aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: convert tx_progress to uint8_t

Browse Source
pull/15726/head
Philippe Antoine 5 months ago committed by Victor Julien
parent 30d4edf9eb
commit 89dbce1b46
18 changed files with 70 additions and 73 deletions
Show Stats Download Patch File Download Diff File

4
doc/userguide/devguide/extending/app-layer/transactions.rst
Unescape Escape View File

@ -72,8 +72,8 @@ Rule Matching
Transaction progress is also used for certain keywords to know what is the minimum state before we can expect a match: until that, Suricata won't even try to look for the patterns.
As seen in ``DetectAppLayerMpmRegister`` that has ``int progress`` as parameter, and ``DetectAppLayerInspectEngineRegister``, which expects ``int tx_min_progress``, for instance. In the code snippet,
``HTTP2ProgData``, ``HTTP2ProgData`` and ``0`` are the values passed to the functions - in the last
As seen in ``DetectAppLayerMpmRegister`` that has ``int progress`` as parameter, and ``DetectAppLayerInspectEngineRegister``, which expects ``uint8_t tx_min_progress``, for instance. In the code snippet,
``HTTP2ProgData`` and ``0`` are the values passed to the functions - in the last
example, for ``FTPDATA``,
the existence of a transaction implies that a file is being transferred. Hence the ``0`` value.

12
rust/src/ssh/detect.rs
Unescape Escape View File

@ -298,7 +298,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(SCSshTxGetSoftware),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
ssh_software_kw_id,
@ -340,7 +340,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(SCSshTxGetProtocol),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
ssh_proto_kw_id,
@ -360,7 +360,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER,
Some(SCSshTxGetHasshString),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH_STRING,
@ -380,7 +380,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOCLIENT,
Some(SCSshTxGetHasshString),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH_SERVER_STRING,
@ -400,7 +400,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER,
Some(SCSshTxGetHassh),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH,
@ -421,7 +421,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOCLIENT,
Some(SCSshTxGetHassh),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH_SERVER,

9
rust/sys/src/sys.rs
Unescape Escape View File

@ -870,8 +870,7 @@ extern "C" {
}
extern "C" {
pub fn SCDetectHelperBufferProgressRegister(
name: *const ::std::os::raw::c_char, alproto: AppProto, direction: u8,
progress: ::std::os::raw::c_int,
name: *const ::std::os::raw::c_char, alproto: AppProto, direction: u8, progress: u8,
) -> ::std::os::raw::c_int;
}
extern "C" {
@ -889,8 +888,7 @@ extern "C" {
extern "C" {
pub fn SCDetectHelperBufferProgressMpmRegister(
name: *const ::std::os::raw::c_char, desc: *const ::std::os::raw::c_char,
alproto: AppProto, direction: u8, GetData: InspectionSingleBufferGetDataPtr,
progress: ::std::os::raw::c_int,
alproto: AppProto, direction: u8, GetData: InspectionSingleBufferGetDataPtr, progress: u8,
) -> ::std::os::raw::c_int;
}
extern "C" {
@ -902,8 +900,7 @@ extern "C" {
extern "C" {
pub fn SCDetectHelperMultiBufferProgressMpmRegister(
name: *const ::std::os::raw::c_char, desc: *const ::std::os::raw::c_char,
alproto: AppProto, direction: u8, GetData: InspectionMultiBufferGetDataPtr,
progress: ::std::os::raw::c_int,
alproto: AppProto, direction: u8, GetData: InspectionMultiBufferGetDataPtr, progress: u8,
) -> ::std::os::raw::c_int;
}
extern "C" {

6
src/app-layer-parser.c
Unescape Escape View File

@ -1137,12 +1137,12 @@ void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint
SCReturnPtr(r, "void *");
}
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto,
uint8_t direction)
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
{
SCEnter();
int r = StateGetProgressCompletionStatus(alproto, direction);
SCReturnInt(r);
// TODO convert StateGetProgressCompletionStatus and more to uint8_t
return (uint8_t)r;
}
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,

2
src/app-layer-parser.h
Unescape Escape View File

@ -314,7 +314,7 @@ int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
void *alstate, uint8_t direction);
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
uint8_t *event_id, AppLayerEventType *event_type);
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id,

6
src/detect-app-layer-state.c
Unescape Escape View File

@ -140,7 +140,7 @@ end:
}
// TODO dedup with detect-parse.c
static SignatureHook SetAppHook(const AppProto alproto, int progress)
static SignatureHook SetAppHook(const AppProto alproto, uint8_t progress)
{
SignatureHook h = {
.type = SIGNATURE_HOOK_TYPE_APP,
@ -175,7 +175,7 @@ static int DetectAppLayerStateSetup(DetectEngineCtx *de_ctx, Signature *s, const
IPPROTO_TCP /* TODO */, s->alproto, h, STREAM_TOSERVER);
if (progress_ts >= 0) {
s->flags |= SIG_FLAG_TOSERVER;
s->init_data->hook = SetAppHook(s->alproto, progress_ts);
s->init_data->hook = SetAppHook(s->alproto, (uint8_t)progress_ts);
} else {
const int progress_tc = AppLayerParserGetStateIdByName(
IPPROTO_TCP /* TODO */, s->alproto, h, STREAM_TOCLIENT);
@ -183,7 +183,7 @@ static int DetectAppLayerStateSetup(DetectEngineCtx *de_ctx, Signature *s, const
return -1;
}
s->flags |= SIG_FLAG_TOCLIENT;
s->init_data->hook = SetAppHook(s->alproto, progress_tc);
s->init_data->hook = SetAppHook(s->alproto, (uint8_t)progress_tc);
}
SCLogDebug("hook %u", s->init_data->hook.t.app.app_progress);
return 0;

2
src/detect-engine-file.h
Unescape Escape View File

@ -29,6 +29,6 @@ uint8_t DetectFileInspectGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
uint8_t flags, void *_alstate, void *tx, uint64_t tx_id);
void DetectFileRegisterProto(
AppProto alproto, int direction, int to_client_progress, int to_server_progress);
AppProto alproto, int direction, uint8_t to_client_progress, uint8_t to_server_progress);
#endif /* SURICATA_DETECT_ENGINE_FILE_H */

7
src/detect-engine-helper.c
Unescape Escape View File

@ -32,7 +32,7 @@
#include "rust.h"
int SCDetectHelperBufferProgressRegister(
const char *name, AppProto alproto, uint8_t direction, int progress)
const char *name, AppProto alproto, uint8_t direction, uint8_t progress)
{
if (direction & STREAM_TOSERVER) {
DetectAppLayerInspectEngineRegister(
@ -84,7 +84,7 @@ int SCDetectRegisterMpmGeneric(const char *name, const char *desc, AppProto alpr
}
int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, int progress)
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, uint8_t progress)
{
if (direction & STREAM_TOSERVER) {
DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOSERVER, progress,
@ -103,7 +103,8 @@ int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc,
}
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData,
uint8_t progress)
{
if (direction & STREAM_TOSERVER) {
DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);

7
src/detect-engine-helper.h
Unescape Escape View File

@ -81,18 +81,19 @@ int SCDetectHelperNewKeywordId(void);
uint16_t SCDetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw);
void SCDetectHelperKeywordAliasRegister(uint16_t kwid, const char *alias);
int SCDetectHelperBufferProgressRegister(
const char *name, AppProto alproto, uint8_t direction, int progress);
const char *name, AppProto alproto, uint8_t direction, uint8_t progress);
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionSingleBufferGetDataPtr GetData);
int SCDetectRegisterMpmGeneric(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionBufferGetDataPtr GetData);
int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, int progress);
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, uint8_t progress);
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionMultiBufferGetDataPtr GetData);
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress);
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData,
uint8_t progress);
int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw);

8
src/detect-engine-mpm.c
Unescape Escape View File

@ -89,7 +89,7 @@ static int g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_SIZE] = { 0, 0, 0 };
static void RegisterInternal(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
InspectionSingleBufferGetDataPtr GetDataSingle,
InspectionMultiBufferGetDataPtr GetMultiData, AppProto alproto, int tx_min_progress)
InspectionMultiBufferGetDataPtr GetMultiData, AppProto alproto, uint8_t tx_min_progress)
{
SCLogDebug("registering %s/%d/%d/%p/%p/%u/%d", name, direction, priority,
PrefilterRegister, GetData, alproto, tx_min_progress);
@ -151,7 +151,7 @@ static void RegisterInternal(const char *name, int direction, int priority,
void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress)
AppProto alproto, uint8_t tx_min_progress)
{
RegisterInternal(name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
tx_min_progress);
@ -159,7 +159,7 @@ void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress)
AppProto alproto, uint8_t tx_min_progress)
{
RegisterInternal(name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
tx_min_progress);
@ -167,7 +167,7 @@ void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priori
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress)
AppProto alproto, uint8_t tx_min_progress)
{
RegisterInternal(name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
tx_min_progress);

6
src/detect-engine-mpm.h
Unescape Escape View File

@ -86,13 +86,13 @@ typedef int (*PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
*/
void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress);
AppProto alproto, uint8_t tx_min_progress);
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress);
AppProto alproto, uint8_t tx_min_progress);
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress);
AppProto alproto, uint8_t tx_min_progress);
void DetectAppLayerMpmRegisterByParentId(
DetectEngineCtx *de_ctx,
const int id, const int parent_id,

21
src/detect-engine-prefilter.c
Unescape Escape View File

@ -354,7 +354,7 @@ int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
}
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx,
PrefilterTxFn PrefilterTxFunc, AppProto alproto, int8_t tx_min_progress, void *pectx,
void (*FreeFunc)(void *pectx), const char *name)
{
if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
@ -368,9 +368,7 @@ int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
e->PrefilterTx = PrefilterTxFunc;
e->pectx = pectx;
e->alproto = alproto;
// TODO change function prototype ?
DEBUG_VALIDATE_BUG_ON(tx_min_progress > INT8_MAX);
e->tx_min_progress = (uint8_t)tx_min_progress;
e->tx_min_progress = tx_min_progress;
e->Free = FreeFunc;
if (sgh->init->tx_engines == NULL) {
@ -704,7 +702,7 @@ static void NonPFNamesFree(void *data)
struct TxNonPFData {
AppProto alproto;
int dir; /**< 0: toserver, 1: toclient */
int progress; /**< progress state value to register at */
uint8_t progress; /**< progress state value to register at */
int sig_list; /**< special handling: normally 0, but for special cases (app-layer-state,
app-layer-event) use the list id to create separate engines */
uint32_t sigs_cnt;
@ -734,7 +732,7 @@ static void TxNonPFFree(void *data)
}
static int TxNonPFAddSig(DetectEngineCtx *de_ctx, HashListTable *tx_engines_hash,
const AppProto alproto, const int dir, const int16_t progress, const int sig_list,
const AppProto alproto, const int dir, const uint8_t progress, const int sig_list,
const char *name, const Signature *s)
{
const uint32_t max_sids = DetectEngineGetMaxSigId(de_ctx);
@ -952,8 +950,8 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
}
const int sm_list = DetectEngineAppHookToSmlist(
s->alproto, state, dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
if (TxNonPFAddSig(de_ctx, tx_engines_hash, s->alproto, dir, (int16_t)state, sm_list,
pname, s) != 0) {
if (TxNonPFAddSig(de_ctx, tx_engines_hash, s->alproto, dir, state, sm_list, pname,
s) != 0) {
goto error;
}
tx_non_pf = true;
@ -1032,8 +1030,8 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
if (TxNonPFAddSig(de_ctx, tx_engines_hash, s->alproto, dir,
(int16_t)s->init_data->hook.t.app.app_progress, s->init_data->hook.sm_list,
pname, s) != 0) {
s->init_data->hook.t.app.app_progress, s->init_data->hook.sm_list, pname,
s) != 0) {
goto error;
}
tx_non_pf = true;
@ -1110,7 +1108,8 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
}
/* register special progress value to indicate we need to run it all the time */
int engine_progress = t->progress;
DEBUG_VALIDATE_BUG_ON(t->progress > INT8_MAX);
int8_t engine_progress = (int8_t)t->progress;
if (t->sig_list == app_state_list_id) {
SCLogDebug("engine %s for state list", t->engine_name);
engine_progress = -1;

2
src/detect-engine-prefilter.h
Unescape Escape View File

@ -64,7 +64,7 @@ void PrefilterPostRuleMatch(
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterPktFn PrefilterFunc, void *pectx, void (*FreeFunc)(void *pectx), const char *name);
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterTxFn PrefilterTxFunc, const AppProto alproto, const int tx_min_progress,
PrefilterTxFn PrefilterTxFunc, const AppProto alproto, const int8_t tx_min_progress,
void *pectx, void (*FreeFunc)(void *pectx), const char *name);
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx,

17
src/detect-engine.c
Unescape Escape View File

@ -195,7 +195,7 @@ void DetectPktInspectEngineRegister(const char *name,
*
* \note errors are fatal */
static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alproto, uint32_t dir,
int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData,
uint8_t progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData,
InspectionSingleBufferGetDataPtr GetDataSingle,
InspectionMultiBufferGetDataPtr GetMultiData)
{
@ -209,8 +209,7 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
SCLogDebug("name %s id %d", name, sm_list);
if ((alproto == ALPROTO_FAILED) || (!(dir == SIG_FLAG_TOSERVER || dir == SIG_FLAG_TOCLIENT)) ||
(sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) ||
(progress < 0 || progress >= SHRT_MAX) || (Callback == NULL)) {
(sm_list < DETECT_SM_LIST_MATCH) || (sm_list >= SHRT_MAX) || (Callback == NULL)) {
SCLogError("Invalid arguments");
BUG_ON(1);
} else if (Callback == DetectEngineInspectBufferGeneric && GetData == NULL) {
@ -248,7 +247,7 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
new_engine->dir = direction;
new_engine->sm_list = (uint16_t)sm_list;
new_engine->sm_list_base = (uint16_t)sm_list;
new_engine->progress = (int16_t)progress;
new_engine->progress = progress;
new_engine->v2.Callback = Callback;
if (Callback == DetectEngineInspectBufferGeneric) {
new_engine->v2.GetData = GetData;
@ -271,7 +270,7 @@ static void AppLayerInspectEngineRegisterInternal(const char *name, AppProto alp
}
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir,
int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
uint8_t progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
{
/* before adding, check that we don't add a duplicate entry, which will
* propagate all the way into the packet runtime if allowed. */
@ -293,7 +292,7 @@ void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uin
}
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir,
int progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
uint8_t progress, InspectEngineFuncPtr Callback, InspectionSingleBufferGetDataPtr GetData)
{
/* before adding, check that we don't add a duplicate entry, which will
* propagate all the way into the packet runtime if allowed. */
@ -900,7 +899,7 @@ int DetectEngineAppInspectionEngine2Signature(DetectEngineCtx *de_ctx, Signature
DetectEngineAppInspectionEngine t = {
.alproto = s->init_data->hook.t.app.alproto,
.progress = (uint16_t)state,
.progress = state,
.sm_list = (uint16_t)sm_list,
.sm_list_base = (uint16_t)sm_list,
.dir = dir,
@ -982,7 +981,7 @@ int DetectEngineAppInspectionEngine2Signature(DetectEngineCtx *de_ctx, Signature
DetectEngineAppInspectionEngine t = {
.alproto = s->init_data->hook.t.app.alproto,
.progress = (uint16_t)s->init_data->hook.t.app.app_progress,
.progress = s->init_data->hook.t.app.app_progress,
.sm_list = (uint16_t)s->init_data->hook.sm_list,
.sm_list_base = (uint16_t)s->init_data->hook.sm_list,
.dir = dir,
@ -2202,7 +2201,7 @@ uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineTh
// wrapper for both DetectAppLayerInspectEngineRegister and DetectAppLayerMpmRegister
// with cast of callback function
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress,
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, uint8_t progress,
InspectionMultiBufferGetDataPtr GetData, int priority)
{
AppLayerInspectEngineRegisterInternal(name, alproto, dir, progress,

6
src/detect-engine.h
Unescape Escape View File

@ -164,12 +164,12 @@ int DetectEngineInspectPktBufferGeneric(
* \param Callback The engine callback.
*/
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir,
int progress, InspectEngineFuncPtr Callback2, InspectionBufferGetDataPtr GetData);
uint8_t progress, InspectEngineFuncPtr Callback2, InspectionBufferGetDataPtr GetData);
void DetectAppLayerInspectEngineRegisterSingle(const char *name, AppProto alproto, uint32_t dir,
int progress, InspectEngineFuncPtr Callback2, InspectionSingleBufferGetDataPtr GetData);
uint8_t progress, InspectEngineFuncPtr Callback2, InspectionSingleBufferGetDataPtr GetData);
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress,
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, uint8_t progress,
InspectionMultiBufferGetDataPtr GetData, int priority);
void DetectPktInspectEngineRegister(const char *name,

6
src/detect-file-data.c
Unescape Escape View File

@ -70,8 +70,8 @@ int PrefilterMpmFiledataRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, Mpm
typedef struct {
AppProto alproto;
int direction;
int to_client_progress;
int to_server_progress;
uint8_t to_client_progress;
uint8_t to_server_progress;
} DetectFileHandlerProtocol_t;
/* Table with all filehandler registrations */
@ -97,7 +97,7 @@ DetectFileHandlerProtocol_t al_protocols[ALPROTO_WITHFILES_MAX] = {
};
void DetectFileRegisterProto(
AppProto alproto, int direction, int to_client_progress, int to_server_progress)
AppProto alproto, int direction, uint8_t to_client_progress, uint8_t to_server_progress)
{
size_t i = 0;
while (i < ALPROTO_WITHFILES_MAX && al_protocols[i].alproto != ALPROTO_UNKNOWN) {

16
src/detect-parse.c
Unescape Escape View File

@ -1161,9 +1161,9 @@ void DetectRegisterAppLayerHookLists(void)
alproto_name = "http1";
SCLogDebug("alproto %u/%s", a, alproto_name);
const int max_progress_ts =
const uint8_t max_progress_ts =
AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER);
const int max_progress_tc =
const uint8_t max_progress_tc =
AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT);
char ts_tx_started[64];
@ -1196,7 +1196,7 @@ void DetectRegisterAppLayerHookLists(void)
SCLogDebug("- hook %s:%s list %s (%u)", alproto_name, "response_name", tc_tx_complete,
(uint32_t)strlen(tc_tx_complete));
for (int p = 0; p <= max_progress_ts; p++) {
for (uint8_t p = 0; p <= max_progress_ts; p++) {
const char *name = AppLayerParserGetStateNameById(
IPPROTO_TCP /* TODO no ipproto */, a, p, STREAM_TOSERVER);
if (name != NULL && !IsBuiltIn(name)) {
@ -1209,7 +1209,7 @@ void DetectRegisterAppLayerHookLists(void)
list_name, a, SIG_FLAG_TOSERVER, p, DetectEngineInspectGenericList, NULL);
}
}
for (int p = 0; p <= max_progress_tc; p++) {
for (uint8_t p = 0; p <= max_progress_tc; p++) {
const char *name = AppLayerParserGetStateNameById(
IPPROTO_TCP /* TODO no ipproto */, a, p, STREAM_TOCLIENT);
if (name != NULL && !IsBuiltIn(name)) {
@ -1304,7 +1304,7 @@ static int SigParseProtoHookPkt(Signature *s, const char *proto_hook, const char
return 0;
}
static SignatureHook SetAppHook(const AppProto alproto, int progress)
static SignatureHook SetAppHook(const AppProto alproto, uint8_t progress)
{
SignatureHook h = {
.type = SIGNATURE_HOOK_TYPE_APP,
@ -1341,7 +1341,7 @@ static int SigParseProtoHookApp(Signature *s, const char *proto_hook, const char
IPPROTO_TCP /* TODO */, s->alproto, h, STREAM_TOSERVER);
if (progress_ts >= 0) {
s->flags |= SIG_FLAG_TOSERVER;
s->init_data->hook = SetAppHook(s->alproto, progress_ts);
s->init_data->hook = SetAppHook(s->alproto, (uint8_t)progress_ts);
} else {
const int progress_tc = AppLayerParserGetStateIdByName(
IPPROTO_TCP /* TODO */, s->alproto, h, STREAM_TOCLIENT);
@ -1349,7 +1349,7 @@ static int SigParseProtoHookApp(Signature *s, const char *proto_hook, const char
return -1;
}
s->flags |= SIG_FLAG_TOCLIENT;
s->init_data->hook = SetAppHook(s->alproto, progress_tc);
s->init_data->hook = SetAppHook(s->alproto, (uint8_t)progress_tc);
}
}
@ -1366,7 +1366,7 @@ static int SigParseProtoHookApp(Signature *s, const char *proto_hook, const char
SignatureHookTypeToString(s->init_data->hook.type), s->init_data->hook.t.app.alproto,
s->init_data->hook.t.app.app_progress);
s->app_progress_hook = (uint8_t)s->init_data->hook.t.app.app_progress;
s->app_progress_hook = s->init_data->hook.t.app.app_progress;
return 0;
}

6
src/detect.h
Unescape Escape View File

@ -423,7 +423,7 @@ typedef struct DetectEngineAppInspectionEngine_ {
bool match_on_null;
uint16_t sm_list;
uint16_t sm_list_base; /**< base buffer being transformed */
int16_t progress;
uint8_t progress;
struct {
union {
@ -580,7 +580,7 @@ typedef struct SignatureHook_ {
AppProto alproto;
/** progress value of the app-layer hook specified in the rule. Sets the app_proto
* specific progress value. */
int app_progress;
uint8_t app_progress;
} app;
struct {
enum SignatureHookPkt ph;
@ -791,7 +791,7 @@ typedef struct DetectBufferMpmRegistry_ {
InspectionMultiBufferGetDataPtr GetMultiData;
};
AppProto alproto;
int tx_min_progress;
uint8_t tx_min_progress;
} app_v2;
/* pkt matching: use if type == DETECT_BUFFER_MPM_TYPE_PKT */

Write Preview
Loading…
Cancel
Save