aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: list-keywords cli shows multi-buffers

Browse Source 
Ticket: 7571
pull/13884/head
Philippe Antoine 12 months ago committed by Victor Julien
parent 37d748d441
commit b298bce0e7
28 changed files with 100 additions and 52 deletions
Show Stats Download Patch File Download Diff File

3
doc/userguide/rules/multi-buffer-matching.rst
Unescape Escape View File

@ -126,3 +126,6 @@ following keywords:
* ``tls.alpn``
* ``tls.certs``
* ``tls.subjectaltname``
These can be found by command
``suricata --list-keywords=csv | grep "multi buffer" | cut -d';' -f1``

1
rust/cbindgen.toml
Unescape Escape View File

@ -118,6 +118,7 @@ exclude = [
"SRepCatGetByShortname",
"SIGMATCH_NOOPT",
"SIGMATCH_INFO_STICKY_BUFFER",
"SIGMATCH_INFO_MULTI_BUFFER",
"FtpCommand",
]

16
rust/src/detect/mod.rs
Unescape Escape View File

@ -74,7 +74,7 @@ pub struct SigTableElmtStickyBuffer {
) -> c_int,
}
pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u16) -> u16 {
let name = CString::new(kw.name.as_bytes()).unwrap().into_raw();
let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw();
let url = CString::new(kw.url.as_bytes()).unwrap().into_raw();
@ -83,7 +83,7 @@ pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u
desc,
url,
Setup: Some(kw.setup),
flags: SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER,
flags,
AppLayerTxMatch: None,
Free: None,
};
@ -94,6 +94,17 @@ pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u
}
}
pub fn helper_keyword_register_multi_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
return helper_keyword_register_buffer_flags(
kw,
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER,
);
}
pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
return helper_keyword_register_buffer_flags(kw, SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER);
}
#[repr(C)]
#[allow(non_snake_case)]
/// Names of SigTableElmt for release by rust
@ -118,6 +129,7 @@ pub const SIGMATCH_NOOPT: u16 = 1; // BIT_U16(0) in detect.h
pub(crate) const SIGMATCH_OPTIONAL_OPT: u16 = 0x10; // BIT_U16(4) in detect.h
pub(crate) const SIGMATCH_QUOTES_MANDATORY: u16 = 0x40; // BIT_U16(6) in detect.h
pub const SIGMATCH_INFO_STICKY_BUFFER: u16 = 0x200; // BIT_U16(9)
pub const SIGMATCH_INFO_MULTI_BUFFER: u16 = 0x4000; // BIT_U16(14)
#[repr(u8)]
#[derive(Copy, Clone, Debug, PartialEq, Eq)]

8
rust/src/dns/detect.rs
Unescape Escape View File

@ -24,7 +24,7 @@ use crate::detect::uint::{
detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
SCDetectU8Free, SCDetectU8Parse,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer};
use crate::direction::Direction;
use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
@ -358,7 +358,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
url: String::from("/rules/dns-keywords.html#dns-answer-name"),
setup: dns_detect_answer_name_setup,
};
let _g_dns_answer_name_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_dns_answer_name_kw_id = helper_keyword_register_multi_buffer(&kw);
G_DNS_ANSWER_NAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
b"dns.answer.name\0".as_ptr() as *const libc::c_char,
b"dns answer name\0".as_ptr() as *const libc::c_char,
@ -390,7 +390,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
url: String::from("/rules/dns-keywords.html#dns-query-name"),
setup: dns_detect_query_name_setup,
};
let _g_dns_query_name_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_dns_query_name_kw_id = helper_keyword_register_multi_buffer(&kw);
G_DNS_QUERY_NAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
b"dns.query.name\0".as_ptr() as *const libc::c_char,
b"dns query name\0".as_ptr() as *const libc::c_char,
@ -437,7 +437,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
url: String::from("/rules/dns-keywords.html#dns-query"),
setup: dns_detect_query_setup,
};
let g_dns_query_name_kw_id = helper_keyword_register_sticky_buffer(&kw);
let g_dns_query_name_kw_id = helper_keyword_register_multi_buffer(&kw);
SCDetectHelperKeywordAliasRegister(
g_dns_query_name_kw_id,
b"dns_query\0".as_ptr() as *const libc::c_char,

13
rust/src/ldap/detect.rs
Unescape Escape View File

@ -22,7 +22,10 @@ use crate::detect::uint::{
detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU32Free,
SCDetectU32Parse, SCDetectU8Free,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer,
};
use crate::ldap::types::*;
use ldap_parser::ldap::{LdapMessage, ProtocolOp};
use suricata_sys::sys::{
@ -575,7 +578,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
url: String::from("/rules/ldap-keywords.html#ldap.responses.dn"),
setup: ldap_detect_responses_dn_setup,
};
let _g_ldap_responses_dn_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_ldap_responses_dn_kw_id = helper_keyword_register_multi_buffer(&kw);
G_LDAP_RESPONSES_DN_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.responses.dn\0".as_ptr() as *const libc::c_char,
b"LDAP RESPONSES DISTINGUISHED_NAME\0".as_ptr() as *const libc::c_char,
@ -605,7 +608,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
url: String::from("/rules/ldap-keywords.html#ldap.responses.message"),
setup: ldap_detect_responses_msg_setup,
};
let _g_ldap_responses_dn_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_ldap_responses_dn_kw_id = helper_keyword_register_multi_buffer(&kw);
G_LDAP_RESPONSES_MSG_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.responses.message\0".as_ptr() as *const libc::c_char,
b"LDAP RESPONSES DISTINGUISHED_NAME\0".as_ptr() as *const libc::c_char,
@ -619,7 +622,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
url: String::from("/rules/ldap-keywords.html#ldap.request.attribute_type"),
setup: ldap_detect_request_attibute_type_setup,
};
let _g_ldap_request_attribute_type_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_ldap_request_attribute_type_kw_id = helper_keyword_register_multi_buffer(&kw);
G_LDAP_REQUEST_ATTRIBUTE_TYPE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.request.attribute_type\0".as_ptr() as *const libc::c_char,
b"LDAP REQUEST ATTRIBUTE TYPE\0".as_ptr() as *const libc::c_char,
@ -633,7 +636,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
url: String::from("/rules/ldap-keywords.html#ldap.responses.attribute_type"),
setup: ldap_detect_responses_attibute_type_setup,
};
let _g_ldap_responses_attribute_type_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_ldap_responses_attribute_type_kw_id = helper_keyword_register_multi_buffer(&kw);
G_LDAP_RESPONSES_ATTRIBUTE_TYPE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.responses.attribute_type\0".as_ptr() as *const libc::c_char,
b"LDAP RESPONSES ATTRIBUTE TYPE\0".as_ptr() as *const libc::c_char,

9
rust/src/mqtt/detect.rs
Unescape Escape View File

@ -22,7 +22,10 @@ use crate::detect::uint::{
detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint, detect_uint_match_at_index,
DetectUintArrayData, DetectUintData, DetectUintMode, SCDetectU8Free, SCDetectU8Parse,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer,
};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
SCDetectHelperBufferMpmRegister, SCDetectHelperBufferRegister, SCDetectHelperKeywordRegister,
@ -992,7 +995,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
SCLogError!("Invalid value for app-layer.protocols.mqtt.unsubscribe-topic-match-limit");
}
}
let _g_mqtt_unsub_topic_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_mqtt_unsub_topic_kw_id = helper_keyword_register_multi_buffer(&kw);
G_MQTT_UNSUB_TOPIC_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
keyword_name,
b"unsubscribe topic query\0".as_ptr() as *const libc::c_char,
@ -1031,7 +1034,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
SCLogError!("Invalid value for app-layer.protocols.mqtt.subscribe-topic-match-limit");
}
}
let _g_mqtt_sub_topic_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_mqtt_sub_topic_kw_id = helper_keyword_register_multi_buffer(&kw);
G_MQTT_SUB_TOPIC_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
keyword_name,
b"subscribe topic query\0".as_ptr() as *const libc::c_char,

21
rust/src/sdp/detect.rs
Unescape Escape View File

@ -18,7 +18,10 @@
// written by Giuseppe Longo <giuseppe@glongo.it>
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer,
};
use crate::direction::Direction;
use crate::sip::sip::{SIPTransaction, ALPROTO_SIP};
use std::os::raw::{c_int, c_void};
@ -740,7 +743,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#sdp-bandwidth"),
setup: sdp_bandwidth_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_BANDWIDTH_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.bandwidth\0".as_ptr() as *const libc::c_char,
b"sdp.bandwidth\0".as_ptr() as *const libc::c_char,
@ -754,7 +757,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#time"),
setup: sdp_time_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_TIME_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.time\0".as_ptr() as *const libc::c_char,
b"sdp.time\0".as_ptr() as *const libc::c_char,
@ -768,7 +771,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#repeat-time"),
setup: sdp_repeat_time_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_REPEAT_TIME_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.repeat_time\0".as_ptr() as *const libc::c_char,
b"sdp.repeat_time\0".as_ptr() as *const libc::c_char,
@ -810,7 +813,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#sdp-attribute"),
setup: sdp_attribute_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_ATTRIBUTE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.attribute\0".as_ptr() as *const libc::c_char,
b"sdp.attribute\0".as_ptr() as *const libc::c_char,
@ -826,7 +829,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#media-description-media"),
setup: sdp_media_desc_media_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_MEDIA_DESC_MEDIA_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.media\0".as_ptr() as *const libc::c_char,
b"sdp.media.media\0".as_ptr() as *const libc::c_char,
@ -840,7 +843,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#sdp-media-description-session-info"),
setup: sdp_media_desc_session_info_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_MEDIA_DESC_SESSION_INFO_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.media_info\0".as_ptr() as *const libc::c_char,
b"sdp.media.media_info\0".as_ptr() as *const libc::c_char,
@ -854,7 +857,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#sdp-media-description-connection-data"),
setup: sdp_media_desc_connection_data_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_MEDIA_DESC_CONNECTION_DATA_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.connection_data\0".as_ptr() as *const libc::c_char,
b"sdp.media.connection_data\0".as_ptr() as *const libc::c_char,
@ -868,7 +871,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
url: String::from("/rules/sdp-keywords.html#sdp-media-description-encryption-key"),
setup: sdp_media_desc_encryption_key_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
let _ = helper_keyword_register_multi_buffer(&kw);
G_SDP_MEDIA_DESC_ENCRYPTION_KEY_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.encryption_key\0".as_ptr() as *const libc::c_char,
b"sdp.media.encryption_key\0".as_ptr() as *const libc::c_char,

17
rust/src/sip/detect.rs
Unescape Escape View File

@ -18,7 +18,10 @@
// written by Giuseppe Longo <giuseppe@glongo.it>
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::detect::{
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer,
};
use crate::direction::Direction;
use crate::sip::sip::{SIPTransaction, ALPROTO_SIP};
use std::os::raw::{c_int, c_void};
@ -493,7 +496,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
url: String::from("/rules/sip-keywords.html#sip-from"),
setup: sip_from_hdr_setup,
};
let _g_sip_from_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_sip_from_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_SIP_FROM_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.from\0".as_ptr() as *const libc::c_char,
b"sip.from\0".as_ptr() as *const libc::c_char,
@ -507,7 +510,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
url: String::from("/rules/sip-keywords.html#sip-to"),
setup: sip_to_hdr_setup,
};
let _g_sip_to_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_sip_to_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_SIP_TO_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.to\0".as_ptr() as *const libc::c_char,
b"sip.to\0".as_ptr() as *const libc::c_char,
@ -521,7 +524,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
url: String::from("/rules/sip-keywords.html#sip-via"),
setup: sip_via_hdr_setup,
};
let _g_sip_via_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_sip_via_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_SIP_VIA_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.via\0".as_ptr() as *const libc::c_char,
b"sip.via\0".as_ptr() as *const libc::c_char,
@ -535,7 +538,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
url: String::from("/rules/sip-keywords.html#sip-user-agent"),
setup: sip_ua_hdr_setup,
};
let _g_sip_ua_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_sip_ua_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_SIP_UA_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.ua\0".as_ptr() as *const libc::c_char,
b"sip.ua\0".as_ptr() as *const libc::c_char,
@ -549,7 +552,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
url: String::from("/rules/sip-keywords.html#sip-content-type"),
setup: sip_content_type_hdr_setup,
};
let _g_sip_content_type_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_sip_content_type_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_SIP_CONTENT_TYPE_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.content_type\0".as_ptr() as *const libc::c_char,
b"sip.content_type\0".as_ptr() as *const libc::c_char,
@ -563,7 +566,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
url: String::from("/rules/sip-keywords.html#sip-content-length"),
setup: sip_content_length_hdr_setup,
};
let _g_sip_content_length_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
let _g_sip_content_length_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_SIP_CONTENT_LENGTH_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.content_length\0".as_ptr() as *const libc::c_char,
b"sip.content_length\0".as_ptr() as *const libc::c_char,

2
src/detect-dns-name.c
Unescape Escape View File

@ -113,7 +113,7 @@ static int Register(const char *keyword, const char *desc, const char *doc,
sigmatch_table[keyword_id].url = doc;
sigmatch_table[keyword_id].Setup = Setup;
sigmatch_table[keyword_id].flags |= SIGMATCH_NOOPT;
sigmatch_table[keyword_id].flags |= SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[keyword_id].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister(keyword, alproto, SIG_FLAG_TOSERVER, 1, GetBufferFn, 2);
DetectAppLayerMultiRegister(keyword, alproto, SIG_FLAG_TOCLIENT, 1, GetBufferFn, 2);

4
src/detect-email.c
Unescape Escape View File

@ -327,7 +327,7 @@ void DetectEmailRegister(void)
kw.desc = "'Url' extracted from an email";
kw.url = "/rules/email-keywords.html#email.url";
kw.Setup = DetectMimeEmailUrlSetup;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
SCDetectHelperKeywordRegister(&kw);
g_mime_email_url_buffer_id = SCDetectHelperMultiBufferMpmRegister(
"email.url", "MIME EMAIL URL", ALPROTO_SMTP, STREAM_TOSERVER, GetMimeEmailUrlData);
@ -336,7 +336,7 @@ void DetectEmailRegister(void)
kw.desc = "'Received' field from an email";
kw.url = "/rules/email-keywords.html#email.received";
kw.Setup = DetectMimeEmailReceivedSetup;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
SCDetectHelperKeywordRegister(&kw);
g_mime_email_received_buffer_id = SCDetectHelperMultiBufferMpmRegister("email.received",
"MIME EMAIL RECEIVED", ALPROTO_SMTP, STREAM_TOSERVER, GetMimeEmailReceivedData);

6
src/detect-engine-register.c
Unescape Escape View File

@ -329,6 +329,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
printf("supports firewall");
prev = 1;
}
if (flags & SIGMATCH_INFO_MULTI_BUFFER) {
if (prev == 1)
printf("%c", sep);
printf("multi buffer");
prev = 1;
}
if (e->Transform) {
if (prev == 1)
printf("%c", sep);

3
src/detect-file-data.c
Unescape Escape View File

@ -155,7 +155,8 @@ void DetectFiledataRegister(void)
#ifdef UNITTESTS
sigmatch_table[DETECT_FILE_DATA].RegisterTests = DetectFiledataRegisterTests;
#endif
sigmatch_table[DETECT_FILE_DATA].flags = SIGMATCH_OPTIONAL_OPT | SIGMATCH_SUPPORT_DIR;
sigmatch_table[DETECT_FILE_DATA].flags =
SIGMATCH_OPTIONAL_OPT | SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_MULTI_BUFFER;
filehandler_table[DETECT_FILE_DATA].name = "file_data";
filehandler_table[DETECT_FILE_DATA].priority = 2;

4
src/detect-filemagic.c
Unescape Escape View File

@ -114,8 +114,8 @@ void DetectFilemagicRegister(void)
sigmatch_table[DETECT_FILE_MAGIC].desc = "sticky buffer to match on the file magic";
sigmatch_table[DETECT_FILE_MAGIC].url = "/rules/file-keywords.html#filemagic";
sigmatch_table[DETECT_FILE_MAGIC].Setup = DetectFilemagicSetupSticky;
sigmatch_table[DETECT_FILE_MAGIC].flags =
SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_SUPPORT_DIR;
sigmatch_table[DETECT_FILE_MAGIC].flags = SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER |
SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_MULTI_BUFFER;
filehandler_table[DETECT_FILE_MAGIC].name = "file.magic",
filehandler_table[DETECT_FILE_MAGIC].priority = 2;

4
src/detect-filename.c
Unescape Escape View File

@ -100,8 +100,8 @@ void DetectFilenameRegister(void)
sigmatch_table[DETECT_FILE_NAME].desc = "sticky buffer to match on the file name";
sigmatch_table[DETECT_FILE_NAME].url = "/rules/file-keywords.html#filename";
sigmatch_table[DETECT_FILE_NAME].Setup = DetectFilenameSetupSticky;
sigmatch_table[DETECT_FILE_NAME].flags =
SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_SUPPORT_DIR;
sigmatch_table[DETECT_FILE_NAME].flags = SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER |
SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_MULTI_BUFFER;
DetectBufferTypeSetDescriptionByName("file.name", "file name");

3
src/detect-ftp-completion-code.c
Unescape Escape View File

@ -92,7 +92,8 @@ void DetectFtpCompletionCodeRegister(void)
"sticky buffer to match on the FTP completion code buffer";
sigmatch_table[DETECT_FTP_COMPLETION_CODE].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_FTP_COMPLETION_CODE].Setup = DetectFtpCompletionCodeSetup;
sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister(
BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPCompletionCodeGetData, 2);

3
src/detect-ftp-reply.c
Unescape Escape View File

@ -94,7 +94,8 @@ void DetectFtpReplyRegister(void)
sigmatch_table[DETECT_FTP_REPLY].desc = "sticky buffer to match on the FTP reply buffer";
sigmatch_table[DETECT_FTP_REPLY].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_FTP_REPLY].Setup = DetectFtpReplySetup;
sigmatch_table[DETECT_FTP_REPLY].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_FTP_REPLY].flags |=
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister(
BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 1, DetectFTPReplyGetData, 2);

4
src/detect-http-header.c
Unescape Escape View File

@ -589,7 +589,7 @@ void DetectHttpRequestHeaderRegister(void)
sigmatch_table[DETECT_HTTP_REQUEST_HEADER].url = "/rules/http-keywords.html#request_header";
sigmatch_table[DETECT_HTTP_REQUEST_HEADER].Setup = DetectHTTPRequestHeaderSetup;
sigmatch_table[DETECT_HTTP_REQUEST_HEADER].flags |=
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister("http_request_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateOpen, SCHttp2TxGetHeader, 2);
@ -622,7 +622,7 @@ void DetectHttpResponseHeaderRegister(void)
sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].url = "/rules/http2-keywords.html#response_header";
sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].Setup = DetectHTTPResponseHeaderSetup;
sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].flags |=
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
HTTP2StateOpen, SCHttp2TxGetHeader, 2);

3
src/detect-http2.c
Unescape Escape View File

@ -173,7 +173,8 @@ void DetectHttp2Register(void)
sigmatch_table[DETECT_HTTP2_HEADERNAME].desc = "sticky buffer to match on one HTTP2 header name";
sigmatch_table[DETECT_HTTP2_HEADERNAME].url = "/rules/http2-keywords.html#header_name";
sigmatch_table[DETECT_HTTP2_HEADERNAME].Setup = DetectHTTP2headerNameSetup;
sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |=
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
HTTP2StateOpen, SCHttp2TxGetHeaderName, 2);

3
src/detect-ike-vendor.c
Unescape Escape View File

@ -50,7 +50,8 @@ void DetectIkeVendorRegister(void)
sigmatch_table[DETECT_IKE_VENDOR].url = "/rules/ike-keywords.html#ike-vendor";
sigmatch_table[DETECT_IKE_VENDOR].Setup = DetectIkeVendorSetup;
sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_IKE_VENDOR].flags |=
SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister(
"ike.vendor", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, SCIkeTxGetVendor, 1);

3
src/detect-krb5-cname.c
Unescape Escape View File

@ -56,7 +56,8 @@ void DetectKrb5CNameRegister(void)
sigmatch_table[DETECT_KRB5_CNAME].alias = "krb5_cname";
sigmatch_table[DETECT_KRB5_CNAME].url = "/rules/kerberos-keywords.html#krb5-cname";
sigmatch_table[DETECT_KRB5_CNAME].Setup = DetectKrb5CNameSetup;
sigmatch_table[DETECT_KRB5_CNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_KRB5_CNAME].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
sigmatch_table[DETECT_KRB5_CNAME].desc = "sticky buffer to match on Kerberos 5 client name";
DetectAppLayerMultiRegister(

3
src/detect-krb5-sname.c
Unescape Escape View File

@ -56,7 +56,8 @@ void DetectKrb5SNameRegister(void)
sigmatch_table[DETECT_KRB5_SNAME].alias = "krb5_sname";
sigmatch_table[DETECT_KRB5_SNAME].url = "/rules/kerberos-keywords.html#krb5-sname";
sigmatch_table[DETECT_KRB5_SNAME].Setup = DetectKrb5SNameSetup;
sigmatch_table[DETECT_KRB5_SNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_KRB5_SNAME].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
sigmatch_table[DETECT_KRB5_SNAME].desc = "sticky buffer to match on Kerberos 5 server name";
DetectAppLayerMultiRegister(

3
src/detect-quic-cyu-hash.c
Unescape Escape View File

@ -63,7 +63,8 @@ void DetectQuicCyuHashRegister(void)
sigmatch_table[DETECT_QUIC_CYU_HASH].desc = "sticky buffer to match on the QUIC CYU hash";
sigmatch_table[DETECT_QUIC_CYU_HASH].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_QUIC_CYU_HASH].Setup = DetectQuicCyuHashSetup;
sigmatch_table[DETECT_QUIC_CYU_HASH].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_QUIC_CYU_HASH].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
#ifdef UNITTESTS
sigmatch_table[DETECT_QUIC_CYU_HASH].RegisterTests = DetectQuicCyuHashRegisterTests;
#endif

3
src/detect-quic-cyu-string.c
Unescape Escape View File

@ -61,7 +61,8 @@ void DetectQuicCyuStringRegister(void)
sigmatch_table[DETECT_QUIC_CYU_STRING].desc = "sticky buffer to match on the QUIC CYU string";
sigmatch_table[DETECT_QUIC_CYU_STRING].url = "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_QUIC_CYU_STRING].Setup = DetectQuicCyuStringSetup;
sigmatch_table[DETECT_QUIC_CYU_STRING].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_QUIC_CYU_STRING].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
#ifdef UNITTESTS
sigmatch_table[DETECT_QUIC_CYU_STRING].RegisterTests = DetectQuicCyuStringRegisterTests;
#endif

2
src/detect-smtp.c
Unescape Escape View File

@ -155,7 +155,7 @@ void SCDetectSMTPRegister(void)
kw.desc = "SMTP rcpt to buffer";
kw.url = "/rules/smtp-keywords.html#smtp-rcpt-to";
kw.Setup = DetectSmtpRcptToSetup;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
SCDetectHelperKeywordRegister(&kw);
g_smtp_rcpt_to_buffer_id = SCDetectHelperMultiBufferMpmRegister(
"smtp.rcpt_to", "SMTP RCPT TO", ALPROTO_SMTP, STREAM_TOSERVER, GetSmtpRcptToData);

3
src/detect-tls-alpn.c
Unescape Escape View File

@ -89,7 +89,8 @@ void DetectTlsAlpnRegister(void)
sigmatch_table[DETECT_TLS_ALPN].url = "/rules/tls-keywords.html#tls-alpn";
sigmatch_table[DETECT_TLS_ALPN].Setup = DetectTlsAlpnSetup;
sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_TLS_ALPN].flags |=
SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_CLIENT_HELLO_DONE, TlsAlpnGetData, 2);

3
src/detect-tls-certs.c
Unescape Escape View File

@ -111,7 +111,8 @@ void DetectTlsCertsRegister(void)
sigmatch_table[DETECT_TLS_CERTS].RegisterTests = DetectTlsCertsRegisterTests;
#endif
sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_TLS_CERTS].flags |=
SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_SERVER_CERT_DONE, TlsCertsGetData, 2);

3
src/detect-tls-subjectaltname.c
Unescape Escape View File

@ -88,7 +88,8 @@ void DetectTlsSubjectAltNameRegister(void)
sigmatch_table[DETECT_TLS_SUBJECTALTNAME].url = "/rules/tls-keywords.html#tls-subjectaltname";
sigmatch_table[DETECT_TLS_SUBJECTALTNAME].Setup = DetectTlsSubjectAltNameSetup;
sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |=
SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister("tls.subjectaltname", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_SERVER_CERT_DONE, TlsSubjectAltNameGetData, 2);

2
src/detect.h
Unescape Escape View File

@ -1680,6 +1680,8 @@ typedef struct SigGroupHead_ {
#define SIGMATCH_SUPPORT_FIREWALL BIT_U16(12)
/** keyword supporting setting an optional direction */
#define SIGMATCH_SUPPORT_DIR BIT_U16(13)
/** keyword is a multi buffer */
#define SIGMATCH_INFO_MULTI_BUFFER BIT_U16(14)
enum DetectEngineTenantSelectors
{

Write Preview
Loading…
Cancel
Save