From: Mats Klepsland Date: Fri, 16 Mar 2018 21:00:19 +0000 (+0100) Subject: detect-tls-cert-issuer: use *_Register2 API functions X-Git-Tag: suricata-4.1.0-beta1~6 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b1dd41c9cda6855a8e9e947ed6feef1b30f43f7a;p=thirdparty%2Fsuricata.git detect-tls-cert-issuer: use *_Register2 API functions Use *_Register2 API functions when registering 'tls_cert_issuer' detection keyword. --- diff --git a/src/detect-engine-tls.c b/src/detect-engine-tls.c index fa6d76410a..a72925e811 100644 --- a/src/detect-engine-tls.c +++ b/src/detect-engine-tls.c @@ -123,82 +123,6 @@ int DetectEngineInspectTlsSni(ThreadVars *tv, return cnt; } -/** \brief TLS Issuer Mpm prefilter callback - * - * \param det_ctx detection engine thread ctx - * \param p packet to inspect - * \param f flow to inspect - * \param txv tx to inspect - * \param pectx inspection context - */ -static void PrefilterTxTlsIssuer(DetectEngineThreadCtx *det_ctx, const void *pectx, - Packet *p, Flow *f, void *txv, - const uint64_t idx, const uint8_t flags) -{ - SCEnter(); - - const MpmCtx *mpm_ctx = (MpmCtx *)pectx; - SSLState *ssl_state = f->alstate; - - if (ssl_state->server_connp.cert0_issuerdn == NULL) - return; - - const uint8_t *buffer = (const uint8_t *)ssl_state->server_connp.cert0_issuerdn; - const uint32_t buffer_len = strlen(ssl_state->server_connp.cert0_issuerdn); - - if (buffer_len >= mpm_ctx->minlen) { - (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, - &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); - } -} - -int PrefilterTxTlsIssuerRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx) -{ - SCEnter(); - - return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxTlsIssuer, - ALPROTO_TLS, TLS_STATE_CERT_READY, - mpm_ctx, NULL, "tls_cert_issuer"); -} - -/** \brief Do the content inspection and validation for a signature - * - * \param de_ctx Detection engine context - * \param det_ctx Detection engine thread context - * \param s Signature to inspect - * \param sm SigMatch to inspect - * \param f Flow - * \param flags App layer flags - * \param state App layer state - * - * \retval 0 No match - * \retval 1 Match - */ -int DetectEngineInspectTlsIssuer(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) -{ - uint8_t *buffer; - uint32_t buffer_len; - int cnt = 0; - - SSLState *ssl_state = (SSLState *)alstate; - - if (ssl_state->server_connp.cert0_issuerdn == NULL) - return 0; - - buffer = (uint8_t *)ssl_state->server_connp.cert0_issuerdn; - buffer_len = strlen(ssl_state->server_connp.cert0_issuerdn); - - cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, smd, - f, buffer, buffer_len, 0, DETECT_CI_FLAGS_SINGLE, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); - - return cnt; -} - /** \brief TLS Subject Mpm prefilter callback * * \param det_ctx detection engine thread ctx diff --git a/src/detect-engine-tls.h b/src/detect-engine-tls.h index 14d2dd4166..7f6004ba2a 100644 --- a/src/detect-engine-tls.h +++ b/src/detect-engine-tls.h @@ -25,8 +25,6 @@ int PrefilterTxTlsSniRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx); -int PrefilterTxTlsIssuerRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxTlsSubjectRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx); int PrefilterTxTlsSerialRegister(DetectEngineCtx *de_ctx, @@ -37,11 +35,6 @@ int DetectEngineInspectTlsSni(ThreadVars *tv, const Signature *s, const SigMatchData *smd, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); -int DetectEngineInspectTlsIssuer(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id); - int DetectEngineInspectTlsSubject(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c index 8b7f57494c..6edcf1d729 100644 --- a/src/detect-tls-cert-issuer.c +++ b/src/detect-tls-cert-issuer.c @@ -32,7 +32,7 @@ #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" -#include "detect-engine-tls.h" +#include "detect-engine-prefilter.h" #include "detect-content.h" #include "detect-pcre.h" @@ -56,6 +56,10 @@ static int DetectTlsIssuerSetup(DetectEngineCtx *, Signature *, const char *); static void DetectTlsIssuerRegisterTests(void); +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, + Flow *_f, const uint8_t _flow_flags, + void *txv, const int list_id); static int g_tls_cert_issuer_buffer_id = 0; /** @@ -73,12 +77,16 @@ void DetectTlsIssuerRegister(void) sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_NOOPT; - DetectAppLayerMpmRegister("tls_cert_issuer", SIG_FLAG_TOCLIENT, 2, - PrefilterTxTlsIssuerRegister); + DetectAppLayerInspectEngineRegister2("tls_cert_issuer", ALPROTO_TLS, + SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY, + DetectEngineInspectBufferGeneric, GetData); - DetectAppLayerInspectEngineRegister("tls_cert_issuer", - ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY, - DetectEngineInspectTlsIssuer); + DetectAppLayerMpmRegister2("tls_cert_issuer", SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, + TLS_STATE_CERT_READY); + + DetectBufferTypeSetDescriptionByName("tls_cert_issuer", + "TLS certificate issuer"); g_tls_cert_issuer_buffer_id = DetectBufferTypeGetByName("tls_cert_issuer"); } @@ -95,11 +103,35 @@ void DetectTlsIssuerRegister(void) */ static int DetectTlsIssuerSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - s->init_data->list = g_tls_cert_issuer_buffer_id; + DetectBufferSetActiveList(s, g_tls_cert_issuer_buffer_id); s->alproto = ALPROTO_TLS; return 0; } +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + BUG_ON(det_ctx->inspect_buffers == NULL); + InspectionBuffer *buffer = &det_ctx->inspect_buffers[list_id]; + + if (buffer->inspect == NULL) { + SSLState *ssl_state = (SSLState *)_f->alstate; + + if (ssl_state->server_connp.cert0_issuerdn == NULL) { + return NULL; + } + + const uint32_t data_len = strlen(ssl_state->server_connp.cert0_issuerdn); + const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_issuerdn; + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + #ifdef UNITTESTS /**