Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gen/refactor: transform and misc related changes for improved transform support #12502

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions rust/src/detect/transforms/casechange.rs
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ fn tolower_transform_do(input: &[u8], output: &mut [u8]) {
}
}

unsafe extern "C" fn tolower_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn tolower_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down Expand Up @@ -99,7 +99,7 @@ fn toupper_transform_do(input: &[u8], output: &mut [u8]) {
}
}

unsafe extern "C" fn toupper_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn toupper_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
2 changes: 1 addition & 1 deletion rust/src/detect/transforms/compress_whitespace.rs
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ fn compress_whitespace_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
return nb as u32;
}

unsafe extern "C" fn compress_whitespace_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn compress_whitespace_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
2 changes: 1 addition & 1 deletion rust/src/detect/transforms/dotprefix.rs
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ fn dot_prefix_transform_do(input: &[u8], output: &mut [u8]) {
output[0] = b'.';
}

unsafe extern "C" fn dot_prefix_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn dot_prefix_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input_len = InspectionBufferLength(buffer);
if input_len == 0 {
return;
Expand Down
6 changes: 3 additions & 3 deletions rust/src/detect/transforms/hash.rs
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ fn md5_transform_do(input: &[u8], output: &mut [u8]) {
Md5::new().chain(input).finalize_into(output.into());
}

unsafe extern "C" fn md5_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn md5_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down Expand Up @@ -101,7 +101,7 @@ fn sha1_transform_do(input: &[u8], output: &mut [u8]) {
Sha1::new().chain(input).finalize_into(output.into());
}

unsafe extern "C" fn sha1_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn sha1_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down Expand Up @@ -153,7 +153,7 @@ fn sha256_transform_do(input: &[u8], output: &mut [u8]) {
Sha256::new().chain(input).finalize_into(output.into());
}

unsafe extern "C" fn sha256_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn sha256_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
4 changes: 2 additions & 2 deletions rust/src/detect/transforms/http_headers.rs
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ fn header_lowertransform_do(input: &[u8], output: &mut [u8]) {
}
}

unsafe extern "C" fn header_lowertransform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn header_lowertransform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down Expand Up @@ -114,7 +114,7 @@ fn strip_pseudo_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
return nb as u32;
}

unsafe extern "C" fn strip_pseudo_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn strip_pseudo_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
2 changes: 1 addition & 1 deletion rust/src/detect/transforms/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ pub struct SCTransformTableElmt {
pub flags: u16,
pub Setup: unsafe extern "C" fn(de: *mut c_void, s: *mut c_void, raw: *const c_char) -> c_int,
pub Free: Option<unsafe extern "C" fn(de: *mut c_void, ptr: *mut c_void)>,
pub Transform: unsafe extern "C" fn(inspect_buf: *mut c_void, options: *mut c_void),
pub Transform: unsafe extern "C" fn(det: *mut c_void, inspect_buf: *mut c_void, options: *mut c_void),
pub TransformValidate:
Option<unsafe extern "C" fn(content: *const u8, len: u16, context: *mut c_void) -> bool>,
}
Expand Down
2 changes: 1 addition & 1 deletion rust/src/detect/transforms/strip_whitespace.rs
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ fn strip_whitespace_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
return nb as u32;
}

unsafe extern "C" fn strip_whitespace_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn strip_whitespace_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
2 changes: 1 addition & 1 deletion rust/src/detect/transforms/urldecode.rs
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ fn url_decode_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
return nb as u32;
}

unsafe extern "C" fn url_decode_transform(buffer: *mut c_void, _ctx: *mut c_void) {
unsafe extern "C" fn url_decode_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
2 changes: 1 addition & 1 deletion rust/src/detect/transforms/xor.rs
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ fn xor_transform_do(input: &[u8], output: &mut [u8], ctx: &DetectTransformXorDat
}
}

unsafe extern "C" fn xor_transform(buffer: *mut c_void, ctx: *mut c_void) {
unsafe extern "C" fn xor_transform(_det: *mut c_void, buffer: *mut c_void, ctx: *mut c_void) {
let input = InspectionBufferPtr(buffer);
let input_len = InspectionBufferLength(buffer);
if input.is_null() || input_len == 0 {
Expand Down
8 changes: 4 additions & 4 deletions src/detect-dce-stub-data.c
Original file line number Diff line number Diff line change
Expand Up @@ -79,8 +79,8 @@ static InspectionBuffer *GetSMBData(DetectEngineThreadCtx *det_ctx,
return NULL;
SCLogDebug("have data!");

InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
InspectionBufferSetupAndApplyTransforms(
det_ctx, list_id, buffer, data, data_len, transforms);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you use DetectHelperGetData to save even more lines ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes -- I think that pattern could be used in several places but is probably best done in a separate PR, imo

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, why do you need this commit ? if it "is probably best done in a separate PR"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, why do you need this commit ? if it "is probably best done in a separate PR"

}
return buffer;
}
Expand All @@ -105,8 +105,8 @@ static InspectionBuffer *GetDCEData(DetectEngineThreadCtx *det_ctx,
} else {
buffer->flags |= DETECT_CI_FLAGS_DCE_BE;
}
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
InspectionBufferApplyTransforms(buffer, transforms);
InspectionBufferSetupAndApplyTransforms(
det_ctx, list_id, buffer, data, data_len, transforms);
}
return buffer;
}
Expand Down
4 changes: 2 additions & 2 deletions src/detect-dnp3.c
Original file line number Diff line number Diff line change
Expand Up @@ -166,8 +166,8 @@ static InspectionBuffer *GetDNP3Data(DetectEngineThreadCtx *det_ctx,
}

SCLogDebug("tx %p data %p data_len %u", tx, tx->buffer, tx->buffer_len);
InspectionBufferSetup(det_ctx, list_id, buffer, tx->buffer, tx->buffer_len);
InspectionBufferApplyTransforms(buffer, transforms);
InspectionBufferSetupAndApplyTransforms(
det_ctx, list_id, buffer, tx->buffer, tx->buffer_len, transforms);
}
return buffer;
}
Expand Down
2 changes: 1 addition & 1 deletion src/detect-dns-answer-name.c
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ static InspectionBuffer *GetBuffer(DetectEngineThreadCtx *det_ctx,
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}
InspectionBufferSetupMulti(buffer, transforms, data, data_len);
InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
buffer->flags = DETECT_CI_FLAGS_SINGLE;
return buffer;
}
Expand Down
2 changes: 1 addition & 1 deletion src/detect-dns-query-name.c
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ static InspectionBuffer *GetBuffer(DetectEngineThreadCtx *det_ctx,
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}
InspectionBufferSetupMulti(buffer, transforms, data, data_len);
InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
buffer->flags = DETECT_CI_FLAGS_SINGLE;
return buffer;
}
Expand Down
2 changes: 1 addition & 1 deletion src/detect-dns-query.c
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ static InspectionBuffer *DnsQueryGetData(DetectEngineThreadCtx *det_ctx,
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}
InspectionBufferSetupMulti(buffer, transforms, data, data_len);
InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
buffer->flags = DETECT_CI_FLAGS_SINGLE;

SCReturnPtr(buffer, "InspectionBuffer");
Expand Down
16 changes: 8 additions & 8 deletions src/detect-engine-frame.c
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,8 @@ static bool SetupStreamCallbackData(struct FrameStreamData *dst, const TcpSessio

static bool BufferSetup(struct FrameStreamData *fsd, InspectionBuffer *buffer, const uint8_t *input,
const uint32_t input_len, const uint64_t input_offset);
static void BufferSetupUdp(InspectionBuffer *buffer, const Frame *frame, const Packet *p,
const DetectEngineTransforms *transforms);
static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer,
const Frame *frame, const Packet *p, const DetectEngineTransforms *transforms);

void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
const Frames *frames, const Frame *frame, const AppProto alproto)
Expand Down Expand Up @@ -159,7 +159,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx,
if (frame->offset >= p->payload_len)
return;

BufferSetupUdp(buffer, frame, p, ctx->transforms);
BufferSetupUdp(det_ctx, buffer, frame, p, ctx->transforms);
const uint32_t data_len = buffer->inspect_len;
const uint8_t *data = buffer->inspect;

Expand Down Expand Up @@ -251,8 +251,8 @@ bool DetectRunFrameInspectRule(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, c
return false;
}

static void BufferSetupUdp(InspectionBuffer *buffer, const Frame *frame, const Packet *p,
const DetectEngineTransforms *transforms)
static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer,
const Frame *frame, const Packet *p, const DetectEngineTransforms *transforms)
{
uint8_t ci_flags = DETECT_CI_FLAGS_START;
uint32_t frame_len;
Expand All @@ -275,7 +275,7 @@ static void BufferSetupUdp(InspectionBuffer *buffer, const Frame *frame, const P
AppLayerParserGetFrameNameById(p->flow->proto, p->flow->alproto, frame->type),
frame->offset, frame->type, frame->len);

InspectionBufferSetupMulti(buffer, transforms, data, data_len);
InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
buffer->inspect_offset = 0;
buffer->flags = ci_flags;
}
Expand All @@ -301,7 +301,7 @@ static int DetectFrameInspectUdp(DetectEngineThreadCtx *det_ctx,
return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;

if (!buffer->initialized)
BufferSetupUdp(buffer, frame, p, transforms);
BufferSetupUdp(det_ctx, buffer, frame, p, transforms);
DEBUG_VALIDATE_BUG_ON(!buffer->initialized);
if (buffer->inspect == NULL)
return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
Expand Down Expand Up @@ -387,7 +387,7 @@ static bool BufferSetup(struct FrameStreamData *fsd, InspectionBuffer *buffer, c
}
// PrintRawDataFp(stdout, data, data_len);
SCLogDebug("fsd->transforms %p", fsd->transforms);
InspectionBufferSetupMulti(buffer, fsd->transforms, data, data_len);
InspectionBufferSetupMulti(fsd->det_ctx, buffer, fsd->transforms, data, data_len);
SCLogDebug("inspect_offset %" PRIu64, fo_inspect_offset);
buffer->inspect_offset = fo_inspect_offset;
buffer->flags = ci_flags;
Expand Down
10 changes: 5 additions & 5 deletions src/detect-engine-helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,7 @@ InspectionBuffer *DetectHelperGetData(struct DetectEngineThreadCtx_ *det_ctx,
if (!GetBuf(txv, flow_flags, &b, &b_len))
return NULL;

InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
InspectionBufferApplyTransforms(buffer, transforms);
InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
}
return buffer;
}
Expand Down Expand Up @@ -137,8 +136,9 @@ int DetectHelperTransformRegister(const SCTransformTableElmt *kw)
sigmatch_table[DETECT_TBLSIZE_IDX].desc = kw->desc;
sigmatch_table[DETECT_TBLSIZE_IDX].url = kw->url;
sigmatch_table[DETECT_TBLSIZE_IDX].flags = kw->flags;
sigmatch_table[DETECT_TBLSIZE_IDX].Transform =
(void (*)(InspectionBuffer * buffer, void *options)) kw->Transform;
sigmatch_table[DETECT_TBLSIZE_IDX].Transform = (void (*)(
struct DetectEngineThreadCtx_ * det_ctx, InspectionBuffer * buffer, void *options))
kw->Transform;
sigmatch_table[DETECT_TBLSIZE_IDX].TransformValidate = (bool (*)(
const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate;
sigmatch_table[DETECT_TBLSIZE_IDX].Setup =
Expand Down Expand Up @@ -167,7 +167,7 @@ InspectionBuffer *DetectHelperGetMultiData(struct DetectEngineThreadCtx_ *det_ct
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}
InspectionBufferSetupMulti(buffer, transforms, data, data_len);
InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len);
buffer->flags = DETECT_CI_FLAGS_SINGLE;
return buffer;
}
Expand Down
1 change: 0 additions & 1 deletion src/detect-engine-mpm.h
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,6 @@ void DetectEngineFrameMpmRegister(DetectEngineCtx *de_ctx, const char *name, int
const DetectBufferMpmRegistry *mpm_reg, int list_id),
AppProto alproto, uint8_t type);


Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does not deserve its own commit :-p

int PrefilterGenericMpmFrameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx,
const DetectBufferMpmRegistry *mpm_reg, int list_id);

Expand Down
Loading
Loading