Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

De cleanups/20241010/v1 #11928

Closed
wants to merge 3 commits into from
Closed

De cleanups/20241010/v1 #11928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
22e88c7
detect/engine: use combined flags for TCP
inashivb Oct 8, 2024
b57bfc7
detect/proto: use BIT macros instead of expr
inashivb Oct 10, 2024
3665666
detect/engine: rename fns, add comments
inashivb Oct 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 11 additions & 28 deletions src/detect-engine-build.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,27 +487,11 @@ static int SignatureCreateMask(Signature *s)
{
DetectFlagsData *fl = (DetectFlagsData *)sm->ctx;

if (fl->flags & TH_SYN) {
if (fl->flags & MASK_TCP_INITDEINIT_FLAGS) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT");
}
if (fl->flags & TH_RST) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT");
}
if (fl->flags & TH_FIN) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_INITDEINIT;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_INITDEINIT");
}
if (fl->flags & TH_URG) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL");
}
if (fl->flags & TH_ECN) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL");
}
if (fl->flags & TH_CWR) {
if (fl->flags & MASK_TCP_UNUSUAL_FLAGS) {
s->mask |= SIG_MASK_REQUIRE_FLAGS_UNUSUAL;
SCLogDebug("sig requires SIG_MASK_REQUIRE_FLAGS_UNUSUAL");
}
Expand Down Expand Up @@ -969,7 +953,7 @@ static void RulesDumpGrouping(const DetectEngineCtx *de_ctx,
fclose(fp);
}

static int RulesGroupByProto(DetectEngineCtx *de_ctx)
static int RulesGroupByIPProto(DetectEngineCtx *de_ctx)
{
Signature *s = de_ctx->sig_list;

Expand All @@ -980,15 +964,16 @@ static int RulesGroupByProto(DetectEngineCtx *de_ctx)
if (s->type == SIG_TYPE_IPONLY)
continue;

int p;
for (p = 0; p < 256; p++) {
/* traverse over IP protocol list from libc */
for (int p = 0; p < 256; p++) {
if (p == IPPROTO_TCP || p == IPPROTO_UDP) {
continue;
}
if (!(s->proto.proto[p / 8] & (1<<(p % 8)) || (s->proto.flags & DETECT_PROTO_ANY))) {
continue;
}

/* Signatures that are !IP only, ICMP, SCTP are handlnd here */
if (s->flags & SIG_FLAG_TOCLIENT) {
SigGroupHeadAppendSig(de_ctx, &sgh_tc[p], s);
}
Expand Down Expand Up @@ -1079,8 +1064,7 @@ static int RulesGroupByProto(DetectEngineCtx *de_ctx)
return 0;
}

static int PortIsWhitelisted(const DetectEngineCtx *de_ctx,
const DetectPort *a, int ipproto)
static int PortIsPriority(const DetectEngineCtx *de_ctx, const DetectPort *a, int ipproto)
{
DetectPort *w = de_ctx->tcp_whitelist;
inashivb marked this conversation as resolved.
Show resolved Hide resolved
if (ipproto == IPPROTO_UDP)
Expand All @@ -1098,7 +1082,7 @@ static int PortIsWhitelisted(const DetectEngineCtx *de_ctx,
return 0;
}

static int RuleSetWhitelist(Signature *s)
static int RuleSetScore(Signature *s)
{
DetectPort *p = NULL;
if (s->flags & SIG_FLAG_TOSERVER)
Expand Down Expand Up @@ -1535,8 +1519,7 @@ static DetectPort *RulesGroupByPorts(DetectEngineCtx *de_ctx, uint8_t ipproto, u

int wl = s->init_data->score;
while (p) {
int pwl = PortIsWhitelisted(de_ctx, p, ipproto) ? DETECT_PGSCORE_RULE_PORT_WHITELISTED
: 0;
int pwl = PortIsPriority(de_ctx, p, ipproto) ? DETECT_PGSCORE_RULE_PORT_WHITELISTED : 0;
pwl = MAX(wl,pwl);

DetectPort *lookup = DetectPortHashLookup(de_ctx, p);
Expand Down Expand Up @@ -1802,7 +1785,7 @@ int SigPrepareStage1(DetectEngineCtx *de_ctx)
DetectContentPropagateLimits(s);
SigParseApplyDsizeToContent(s);

RuleSetWhitelist(s);
RuleSetScore(s);

/* if keyword engines are enabled in the config, handle them here */
if (!g_skip_prefilter && de_ctx->prefilter_setting == DETECT_PREFILTER_AUTO &&
Expand Down Expand Up @@ -1907,7 +1890,7 @@ int SigPrepareStage2(DetectEngineCtx *de_ctx)
de_ctx->flow_gh[0].udp = RulesGroupByPorts(de_ctx, IPPROTO_UDP, SIG_FLAG_TOCLIENT);

/* Setup the other IP Protocols (so not TCP/UDP) */
RulesGroupByProto(de_ctx);
RulesGroupByIPProto(de_ctx);

/* now for every rule add the source group to our temp lists */
for (Signature *s = de_ctx->sig_list; s != NULL; s = s->next) {
Expand Down
17 changes: 8 additions & 9 deletions src/detect-engine-proto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
/* Copyright (C) 2007-2024 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
Expand All @@ -24,14 +24,13 @@
#ifndef SURICATA_DETECT_PROTO_H
#define SURICATA_DETECT_PROTO_H

#define DETECT_PROTO_ANY (1 << 0) /**< Indicate that given protocol
is considered as IP */
#define DETECT_PROTO_ONLY_PKT (1 << 1) /**< Indicate that we only care
about packet payloads. */
#define DETECT_PROTO_ONLY_STREAM (1 << 2) /**< Indicate that we only care
about stream payloads. */
#define DETECT_PROTO_IPV4 (1 << 3) /**< IPv4 only */
#define DETECT_PROTO_IPV6 (1 << 4) /**< IPv6 only */
// clang-format off
#define DETECT_PROTO_ANY BIT_U8(0) /**< Indicate that given protocol is considered as IP */
#define DETECT_PROTO_ONLY_PKT BIT_U8(1) /**< Indicate that we only care about packet payloads. */
#define DETECT_PROTO_ONLY_STREAM BIT_U8(2) /**< Indicate that we only care about stream payloads. */
#define DETECT_PROTO_IPV4 BIT_U8(3) /**< IPv4 only */
#define DETECT_PROTO_IPV6 BIT_U8(4) /**< IPv6 only */
// clang-format on

typedef struct DetectProto_ {
uint8_t proto[256/8]; /**< bit array for 256 protocol bits */
Expand Down
Loading