetectFilestorePostMatch(th_v, det_ctx,p); + + SigMatchSignaturesRunPostMatch(th_v, de_ctx, det_ctx, p, s); if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, alert_flags, alert_msg); diff --git a/src/detect.h b/src/detect.h index c801449a7a..3bdd62c11f 100644 --- a/src/detect.h +++ b/src/detect.h @@ -102,6 +102,8 @@ enum { DETECT_SM_LIST_HRUDMATCH, DETECT_SM_LIST_FILEMATCH, + + DETECT_SM_LIST_POSTMATCH, DETECT_SM_LIST_MAX, };