From 180885259717ec2d7ec2f99c2c6c43f25bef8337 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Fri, 30 Nov 2012 16:57:53 +0100
Subject: [PATCH] detect plugin: add helloworld example

---
 src/Makefile.am         |    1 +
 src/detect-helloworld.c |  294 +++++++++++++++++++++++++++++++++++++++++++++++
 src/detect-helloworld.h |   35 ++++++
 src/detect.c            |    2 +
 src/detect.h            |    2 +
 5 files changed, 334 insertions(+)
 create mode 100644 src/detect-helloworld.c
 create mode 100644 src/detect-helloworld.h

diff --git a/src/Makefile.am b/src/Makefile.am
index 0910e06..38a82e1 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -120,6 +120,7 @@ detect-fragbits.c detect-fragbits.h \
 detect-fragoffset.c detect-fragoffset.h \
 detect-ftpbounce.c detect-ftpbounce.h \
 detect-gid.c detect-gid.h \
+detect-helloworld.c detect-helloworld.h \
 detect-http-client-body.c detect-http-client-body.h \
 detect-http-cookie.c detect-http-cookie.h \
 detect-http-header.c detect-http-header.h \
diff --git a/src/detect-helloworld.c b/src/detect-helloworld.c
new file mode 100644
index 0000000..5336f2d
--- /dev/null
+++ b/src/detect-helloworld.c
@@ -0,0 +1,294 @@
+/* Copyright (C) 2012 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Yourname <youremail@yourdomain>
+ *
+ * Short description of the purpose of this keyword
+ */
+
+#include "suricata-common.h"
+#include "util-unittest.h"
+
+#include "detect-parse.h"
+#include "detect-engine.h"
+
+#include "detect-helloworld.h"
+
+/**
+ * \brief Regex for parsing our keyword options
+ */
+#define PARSE_REGEX  "^\\s*([0-9]+)?\\s*,s*([0-9]+)?\\s*$"
+
+static pcre *parse_regex;
+static pcre_extra *parse_regex_study;
+
+/* prototypes */
+static int DetectHelloWorldMatch (ThreadVars *, DetectEngineThreadCtx *,
+        Packet *, Signature *, SigMatch *);
+static int DetectHelloWorldSetup (DetectEngineCtx *, Signature *, char *);
+static void DetectHelloWorldFree (void *);
+static void DetectHelloWorldRegisterTests (void);
+
+/**
+ * \brief Registration function for helloworld: keyword
+ */
+void DetectHelloWorldRegister(void) {
+    sigmatch_table[DETECT_HELLOWORLD].name = "helloworld";
+    sigmatch_table[DETECT_HELLOWORLD].desc = "<todo>";
+    sigmatch_table[DETECT_HELLOWORLD].url = "<todo>";
+    sigmatch_table[DETECT_HELLOWORLD].Match = DetectHelloWorldMatch;
+    sigmatch_table[DETECT_HELLOWORLD].Setup = DetectHelloWorldSetup;
+    sigmatch_table[DETECT_HELLOWORLD].Free = DetectHelloWorldFree;
+    sigmatch_table[DETECT_HELLOWORLD].RegisterTests = DetectHelloWorldRegisterTests;
+
+    const char *eb;
+    int eo;
+    int opts = 0;
+
+    parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
+    if (parse_regex == NULL) {
+        SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb);
+        goto error;
+    }
+
+    parse_regex_study = pcre_study(parse_regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
+        goto error;
+    }
+    return;
+
+error:
+    if (parse_regex != NULL)
+        SCFree(parse_regex);
+    if (parse_regex_study != NULL)
+        SCFree(parse_regex_study);
+    return;
+}
+
+/**
+ * \brief This function is used to match HELLOWORLD rule option on a packet
+ *
+ * \param t pointer to thread vars
+ * \param det_ctx pointer to the pattern matcher thread
+ * \param p pointer to the current packet
+ * \param m pointer to the sigmatch with context that we will cast into DetectHelloWorldData
+ *
+ * \retval 0 no match
+ * \retval 1 match
+ */
+int DetectHelloWorldMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *m)
+{
+    int ret = 0;
+    DetectHelloWorldData *helloworldd = (DetectHelloWorldData *) m->ctx;
+#if 0
+    if (PKT_IS_PSEUDOPKT(p)) {
+        /* fake pkt */
+    }
+
+    if (PKT_IS_IPV4(p)) {
+        /* ipv4 pkt */
+    } else if (PKT_IS_IPV6(p)) {
+        /* ipv6 pkt */
+    } else {
+        SCLogDebug("pcket is of not IPv4 or IPv6");
+        return ret;
+    }
+#endif
+    /* packet payload access */
+    if (p->payload != NULL && p->payload_len > 0) {
+        if (helloworldd->helloworld1 == p->payload[0] &&
+            helloworldd->helloworld2 == p->payload[p->payload_len - 1])
+        {
+            ret = 1;
+        }
+    }
+
+    return ret;
+}
+
+/**
+ * \brief This function is used to parse helloworld options passed via helloworld: keyword
+ *
+ * \param helloworldstr Pointer to the user provided helloworld options
+ *
+ * \retval helloworldd pointer to DetectHelloWorldData on success
+ * \retval NULL on failure
+ */
+
+DetectHelloWorldData *DetectHelloWorldParse (char *helloworldstr)
+{
+    DetectHelloWorldData *helloworldd = NULL;
+    char *arg1 = NULL;
+    char *arg2 = NULL;
+#define MAX_SUBSTRINGS 30
+    int ret = 0, res = 0;
+    int ov[MAX_SUBSTRINGS];
+
+    ret = pcre_exec(parse_regex, parse_regex_study, helloworldstr, strlen(helloworldstr), 0, 0, ov, MAX_SUBSTRINGS);
+    if (ret != 3) {
+        SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 "", ret);
+        goto error;
+    }
+    const char *str_ptr;
+
+    res = pcre_get_substring((char *) helloworldstr, ov, MAX_SUBSTRINGS, 1, &str_ptr);
+    if (res < 0) {
+        SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
+        goto error;
+    }
+    arg1 = (char *) str_ptr;
+    SCLogDebug("Arg1 \"%s\"", arg1);
+
+    if (ret >= 3) {
+        res = pcre_get_substring((char *) helloworldstr, ov, MAX_SUBSTRINGS, 2, &str_ptr);
+        if (res < 0) {
+            SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
+            goto error;
+        }
+        arg2 = (char *) str_ptr;
+        SCLogDebug("Arg2 \"%s\"", arg2);
+
+    }
+
+    helloworldd = SCMalloc(sizeof (DetectHelloWorldData));
+    if (unlikely(helloworldd == NULL))
+        goto error;
+    helloworldd->helloworld1 = (uint8_t)atoi(arg1);
+    helloworldd->helloworld2 = (uint8_t)atoi(arg2);
+
+    SCFree(arg1);
+    SCFree(arg2);
+    return helloworldd;
+
+error:
+    if (helloworldd)
+        SCFree(helloworldd);
+    if (arg1)
+        SCFree(arg1);
+    if (arg2)
+        SCFree(arg2);
+    return NULL;
+}
+
+/**
+ * \brief this function is used to ahelloworldd the parsed helloworld data into the current signature
+ *
+ * \param de_ctx pointer to the Detection Engine Context
+ * \param s pointer to the Current Signature
+ * \param helloworldstr pointer to the user provided helloworld options
+ *
+ * \retval 0 on Success
+ * \retval -1 on Failure
+ */
+static int DetectHelloWorldSetup (DetectEngineCtx *de_ctx, Signature *s, char *helloworldstr)
+{
+    DetectHelloWorldData *helloworldd = NULL;
+    SigMatch *sm = NULL;
+
+    helloworldd = DetectHelloWorldParse(helloworldstr);
+    if (helloworldd == NULL)
+        goto error;
+
+    sm = SigMatchAlloc();
+    if (sm == NULL)
+        goto error;
+
+    sm->type = DETECT_HELLOWORLD;
+    sm->ctx = (void *)helloworldd;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+    s->flags |= SIG_FLAG_REQUIRE_PACKET;
+
+    return 0;
+
+error:
+    if (helloworldd != NULL)
+        DetectHelloWorldFree(helloworldd);
+    if (sm != NULL)
+        SCFree(sm);
+    return -1;
+}
+
+/**
+ * \brief this function will free memory associated with DetectHelloWorldData
+ *
+ * \param ptr pointer to DetectHelloWorldData
+ */
+void DetectHelloWorldFree(void *ptr) {
+    DetectHelloWorldData *helloworldd = (DetectHelloWorldData *)ptr;
+    SCFree(helloworldd);
+}
+
+#ifdef UNITTESTS
+
+/**
+ * \test description of the test
+ */
+
+static int DetectHelloWorldParseTest01 (void) {
+    DetectHelloWorldData *helloworldd = NULL;
+    uint8_t res = 0;
+
+    helloworldd = DetectHelloWorldParse("1,10");
+    if (helloworldd != NULL) {
+        if (helloworldd->helloworld1 == 1 && helloworldd->helloworld2 == 10)
+            res = 1;
+
+        DetectHelloWorldFree(helloworldd);
+    }
+
+    return res;
+}
+
+static int DetectHelloWorldSignatureTest01 (void) {
+    uint8_t res = 0;
+
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    if (de_ctx == NULL)
+        goto end;
+
+    Signature *sig = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (helloworld:1,10; sid:1; rev:1;)");
+    if (sig == NULL) {
+        printf("parsing signature failed: ");
+        goto end;
+    }
+
+    /* if we get here, all conditions pass */
+    res = 1;
+end:
+    if (de_ctx != NULL)
+        DetectEngineCtxFree(de_ctx);
+    return res;
+}
+
+#endif /* UNITTESTS */
+
+/**
+ * \brief this function registers unit tests for DetectHelloWorld
+ */
+void DetectHelloWorldRegisterTests(void) {
+#ifdef UNITTESTS
+    UtRegisterTest("DetectHelloWorldParseTest01",
+            DetectHelloWorldParseTest01, 1);
+    UtRegisterTest("DetectHelloWorldSignatureTest01",
+            DetectHelloWorldSignatureTest01, 1);
+#endif /* UNITTESTS */
+}
diff --git a/src/detect-helloworld.h b/src/detect-helloworld.h
new file mode 100644
index 0000000..c9edf37
--- /dev/null
+++ b/src/detect-helloworld.h
@@ -0,0 +1,35 @@
+/* Copyright (C) 2012 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Yourname <youremail@yourdomain>
+ */
+
+#ifndef _DETECT_HELLOWORLD_H
+#define	_DETECT_HELLOWORLD_H
+
+typedef struct DetectHelloWorldData_ {
+    uint8_t helloworld1;   /**< first value */
+    uint8_t helloworld2;   /**< second value */
+} DetectHelloWorldData;
+
+void DetectHelloWorldRegister(void);
+
+#endif	/* _DETECT_HELLOWORLD_H */
+
diff --git a/src/detect.c b/src/detect.c
index c9224d6..16b7f91 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -144,6 +144,7 @@
 #include "detect-app-layer-event.h"
 #include "detect-luajit.h"
 #include "detect-iprep.h"
+#include "detect-helloworld.h"
 
 #include "util-rule-vars.h"
 
@@ -4781,6 +4782,7 @@ void SigTableSetup(void) {
     DetectHttpUARegister();
     DetectLuajitRegister();
     DetectIPRepRegister();
+    DetectHelloWorldRegister();
 
     uint8_t i = 0;
     for (i = 0; i < DETECT_TBLSIZE; i++) {
diff --git a/src/detect.h b/src/detect.h
index 3ebcb8a..5dca075 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -1097,6 +1097,8 @@ enum {
     DETECT_LUAJIT,
     DETECT_IPREP,
 
+    DETECT_HELLOWORLD,
+
     /* make sure this stays last */
     DETECT_TBLSIZE,
 };
-- 
1.7.10.4

