Skip to content

Commit 1b359e1

Browse files
catenacybercatenacyber
committed
detect: tunnel_id can be a selector for multi-tenants
Tciket: 7674
1 parent 502b92b commit 1b359e1

3 files changed

Lines changed: 102 additions & 6 deletions

File tree

‎src/detect-engine.c‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ static DetectEngineMasterCtx g_master_de_ctx = { SCMUTEX_INITIALIZER,
102102
static uint32_t TenantIdHash(HashTable *h, void *data, uint16_t data_len);
103103
static char TenantIdCompare(void *d1, uint16_t d1_len, void *d2, uint16_t d2_len);
104104
static void TenantIdFree(void *d);
105+
static uint32_t DetectEngineTenantGetIdFromTunnel(const void *ctx, const Packet *p);
105106
static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet *p);
106107
static uint32_t DetectEngineTenantGetIdFromVlanId(const void *ctx, const Packet *p);
107108
static uint32_t DetectEngineTenantGetIdFromPcap(const void *ctx, const Packet *p);
@@ -3251,6 +3252,10 @@ static TmEcode DetectEngineThreadCtxInitForMT(ThreadVars *tv, DetectEngineThread
32513252
det_ctx->TenantGetId = DetectEngineTenantGetIdFromLivedev;
32523253
SCLogDebug("TENANT_SELECTOR_LIVEDEV");
32533254
break;
3255+
case TENANT_SELECTOR_TUNNEL:
3256+
det_ctx->TenantGetId = DetectEngineTenantGetIdFromTunnel;
3257+
SCLogDebug("TENANT_SELECTOR_TUNNEL");
3258+
break;
32543259
case TENANT_SELECTOR_DIRECT:
32553260
det_ctx->TenantGetId = DetectEngineTenantGetIdFromPcap;
32563261
SCLogDebug("TENANT_SELECTOR_DIRECT");
@@ -4172,6 +4177,57 @@ int DetectEngineReloadTenantsBlocking(const int reload_cnt)
41724177
return 0;
41734178
}
41744179

4180+
static int DetectEngineMultiTenantSetupLoadTunnelMappings(
4181+
const SCConfNode *mappings_root_node, bool failure_fatal)
4182+
{
4183+
SCConfNode *mapping_node = NULL;
4184+
4185+
int mapping_cnt = 0;
4186+
if (mappings_root_node != NULL) {
4187+
TAILQ_FOREACH (mapping_node, &mappings_root_node->head, next) {
4188+
SCConfNode *tenant_id_node = SCConfNodeLookupChild(mapping_node, "tenant-id");
4189+
if (tenant_id_node == NULL)
4190+
goto bad_mapping;
4191+
SCConfNode *tunnel_id_node = SCConfNodeLookupChild(mapping_node, "tunnel-id");
4192+
if (tunnel_id_node == NULL)
4193+
goto bad_mapping;
4194+
4195+
uint32_t tenant_id = 0;
4196+
if (StringParseUint32(&tenant_id, 10, (uint16_t)strlen(tenant_id_node->val),
4197+
tenant_id_node->val) < 0) {
4198+
SCLogError("tenant-id "
4199+
"of %s is invalid",
4200+
tenant_id_node->val);
4201+
goto bad_mapping;
4202+
}
4203+
4204+
uint16_t tunnel_id = 0;
4205+
if (StringParseUint16(&tunnel_id, 10, (uint16_t)strlen(tunnel_id_node->val),
4206+
tunnel_id_node->val) < 0) {
4207+
SCLogError("tunnel id "
4208+
"of %s is invalid",
4209+
tunnel_id_node->val);
4210+
goto bad_mapping;
4211+
}
4212+
4213+
if (DetectEngineTenantRegisterTunnel(tenant_id, tunnel_id) != 0) {
4214+
goto error;
4215+
}
4216+
SCLogConfig("tunnel %u connected to tenant-id %u", tunnel_id, tenant_id);
4217+
mapping_cnt++;
4218+
continue;
4219+
4220+
bad_mapping:
4221+
if (failure_fatal)
4222+
goto error;
4223+
}
4224+
}
4225+
return mapping_cnt;
4226+
4227+
error:
4228+
return 0;
4229+
}
4230+
41754231
static int DetectEngineMultiTenantSetupLoadLivedevMappings(
41764232
const SCConfNode *mappings_root_node, bool failure_fatal)
41774233
{
@@ -4330,6 +4386,8 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
43304386

43314387
} else if (strcmp(handler, "direct") == 0) {
43324388
tenant_selector = master->tenant_selector = TENANT_SELECTOR_DIRECT;
4389+
} else if (strcmp(handler, "tunnel") == 0) {
4390+
tenant_selector = master->tenant_selector = TENANT_SELECTOR_TUNNEL;
43334391
} else if (strcmp(handler, "device") == 0) {
43344392
tenant_selector = master->tenant_selector = TENANT_SELECTOR_LIVEDEV;
43354393
if (EngineModeIsIPS()) {
@@ -4372,6 +4430,17 @@ int DetectEngineMultiTenantSetup(const bool unix_socket)
43724430
}
43734431
}
43744432
}
4433+
} else if (tenant_selector == TENANT_SELECTOR_TUNNEL) {
4434+
int mapping_cnt = DetectEngineMultiTenantSetupLoadTunnelMappings(
4435+
mappings_root_node, failure_fatal);
4436+
if (mapping_cnt == 0) {
4437+
if (failure_fatal) {
4438+
SCLogError("no multi-detect mappings defined");
4439+
goto error;
4440+
} else {
4441+
SCLogWarning("no multi-detect mappings defined");
4442+
}
4443+
}
43754444
} else if (tenant_selector == TENANT_SELECTOR_LIVEDEV) {
43764445
int mapping_cnt = DetectEngineMultiTenantSetupLoadLivedevMappings(mappings_root_node,
43774446
failure_fatal);
@@ -4498,6 +4567,26 @@ static uint32_t DetectEngineTenantGetIdFromLivedev(const void *ctx, const Packet
44984567
return ld->tenant_id;
44994568
}
45004569

4570+
static uint32_t DetectEngineTenantGetIdFromTunnel(const void *ctx, const Packet *p)
4571+
{
4572+
const DetectEngineThreadCtx *det_ctx = ctx;
4573+
4574+
if (p->tunnel_id == 0 || p->tunnel_id == PKT_TUNNEL_UNKNOWN)
4575+
return 0;
4576+
4577+
if (det_ctx == NULL || det_ctx->tenant_array == NULL || det_ctx->tenant_array_size == 0)
4578+
return 0;
4579+
4580+
/* not very efficient, but for now we're targeting only limited amounts.
4581+
* Can use hash/tree approach later. */
4582+
for (uint32_t x = 0; x < det_ctx->tenant_array_size; x++) {
4583+
if (det_ctx->tenant_array[x].traffic_id == p->tunnel_id)
4584+
return det_ctx->tenant_array[x].tenant_id;
4585+
}
4586+
4587+
return 0;
4588+
}
4589+
45014590
static int DetectEngineTenantRegisterSelector(
45024591
enum DetectEngineTenantSelectors selector, uint32_t tenant_id, uint32_t traffic_id)
45034592
{
@@ -4581,6 +4670,12 @@ int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id)
45814670
TENANT_SELECTOR_LIVEDEV, tenant_id, (uint32_t)device_id);
45824671
}
45834672

4673+
int DetectEngineTenantRegisterTunnel(uint32_t tenant_id, uint16_t tunnel_id)
4674+
{
4675+
return DetectEngineTenantRegisterSelector(
4676+
TENANT_SELECTOR_TUNNEL, tenant_id, (uint32_t)tunnel_id);
4677+
}
4678+
45844679
int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id)
45854680
{
45864681
return DetectEngineTenantRegisterSelector(TENANT_SELECTOR_VLAN, tenant_id, (uint32_t)vlan_id);

‎src/detect-engine.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ int DetectEngineReloadTenantBlocking(uint32_t tenant_id, const char *yaml, int r
121121
int DetectEngineReloadTenantsBlocking(const int reload_cnt);
122122

123123
int DetectEngineTenantRegisterLivedev(uint32_t tenant_id, int device_id);
124+
int DetectEngineTenantRegisterTunnel(uint32_t tenant_id, uint16_t tunnel_id);
124125
int DetectEngineTenantRegisterVlanId(uint32_t tenant_id, uint16_t vlan_id);
125126
int DetectEngineTenantUnregisterVlanId(uint32_t tenant_id, uint16_t vlan_id);
126127
int DetectEngineTenantRegisterPcapFile(uint32_t tenant_id);

‎src/detect.h‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1681,12 +1681,12 @@ typedef struct SigGroupHead_ {
16811681
/** keyword supporting setting an optional direction */
16821682
#define SIGMATCH_SUPPORT_DIR BIT_U16(13)
16831683

1684-
enum DetectEngineTenantSelectors
1685-
{
1686-
TENANT_SELECTOR_UNKNOWN = 0, /**< not set */
1687-
TENANT_SELECTOR_DIRECT, /**< method provides direct tenant id */
1688-
TENANT_SELECTOR_VLAN, /**< map vlan to tenant id */
1689-
TENANT_SELECTOR_LIVEDEV, /**< map livedev to tenant id */
1684+
enum DetectEngineTenantSelectors {
1685+
TENANT_SELECTOR_UNKNOWN = 0, /**< not set */
1686+
TENANT_SELECTOR_DIRECT, /**< method provides direct tenant id */
1687+
TENANT_SELECTOR_VLAN, /**< map vlan to tenant id */
1688+
TENANT_SELECTOR_LIVEDEV, /**< map livedev to tenant id */
1689+
TENANT_SELECTOR_TUNNEL, /**< map tunnel id to tenant id */
16901690
};
16911691

16921692
typedef struct DetectEngineTenantMapping_ {

0 commit comments

Comments
 (0)