next/648/20241128/v1

doc/userguide/rules/payload-keywords.rst

@@ -274,6 +274,27 @@ You can also use the negation (!) before isdataat.
 
 .. image:: payload-keywords/isdataat1.png
 
+absent
+------
+
+The keyword ``absent`` checks that a sticky buffer does not exist.
+It can be used without any argument to match only on absent buffer :
+
+Example of ``absent`` in a rule:
+
+.. container:: example-rule
+
+   alert http any any -> any any (msg:"HTTP request without referer";  :example-rule-emphasis:`http.referer; absent;` sid:1; rev:1;)
+
+
+It can take an argument "or_else" to match on absent buffer or on what comes next such as negated content, for instance :
+
+.. container:: example-rule
+
+   alert http any any -> any any (msg:"HTTP request without referer";  :example-rule-emphasis:`http.referer; absent: or_else;` content: !"abc"; sid:1; rev:1;)
+
+For files (ie ``file.data``), absent means there are no files in the transaction.
+
 bsize
 -----
 

src/Makefile.am

@@ -541,7 +541,9 @@ noinst_HEADERS = \
 	util-profiling.h \
 	util-profiling-locks.h \
 	util-proto-name.h \
-	util-radix-tree.h \
+	util-radix-tree-common.h \
+	util-radix4-tree.h \
+	util-radix6-tree.h \
 	util-random.h \
 	util-reference-config.h \
 	util-rohash.h \
@@ -1088,7 +1090,8 @@ libsuricata_c_a_SOURCES = \
 	util-profiling-rulegroups.c \
 	util-profiling-rules.c \
 	util-proto-name.c \
-	util-radix-tree.c \
+	util-radix4-tree.c \
+	util-radix6-tree.c \
 	util-random.c \
 	util-reference-config.c \
 	util-rohash.c \

src/app-layer-htp.c

@@ -76,7 +76,16 @@
 //#define PRINT
 
 /** Fast lookup tree (radix) for the various HTP configurations */
-static SCRadixTree *cfgtree;
+static struct HTPConfigTree {
+    SCRadix4Tree ipv4;
+    SCRadix6Tree ipv6;
+} cfgtree = {
+    .ipv4 = SC_RADIX4_TREE_INITIALIZER,
+    .ipv6 = SC_RADIX6_TREE_INITIALIZER,
+};
+SCRadix4Config htp_radix4_cfg = { NULL, NULL };
+SCRadix6Config htp_radix6_cfg = { NULL, NULL };
+
 /** List of HTP configurations. */
 static HTPCfgRec cfglist;
 
@@ -791,11 +800,12 @@ static int Setup(Flow *f, HtpState *hstate)
 
     if (FLOW_IS_IPV4(f)) {
         SCLogDebug("Looking up HTP config for ipv4 %08x", *GET_IPV4_DST_ADDR_PTR(f));
-        (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)GET_IPV4_DST_ADDR_PTR(f), cfgtree, &user_data);
+        (void)SCRadix4TreeFindBestMatch(
+                &cfgtree.ipv4, (uint8_t *)GET_IPV4_DST_ADDR_PTR(f), &user_data);
     }
     else if (FLOW_IS_IPV6(f)) {
         SCLogDebug("Looking up HTP config for ipv6");
-        (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)GET_IPV6_DST_ADDR(f), cfgtree, &user_data);
+        (void)SCRadix6TreeFindBestMatch(&cfgtree.ipv6, (uint8_t *)GET_IPV6_DST_ADDR(f), &user_data);
     }
     else {
         SCLogError("unknown address family, bug!");
@@ -1659,8 +1669,6 @@ void HTPFreeConfig(void)
     }
 
     HTPCfgRec *nextrec = cfglist.next;
-    SCRadixReleaseRadixTree(cfgtree);
-    cfgtree = NULL;
     htp_config_destroy(cfglist.cfg);
     while (nextrec != NULL) {
         HTPCfgRec *htprec = nextrec;
@@ -1669,6 +1677,8 @@ void HTPFreeConfig(void)
         htp_config_destroy(htprec->cfg);
         SCFree(htprec);
     }
+    SCRadix4TreeRelease(&cfgtree.ipv4, &htp_radix4_cfg);
+    SCRadix6TreeRelease(&cfgtree.ipv6, &htp_radix6_cfg);
     SCReturn;
 }
 
@@ -2162,40 +2172,34 @@ static void HTPConfigSetDefaultsPhase2(const char *name, HTPCfgRec *cfg_prec)
     htp_config_register_request_line(cfg_prec->cfg, HTPCallbackRequestLine);
 }
 
-static void HTPConfigParseParameters(HTPCfgRec *cfg_prec, ConfNode *s,
-                                     SCRadixTree *tree)
+static void HTPConfigParseParameters(HTPCfgRec *cfg_prec, ConfNode *s, struct HTPConfigTree *tree)
 {
     if (cfg_prec == NULL || s == NULL || tree == NULL)
         return;
 
     ConfNode *p = NULL;
 
     /* Default Parameters */
-    TAILQ_FOREACH(p, &s->head, next) {
-
+    TAILQ_FOREACH (p, &s->head, next) {
         if (strcasecmp("address", p->name) == 0) {
             ConfNode *pval;
             /* Addresses */
             TAILQ_FOREACH(pval, &p->head, next) {
-                SCLogDebug("LIBHTP server %s: %s=%s", s->name, p->name,
-                           pval->val);
-
+                SCLogDebug("LIBHTP server %s: %s=%s", s->name, p->name, pval->val);
                 /* IPV6 or IPV4? */
                 if (strchr(pval->val, ':') != NULL) {
                     SCLogDebug("LIBHTP adding ipv6 server %s at %s: %p",
                                s->name, pval->val, cfg_prec->cfg);
-                    if (!SCRadixAddKeyIPV6String(pval->val, tree, cfg_prec)) {
-                        SCLogWarning("LIBHTP failed to "
-                                     "add ipv6 server %s, ignoring",
-                                pval->val);
+                    if (!SCRadix6AddKeyIPV6String(
+                                &tree->ipv6, &htp_radix6_cfg, pval->val, cfg_prec)) {
+                        SCLogWarning("LIBHTP failed to add ipv6 server %s, ignoring", pval->val);
                     }
                 } else {
                     SCLogDebug("LIBHTP adding ipv4 server %s at %s: %p",
                                s->name, pval->val, cfg_prec->cfg);
-                    if (!SCRadixAddKeyIPV4String(pval->val, tree, cfg_prec)) {
-                        SCLogWarning("LIBHTP failed "
-                                     "to add ipv4 server %s, ignoring",
-                                pval->val);
+                    if (!SCRadix4AddKeyIPV4String(
+                                &tree->ipv4, &htp_radix4_cfg, pval->val, cfg_prec)) {
+                        SCLogWarning("LIBHTP failed to add ipv4 server %s, ignoring", pval->val);
                     }
                 } /* else - if (strchr(pval->val, ':') != NULL) */
             } /* TAILQ_FOREACH(pval, &p->head, next) */
@@ -2563,10 +2567,6 @@ void HTPConfigure(void)
     htp_sbcfg.Realloc = HTPRealloc;
     htp_sbcfg.Free = HTPFree;
 
-    cfgtree = SCRadixCreateRadixTree(NULL, NULL);
-    if (NULL == cfgtree)
-        exit(EXIT_FAILURE);
-
     /* Default Config */
     cfglist.cfg = htp_config_create();
     if (NULL == cfglist.cfg) {
@@ -2575,10 +2575,10 @@ void HTPConfigure(void)
     SCLogDebug("LIBHTP default config: %p", cfglist.cfg);
     HTPConfigSetDefaultsPhase1(&cfglist);
     if (ConfGetNode("app-layer.protocols.http.libhtp") == NULL) {
-        HTPConfigParseParameters(&cfglist, ConfGetNode("libhtp.default-config"),
-                                 cfgtree);
+        HTPConfigParseParameters(&cfglist, ConfGetNode("libhtp.default-config"), &cfgtree);
     } else {
-        HTPConfigParseParameters(&cfglist, ConfGetNode("app-layer.protocols.http.libhtp.default-config"), cfgtree);
+        HTPConfigParseParameters(
+                &cfglist, ConfGetNode("app-layer.protocols.http.libhtp.default-config"), &cfgtree);
     }
     HTPConfigSetDefaultsPhase2("default", &cfglist);
 
@@ -2621,7 +2621,7 @@ void HTPConfigure(void)
         }
 
         HTPConfigSetDefaultsPhase1(htprec);
-        HTPConfigParseParameters(htprec, s, cfgtree);
+        HTPConfigParseParameters(htprec, s, &cfgtree);
         HTPConfigSetDefaultsPhase2(s->name, htprec);
     }
 
@@ -3957,14 +3957,11 @@ libhtp:\n\
     ConfCreateContextBackup();
     ConfInit();
     HtpConfigCreateBackup();
-
     ConfYamlLoadString(input, strlen(input));
-
     HTPConfigure();
-
     FAIL_IF_NULL(cfglist.cfg);
-
-    FAIL_IF_NULL(cfgtree);
+    FAIL_IF_NULL(cfgtree.ipv4.head);
+    FAIL_IF_NULL(cfgtree.ipv6.head);
 
     htp_cfg_t *htp = cfglist.cfg;
     uint8_t buf[128];
@@ -3973,7 +3970,7 @@ libhtp:\n\
 
     addr = "192.168.10.42";
     FAIL_IF(inet_pton(AF_INET, addr, buf) != 1);
-    (void)SCRadixFindKeyIPV4BestMatch(buf, cfgtree, &user_data);
+    (void)SCRadix4TreeFindBestMatch(&cfgtree.ipv4, buf, &user_data);
     FAIL_IF_NULL(user_data);
     HTPCfgRec *htp_cfg_rec = user_data;
     htp = htp_cfg_rec->cfg;
@@ -3983,7 +3980,7 @@ libhtp:\n\
     user_data = NULL;
     addr = "::1";
     FAIL_IF(inet_pton(AF_INET6, addr, buf) != 1);
-    (void)SCRadixFindKeyIPV6BestMatch(buf, cfgtree, &user_data);
+    (void)SCRadix6TreeFindBestMatch(&cfgtree.ipv6, buf, &user_data);
     FAIL_IF_NULL(user_data);
     htp_cfg_rec = user_data;
     htp = htp_cfg_rec->cfg;
@@ -4049,16 +4046,17 @@ libhtp:\n\
     f->alproto = ALPROTO_HTTP1;
 
     htp_cfg_t *htp = cfglist.cfg;
+    FAIL_IF_NULL(htp);
 
     void *user_data = NULL;
-    (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)f->dst.addr_data32, cfgtree, &user_data);
+    (void)SCRadix4TreeFindBestMatch(&cfgtree.ipv4, (uint8_t *)f->dst.addr_data32, &user_data);
     FAIL_IF_NULL(user_data);
+
     HTPCfgRec *htp_cfg_rec = user_data;
     htp = htp_cfg_rec->cfg;
+    FAIL_IF_NULL(user_data);
     SCLogDebug("LIBHTP using config: %p", htp);
 
-    FAIL_IF_NULL(htp);
-
     StreamTcpInitConfig(true);
 
     uint32_t u;

src/defrag-config.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -25,20 +25,24 @@
 #include "suricata-common.h"
 #include "defrag-config.h"
 #include "util-misc.h"
-#include "util-radix-tree.h"
 #include "conf.h"
-
-static SCRadixTree *defrag_tree = NULL;
-
-static int default_timeout = 0;
+#include "util-radix4-tree.h"
+#include "util-radix6-tree.h"
 
 static void DefragPolicyFreeUserData(void *data)
 {
     if (data != NULL)
         SCFree(data);
 }
 
-static void DefragPolicyAddHostInfo(char *host_ip_range, uint64_t timeout)
+static SCRadix4Tree defrag4_tree = SC_RADIX4_TREE_INITIALIZER;
+static SCRadix6Tree defrag6_tree = SC_RADIX6_TREE_INITIALIZER;
+static SCRadix4Config defrag4_config = { DefragPolicyFreeUserData, NULL };
+static SCRadix6Config defrag6_config = { DefragPolicyFreeUserData, NULL };
+
+static int default_timeout = 0;
+
+static void DefragPolicyAddHostInfo(const char *host_ip_range, uint64_t timeout)
 {
     uint64_t *user_data = NULL;
 
@@ -50,37 +54,38 @@ static void DefragPolicyAddHostInfo(char *host_ip_range, uint64_t timeout)
 
     if (strchr(host_ip_range, ':') != NULL) {
         SCLogDebug("adding ipv6 host %s", host_ip_range);
-        if (!SCRadixAddKeyIPV6String(host_ip_range, defrag_tree, (void *)user_data)) {
+        if (!SCRadix6AddKeyIPV6String(
+                    &defrag6_tree, &defrag6_config, host_ip_range, (void *)user_data)) {
             SCFree(user_data);
             if (sc_errno != SC_EEXIST) {
                 SCLogWarning("failed to add ipv6 host %s", host_ip_range);
             }
         }
     } else {
         SCLogDebug("adding ipv4 host %s", host_ip_range);
-        if (!SCRadixAddKeyIPV4String(host_ip_range, defrag_tree, (void *)user_data)) {
-            SCFree(user_data);
+        if (!SCRadix4AddKeyIPV4String(
+                    &defrag4_tree, &defrag4_config, host_ip_range, (void *)user_data)) {
             if (sc_errno != SC_EEXIST) {
                 SCLogWarning("failed to add ipv4 host %s", host_ip_range);
             }
         }
     }
 }
 
-static int DefragPolicyGetIPv4HostTimeout(uint8_t *ipv4_addr)
+static int DefragPolicyGetIPv4HostTimeout(const uint8_t *ipv4_addr)
 {
     void *user_data = NULL;
-    (void)SCRadixFindKeyIPV4BestMatch(ipv4_addr, defrag_tree, &user_data);
+    (void)SCRadix4TreeFindBestMatch(&defrag4_tree, ipv4_addr, &user_data);
     if (user_data == NULL)
         return -1;
 
     return *((int *)user_data);
 }
 
-static int DefragPolicyGetIPv6HostTimeout(uint8_t *ipv6_addr)
+static int DefragPolicyGetIPv6HostTimeout(const uint8_t *ipv6_addr)
 {
     void *user_data = NULL;
-    (void)SCRadixFindKeyIPV6BestMatch(ipv6_addr, defrag_tree, &user_data);
+    (void)SCRadix6TreeFindBestMatch(&defrag6_tree, ipv6_addr, &user_data);
     if (user_data == NULL)
         return -1;
 
@@ -92,9 +97,9 @@ int DefragPolicyGetHostTimeout(Packet *p)
     int timeout = 0;
 
     if (PacketIsIPv4(p))
-        timeout = DefragPolicyGetIPv4HostTimeout((uint8_t *)GET_IPV4_DST_ADDR_PTR(p));
+        timeout = DefragPolicyGetIPv4HostTimeout((const uint8_t *)GET_IPV4_DST_ADDR_PTR(p));
     else if (PacketIsIPv6(p))
-        timeout = DefragPolicyGetIPv6HostTimeout((uint8_t *)GET_IPV6_DST_ADDR(p));
+        timeout = DefragPolicyGetIPv6HostTimeout((const uint8_t *)GET_IPV6_DST_ADDR(p));
 
     if (timeout <= 0)
         timeout = default_timeout;
@@ -134,11 +139,6 @@ void DefragPolicyLoadFromConfig(void)
 {
     SCEnter();
 
-    defrag_tree = SCRadixCreateRadixTree(DefragPolicyFreeUserData, NULL);
-    if (defrag_tree == NULL) {
-        FatalError("Can't alloc memory for the defrag config tree.");
-    }
-
     ConfNode *server_config = ConfGetNode("defrag.host-config");
     if (server_config == NULL) {
         SCLogDebug("failed to read host config");
@@ -160,8 +160,6 @@ void DefragPolicyLoadFromConfig(void)
 
 void DefragTreeDestroy(void)
 {
-    if (defrag_tree != NULL) {
-        SCRadixReleaseRadixTree(defrag_tree);
-    }
-    defrag_tree = NULL;
+    SCRadix4TreeRelease(&defrag4_tree, &defrag4_config);
+    SCRadix6TreeRelease(&defrag6_tree, &defrag6_config);
 }

src/defrag-config.h

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
+/* Copyright (C) 2007-2022 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free

src/detect-engine-analyzer.c

@@ -39,6 +39,7 @@
 #include "detect-pcre.h"
 #include "detect-bytejump.h"
 #include "detect-bytetest.h"
+#include "detect-isdataat.h"
 #include "detect-flow.h"
 #include "detect-tcp-flags.h"
 #include "detect-tcp-ack.h"
@@ -855,6 +856,14 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
                 jb_close(js);
                 break;
             }
+            case DETECT_ABSENT: {
+                const DetectAbsentData *dad = (const DetectAbsentData *)smd->ctx;
+                jb_open_object(js, "absent");
+                jb_set_bool(js, "or_else", dad->or_else);
+                jb_close(js);
+                break;
+            }
+
             case DETECT_IPOPTS: {
                 const DetectIpOptsData *cd = (const DetectIpOptsData *)smd->ctx;