aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: byte_math support

Browse Source
pull/5169/head
Jeff Lucovsky 6 years ago committed by Victor Julien
parent 1a726731e4
commit fb409664d2
16 changed files with 168 additions and 125 deletions
Show Stats Download Patch File Download Diff File

70
src/detect-byte-extract.c
Unescape Escape View File

@ -536,7 +536,7 @@ static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const c
if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -556,7 +556,7 @@ static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const c
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -2371,7 +2371,7 @@ static int DetectByteExtractTest43(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "three", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_OFFSET_BE |
cd->flags != (DETECT_CONTENT_OFFSET_VAR |
DETECT_CONTENT_OFFSET) ||
cd->offset != bed->local_id) {
printf("three failed\n");
@ -2479,7 +2479,7 @@ static int DetectByteExtractTest44(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_OFFSET_BE |
cd->flags != (DETECT_CONTENT_OFFSET_VAR |
DETECT_CONTENT_OFFSET) ||
cd->offset != bed1->local_id) {
printf("four failed\n");
@ -2494,7 +2494,7 @@ static int DetectByteExtractTest44(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "five", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_OFFSET_BE |
cd->flags != (DETECT_CONTENT_OFFSET_VAR |
DETECT_CONTENT_OFFSET) ||
cd->offset != bed2->local_id) {
printf("five failed\n");
@ -2592,7 +2592,7 @@ static int DetectByteExtractTest45(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "three", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DEPTH_BE |
cd->flags != (DETECT_CONTENT_DEPTH_VAR |
DETECT_CONTENT_DEPTH) ||
cd->depth != bed->local_id ||
cd->offset != 0) {
@ -2701,7 +2701,7 @@ static int DetectByteExtractTest46(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DEPTH_BE |
cd->flags != (DETECT_CONTENT_DEPTH_VAR |
DETECT_CONTENT_DEPTH) ||
cd->depth != bed1->local_id) {
printf("four failed\n");
@ -2716,7 +2716,7 @@ static int DetectByteExtractTest46(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "five", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DEPTH_BE |
cd->flags != (DETECT_CONTENT_DEPTH_VAR |
DETECT_CONTENT_DEPTH) ||
cd->depth != bed2->local_id) {
printf("five failed\n");
@ -2814,7 +2814,7 @@ static int DetectByteExtractTest47(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "three", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DISTANCE_BE |
cd->flags != (DETECT_CONTENT_DISTANCE_VAR |
DETECT_CONTENT_DISTANCE) ||
cd->distance != bed->local_id ||
cd->offset != 0 ||
@ -2924,7 +2924,7 @@ static int DetectByteExtractTest48(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DISTANCE_BE |
cd->flags != (DETECT_CONTENT_DISTANCE_VAR |
DETECT_CONTENT_DISTANCE |
DETECT_CONTENT_DISTANCE_NEXT) ||
cd->distance != bed1->local_id ||
@ -2942,7 +2942,7 @@ static int DetectByteExtractTest48(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "five", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DISTANCE_BE |
cd->flags != (DETECT_CONTENT_DISTANCE_VAR |
DETECT_CONTENT_DISTANCE) ||
cd->distance != bed2->local_id ||
cd->depth != 0 ||
@ -3042,7 +3042,7 @@ static int DetectByteExtractTest49(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "three", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_WITHIN_BE |
cd->flags != (DETECT_CONTENT_WITHIN_VAR |
DETECT_CONTENT_WITHIN) ||
cd->within != bed->local_id ||
cd->offset != 0 ||
@ -3153,7 +3153,7 @@ static int DetectByteExtractTest50(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_WITHIN_BE |
cd->flags != (DETECT_CONTENT_WITHIN_VAR |
DETECT_CONTENT_WITHIN|
DETECT_CONTENT_WITHIN_NEXT) ||
cd->within != bed1->local_id ||
@ -3172,7 +3172,7 @@ static int DetectByteExtractTest50(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "five", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_WITHIN_BE |
cd->flags != (DETECT_CONTENT_WITHIN_VAR |
DETECT_CONTENT_WITHIN) ||
cd->within != bed2->local_id ||
cd->depth != 0 ||
@ -3273,7 +3273,7 @@ static int DetectByteExtractTest51(void)
goto end;
}
btd = (DetectBytetestData *)sm->ctx;
if (btd->flags != DETECT_BYTETEST_OFFSET_BE ||
if (btd->flags != DETECT_BYTETEST_OFFSET_VAR ||
btd->value != 10 ||
btd->offset != 0) {
printf("three failed\n");
@ -3379,8 +3379,8 @@ static int DetectByteExtractTest52(void)
goto end;
}
btd = (DetectBytetestData *)sm->ctx;
if (btd->flags != (DETECT_BYTETEST_OFFSET_BE |
DETECT_BYTETEST_VALUE_BE) ||
if (btd->flags != (DETECT_BYTETEST_OFFSET_VAR |
DETECT_BYTETEST_VALUE_VAR) ||
btd->value != 0 ||
btd->offset != 1) {
printf("three failed\n");
@ -3394,7 +3394,7 @@ static int DetectByteExtractTest52(void)
goto end;
}
btd = (DetectBytetestData *)sm->ctx;
if (btd->flags != DETECT_BYTETEST_OFFSET_BE ||
if (btd->flags != DETECT_BYTETEST_OFFSET_VAR ||
btd->value != 10 ||
btd->offset != 1) {
printf("four failed\n");
@ -3492,7 +3492,7 @@ static int DetectByteExtractTest53(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 0) {
printf("three failed\n");
result = 0;
@ -3597,7 +3597,7 @@ static int DetectByteExtractTest54(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 0) {
printf("three failed\n");
result = 0;
@ -3610,7 +3610,7 @@ static int DetectByteExtractTest54(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 1) {
printf("four failed\n");
result = 0;
@ -3720,8 +3720,8 @@ static int DetectByteExtractTest55(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DISTANCE_BE |
DETECT_CONTENT_WITHIN_BE |
cd->flags != (DETECT_CONTENT_DISTANCE_VAR |
DETECT_CONTENT_WITHIN_VAR |
DETECT_CONTENT_DISTANCE |
DETECT_CONTENT_WITHIN) ||
cd->within != bed1->local_id ||
@ -3867,8 +3867,8 @@ static int DetectByteExtractTest56(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DISTANCE_BE |
DETECT_CONTENT_WITHIN_BE |
cd->flags != (DETECT_CONTENT_DISTANCE_VAR |
DETECT_CONTENT_WITHIN_VAR |
DETECT_CONTENT_DISTANCE |
DETECT_CONTENT_WITHIN) ||
cd->within != bed1->local_id ||
@ -4032,8 +4032,8 @@ static int DetectByteExtractTest57(void)
}
cd = (DetectContentData *)sm->ctx;
if (strncmp((char *)cd->content, "four", cd->content_len) != 0 ||
cd->flags != (DETECT_CONTENT_DISTANCE_BE |
DETECT_CONTENT_WITHIN_BE |
cd->flags != (DETECT_CONTENT_DISTANCE_VAR |
DETECT_CONTENT_WITHIN_VAR |
DETECT_CONTENT_DISTANCE |
DETECT_CONTENT_WITHIN) ||
cd->within != bed1->local_id ||
@ -4144,7 +4144,7 @@ static int DetectByteExtractTest58(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 0) {
printf("three failed\n");
result = 0;
@ -4157,7 +4157,7 @@ static int DetectByteExtractTest58(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 1) {
printf("four failed\n");
result = 0;
@ -4170,7 +4170,7 @@ static int DetectByteExtractTest58(void)
goto end;
}
isdd = (DetectIsdataatData *)sm->ctx;
if (isdd->flags != ISDATAAT_OFFSET_BE ||
if (isdd->flags != ISDATAAT_OFFSET_VAR ||
isdd->dataat != 1) {
printf("isdataat failed\n");
result = 0;
@ -4277,7 +4277,7 @@ static int DetectByteExtractTest59(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 0) {
printf("three failed\n");
result = 0;
@ -4290,7 +4290,7 @@ static int DetectByteExtractTest59(void)
goto end;
}
bjd = (DetectBytejumpData *)sm->ctx;
if (bjd->flags != DETECT_BYTEJUMP_OFFSET_BE ||
if (bjd->flags != DETECT_CONTENT_OFFSET_VAR ||
bjd->offset != 1) {
printf("four failed\n");
result = 0;
@ -4303,7 +4303,7 @@ static int DetectByteExtractTest59(void)
goto end;
}
isdd = (DetectIsdataatData *)sm->ctx;
if (isdd->flags != (ISDATAAT_OFFSET_BE |
if (isdd->flags != (ISDATAAT_OFFSET_VAR |
ISDATAAT_RELATIVE) ||
isdd->dataat != 1) {
printf("isdataat failed\n");
@ -4404,7 +4404,7 @@ static int DetectByteExtractTest60(void)
goto end;
}
isdd = (DetectIsdataatData *)sm->ctx;
if (isdd->flags != (ISDATAAT_OFFSET_BE) ||
if (isdd->flags != (ISDATAAT_OFFSET_VAR) ||
isdd->dataat != bed1->local_id) {
printf("isdataat failed\n");
result = 0;
@ -4590,7 +4590,7 @@ static int DetectByteExtractTest61(void)
goto end;
}
isdd = (DetectIsdataatData *)sm->ctx;
if (isdd->flags != (ISDATAAT_OFFSET_BE |
if (isdd->flags != (ISDATAAT_OFFSET_VAR |
ISDATAAT_RELATIVE) ||
isdd->dataat != bed1->local_id) {
printf("isdataat failed\n");

15
src/detect-bytejump.c
Unescape Escape View File

@ -31,8 +31,9 @@
#include "detect-engine.h"
#include "app-layer.h"
#include "detect-bytejump.h"
#include "detect-byte.h"
#include "detect-byte-extract.h"
#include "detect-bytejump.h"
#include "detect-content.h"
#include "detect-uricontent.h"
@ -539,7 +540,7 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -558,7 +559,7 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -587,14 +588,14 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
if (offset != NULL) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s);
if (bed_sm == NULL) {
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(offset, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
"seen in byte_jump - %s", offset);
goto error;
}
data->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
data->flags |= DETECT_BYTEJUMP_OFFSET_BE;
data->offset = index;
data->flags |= DETECT_CONTENT_OFFSET_VAR;
SCFree(offset);
offset = NULL;
}

23
src/detect-bytetest.c
Unescape Escape View File

@ -33,6 +33,7 @@
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-byte.h"
#include "detect-bytetest.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
@ -241,7 +242,7 @@ int DetectBytetestDoMatch(DetectEngineThreadCtx *det_ctx,
/* A successful match depends on negation */
if ((!neg && match) || (neg && !match)) {
SCLogDebug("MATCH");
SCLogDebug("MATCH [bt] extracted value is %"PRIu64, val);
SCReturnInt(1);
}
@ -543,7 +544,7 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -562,7 +563,7 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -589,27 +590,27 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
if (value != NULL) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(value, s);
if (bed_sm == NULL) {
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(value, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
"seen in byte_test - %s\n", value);
goto error;
}
data->value = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
data->flags |= DETECT_BYTETEST_VALUE_BE;
data->value = index;
data->flags |= DETECT_BYTETEST_VALUE_VAR;
SCFree(value);
value = NULL;
}
if (offset != NULL) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s);
if (bed_sm == NULL) {
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(offset, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
"seen in byte_test - %s\n", offset);
goto error;
}
data->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
data->flags |= DETECT_BYTETEST_OFFSET_BE;
data->offset = index;
data->flags |= DETECT_BYTETEST_OFFSET_VAR;
SCFree(offset);
offset = NULL;
}

4
src/detect-bytetest.h
Unescape Escape View File

@ -46,8 +46,8 @@
#define DETECT_BYTETEST_RELATIVE BIT_U8(3) /**< "relative" offset */
#define DETECT_BYTETEST_DCE BIT_U8(4) /**< dce enabled */
#define DETECT_BYTETEST_BITMASK BIT_U8(5) /**< bitmask supplied*/
#define DETECT_BYTETEST_VALUE_BE BIT_U8(6) /**< byte extract value enabled */
#define DETECT_BYTETEST_OFFSET_BE BIT_U8(7) /**< byte extract value enabled */
#define DETECT_BYTETEST_VALUE_VAR BIT_U8(6) /**< byte extract value enabled */
#define DETECT_BYTETEST_OFFSET_VAR BIT_U8(7) /**< byte extract value enabled */
typedef struct DetectBytetestData_ {
uint8_t nbytes; /**< Number of bytes to compare */

8
src/detect-content.h
Unescape Escape View File

@ -42,10 +42,10 @@
#define DETECT_CONTENT_ENDS_WITH BIT_U32(10)
/* BE - byte extract */
#define DETECT_CONTENT_OFFSET_BE BIT_U32(11)
#define DETECT_CONTENT_DEPTH_BE BIT_U32(12)
#define DETECT_CONTENT_DISTANCE_BE BIT_U32(13)
#define DETECT_CONTENT_WITHIN_BE BIT_U32(14)
#define DETECT_CONTENT_OFFSET_VAR BIT_U32(11)
#define DETECT_CONTENT_DEPTH_VAR BIT_U32(12)
#define DETECT_CONTENT_DISTANCE_VAR BIT_U32(13)
#define DETECT_CONTENT_WITHIN_VAR BIT_U32(14)
/* replace data */
#define DETECT_CONTENT_REPLACE BIT_U32(15)

11
src/detect-depth.c
Unescape Escape View File

@ -32,6 +32,7 @@
#include "detect-parse.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-byte.h"
#include "detect-byte-extract.h"
#include "detect-depth.h"
@ -105,14 +106,14 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, const char *
goto end;
}
if (str[0] != '-' && isalpha((unsigned char)str[0])) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
if (bed_sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
"seen in depth - %s.", str);
goto end;
}
cd->depth = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
cd->flags |= DETECT_CONTENT_DEPTH_BE;
cd->depth = index;
cd->flags |= DETECT_CONTENT_DEPTH_VAR;
} else {
if (StringParseUint16(&cd->depth, 0, 0, str) < 0)
{

11
src/detect-distance.c
Unescape Escape View File

@ -36,6 +36,7 @@
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-pcre.h"
#include "detect-byte.h"
#include "detect-byte-extract.h"
#include "detect-distance.h"
@ -104,14 +105,14 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
goto end;
}
if (str[0] != '-' && isalpha((unsigned char)str[0])) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
if (bed_sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
"seen in distance - %s\n", str);
goto end;
}
cd->distance = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
cd->flags |= DETECT_CONTENT_DISTANCE_BE;
cd->distance = index;
cd->flags |= DETECT_CONTENT_DISTANCE_VAR;
} else {
if (StringParseInt32(&cd->distance, 0, 0, str) < 0) {
SCLogError(SC_ERR_INVALID_SIGNATURE,

89
src/detect-engine-content-inspection.c
Unescape Escape View File

@ -35,6 +35,7 @@
#include "detect-pcre.h"
#include "detect-isdataat.h"
#include "detect-bytetest.h"
#include "detect-bytemath.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "detect-replace.h"
@ -159,8 +160,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
int distance = cd->distance;
if (cd->flags & DETECT_CONTENT_DISTANCE) {
if (cd->flags & DETECT_CONTENT_DISTANCE_BE) {
distance = det_ctx->bj_values[cd->distance];
if (cd->flags & DETECT_CONTENT_DISTANCE_VAR) {
distance = det_ctx->byte_values[cd->distance];
}
if (distance < 0 && (uint32_t)(abs(distance)) > offset)
offset = 0;
@ -172,9 +173,9 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
}
if (cd->flags & DETECT_CONTENT_WITHIN) {
if (cd->flags & DETECT_CONTENT_WITHIN_BE) {
if ((int32_t)depth > (int32_t)(prev_buffer_offset + det_ctx->bj_values[cd->within] + distance)) {
depth = prev_buffer_offset + det_ctx->bj_values[cd->within] + distance;
if (cd->flags & DETECT_CONTENT_WITHIN_VAR) {
if ((int32_t)depth > (int32_t)(prev_buffer_offset + det_ctx->byte_values[cd->within] + distance)) {
depth = prev_buffer_offset + det_ctx->byte_values[cd->within] + distance;
}
} else {
if ((int32_t)depth > (int32_t)(prev_buffer_offset + cd->within + distance)) {
@ -196,9 +197,9 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
}
}
if (cd->flags & DETECT_CONTENT_DEPTH_BE) {
if ((det_ctx->bj_values[cd->depth] + prev_buffer_offset) < depth) {
depth = prev_buffer_offset + det_ctx->bj_values[cd->depth];
if (cd->flags & DETECT_CONTENT_DEPTH_VAR) {
if ((det_ctx->byte_values[cd->depth] + prev_buffer_offset) < depth) {
depth = prev_buffer_offset + det_ctx->byte_values[cd->depth];
}
} else {
if (cd->depth != 0) {
@ -210,9 +211,9 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
}
}
if (cd->flags & DETECT_CONTENT_OFFSET_BE) {
if (det_ctx->bj_values[cd->offset] > offset)
offset = det_ctx->bj_values[cd->offset];
if (cd->flags & DETECT_CONTENT_OFFSET_VAR) {
if (det_ctx->byte_values[cd->offset] > offset)
offset = det_ctx->byte_values[cd->offset];
} else {
if (cd->offset > offset) {
offset = cd->offset;
@ -221,8 +222,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
}
} else { /* implied no relative matches */
/* set depth */
if (cd->flags & DETECT_CONTENT_DEPTH_BE) {
depth = det_ctx->bj_values[cd->depth];
if (cd->flags & DETECT_CONTENT_DEPTH_VAR) {
depth = det_ctx->byte_values[cd->depth];
} else {
if (cd->depth != 0) {
depth = cd->depth;
@ -240,8 +241,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
}
/* set offset */
if (cd->flags & DETECT_CONTENT_OFFSET_BE)
offset = det_ctx->bj_values[cd->offset];
if (cd->flags & DETECT_CONTENT_OFFSET_VAR)
offset = det_ctx->byte_values[cd->offset];
else
offset = cd->offset;
prev_buffer_offset = 0;
@ -250,7 +251,7 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
/* If the value came from a variable, make sure to adjust the depth so it's relative
* to the offset value.
*/
if (cd->flags & (DETECT_CONTENT_DISTANCE_BE|DETECT_CONTENT_OFFSET_BE|DETECT_CONTENT_DEPTH_BE)) {
if (cd->flags & (DETECT_CONTENT_DISTANCE_VAR|DETECT_CONTENT_OFFSET_VAR|DETECT_CONTENT_DEPTH_VAR)) {
depth += offset;
}
@ -375,8 +376,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
const DetectIsdataatData *id = (DetectIsdataatData *)smd->ctx;
uint32_t dataat = id->dataat;
if (id->flags & ISDATAAT_OFFSET_BE) {
uint64_t be_value = det_ctx->bj_values[dataat];
if (id->flags & ISDATAAT_OFFSET_VAR) {
uint64_t be_value = det_ctx->byte_values[dataat];
if (be_value >= 100000000) {
if ((id->flags & ISDATAAT_NEGATED) == 0) {
SCLogDebug("extracted value %"PRIu64" very big: no match", be_value);
@ -461,11 +462,11 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
uint8_t btflags = btd->flags;
int32_t offset = btd->offset;
uint64_t value = btd->value;
if (btflags & DETECT_BYTETEST_OFFSET_BE) {
offset = det_ctx->bj_values[offset];
if (btflags & DETECT_BYTETEST_OFFSET_VAR) {
offset = det_ctx->byte_values[offset];
}
if (btflags & DETECT_BYTETEST_VALUE_BE) {
value = det_ctx->bj_values[value];
if (btflags & DETECT_BYTETEST_VALUE_VAR) {
value = det_ctx->byte_values[value];
}
/* if we have dce enabled we will have to use the endianness
@ -489,8 +490,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
uint16_t bjflags = bjd->flags;
int32_t offset = bjd->offset;
if (bjflags & DETECT_BYTEJUMP_OFFSET_BE) {
offset = det_ctx->bj_values[offset];
if (bjflags & DETECT_CONTENT_OFFSET_VAR) {
offset = det_ctx->byte_values[offset];
}
/* if we have dce enabled we will have to use the endianness
@ -528,11 +529,49 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
if (DetectByteExtractDoMatch(det_ctx, smd, s, buffer,
buffer_len,
&det_ctx->bj_values[bed->local_id],
&det_ctx->byte_values[bed->local_id],
endian) != 1) {
goto no_match;
}
SCLogDebug("[BE] Fetched value for index %d: %"PRIu64,
bed->local_id, det_ctx->byte_values[bed->local_id]);
goto match;
} else if (smd->type == DETECT_BYTEMATH) {
DetectByteMathData *bmd = (DetectByteMathData *)smd->ctx;
uint8_t endian = bmd->endian;
/* if we have dce enabled we will have to use the endianness
* specified by the dce header */
if ((bmd->flags & DETECT_BYTEMATH_FLAG_ENDIAN) &&
endian == DETECT_BYTEMATH_ENDIAN_DCE &&
flags & (DETECT_CI_FLAGS_DCE_LE|DETECT_CI_FLAGS_DCE_BE)) {
/* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/
endian |= ((flags & DETECT_CI_FLAGS_DCE_LE) ?
DETECT_BYTEMATH_ENDIAN_LITTLE : DETECT_BYTEMATH_ENDIAN_BIG);
}
uint64_t rvalue;
if (bmd->flags & DETECT_BYTEMATH_RVALUE_VAR) {
rvalue = det_ctx->byte_values[bmd->local_id];
} else {
rvalue = bmd->rvalue;
}
if (DetectByteMathDoMatch(det_ctx, smd, s, buffer,
buffer_len,
rvalue,
&det_ctx->byte_values[bmd->local_id],
endian) != 1) {
goto no_match;
}
SCLogDebug("[BM] Fetched value for index %d: %"PRIu64,
bmd->local_id, det_ctx->byte_values[bmd->local_id]);
goto match;
} else if (smd->type == DETECT_BSIZE) {

2
src/detect-engine-mpm.c
Unescape Escape View File

@ -745,7 +745,7 @@ static void PopulateMpmHelperAddPattern(MpmCtx *mpm_ctx,
/* We have to effectively "wild card" values that will be coming from
* byte_extract variables
*/
if (cd->flags & (DETECT_CONTENT_DEPTH_BE | DETECT_CONTENT_OFFSET_BE)) {
if (cd->flags & (DETECT_CONTENT_DEPTH_VAR | DETECT_CONTENT_OFFSET_VAR)) {
pat_depth = pat_offset = 0;
}

2
src/detect-engine-register.c
Unescape Escape View File

@ -89,6 +89,7 @@
#include "detect-nocase.h"
#include "detect-rawbytes.h"
#include "detect-bytetest.h"
#include "detect-bytemath.h"
#include "detect-bytejump.h"
#include "detect-sameip.h"
#include "detect-l3proto.h"
@ -481,6 +482,7 @@ void SigTableSetup(void)
DetectRawbytesRegister();
DetectBytetestRegister();
DetectBytejumpRegister();
DetectBytemathRegister();
DetectSameipRegister();
DetectGeoipRegister();
DetectL3ProtoRegister();

8
src/detect-engine.c
Unescape Escape View File

@ -2724,9 +2724,9 @@ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *
}
/* byte_extract storage */
det_ctx->bj_values = SCMalloc(sizeof(*det_ctx->bj_values) *
det_ctx->byte_values = SCMalloc(sizeof(*det_ctx->byte_values) *
(de_ctx->byte_extract_max_local_id + 1));
if (det_ctx->bj_values == NULL) {
if (det_ctx->byte_values == NULL) {
return TM_ECODE_FAILED;
}
@ -2954,8 +2954,8 @@ static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
RuleMatchCandidateTxArrayFree(det_ctx);
if (det_ctx->bj_values != NULL)
SCFree(det_ctx->bj_values);
if (det_ctx->byte_values != NULL)
SCFree(det_ctx->byte_values);
/* Decoded base64 data. */
if (det_ctx->base64_decoded != NULL) {

13
src/detect-isdataat.c
Unescape Escape View File

@ -44,8 +44,7 @@
#include "util-debug.h"
#include "util-byte.h"
#include "detect-pcre.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "detect-byte.h"
/**
* \brief Regex for parsing our isdataat options
@ -227,7 +226,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isda
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL)
sm_list = DETECT_SM_LIST_PMATCH;
else {
@ -240,14 +239,14 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isda
}
if (offset != NULL) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s);
if (bed_sm == NULL) {
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(offset, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
"seen in isdataat - %s\n", offset);
goto end;
}
idad->dataat = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
idad->flags |= ISDATAAT_OFFSET_BE;
idad->dataat = index;
idad->flags |= ISDATAAT_OFFSET_VAR;
SCLogDebug("isdataat uses byte_extract with local id %u", idad->dataat);
SCFree(offset);
offset = NULL;

8
src/detect-isdataat.h
Unescape Escape View File

@ -24,10 +24,10 @@
#ifndef __DETECT_ISDATAAT_H__
#define __DETECT_ISDATAAT_H__
#define ISDATAAT_RELATIVE 0x01
#define ISDATAAT_RAWBYTES 0x02
#define ISDATAAT_NEGATED 0x04
#define ISDATAAT_OFFSET_BE 0x08
#define ISDATAAT_RELATIVE 0x01
#define ISDATAAT_RAWBYTES 0x02
#define ISDATAAT_NEGATED 0x04
#define ISDATAAT_OFFSET_VAR 0x08
#define ISDATAAT_MIN 0
#define ISDATAAT_MAX 65535

12
src/detect-offset.c
Unescape Escape View File

@ -32,6 +32,7 @@
#include "detect-parse.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-byte.h"
#include "detect-byte-extract.h"
#include "detect-offset.h"
@ -96,15 +97,14 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *offset
goto end;
}
if (str[0] != '-' && isalpha((unsigned char)str[0])) {
SigMatch *bed_sm =
DetectByteExtractRetrieveSMVar(str, s);
if (bed_sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
"seen in offset - %s.", str);
goto end;
}
cd->offset = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
cd->flags |= DETECT_CONTENT_OFFSET_BE;
cd->offset = index;
cd->flags |= DETECT_CONTENT_OFFSET_VAR;
} else {
if (StringParseUint16(&cd->offset, 0, 0, str) < 0)
{

13
src/detect-within.c
Unescape Escape View File

@ -33,8 +33,7 @@
#include "detect-parse.h"
#include "detect-content.h"
#include "detect-uricontent.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "detect-byte.h"
#include "app-layer.h"
#include "flow-var.h"
@ -104,14 +103,14 @@ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *
goto end;
}
if (str[0] != '-' && isalpha((unsigned char)str[0])) {
SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
if (bed_sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
DetectByteIndexType index;
if (!DetectByteRetrieveSMVar(str, s, &index)) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
"seen in within - %s\n", str);
goto end;
}
cd->within = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
cd->flags |= DETECT_CONTENT_WITHIN_BE;
cd->within = index;
cd->flags |= DETECT_CONTENT_WITHIN_VAR;
} else {
if (StringParseInt32(&cd->within, 0, 0, str) < 0) {
SCLogError(SC_ERR_INVALID_SIGNATURE,

4
src/detect.h
Unescape Escape View File

@ -1116,8 +1116,8 @@ typedef struct DetectEngineThreadCtx_ {
/** ip only rules ctx */
DetectEngineIPOnlyThreadCtx io_ctx;
/* byte jump values */
uint64_t *bj_values;
/* byte_* values */
uint64_t *byte_values;
/* string to replace */
DetectReplaceList *replist;

Write Preview
Loading…
Cancel
Save