Skip to content

Commit

Permalink
detect/mt: Add support for inner vlan selector
Browse files Browse the repository at this point in the history 
Issue: 6237
  • Loading branch information
@jlucovsky
jlucovsky committed Aug 19, 2023
1 parent d30de9e commit 04acf3f
Show file tree
Hide file tree
Showing 4 changed files with 68 additions and 29 deletions.
67 changes: 48 additions & 19 deletions src/detect-engine.c
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 2007-2022 Open Information Security Foundation
/* Copyright (C) 2007-2023 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
Expand Down Expand Up @@ -101,6 +101,7 @@ static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len
static void TenantIdFree(void *d);
static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p);
static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p);
static uint32_t DetectEngineTenantGetIdFromVlanIdInner(const void *ctx, const Packet *p);
static uint32_t DetectEngineTenantGetIdFromPcap(const void *ctx, const Packet *p);

static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL;
Expand Down Expand Up @@ -3171,6 +3172,10 @@ static TmEcode DetectEngineThreadCtxInitForMT(ThreadVars *tv, DetectEngineThread
case TENANT_SELECTOR_UNKNOWN:
SCLogDebug("TENANT_SELECTOR_UNKNOWN");
break;
case TENANT_SELECTOR_VLAN_INNER:
det_ctx->TenantGetId = DetectEngineTenantGetIdFromVlanIdInner;
SCLogDebug("TENANT_SELECTOR_VLAN_INNER");
break;
case TENANT_SELECTOR_VLAN:
det_ctx->TenantGetId = DetectEngineTenantGetIdFromVlanId;
SCLogDebug("TENANT_SELECTOR_VLAN");
Expand Down Expand Up @@ -4187,9 +4192,6 @@ static int DetectEngineMultiTenantSetupLoadVlanMappings(const ConfNode *mappings
goto bad_mapping;
}

if (DetectEngineTenantRegisterVlanId(tenant_id, vlan_id) != 0) {
goto error;
}
SCLogConfig("vlan %u connected to tenant-id %u", vlan_id, tenant_id);
mapping_cnt++;
continue;
Expand Down Expand Up @@ -4234,8 +4236,11 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
if (ConfGet("multi-detect.selector", &handler) == 1) {
SCLogConfig("multi-tenant selector type %s", handler);

if (strcmp(handler, "vlan") == 0) {
tenant_selector = master->tenant_selector = TENANT_SELECTOR_VLAN;
if (strcmp(handler, "vlan") == 0 || strcmp(handler, "vlan-inner") == 0) {
if (strcmp(handler, "vlan-inner") == 0)
tenant_selector = master->tenant_selector = TENANT_SELECTOR_VLAN_INNER;
else
tenant_selector = master->tenant_selector = TENANT_SELECTOR_VLAN;

int vlanbool = 0;
if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) {
Expand All @@ -4244,7 +4249,6 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
SCMutexUnlock(&master->lock);
goto error;
}

} else if (strcmp(handler, "direct") == 0) {
tenant_selector = master->tenant_selector = TENANT_SELECTOR_DIRECT;
} else if (strcmp(handler, "device") == 0) {
Expand Down Expand Up @@ -4379,28 +4383,41 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
return -1;
}

static inline uint32_t DetectEngineTenantGetIdVlanInternal(
const DetectEngineThreadCtx *det_ctx, uint32_t vlan_id)
{
/* not very efficient, but for now we're targeting only limited amounts.
* Can use hash/tree approach later. */
for (uint32_t x = 0; x < det_ctx->tenant_array_size; x++) {
if (det_ctx->tenant_array[x].traffic_id == vlan_id)
return det_ctx->tenant_array[x].tenant_id;
}

return 0;
}

static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p)
{
if (p->vlan_idx == 0)
return 0;

const DetectEngineThreadCtx *det_ctx = ctx;
uint32_t x = 0;
uint32_t vlan_id = 0;
if (det_ctx == NULL || det_ctx->tenant_array == NULL || det_ctx->tenant_array_size == 0)
return 0;

return DetectEngineTenantGetIdVlanInternal(det_ctx, p->vlan_id[0]);
}

static uint32_t DetectEngineTenantGetIdFromVlanIdInner(const void *ctx, const Packet *p)
{
if (p->vlan_idx == 0)
return 0;

vlan_id = p->vlan_id[0];

const DetectEngineThreadCtx *det_ctx = ctx;
if (det_ctx == NULL || det_ctx->tenant_array == NULL || det_ctx->tenant_array_size == 0)
return 0;

/* not very efficient, but for now we're targeting only limited amounts.
* Can use hash/tree approach later. */
for (x = 0; x < det_ctx->tenant_array_size; x++) {
if (det_ctx->tenant_array[x].traffic_id == vlan_id)
return det_ctx->tenant_array[x].tenant_id;
}

return 0;
return DetectEngineTenantGetIdVlanInternal(det_ctx, p->vlan_id[p->vlan_idx]);
}

static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p)
Expand Down Expand Up @@ -4508,6 +4525,18 @@ int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
return DetectEngineTenantUnregisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id);
}

int DetectEngineTenantRegisterVlanIdInner(uint32_t tenant_id, uint16_t vlan_id)
{
return DetectEngineTenantRegisterSelector(
TENANT_SELECTOR_VLAN_INNER, tenant_id, (uint32_t)vlan_id);
}

int DetectEngineTenantUnregisterVlanIdInner(uint32_t tenant_id, uint16_t vlan_id)
{
return DetectEngineTenantUnregisterSelector(
TENANT_SELECTOR_VLAN_INNER, tenant_id, (uint32_t)vlan_id);
}

int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id)
{
SCLogInfo("registering %u %d 0", TENANT_SELECTOR_DIRECT, tenant_id);
Expand Down
2 changes: 2 additions & 0 deletions src/detect-engine.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,8 @@ int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int r
int DetectEngineReloadTenantsBlocking(const int reload_cnt);

int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id);
int DetectEngineTenantRegisterVlanIdInner(uint32_t tenant_id, uint16_t vlan_id);
int DetectEngineTenantUnregisterVlanIdInner(uint32_t tenant_id, uint16_t vlan_id);
int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id);
int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id);
int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id);
Expand Down
12 changes: 6 additions & 6 deletions src/detect.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1493,12 +1493,12 @@ typedef struct SigGroupHead_ {
/** strict parsing is enabled */
#define SIGMATCH_STRICT_PARSING BIT_U16(11)

enum DetectEngineTenantSelectors
{
TENANT_SELECTOR_UNKNOWN = 0, /**< not set */
TENANT_SELECTOR_DIRECT, /**< method provides direct tenant id */
TENANT_SELECTOR_VLAN, /**< map vlan to tenant id */
TENANT_SELECTOR_LIVEDEV, /**< map livedev to tenant id */
enum DetectEngineTenantSelectors {
TENANT_SELECTOR_UNKNOWN = 0, /**< not set */
TENANT_SELECTOR_DIRECT, /**< method provides direct tenant id */
TENANT_SELECTOR_VLAN, /**< map vlan to tenant id */
TENANT_SELECTOR_LIVEDEV, /**< map livedev to tenant id */
TENANT_SELECTOR_VLAN_INNER, /**< map inner vlan to tenant id */
};

typedef struct DetectEngineTenantMapping_ {
Expand Down
16 changes: 12 additions & 4 deletions src/runmode-unix-socket.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -885,7 +885,7 @@ TmEcode UnixSocketRegisterTenantHandler(json_t *cmd, json_t* answer, void *data)
int r = -1;
if (strcmp(htype, "pcap") == 0) {
r = DetectEngineTenantRegisterPcapFile(tenant_id);
} else if (strcmp(htype, "vlan") == 0) {
} else if (strcmp(htype, "vlan") == 0 || strcmp(htype, "vlan-inner") == 0) {
if (traffic_id < 0) {
json_object_set_new(answer, "message", json_string("vlan requires argument"));
return TM_ECODE_FAILED;
Expand All @@ -896,7 +896,11 @@ TmEcode UnixSocketRegisterTenantHandler(json_t *cmd, json_t* answer, void *data)
}

SCLogInfo("VLAN handler: id %u maps to tenant %u", (uint32_t)traffic_id, tenant_id);
r = DetectEngineTenantRegisterVlanId(tenant_id, (uint16_t)traffic_id);
if (strcmp(htype, "vlan") == 0) {
r = DetectEngineTenantRegisterVlanId(tenant_id, (uint16_t)traffic_id);
} else {
r = DetectEngineTenantRegisterVlanIdInner(tenant_id, (uint16_t)traffic_id);
}
}
if (r != 0) {
json_object_set_new(answer, "message", json_string("handler setup failure"));
Expand Down Expand Up @@ -966,7 +970,7 @@ TmEcode UnixSocketUnregisterTenantHandler(json_t *cmd, json_t* answer, void *dat
int r = -1;
if (strcmp(htype, "pcap") == 0) {
r = DetectEngineTenantUnregisterPcapFile(tenant_id);
} else if (strcmp(htype, "vlan") == 0) {
} else if (strcmp(htype, "vlan") == 0 || strcmp(htype, "vlan-inner") == 0) {
if (traffic_id < 0) {
json_object_set_new(answer, "message", json_string("vlan requires argument"));
return TM_ECODE_FAILED;
Expand All @@ -977,7 +981,11 @@ TmEcode UnixSocketUnregisterTenantHandler(json_t *cmd, json_t* answer, void *dat
}

SCLogInfo("VLAN handler: removing mapping of %u to tenant %u", (uint32_t)traffic_id, tenant_id);
r = DetectEngineTenantUnregisterVlanId(tenant_id, (uint16_t)traffic_id);
if (strcmp(htype, "vlan") == 0) {
r = DetectEngineTenantUnregisterVlanId(tenant_id, (uint16_t)traffic_id);
} else {
r = DetectEngineTenantUnregisterVlanIdInner(tenant_id, (uint16_t)traffic_id);
}
}
if (r != 0) {
json_object_set_new(answer, "message", json_string("handler unregister failure"));
Expand Down

0 comments on commit 04acf3f

Please sign in to comment.