detect: factorize code for DetectSetupDirection (transactional rules)#13046
detect: factorize code for DetectSetupDirection (transactional rules)#13046catenacyber wants to merge 1 commit intoOISF:masterfrom
Conversation
Ticket: 7665 Instead of each keyword calling DetectSetupDirection, use a new flag SIGMATCH_SUPPORT_DIR so that DetectSetupDirection gets called, before parsing the rest of the keyword. Allows to support filesize keyword in transactional signatures
|
Information: QA ran without warnings. Pipeline 25721 |
catenacyber
changed the title
victorjulien
left a comment
victorjulien
left a comment
There was a problem hiding this comment.
some questions inline, also needs a rebase
| */ | ||
| static int DetectSetupDirection(Signature *s, char **str, bool only_dir) | ||
| { | ||
| if (strncmp(*str, "to_client", strlen("to_client")) == 0) { |
There was a problem hiding this comment.
this will also match to_client_toto I think. Will that be detected correctly?
There was a problem hiding this comment.
yes
After matching the prefix, we check further characters : optional spaces then comma or end of string
to_client_toto gets to line 887 SCLogError("expecting to_client [, other]");
| * | ||
| * \retval 0 on success, -1 on failure | ||
| */ | ||
| static int DetectSetupDirection(Signature *s, char **str, bool only_dir) |
There was a problem hiding this comment.
why not a single pointer char *str? We're not passing something back, are we?
There was a problem hiding this comment.
We're not passing something back, are we?
Yes, we are moving forward the string pointer, so that the keyword filesize only "sees" >100 when the signature had filesize: to_client, >100;
|
Rebased in #13120 |
3 participants
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7665
Describe changes:
This means adding facility to allow non-sticky buffer keywords
DetectSetupDirectioncall site toSigParseOptionsinstead of in each keyword and use a new flagSIGMATCH_SUPPORT_DIRDetectSetupDirectionnow takes a pointer to a string, and may move the string forward to allowfilesize: to_client, >100;so thatDetectFilesizeSetupgets called with ">100"SigMatchAppendSMToListnow setsonly_tcandonly_tsasDetectBufferSetActiveListalready does(3 commits may be better but debugging, I ended up squashing everything)
Now making transactional rules support other direction-ambiguous keywords should be one-liner like adding
SIGMATCH_SUPPORT_DIRtosigmatch_table[DETECT_KEYWORD].flagsSV_BRANCH=OISF/suricata-verify#2453
#13045 clean