Skip to content

Commit

Permalink
detect/tenants: Add tenant context to rule loads
Browse files Browse the repository at this point in the history
Issue: 1520

This commit adds the tenant id for context to rule and .config file
loads.
  • Loading branch information
jlucovsky committed Oct 23, 2023
1 parent 2fe2d82 commit 2c665c4
Show file tree
Hide file tree
Showing 7 changed files with 54 additions and 23 deletions.
16 changes: 11 additions & 5 deletions src/detect-engine-build.c
Original file line number Diff line number Diff line change
Expand Up @@ -1496,11 +1496,17 @@ int SigAddressPrepareStage1(DetectEngineCtx *de_ctx)
}

if (!(de_ctx->flags & DE_QUIET)) {
SCLogInfo("%" PRIu32 " signatures processed. %" PRIu32 " are IP-only "
"rules, %" PRIu32 " are inspecting packet payload, %"PRIu32
" inspect application layer, %"PRIu32" are decoder event only",
de_ctx->sig_cnt, cnt_iponly, cnt_payload, cnt_applayer,
cnt_deonly);
if (strlen(de_ctx->config_prefix) > 0)
SCLogInfo("tenant id %d: %" PRIu32 " signatures processed. %" PRIu32 " are IP-only "
"rules, %" PRIu32 " are inspecting packet payload, %" PRIu32
" inspect application layer, %" PRIu32 " are decoder event only",
de_ctx->tenant_id, de_ctx->sig_cnt, cnt_iponly, cnt_payload, cnt_applayer,
cnt_deonly);
else
SCLogInfo("%" PRIu32 " signatures processed. %" PRIu32 " are IP-only "
"rules, %" PRIu32 " are inspecting packet payload, %" PRIu32
" inspect application layer, %" PRIu32 " are decoder event only",
de_ctx->sig_cnt, cnt_iponly, cnt_payload, cnt_applayer, cnt_deonly);

SCLogConfig("building signature grouping structure, stage 1: "
"preprocessing rules... complete");
Expand Down
17 changes: 14 additions & 3 deletions src/detect-engine-loader.c
Original file line number Diff line number Diff line change
Expand Up @@ -245,7 +245,11 @@ static int ProcessSigFiles(DetectEngineCtx *de_ctx, char *pattern,
if (strcmp("/dev/null", fname) == 0)
return 0;
#endif
SCLogConfig("Loading rule file: %s", fname);
if (strlen(de_ctx->config_prefix) > 0) {
SCLogConfig("tenant id %d: Loading rule file: %s", de_ctx->tenant_id, fname);
} else {
SCLogConfig("Loading rule file: %s", fname);
}
r = DetectLoadSigFile(de_ctx, fname, good_sigs, bad_sigs);
if (r < 0) {
++(st->bad_files);
Expand Down Expand Up @@ -347,8 +351,15 @@ int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_excl
}
} else {
/* we report the total of files and rules successfully loaded and failed */
SCLogInfo("%" PRId32 " rule files processed. %" PRId32 " rules successfully loaded, %" PRId32 " rules failed",
sig_stat->total_files, sig_stat->good_sigs_total, sig_stat->bad_sigs_total);
if (strlen(de_ctx->config_prefix) > 0)
SCLogInfo("tenant id %d: %" PRId32 " rule files processed. %" PRId32
" rules successfully loaded, %" PRId32 " rules failed",
de_ctx->tenant_id, sig_stat->total_files, sig_stat->good_sigs_total,
sig_stat->bad_sigs_total);
else
SCLogInfo("%" PRId32 " rule files processed. %" PRId32
" rules successfully loaded, %" PRId32 " rules failed",
sig_stat->total_files, sig_stat->good_sigs_total, sig_stat->bad_sigs_total);
}

if ((sig_stat->bad_sigs_total || sig_stat->bad_files) && de_ctx->failure_fatal) {
Expand Down
20 changes: 11 additions & 9 deletions src/detect-engine.c
Original file line number Diff line number Diff line change
Expand Up @@ -2462,7 +2462,8 @@ static int DetectEngineReloadThreads(DetectEngineCtx *new_de_ctx)
return -1;
}

static DetectEngineCtx *DetectEngineCtxInitReal(enum DetectEngineType type, const char *prefix)
static DetectEngineCtx *DetectEngineCtxInitReal(
enum DetectEngineType type, const char *prefix, uint32_t tenant_id)
{
DetectEngineCtx *de_ctx = SCMalloc(sizeof(DetectEngineCtx));
if (unlikely(de_ctx == NULL))
Expand All @@ -2474,6 +2475,7 @@ static DetectEngineCtx *DetectEngineCtxInitReal(enum DetectEngineType type, cons
de_ctx->sigerror = NULL;
de_ctx->type = type;
de_ctx->filemagic_thread_ctx_id = -1;
de_ctx->tenant_id = tenant_id;

if (type == DETECT_ENGINE_TYPE_DD_STUB || type == DETECT_ENGINE_TYPE_MT_STUB) {
de_ctx->version = DetectEngineGetVersion();
Expand Down Expand Up @@ -2547,25 +2549,25 @@ static DetectEngineCtx *DetectEngineCtxInitReal(enum DetectEngineType type, cons

DetectEngineCtx *DetectEngineCtxInitStubForMT(void)
{
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_MT_STUB, NULL);
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_MT_STUB, NULL, 0);
}

DetectEngineCtx *DetectEngineCtxInitStubForDD(void)
{
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_DD_STUB, NULL);
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_DD_STUB, NULL, 0);
}

DetectEngineCtx *DetectEngineCtxInit(void)
{
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, NULL);
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, NULL, 0);
}

DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix)
DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix, uint32_t tenant_id)
{
if (prefix == NULL || strlen(prefix) == 0)
return DetectEngineCtxInit();
else
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, prefix);
return DetectEngineCtxInitReal(DETECT_ENGINE_TYPE_NORMAL, prefix, tenant_id);
}

static void DetectEngineCtxFreeThreadKeywordData(DetectEngineCtx *de_ctx)
Expand Down Expand Up @@ -3841,7 +3843,7 @@ static int DetectEngineMultiTenantLoadTenant(uint32_t tenant_id, const char *fil
goto error;
}

de_ctx = DetectEngineCtxInitWithPrefix(prefix);
de_ctx = DetectEngineCtxInitWithPrefix(prefix, tenant_id);
if (de_ctx == NULL) {
SCLogError("initializing detection engine "
"context failed.");
Expand Down Expand Up @@ -3901,7 +3903,7 @@ static int DetectEngineMultiTenantReloadTenant(uint32_t tenant_id, const char *f
goto error;
}

DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix);
DetectEngineCtx *new_de_ctx = DetectEngineCtxInitWithPrefix(prefix, tenant_id);
if (new_de_ctx == NULL) {
SCLogError("initializing detection engine "
"context failed.");
Expand Down Expand Up @@ -4759,7 +4761,7 @@ int DetectEngineReload(const SCInstance *suri)
}

/* get new detection engine */
new_de_ctx = DetectEngineCtxInitWithPrefix(prefix);
new_de_ctx = DetectEngineCtxInitWithPrefix(prefix, old_de_ctx->tenant_id);
if (new_de_ctx == NULL) {
SCLogError("initializing detection engine "
"context failed.");
Expand Down
2 changes: 1 addition & 1 deletion src/detect-engine.h
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ void DetectEngineBufferTypeSupportsMpm(DetectEngineCtx *de_ctx, const char *name
void DetectEngineBufferTypeSupportsTransformations(DetectEngineCtx *de_ctx, const char *name);

/* prototypes */
DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix);
DetectEngineCtx *DetectEngineCtxInitWithPrefix(const char *prefix, uint32_t tenant_id);
DetectEngineCtx *DetectEngineCtxInit(void);
DetectEngineCtx *DetectEngineCtxInitStubForDD(void);
DetectEngineCtx *DetectEngineCtxInitStubForMT(void);
Expand Down
8 changes: 6 additions & 2 deletions src/util-classification-config.c
Original file line number Diff line number Diff line change
Expand Up @@ -363,8 +363,12 @@ static bool SCClassConfParseFile(DetectEngineCtx *de_ctx, FILE *fd)
}

#ifdef UNITTESTS
SCLogInfo("Added \"%d\" classification types from the classification file",
de_ctx->class_conf_ht->count);
if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0)
SCLogInfo("tenant id %d: Added \"%d\" classification types from the classification file",
de_ctx->tenant_id, de_ctx->class_conf_ht->count);
else
SCLogInfo("Added \"%d\" classification types from the classification file",
de_ctx->class_conf_ht->count);
#endif

return errors == 0;
Expand Down
8 changes: 6 additions & 2 deletions src/util-reference-config.c
Original file line number Diff line number Diff line change
Expand Up @@ -335,8 +335,12 @@ static bool SCRConfParseFile(DetectEngineCtx *de_ctx, FILE *fd)
}

#ifdef UNITTESTS
SCLogInfo("Added \"%d\" reference types from the reference.config file",
de_ctx->reference_conf_ht->count);
if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0)
SCLogInfo("tenant id %d: Added \"%d\" reference types from the reference.config file",
de_ctx->tenant_id, de_ctx->reference_conf_ht->count);
else
SCLogInfo("Added \"%d\" reference types from the reference.config file",
de_ctx->reference_conf_ht->count);
#endif /* UNITTESTS */
return true;
}
Expand Down
6 changes: 5 additions & 1 deletion src/util-threshold-config.c
Original file line number Diff line number Diff line change
Expand Up @@ -1042,7 +1042,11 @@ int SCThresholdConfParseFile(DetectEngineCtx *de_ctx, FILE *fp)
}
}

SCLogInfo("Threshold config parsed: %d rule(s) found", rule_num);
if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0)
SCLogInfo("tenant id %d: Threshold config parsed: %d rule(s) found", de_ctx->tenant_id,
rule_num);
else
SCLogInfo("Threshold config parsed: %d rule(s) found", rule_num);
return 0;
}

Expand Down

0 comments on commit 2c665c4

Please sign in to comment.