23374838686

Committed 21 Mar 2026 07:29AM UTC coverage: 59.341% (-20.0%) from 79.315%

Build # 23374838686

Build Type

Pull #15075

github

Committed by

web-flow

Commit Message

Merge 90b4e834f into 6587e363a

Pull Request Pull Request #15075: Stack 8001 v16.4

Coverage Stats

38 of 70 new or added lines in 10 files covered. (54.29%)

34165 existing lines in 563 files now uncovered.

119621 of 201584 relevant lines covered (59.34%)

650666.92 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

73.17

/src/detect-vlan.c

/* Copyright (C) 2024 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

#include "detect-vlan.h"
#include "detect-engine-uint.h"
#include "detect-parse.h"
#include "rust.h"

static void DetectVlanIdFree(DetectEngineCtx *de_ctx, void *ptr)
{
    SCDetectVlanIdFree(ptr);
}

static int DetectVlanIdSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
{
    SigMatchCtx *vdata = SCDetectVlanIdParse(rawstr);
    if (vdata == NULL) {
        SCLogError("vlan id invalid %s", rawstr);
        return -1;
    }

    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_VLAN_ID, vdata, DETECT_SM_LIST_MATCH) == NULL) {
        DetectVlanIdFree(de_ctx, vdata);
        return -1;
    }
    s->flags |= SIG_FLAG_REQUIRE_PACKET;

    return 0;
}

static void PrefilterPacketVlanIdMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
{
    const PrefilterPacketHeaderCtx *ctx = pectx;

    DetectVlanIdDataPrefilter vdata;
    vdata.du16.mode = ctx->v1.u8[0];
    vdata.layer = ctx->v1.u8[1];
    vdata.du16.arg1 = ctx->v1.u16[2];
    vdata.du16.arg2 = ctx->v1.u16[3];

    if (SCDetectVlanIdPrefilterMatch(p->vlan_idx, p->vlan_id, &vdata)) {
        PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
    }
}

static void PrefilterPacketVlanIdSet(PrefilterPacketHeaderValue *v, void *smctx)
{
    const DetectVlanIdDataPrefilter a = SCDetectVlanIdPrefilter(smctx);
    v->u8[0] = a.du16.mode;
    v->u8[1] = a.layer;
    v->u16[2] = a.du16.arg1;
    v->u16[3] = a.du16.arg2;
}

static bool PrefilterPacketVlanIdCompare(PrefilterPacketHeaderValue v, void *smctx)
{
    const DetectVlanIdDataPrefilter a = SCDetectVlanIdPrefilter(smctx);
    if (v.u8[0] == a.du16.mode && v.u8[1] == a.layer && v.u16[2] == a.du16.arg1 &&
            v.u16[3] == a.du16.arg2)
        return true;
    return false;
}

static int PrefilterSetupVlanId(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_VLAN_ID, SIG_MASK_REQUIRE_REAL_PKT,
            PrefilterPacketVlanIdSet, PrefilterPacketVlanIdCompare, PrefilterPacketVlanIdMatch);
}

static bool PrefilterVlanIdIsPrefilterable(const Signature *s)
{
    const SigMatch *sm;
    for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) {
        if (sm->type == DETECT_VLAN_ID) {
            return SCDetectVlanIdPrefilterable(sm->ctx);
        }
    }
    return false;
}

static int DetectVlanIdMatch(
        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
{
    return SCDetectVlanIdMatch(p->vlan_idx, p->vlan_id, ctx);
}
void DetectVlanIdRegister(void)
{
    sigmatch_table[DETECT_VLAN_ID].name = "vlan.id";
    sigmatch_table[DETECT_VLAN_ID].desc = "match vlan id";
    sigmatch_table[DETECT_VLAN_ID].url = "/rules/vlan-keywords.html#vlan-id";
    sigmatch_table[DETECT_VLAN_ID].Match = DetectVlanIdMatch;
    sigmatch_table[DETECT_VLAN_ID].Setup = DetectVlanIdSetup;
    sigmatch_table[DETECT_VLAN_ID].Free = DetectVlanIdFree;
    sigmatch_table[DETECT_VLAN_ID].flags = SIGMATCH_INFO_UINT16 | SIGMATCH_INFO_MULTI_UINT;
    sigmatch_table[DETECT_VLAN_ID].SupportsPrefilter = PrefilterVlanIdIsPrefilterable;
    sigmatch_table[DETECT_VLAN_ID].SetupPrefilter = PrefilterSetupVlanId;
}

static int DetectVlanLayersMatch(
        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
{
    uint8_t nb = p->vlan_idx;

    const DetectU8Data *du8 = (const DetectU8Data *)ctx;
    return DetectU8Match(nb, du8);
}

static void DetectVlanLayersFree(DetectEngineCtx *de_ctx, void *ptr)
{
    SCDetectU8Free(ptr);
}

static int DetectVlanLayersSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
{
    DetectU8Data *du8 = DetectU8Parse(rawstr);

    if (du8 == NULL) {
        SCLogError("vlan layers invalid %s", rawstr);
        return -1;
    }

    if (du8->arg1 > VLAN_MAX_LAYERS || du8->arg2 > VLAN_MAX_LAYERS) {
        SCLogError("number of layers out of range %s", rawstr);
        DetectVlanLayersFree(de_ctx, du8);
        return -1;
    }

    if (SCSigMatchAppendSMToList(
                de_ctx, s, DETECT_VLAN_LAYERS, (SigMatchCtx *)du8, DETECT_SM_LIST_MATCH) == NULL) {
        DetectVlanLayersFree(de_ctx, du8);
        return -1;
    }
    s->flags |= SIG_FLAG_REQUIRE_PACKET;

    return 0;
}

static void PrefilterPacketVlanLayersMatch(
        DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
{
    const PrefilterPacketHeaderCtx *ctx = pectx;

    DetectU8Data du8;
    du8.mode = ctx->v1.u8[0];
    du8.arg1 = ctx->v1.u8[1];
    du8.arg2 = ctx->v1.u8[2];

    if (DetectVlanLayersMatch(det_ctx, p, NULL, (const SigMatchCtx *)&du8)) {
        PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
    }
}

static int PrefilterSetupVlanLayers(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_VLAN_LAYERS, SIG_MASK_REQUIRE_REAL_PKT,
            PrefilterPacketU8Set, PrefilterPacketU8Compare, PrefilterPacketVlanLayersMatch);
}

static bool PrefilterVlanLayersIsPrefilterable(const Signature *s)
{
    return PrefilterIsPrefilterableById(s, DETECT_VLAN_LAYERS);
}

void DetectVlanLayersRegister(void)
{
    sigmatch_table[DETECT_VLAN_LAYERS].name = "vlan.layers";
    sigmatch_table[DETECT_VLAN_LAYERS].desc = "match number of vlan layers";
    sigmatch_table[DETECT_VLAN_LAYERS].url = "/rules/vlan-keywords.html#vlan-layers";
    sigmatch_table[DETECT_VLAN_LAYERS].Match = DetectVlanLayersMatch;
    sigmatch_table[DETECT_VLAN_LAYERS].Setup = DetectVlanLayersSetup;
    sigmatch_table[DETECT_VLAN_LAYERS].Free = DetectVlanLayersFree;
    sigmatch_table[DETECT_VLAN_LAYERS].SupportsPrefilter = PrefilterVlanLayersIsPrefilterable;
    sigmatch_table[DETECT_VLAN_LAYERS].SetupPrefilter = PrefilterSetupVlanLayers;
    sigmatch_table[DETECT_VLAN_LAYERS].flags = SIGMATCH_INFO_UINT8;
}

1	/* Copyright (C) 2024 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	#include "detect-vlan.h"
19	#include "detect-engine-uint.h"
20	#include "detect-parse.h"
21	#include "rust.h"
22
23	static void DetectVlanIdFree(DetectEngineCtx de_ctx, void ptr)
24	{	682✔
25	SCDetectVlanIdFree(ptr);	682✔
26	}	682✔
27
28	static int DetectVlanIdSetup(DetectEngineCtx de_ctx, Signature s, const char *rawstr)
29	{	759✔
30	SigMatchCtx *vdata = SCDetectVlanIdParse(rawstr);	759✔
31	if (vdata == NULL) {	759✔
32	SCLogError("vlan id invalid %s", rawstr);	77✔
33	return -1;	77✔
34	}	77✔
35
36	if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_VLAN_ID, vdata, DETECT_SM_LIST_MATCH) == NULL) {	682✔
37	DetectVlanIdFree(de_ctx, vdata);	×
38	return -1;	×
39	}	×
40	s->flags \|= SIG_FLAG_REQUIRE_PACKET;	682✔
41
42	return 0;	682✔
43	}	682✔
44
45	static void PrefilterPacketVlanIdMatch(DetectEngineThreadCtx det_ctx, Packet p, const void *pectx)
46	{	24✔
47	const PrefilterPacketHeaderCtx *ctx = pectx;	24✔
48
49	DetectVlanIdDataPrefilter vdata;	24✔
50	vdata.du16.mode = ctx->v1.u8[0];	24✔
51	vdata.layer = ctx->v1.u8[1];	24✔
52	vdata.du16.arg1 = ctx->v1.u16[2];	24✔
53	vdata.du16.arg2 = ctx->v1.u16[3];	24✔
54
55	if (SCDetectVlanIdPrefilterMatch(p->vlan_idx, p->vlan_id, &vdata)) {	24✔
56	PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);	13✔
57	}	13✔
58	}	24✔
59
60	static void PrefilterPacketVlanIdSet(PrefilterPacketHeaderValue v, void smctx)
61	{	226✔
62	const DetectVlanIdDataPrefilter a = SCDetectVlanIdPrefilter(smctx);	226✔
63	v->u8[0] = a.du16.mode;	226✔
64	v->u8[1] = a.layer;	226✔
65	v->u16[2] = a.du16.arg1;	226✔
66	v->u16[3] = a.du16.arg2;	226✔
67	}	226✔
68
69	static bool PrefilterPacketVlanIdCompare(PrefilterPacketHeaderValue v, void *smctx)
70	{	113✔
71	const DetectVlanIdDataPrefilter a = SCDetectVlanIdPrefilter(smctx);	113✔
72	if (v.u8[0] == a.du16.mode && v.u8[1] == a.layer && v.u16[2] == a.du16.arg1 &&	113✔
73	v.u16[3] == a.du16.arg2)	113✔
74	return true;	113✔
75	return false;	×
76	}	113✔
77
78	static int PrefilterSetupVlanId(DetectEngineCtx de_ctx, SigGroupHead sgh)
79	{	116✔
80	return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_VLAN_ID, SIG_MASK_REQUIRE_REAL_PKT,	116✔
81	PrefilterPacketVlanIdSet, PrefilterPacketVlanIdCompare, PrefilterPacketVlanIdMatch);	116✔
82	}	116✔
83
84	static bool PrefilterVlanIdIsPrefilterable(const Signature *s)
85	{	×
86	const SigMatch *sm;	×
87	for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) {	×
88	if (sm->type == DETECT_VLAN_ID) {	×
89	return SCDetectVlanIdPrefilterable(sm->ctx);	×
90	}	×
91	}	×
92	return false;	×
93	}	×
94
95	static int DetectVlanIdMatch(
96	DetectEngineThreadCtx det_ctx, Packet p, const Signature s, const SigMatchCtx ctx)
97	{	662✔
98	return SCDetectVlanIdMatch(p->vlan_idx, p->vlan_id, ctx);	662✔
99	}	662✔
100	void DetectVlanIdRegister(void)
101	{	3✔
102	sigmatch_table[DETECT_VLAN_ID].name = "vlan.id";	3✔
103	sigmatch_table[DETECT_VLAN_ID].desc = "match vlan id";	3✔
104	sigmatch_table[DETECT_VLAN_ID].url = "/rules/vlan-keywords.html#vlan-id";	3✔
105	sigmatch_table[DETECT_VLAN_ID].Match = DetectVlanIdMatch;	3✔
106	sigmatch_table[DETECT_VLAN_ID].Setup = DetectVlanIdSetup;	3✔
107	sigmatch_table[DETECT_VLAN_ID].Free = DetectVlanIdFree;	3✔
108	sigmatch_table[DETECT_VLAN_ID].flags = SIGMATCH_INFO_UINT16 \| SIGMATCH_INFO_MULTI_UINT;	3✔
109	sigmatch_table[DETECT_VLAN_ID].SupportsPrefilter = PrefilterVlanIdIsPrefilterable;	3✔
110	sigmatch_table[DETECT_VLAN_ID].SetupPrefilter = PrefilterSetupVlanId;	3✔
111	}	3✔
112
113	static int DetectVlanLayersMatch(
114	DetectEngineThreadCtx det_ctx, Packet p, const Signature s, const SigMatchCtx ctx)
115	{	129✔
116	uint8_t nb = p->vlan_idx;	129✔
117
118	const DetectU8Data du8 = (const DetectU8Data )ctx;	129✔
119	return DetectU8Match(nb, du8);	129✔
120	}	129✔
121
122	static void DetectVlanLayersFree(DetectEngineCtx de_ctx, void ptr)
123	{	56✔
124	SCDetectU8Free(ptr);	56✔
125	}	56✔
126
127	static int DetectVlanLayersSetup(DetectEngineCtx de_ctx, Signature s, const char *rawstr)
128	{	72✔
129	DetectU8Data *du8 = DetectU8Parse(rawstr);	72✔
130
131	if (du8 == NULL) {	72✔
132	SCLogError("vlan layers invalid %s", rawstr);	16✔
133	return -1;	16✔
134	}	16✔
135
136	if (du8->arg1 > VLAN_MAX_LAYERS \|\| du8->arg2 > VLAN_MAX_LAYERS) {	56✔
137	SCLogError("number of layers out of range %s", rawstr);	3✔
138	DetectVlanLayersFree(de_ctx, du8);	3✔
139	return -1;	3✔
140	}	3✔
141
142	if (SCSigMatchAppendSMToList(	53✔
143	de_ctx, s, DETECT_VLAN_LAYERS, (SigMatchCtx *)du8, DETECT_SM_LIST_MATCH) == NULL) {	53✔
144	DetectVlanLayersFree(de_ctx, du8);	×
145	return -1;	×
146	}	×
147	s->flags \|= SIG_FLAG_REQUIRE_PACKET;	53✔
148
149	return 0;	53✔
150	}	53✔
151
152	static void PrefilterPacketVlanLayersMatch(
153	DetectEngineThreadCtx det_ctx, Packet p, const void *pectx)
154	{	×
155	const PrefilterPacketHeaderCtx *ctx = pectx;	×
156
157	DetectU8Data du8;	×
158	du8.mode = ctx->v1.u8[0];	×
159	du8.arg1 = ctx->v1.u8[1];	×
160	du8.arg2 = ctx->v1.u8[2];	×
161
162	if (DetectVlanLayersMatch(det_ctx, p, NULL, (const SigMatchCtx *)&du8)) {	×
163	PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);	×
164	}	×
165	}	×
166
167	static int PrefilterSetupVlanLayers(DetectEngineCtx de_ctx, SigGroupHead sgh)
UNCOV 168	{	×
UNCOV 169	return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_VLAN_LAYERS, SIG_MASK_REQUIRE_REAL_PKT,	×
UNCOV 170	PrefilterPacketU8Set, PrefilterPacketU8Compare, PrefilterPacketVlanLayersMatch);	×
UNCOV 171	}	×
172
173	static bool PrefilterVlanLayersIsPrefilterable(const Signature *s)
174	{	×
175	return PrefilterIsPrefilterableById(s, DETECT_VLAN_LAYERS);	×
176	}	×
177
178	void DetectVlanLayersRegister(void)
179	{	3✔
180	sigmatch_table[DETECT_VLAN_LAYERS].name = "vlan.layers";	3✔
181	sigmatch_table[DETECT_VLAN_LAYERS].desc = "match number of vlan layers";	3✔
182	sigmatch_table[DETECT_VLAN_LAYERS].url = "/rules/vlan-keywords.html#vlan-layers";	3✔
183	sigmatch_table[DETECT_VLAN_LAYERS].Match = DetectVlanLayersMatch;	3✔
184	sigmatch_table[DETECT_VLAN_LAYERS].Setup = DetectVlanLayersSetup;	3✔
185	sigmatch_table[DETECT_VLAN_LAYERS].Free = DetectVlanLayersFree;	3✔
186	sigmatch_table[DETECT_VLAN_LAYERS].SupportsPrefilter = PrefilterVlanLayersIsPrefilterable;	3✔
187	sigmatch_table[DETECT_VLAN_LAYERS].SetupPrefilter = PrefilterSetupVlanLayers;	3✔
188	sigmatch_table[DETECT_VLAN_LAYERS].flags = SIGMATCH_INFO_UINT8;	3✔
189	}	3✔

OISF / suricata / 23374838686

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous