--- /dev/null
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use super::{
+ DetectHelperTransformRegister, DetectSignatureAddTransform, InspectionBufferCheckAndExpand,
+ InspectionBufferLength, InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+};
+use crate::detect::SIGMATCH_NOOPT;
+use std::os::raw::{c_int, c_void};
+use std::ptr;
+
+static mut G_TRANSFORM_DOMAIN_ID: c_int = 0;
+static mut G_TRANSFORM_TLD_ID: c_int = 0;
+
+unsafe extern "C" fn domain_setup(
+ _de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
+) -> c_int {
+ return DetectSignatureAddTransform(s, G_TRANSFORM_DOMAIN_ID, ptr::null_mut());
+}
+
+fn get_domain(input: &[u8], output: &mut [u8]) -> u32 {
+ if let Some(domain) = psl::domain(input) {
+ let domain = domain.as_bytes();
+ let len = domain.len();
+ output[0..len].copy_from_slice(domain);
+ return domain.len() as u32;
+ }
+ 0
+}
+
+unsafe extern "C" fn domain_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
+ let input = InspectionBufferPtr(buffer);
+ let input_len = InspectionBufferLength(buffer);
+ if input.is_null() || input_len == 0 {
+ return;
+ }
+ let input = build_slice!(input, input_len as usize);
+
+ let output = InspectionBufferCheckAndExpand(buffer, input_len);
+ if output.is_null() {
+ // allocation failure
+ return;
+ }
+ let output = std::slice::from_raw_parts_mut(output, input_len as usize);
+
+ let output_len = get_domain(input, output);
+
+ InspectionBufferTruncate(buffer, output_len);
+}
+
+unsafe extern "C" fn tld_setup(
+ _de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
+) -> c_int {
+ return DetectSignatureAddTransform(s, G_TRANSFORM_TLD_ID, ptr::null_mut());
+}
+
+fn get_tld(input: &[u8], output: &mut [u8]) -> u32 {
+ if let Some(domain) = psl::domain(input) {
+ let tldb = domain.suffix().as_bytes();
+ let len = tldb.len();
+ let domain = tldb;
+ output[0..len].copy_from_slice(domain);
+ return domain.len() as u32;
+ }
+ 0
+}
+
+unsafe extern "C" fn tld_transform(_det: *mut c_void, buffer: *mut c_void, _ctx: *mut c_void) {
+ let input = InspectionBufferPtr(buffer);
+ let input_len = InspectionBufferLength(buffer);
+ if input.is_null() || input_len == 0 {
+ return;
+ }
+ let input = build_slice!(input, input_len as usize);
+
+ let output = InspectionBufferCheckAndExpand(buffer, input_len);
+ if output.is_null() {
+ // allocation failure
+ return;
+ }
+ let output = std::slice::from_raw_parts_mut(output, input_len as usize);
+
+ let output_len = get_tld(input, output);
+
+ InspectionBufferTruncate(buffer, output_len);
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn SCDetectTransformDomainRegister() {
+ let kw = SCTransformTableElmt {
+ name: b"domain\0".as_ptr() as *const libc::c_char,
+ desc: b"modify buffer to extract the domain\0".as_ptr() as *const libc::c_char,
+ url: b"/rules/transforms.html#domain\0".as_ptr() as *const libc::c_char,
+ Setup: domain_setup,
+ flags: SIGMATCH_NOOPT,
+ Transform: domain_transform,
+ Free: None,
+ TransformValidate: None,
+ };
+ unsafe {
+ G_TRANSFORM_DOMAIN_ID = DetectHelperTransformRegister(&kw);
+ if G_TRANSFORM_DOMAIN_ID < 0 {
+ SCLogWarning!("Failed registering transform domain");
+ }
+ }
+
+ let kw = SCTransformTableElmt {
+ name: b"tld\0".as_ptr() as *const libc::c_char,
+ desc: b"modify buffer to extract the tld\0".as_ptr() as *const libc::c_char,
+ url: b"/rules/transforms.html#tld\0".as_ptr() as *const libc::c_char,
+ Setup: tld_setup,
+ flags: SIGMATCH_NOOPT,
+ Transform: tld_transform,
+ Free: None,
+ TransformValidate: None,
+ };
+ unsafe {
+ G_TRANSFORM_TLD_ID = DetectHelperTransformRegister(&kw);
+ if G_TRANSFORM_TLD_ID < 0 {
+ SCLogWarning!("Failed registering transform tld");
+ }
+ }
+}
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Eric Leblond <el@stamus-networks.com>
- *
- * Implements the domain extraction transformation
- */
-
-#include "suricata-common.h"
-
-#include "detect.h"
-#include "detect-engine.h"
-#include "detect-engine-prefilter.h"
-#include "detect-parse.h"
-#include "detect-transform-domain.h"
-#include "detect-engine-build.h"
-
-#include "util-unittest.h"
-#include "util-print.h"
-#include "util-memrchr.h"
-#include "util-memcpy.h"
-#include "rust.h"
-
-static int DetectTransformDomainSetup(DetectEngineCtx *, Signature *, const char *);
-static int DetectTransformTLDSetup(DetectEngineCtx *, Signature *, const char *);
-#ifdef UNITTESTS
-static void DetectTransformDomainRegisterTests(void);
-static void DetectTransformTLDRegisterTests(void);
-#endif
-static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options);
-static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options);
-
-void DetectTransformDomainRegister(void)
-{
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].name = "domain";
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].desc = "modify buffer to extract the domain";
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].url = "/rules/transforms.html#domain";
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].Transform = TransformDomain;
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].Setup = DetectTransformDomainSetup;
-#ifdef UNITTESTS
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].RegisterTests = DetectTransformDomainRegisterTests;
-#endif
- sigmatch_table[DETECT_TRANSFORM_DOMAIN].flags |= SIGMATCH_NOOPT;
-
- sigmatch_table[DETECT_TRANSFORM_TLD].name = "tld";
- sigmatch_table[DETECT_TRANSFORM_TLD].desc = "modify buffer to extract the tld";
- sigmatch_table[DETECT_TRANSFORM_TLD].url = "/rules/transforms.html#tld";
- sigmatch_table[DETECT_TRANSFORM_TLD].Transform = TransformTLD;
- sigmatch_table[DETECT_TRANSFORM_TLD].Setup = DetectTransformTLDSetup;
-#ifdef UNITTESTS
- sigmatch_table[DETECT_TRANSFORM_TLD].RegisterTests = DetectTransformTLDRegisterTests;
-#endif
- sigmatch_table[DETECT_TRANSFORM_TLD].flags |= SIGMATCH_NOOPT;
-}
-
-/**
- * \internal
- * \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent
- * \param det_ctx detection engine ctx
- * \param s signature
- * \param nullstr should be null
- * \retval 0 ok
- * \retval -1 failure
- */
-static int DetectTransformDomainSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
-{
- SCEnter();
- int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_DOMAIN, NULL);
- SCReturnInt(r);
-}
-
-/**
- * \brief Return the domain, if any, in the last pattern match.
- *
- */
-static void TransformDomain(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options)
-{
- const size_t input_len = buffer->inspect_len;
- uint64_t output_len = 0;
-
- if (input_len) {
- uint8_t output[input_len];
-
- bool res = rs_get_domain(buffer->inspect, input_len, output, &output_len);
- if (res == true) {
- InspectionBufferCopy(buffer, output, output_len);
- }
- }
-}
-
-/**
- * \internal
- * \brief Extract the dotprefix, if any, the last pattern match, either content or uricontent
- * \param det_ctx detection engine ctx
- * \param s signature
- * \param nullstr should be null
- * \retval 0 ok
- * \retval -1 failure
- */
-static int DetectTransformTLDSetup(DetectEngineCtx *de_ctx, Signature *s, const char *nullstr)
-{
- SCEnter();
- int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_TLD, NULL);
- SCReturnInt(r);
-}
-
-/**
- * \brief Return the domain, if any, in the last pattern match.
- *
- */
-static void TransformTLD(DetectEngineThreadCtx *ctx, InspectionBuffer *buffer, void *options)
-{
- const size_t input_len = buffer->inspect_len;
- uint64_t output_len = 0;
-
- if (input_len) {
- uint8_t output[input_len];
-
- bool res = rs_get_tld(buffer->inspect, input_len, output, &output_len);
- if (res == true) {
- InspectionBufferCopy(buffer, output, output_len);
- }
- }
-}
-
-#ifdef UNITTESTS
-static int DetectTransformDomainTest01(void)
-{
- const uint8_t *input = (const uint8_t *)"www.example.com";
- uint32_t input_len = strlen((char *)input);
-
- const char *result = "example.com";
- uint32_t result_len = strlen((char *)result);
-
- InspectionBuffer buffer;
- InspectionBufferInit(&buffer, input_len);
- InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- TransformDomain(NULL, &buffer, NULL);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- FAIL_IF_NOT(buffer.inspect_len == result_len);
- FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
- InspectionBufferFree(&buffer);
- PASS;
-}
-
-static int DetectTransformDomainTest02(void)
-{
- const uint8_t *input = (const uint8_t *)"hello.example.co.uk";
- uint32_t input_len = strlen((char *)input);
-
- const char *result = "example.co.uk";
- uint32_t result_len = strlen((char *)result);
-
- InspectionBuffer buffer;
- InspectionBufferInit(&buffer, input_len);
- InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- TransformDomain(NULL, &buffer, NULL);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- FAIL_IF_NOT(buffer.inspect_len == result_len);
- FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
- InspectionBufferFree(&buffer);
- PASS;
-}
-
-static int DetectTransformDomainTest03(void)
-{
- const char rule[] =
- "alert dns any any -> any any (dns.query; domain; content:\"google.com\"; sid:1;)";
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx = NULL;
- memset(&th_v, 0, sizeof(th_v));
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- FAIL_IF_NULL(de_ctx);
- Signature *s = DetectEngineAppendSig(de_ctx, rule);
- FAIL_IF_NULL(s);
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
- PASS;
-}
-
-static void DetectTransformDomainRegisterTests(void)
-{
- UtRegisterTest("DetectTransformDomainTest01", DetectTransformDomainTest01);
- UtRegisterTest("DetectTransformDomainTest02", DetectTransformDomainTest02);
- UtRegisterTest("DetectTransformDomainTest03", DetectTransformDomainTest03);
-}
-
-static int DetectTransformTLDTest01(void)
-{
- const uint8_t *input = (const uint8_t *)"www.example.com";
- uint32_t input_len = strlen((char *)input);
-
- const char *result = "com";
- uint32_t result_len = strlen((char *)result);
-
- InspectionBuffer buffer;
- InspectionBufferInit(&buffer, input_len);
- InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- TransformTLD(NULL, &buffer, NULL);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- FAIL_IF_NOT(buffer.inspect_len == result_len);
- FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
- InspectionBufferFree(&buffer);
- PASS;
-}
-
-static int DetectTransformTLDTest02(void)
-{
- const uint8_t *input = (const uint8_t *)"hello.example.co.uk";
- uint32_t input_len = strlen((char *)input);
-
- const char *result = "co.uk";
- uint32_t result_len = strlen((char *)result);
-
- InspectionBuffer buffer;
- InspectionBufferInit(&buffer, input_len);
- InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- TransformTLD(NULL, &buffer, NULL);
- PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
- FAIL_IF_NOT(buffer.inspect_len == result_len);
- FAIL_IF_NOT(strncmp(result, (const char *)buffer.inspect, result_len) == 0);
- InspectionBufferFree(&buffer);
- PASS;
-}
-
-static int DetectTransformTLDTest03(void)
-{
- const char rule[] = "alert dns any any -> any any (dns.query; tld; content:\"com\"; sid:1;)";
- ThreadVars th_v;
- DetectEngineThreadCtx *det_ctx = NULL;
- memset(&th_v, 0, sizeof(th_v));
-
- DetectEngineCtx *de_ctx = DetectEngineCtxInit();
- FAIL_IF_NULL(de_ctx);
- Signature *s = DetectEngineAppendSig(de_ctx, rule);
- FAIL_IF_NULL(s);
- SigGroupBuild(de_ctx);
- DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
- DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
- DetectEngineCtxFree(de_ctx);
- PASS;
-}
-
-static void DetectTransformTLDRegisterTests(void)
-{
- UtRegisterTest("DetectTransformTLDTest01", DetectTransformTLDTest01);
- UtRegisterTest("DetectTransformTLDTest02", DetectTransformTLDTest02);
- UtRegisterTest("DetectTransformTLDTest03", DetectTransformTLDTest03);
-}
-#endif
projects / thirdparty / suricata.git / commitdiff
