/* Copyright (C) 2007-2022 Open Information Security Foundation

 *

 * You can copy, redistribute or modify this Program under the terms of

 * the GNU General Public License version 2 as published by the Free

 * Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * version 2 along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

 * 02110-1301, USA.

 */

/**

 * \file

 *

 * \author Victor Julien <victor@inliniac.net>

 * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>

 *

 * Signatures that only inspect IP addresses are processed here

 * We use radix trees for src dst ipv4 and ipv6 addresses

 * This radix trees hold information for subnets and hosts in a

 * hierarchical distribution

 */

#include "suricata-common.h"

#include "detect.h"

#include "decode.h"

#include "flow.h"

#include "detect-parse.h"

#include "detect-engine.h"

#include "detect-engine-siggroup.h"

#include "detect-engine-address.h"

#include "detect-engine-proto.h"

#include "detect-engine-port.h"

#include "detect-engine-mpm.h"

#include "detect-engine-build.h"

#include "detect-engine-threshold.h"

#include "detect-engine-iponly.h"

#include "detect-threshold.h"

#include "util-classification-config.h"

#include "util-rule-vars.h"

#include "flow-util.h"

#include "util-debug.h"

#include "util-unittest.h"

#include "util-unittest-helper.h"

#include "util-print.h"

#include "util-byte.h"

#include "util-profiling.h"

#include "util-validate.h"

#include "util-cidr.h"

#ifdef OS_WIN32

#include <winsock.h>

#else

#include <netinet/in.h>

#endif /* OS_WIN32 */

/**

 * \brief This function creates a new IPOnlyCIDRItem

 *

 * \retval IPOnlyCIDRItem address of the new instance

 */

static IPOnlyCIDRItem *IPOnlyCIDRItemNew(void)

{

    SCEnter();

    IPOnlyCIDRItem *item = NULL;

    item = SCMalloc(sizeof(IPOnlyCIDRItem));

    if (unlikely(item == NULL))

        SCReturnPtr(NULL, "IPOnlyCIDRItem");

    memset(item, 0, sizeof(IPOnlyCIDRItem));

    SCReturnPtr(item, "IPOnlyCIDRItem");

}

/**

 * \brief Compares two list items

 *

 * \retval An integer less than, equal to, or greater than zero if lhs is

 *         considered to be respectively less than, equal to, or greater than

 *         rhs.

 */

static int IPOnlyCIDRItemCompareReal(const IPOnlyCIDRItem *lhs, const IPOnlyCIDRItem *rhs)

{

    if (lhs->netmask == rhs->netmask) {

        uint8_t i = 0;

        for (; i < lhs->netmask / 32 || i < 1; i++) {

            if (lhs->ip[i] < rhs->ip[i])

                return -1;

            if (lhs->ip[i] > rhs->ip[i])

                return 1;

        }

        return 0;

    }

    return lhs->netmask < rhs->netmask ? -1 : 1;

}

static int IPOnlyCIDRItemCompare(const void *lhsv, const void *rhsv)

{

    const IPOnlyCIDRItem *lhs = *(const IPOnlyCIDRItem **)lhsv;

    const IPOnlyCIDRItem *rhs = *(const IPOnlyCIDRItem **)rhsv;

    return IPOnlyCIDRItemCompareReal(lhs, rhs);

}

static void IPOnlyCIDRListQSort(IPOnlyCIDRItem **head)

{

    if (unlikely(head == NULL || *head == NULL))

        return;

    // First count the number of elements in the list

    size_t len = 0;

    IPOnlyCIDRItem *curr = *head;

    while (curr) {

        curr = curr->next;

        len++;

    }

    // Place a pointer to the list item in an array for sorting

    IPOnlyCIDRItem **tmp = SCMalloc(len * sizeof(IPOnlyCIDRItem *));

    if (unlikely(tmp == NULL)) {

        SCLogError("Failed to allocate enough memory to sort IP-only CIDR items.");

        return;

    }

    curr = *head;

    for (size_t i = 0; i < len; i++) {

        tmp[i] = curr;

        curr = curr->next;

    }

    // Perform the sort using the qsort algorithm

    qsort(tmp, len, sizeof(IPOnlyCIDRItem *), IPOnlyCIDRItemCompare);

    // Update the links to the next element

    *head = tmp[0];

    for (size_t i = 0; i + 1 < len; i++) {

        tmp[i]->next = tmp[i + 1];

    }

    tmp[len - 1]->next = NULL;

    SCFree(tmp);

}

//declaration for using it already

static IPOnlyCIDRItem *IPOnlyCIDRItemInsert(IPOnlyCIDRItem *head,

                                            IPOnlyCIDRItem *item);

static int InsertRange(

        IPOnlyCIDRItem **pdd, IPOnlyCIDRItem *dd, const uint32_t first_in, const uint32_t last_in)

{

    DEBUG_VALIDATE_BUG_ON(dd == NULL);

    DEBUG_VALIDATE_BUG_ON(pdd == NULL);

    uint32_t first = first_in;

    uint32_t last = last_in;

    dd->netmask = 32;

    /* Find the maximum netmask starting from current address first

     * and not crossing last.

     * To extend the mask, we need to start from a power of 2.

     * And we need to pay attention to unsigned overflow back to 0.0.0.0

     */

    while (dd->netmask > 0 && (first & (1UL << (32 - dd->netmask))) == 0 &&

            first + (1UL << (32 - (dd->netmask - 1))) - 1 <= last) {

        dd->netmask--;

    }

    dd->ip[0] = htonl(first);

    first += 1UL << (32 - dd->netmask);

    // case whatever-255.255.255.255 looping to 0.0.0.0/0

    while (first <= last && first != 0) {

        IPOnlyCIDRItem *new = IPOnlyCIDRItemNew();

        if (new == NULL)

            goto error;

        new->negated = dd->negated;

        new->family = dd->family;

        new->netmask = 32;

        while (new->netmask > 0 && (first & (1UL << (32 - new->netmask))) == 0 &&

                first + (1UL << (32 - (new->netmask - 1))) - 1 <= last) {

            new->netmask--;

        }

        new->ip[0] = htonl(first);

        first += 1UL << (32 - new->netmask);

        dd = IPOnlyCIDRItemInsert(dd, new);

    }

    // update head of list

    *pdd = dd;

    return 0;

error:

    return -1;

}

/**

 * \internal

 * \brief Parses an ipv4/ipv6 address string and updates the result into the

 *        IPOnlyCIDRItem instance sent as the argument.

 *

 * \param pdd Double pointer to the IPOnlyCIDRItem instance which should be updated

 *            with the address (in cidr) details from the parsed ip string.

 * \param str Pointer to address string that has to be parsed.

 *

 * \retval  0 On successfully parsing the address string.

 * \retval -1 On failure.

 */

static int IPOnlyCIDRItemParseSingle(IPOnlyCIDRItem **pdd, const char *str)

{

    char buf[256] = "";

    char *ip = NULL, *ip2 = NULL;

    char *mask = NULL;

    int r = 0;

    IPOnlyCIDRItem *dd = *pdd;

    while (*str != '\0' && *str == ' ')

        str++;

    SCLogDebug("str %s", str);

    strlcpy(buf, str, sizeof(buf));

    ip = buf;

    /* first handle 'any' */

    if (strcasecmp(str, "any") == 0) {

        /* if any, insert 0.0.0.0/0 and ::/0 as well */

        SCLogDebug("adding 0.0.0.0/0 and ::/0 as we\'re handling \'any\'");

        IPOnlyCIDRItemParseSingle(&dd, "0.0.0.0/0");

        BUG_ON(dd->family == 0);

        dd->next = IPOnlyCIDRItemNew();

        if (dd->next == NULL)

            goto error;

        IPOnlyCIDRItemParseSingle(&dd->next, "::/0");

        BUG_ON(dd->family == 0);

        SCLogDebug("address is \'any\'");

        return 0;

    }

    /* handle the negation case */

    if (ip[0] == '!') {

        dd->negated = (dd->negated)? 0 : 1;

        ip++;

    }

    /* see if the address is an ipv4 or ipv6 address */

    if ((strchr(str, ':')) == NULL) {

        /* IPv4 Address */

        struct in_addr in;

        dd->family = AF_INET;

        if ((mask = strchr(ip, '/')) != NULL) {

            /* 1.2.3.4/xxx format (either dotted or cidr notation */

            ip[mask - ip] = '\0';

            mask++;

            uint32_t netmask = 0;

            size_t u = 0;

            if ((strchr (mask, '.')) == NULL) {

                /* 1.2.3.4/24 format */

                for (u = 0; u < strlen(mask); u++) {

                    if(!isdigit((unsigned char)mask[u]))

                        goto error;

                }

                uint8_t cidr;

                if (StringParseU8RangeCheck(&cidr, 10, 0, (const char *)mask, 0, 32) <= 0)

                    goto error;

                dd->netmask = cidr;

                netmask = CIDRGet(cidr);

            } else {

                /* 1.2.3.4/255.255.255.0 format */

                r = inet_pton(AF_INET, mask, &in);

                if (r <= 0)

                    goto error;

                int cidr = CIDRFromMask(in.s_addr);

                if (cidr < 0)

                    goto error;

                dd->netmask = (uint8_t)cidr;

            }

            r = inet_pton(AF_INET, ip, &in);

            if (r <= 0)

                goto error;

            dd->ip[0] = in.s_addr & netmask;

        } else if ((ip2 = strchr(ip, '-')) != NULL) {

            /* 1.2.3.4-1.2.3.6 range format */

            ip[ip2 - ip] = '\0';

            ip2++;

            uint32_t first, last;

            r = inet_pton(AF_INET, ip, &in);

            if (r <= 0)

                goto error;

            first = SCNtohl(in.s_addr);

            r = inet_pton(AF_INET, ip2, &in);

            if (r <= 0)

                goto error;

            last = SCNtohl(in.s_addr);

            /* a > b is illegal, a = b is ok */

            if (first > last)

                goto error;

            SCLogDebug("Creating CIDR range for [%s - %s]", ip, ip2);

            return InsertRange(pdd, dd, first, last);

        } else {

            /* 1.2.3.4 format */

            r = inet_pton(AF_INET, ip, &in);

            if (r <= 0)

                goto error;

            /* single host */

            dd->ip[0] = in.s_addr;

            dd->netmask = 32;

        }

    } else {

        /* IPv6 Address */

        struct in6_addr in6, mask6;

        uint32_t ip6addr[4], netmask[4];

        dd->family = AF_INET6;

        if ((mask = strchr(ip, '/')) != NULL)  {

            mask[0] = '\0';

            mask++;

            r = inet_pton(AF_INET6, ip, &in6);

            if (r <= 0)

                goto error;

            /* Format is cidr val */

            if (StringParseU8RangeCheck(&dd->netmask, 10, 0,

                                        (const char *)mask, 0, 128) < 0) {

                goto error;

            }

            memcpy(&ip6addr, &in6.s6_addr, sizeof(ip6addr));

            CIDRGetIPv6(dd->netmask, &mask6);

            memcpy(&netmask, &mask6.s6_addr, sizeof(netmask));

            dd->ip[0] = ip6addr[0] & netmask[0];

            dd->ip[1] = ip6addr[1] & netmask[1];

            dd->ip[2] = ip6addr[2] & netmask[2];

            dd->ip[3] = ip6addr[3] & netmask[3];

        } else {

            r = inet_pton(AF_INET6, ip, &in6);

            if (r <= 0)

                goto error;

            memcpy(dd->ip, &in6.s6_addr, sizeof(dd->ip));

            dd->netmask = 128;

        }

    }

    BUG_ON(dd->family == 0);

    return 0;

error:

    return -1;

}

/**

 * \brief Setup a single address string, parse it and add the resulting

 *        Address items in cidr format to the list of gh

 *

 * \param gh Pointer to the IPOnlyCIDRItem list Head to which the

 *           resulting Address-Range(s) from the parsed ip string has to

 *           be added.

 * \param s  Pointer to the ip address string to be parsed.

 *

 * \retval  0 On success.

 * \retval -1 On failure.

 */

static int IPOnlyCIDRItemSetup(IPOnlyCIDRItem **gh, char *s)

{

    SCLogDebug("gh %p, s %s", *gh, s);

    /* parse the address */

    if (IPOnlyCIDRItemParseSingle(gh, s) == -1) {

        SCLogError("address parsing error \"%s\"", s);

        goto error;

    }

    return 0;

error:

    return -1;

}

/**

 * \brief This function insert a IPOnlyCIDRItem

 *        to a list of IPOnlyCIDRItems

 * \param head Pointer to the head of IPOnlyCIDRItems list

 * \param item Pointer to the item to insert in the list

 *

 * \retval IPOnlyCIDRItem address of the new head if apply

 */

static IPOnlyCIDRItem *IPOnlyCIDRItemInsertReal(IPOnlyCIDRItem *head,

                                         IPOnlyCIDRItem *item)

{

    if (item == NULL)

        return head;

    /* Always insert item as head */

    item->next = head;

    return item;

}

/**

 * \brief This function insert a IPOnlyCIDRItem list

 *        to a list of IPOnlyCIDRItems sorted by netmask

 *        ascending

 * \param head Pointer to the head of IPOnlyCIDRItems list

 * \param item Pointer to the list of items to insert in the list

 *

 * \retval IPOnlyCIDRItem address of the new head if apply

 */

static IPOnlyCIDRItem *IPOnlyCIDRItemInsert(IPOnlyCIDRItem *head,

                                     IPOnlyCIDRItem *item)

{

    IPOnlyCIDRItem *it, *prev = NULL;

    /* The first element */

    if (head == NULL) {

        SCLogDebug("Head is NULL to insert item (%p)",item);

        return item;

    }

    if (item == NULL) {

        SCLogDebug("Item is NULL");

        return head;

    }

    SCLogDebug("Inserting item(%p)->netmask %u head %p", item, item->netmask, head);

    prev = item;

    while (prev != NULL) {

        it = prev->next;

        /* Separate from the item list */

        prev->next = NULL;

        //SCLogDebug("Before:");

        //IPOnlyCIDRListPrint(head);

        head = IPOnlyCIDRItemInsertReal(head, prev);

        //SCLogDebug("After:");

        //IPOnlyCIDRListPrint(head);

        prev = it;

    }

    return head;

}

/**

 * \brief This function free a IPOnlyCIDRItem list

 * \param tmphead Pointer to the list

 */

void IPOnlyCIDRListFree(IPOnlyCIDRItem *tmphead)

{

    SCEnter();

#ifdef DEBUG

    uint32_t i = 0;

#endif

    IPOnlyCIDRItem *it, *next = NULL;

    if (tmphead == NULL) {

        SCLogDebug("temphead is NULL");

        return;

    }

    it = tmphead;

    next = it->next;

    while (it != NULL) {

#ifdef DEBUG

        i++;

        SCLogDebug("Item(%p) %"PRIu32" removed", it, i);

#endif

        SCFree(it);

        it = next;

        if (next != NULL)

            next = next->next;

    }

    SCReturn;

}

/**

 * \brief This function update a list of IPOnlyCIDRItems

 *        setting the signature internal id (signum) to "i"

 *

 * \param tmphead Pointer to the list

 * \param i number of signature internal id

 */

static void IPOnlyCIDRListSetSigNum(IPOnlyCIDRItem *tmphead, SigIntId i)

{

    while (tmphead != NULL) {

        tmphead->signum = i;

        tmphead = tmphead->next;

    }

}

#ifdef UNITTESTS

/**

 * \brief This function print a IPOnlyCIDRItem list

 * \param tmphead Pointer to the head of IPOnlyCIDRItems list

 */

static void IPOnlyCIDRListPrint(IPOnlyCIDRItem *tmphead)

{

#ifdef DEBUG

    uint32_t i = 0;

    while (tmphead != NULL) {

        i++;

        SCLogDebug("Item %"PRIu32" has netmask %"PRIu8" negated:"

                   " %s; IP: %s; signum: %"PRIu32, i, tmphead->netmask,

                   (tmphead->negated) ? "yes":"no",

                   inet_ntoa(*(struct in_addr*)&tmphead->ip[0]),

                   tmphead->signum);

        tmphead = tmphead->next;

    }

#endif

}

#endif

/** \brief user data for storing signature id's in the radix tree

 *

 *  Bit array representing signature internal id's (Signature::num).

 */

typedef struct SigNumArray_ {

    uint8_t *array; /* bit array of sig nums */

    uint32_t size;  /* size in bytes of the array */

} SigNumArray;

/**

 * \brief This function print a SigNumArray, it's used with the

 *        radix tree print function to help debugging

 * \param tmp Pointer to the head of SigNumArray

 */

static void SigNumArrayPrint(void *tmp)

{

    SigNumArray *sna = (SigNumArray *)tmp;

    for (uint32_t u = 0; u < sna->size; u++) {

        uint8_t bitarray = sna->array[u];

        for (uint8_t i = 0; i < 8; i++) {

            if (bitarray & 0x01)

                printf("%" PRIu32 " ", u * 8 + i);

            bitarray = bitarray >> 1;

        }

    }

}

/**

 * \brief This function creates a new SigNumArray with the

 *        size fixed to the io_ctx->max_idx

 * \param de_ctx Pointer to the current detection context

 * \param io_ctx Pointer to the current ip only context

 *

 * \retval SigNumArray address of the new instance

 */

static SigNumArray *SigNumArrayNew(DetectEngineCtx *de_ctx,

                            DetectEngineIPOnlyCtx *io_ctx)

{

    SigNumArray *new = SCMalloc(sizeof(SigNumArray));

    if (unlikely(new == NULL)) {

        FatalError("Fatal error encountered in SigNumArrayNew. Exiting...");

    }

    memset(new, 0, sizeof(SigNumArray));

    new->array = SCMalloc(io_ctx->max_idx / 8 + 1);

    if (new->array == NULL) {

       exit(EXIT_FAILURE);

    }

    memset(new->array, 0, io_ctx->max_idx / 8 + 1);

    new->size = io_ctx->max_idx / 8 + 1;

    SCLogDebug("max idx= %u", io_ctx->max_idx);

    return new;

}

/**

 * \brief This function creates a new SigNumArray with the

 *        same data as the argument

 *

 * \param orig Pointer to the original SigNumArray to copy

 *

 * \retval SigNumArray address of the new instance

 */

static SigNumArray *SigNumArrayCopy(SigNumArray *orig)

{

    SigNumArray *new = SCMalloc(sizeof(SigNumArray));

    if (unlikely(new == NULL)) {

        FatalError("Fatal error encountered in SigNumArrayCopy. Exiting...");

    }

    memset(new, 0, sizeof(SigNumArray));

    new->size = orig->size;

    new->array = SCMalloc(orig->size);

    if (new->array == NULL) {

        exit(EXIT_FAILURE);

    }

    memcpy(new->array, orig->array, orig->size);

    return new;

}

/**

 * \brief This function free() a SigNumArray

 * \param orig Pointer to the original SigNumArray to copy

 */

static void SigNumArrayFree(void *tmp)

{

    SigNumArray *sna = (SigNumArray *)tmp;

    if (sna == NULL)

        return;

    if (sna->array != NULL)

        SCFree(sna->array);

    SCFree(sna);

}

/**

 * \brief This function parses and return a list of IPOnlyCIDRItem

 *

 * \param s Pointer to the string of the addresses

 *          (in the format of signatures)

 * \param negate flag to indicate if all this string is negated or not

 *

 * \retval 0 if success

 * \retval -1 if fails

 */

static IPOnlyCIDRItem *IPOnlyCIDRListParse2(

        const DetectEngineCtx *de_ctx, const char *s, int negate)

{

    size_t x = 0;

    size_t u = 0;

    int o_set = 0, n_set = 0, d_set = 0;

    int depth = 0;

    size_t size = strlen(s);

    char address[8196] = "";

    const char *rule_var_address = NULL;

    char *temp_rule_var_address = NULL;

    IPOnlyCIDRItem *head;

    IPOnlyCIDRItem *subhead;

    head = subhead = NULL;

    SCLogDebug("s %s negate %s", s, negate ? "true" : "false");

    for (u = 0, x = 0; u < size && x < sizeof(address); u++) {

        address[x] = s[u];

        x++;

        if (!o_set && s[u] == '!') {

            n_set = 1;

            x--;

        } else if (s[u] == '[') {

            if (!o_set) {

                o_set = 1;

                x = 0;

            }

            depth++;

        } else if (s[u] == ']') {

            if (depth == 1) {

                address[x - 1] = '\0';

                x = 0;

                if ( (subhead = IPOnlyCIDRListParse2(de_ctx, address,

                                                (negate + n_set) % 2)) == NULL)

                    goto error;

                head = IPOnlyCIDRItemInsert(head, subhead);

                n_set = 0;

            }

            depth--;

        } else if (depth == 0 && s[u] == ',') {

            if (o_set == 1) {

                o_set = 0;

            } else if (d_set == 1) {

                address[x - 1] = '\0';

                rule_var_address = SCRuleVarsGetConfVar(de_ctx, address,

                                                  SC_RULE_VARS_ADDRESS_GROUPS);

                if (rule_var_address == NULL)

                    goto error;

                if ((negate + n_set) % 2) {

                    temp_rule_var_address = SCMalloc(strlen(rule_var_address) + 3);

                    if (unlikely(temp_rule_var_address == NULL)) {

                        goto error;

                    }

                    snprintf(temp_rule_var_address, strlen(rule_var_address) + 3,

                             "[%s]", rule_var_address);

                } else {

                    temp_rule_var_address = SCStrdup(rule_var_address);

                    if (unlikely(temp_rule_var_address == NULL)) {

                        goto error;

                    }

                }

                subhead = IPOnlyCIDRListParse2(de_ctx, temp_rule_var_address,

                                               (negate + n_set) % 2);

                head = IPOnlyCIDRItemInsert(head, subhead);

                d_set = 0;

                n_set = 0;

                SCFree(temp_rule_var_address);

            } else {

                address[x - 1] = '\0';

                subhead = IPOnlyCIDRItemNew();

                if (subhead == NULL)

                    goto error;

                if (!((negate + n_set) % 2))

                    subhead->negated = 0;

                else

                    subhead->negated = 1;

                if (IPOnlyCIDRItemSetup(&subhead, address) < 0) {

                    IPOnlyCIDRListFree(subhead);

                    subhead = NULL;

                    goto error;

                }

                head = IPOnlyCIDRItemInsert(head, subhead);

                n_set = 0;

            }

            x = 0;

        } else if (depth == 0 && s[u] == '$') {

            d_set = 1;

        } else if (depth == 0 && u == size - 1) {

            if (x == sizeof(address)) {

                address[x - 1] = '\0';

            } else {

                address[x] = '\0';

            }

            x = 0;

            if (d_set == 1) {

                rule_var_address = SCRuleVarsGetConfVar(de_ctx, address,

                                                    SC_RULE_VARS_ADDRESS_GROUPS);

                if (rule_var_address == NULL)

                    goto error;

                if ((negate + n_set) % 2) {

                    temp_rule_var_address = SCMalloc(strlen(rule_var_address) + 3);

                    if (unlikely(temp_rule_var_address == NULL)) {

                        goto error;

                    }

                    snprintf(temp_rule_var_address, strlen(rule_var_address) + 3,

                            "[%s]", rule_var_address);

                } else {

                    temp_rule_var_address = SCStrdup(rule_var_address);

                    if (unlikely(temp_rule_var_address == NULL)) {

                        goto error;

                    }

                }

                subhead = IPOnlyCIDRListParse2(de_ctx, temp_rule_var_address,

                                               (negate + n_set) % 2);

                head = IPOnlyCIDRItemInsert(head, subhead);

                d_set = 0;

                SCFree(temp_rule_var_address);

            } else {

                subhead = IPOnlyCIDRItemNew();

                if (subhead == NULL)

                    goto error;

                if (!((negate + n_set) % 2))

                    subhead->negated = 0;

                else

                    subhead->negated = 1;

                if (IPOnlyCIDRItemSetup(&subhead, address) < 0) {

                    IPOnlyCIDRListFree(subhead);

                    subhead = NULL;

                    goto error;

                }

                head = IPOnlyCIDRItemInsert(head, subhead);

            }

            n_set = 0;

        }

    }

    return head;

error:

    SCLogError("Error parsing addresses");

    return head;

}

/**

 * \brief Parses an address group sent as a character string and updates the

 *        IPOnlyCIDRItem list

 *

 * \param gh  Pointer to the IPOnlyCIDRItem list

 * \param str Pointer to the character string containing the address group

 *            that has to be parsed.

 *

 * \retval  0 On success.

 * \retval -1 On failure.

 */

static int IPOnlyCIDRListParse(const DetectEngineCtx *de_ctx, IPOnlyCIDRItem **gh, const char *str)

{

    SCLogDebug("gh %p, str %s", gh, str);

    if (gh == NULL)

        goto error;

    *gh = IPOnlyCIDRListParse2(de_ctx, str, 0);

    if (*gh == NULL) {

        SCLogDebug("IPOnlyCIDRListParse2 returned null");

        goto error;

    }

    return 0;

error:

    return -1;

}

/**

 * \brief Parses an address group sent as a character string and updates the

 *        IPOnlyCIDRItem lists src and dst of the Signature *s

 *

 * \param s Pointer to the signature structure

 * \param addrstr Pointer to the character string containing the address group

 *            that has to be parsed.

 * \param flag to indicate if we are parsing the src string or the dst string

 *

 * \retval  0 On success.

 * \retval -1 On failure.

 */

int IPOnlySigParseAddress(const DetectEngineCtx *de_ctx,

                          Signature *s, const char *addrstr, char flag)

{

    SCLogDebug("Address Group \"%s\" to be parsed now", addrstr);

    /* pass on to the address(list) parser */

    if (flag == 0) {

        if (strcasecmp(addrstr, "any") == 0) {

            s->flags |= SIG_FLAG_SRC_ANY;

            if (IPOnlyCIDRListParse(de_ctx, &s->cidr_src, "[0.0.0.0/0,::/0]") < 0)

                goto error;

        } else if (IPOnlyCIDRListParse(de_ctx, &s->cidr_src, (char *)addrstr) < 0) {

            goto error;

        }

        /* IPOnlyCIDRListPrint(s->CidrSrc); */

    } else {

        if (strcasecmp(addrstr, "any") == 0) {

            s->flags |= SIG_FLAG_DST_ANY;

            if (IPOnlyCIDRListParse(de_ctx, &s->cidr_dst, "[0.0.0.0/0,::/0]") < 0)

                goto error;

        } else if (IPOnlyCIDRListParse(de_ctx, &s->cidr_dst, (char *)addrstr) < 0) {

            goto error;

        }

        /* IPOnlyCIDRListPrint(s->CidrDst); */

    }

    return 0;

error:

    SCLogError("failed to parse addresses");

    return -1;

}

/**

 * \brief Setup the IP Only detection engine context

 *

 * \param de_ctx Pointer to the current detection engine

 * \param io_ctx Pointer to the current ip only detection engine

 */

void IPOnlyInit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx)

{

    io_ctx->tree_ipv4src = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint);

    io_ctx->tree_ipv4dst = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint);

    io_ctx->tree_ipv6src = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint);

    io_ctx->tree_ipv6dst = SCRadixCreateRadixTree(SigNumArrayFree, SigNumArrayPrint);

    io_ctx->sig_mapping = SCCalloc(1, de_ctx->sig_array_len * sizeof(uint32_t));

    if (io_ctx->sig_mapping == NULL) {

        FatalError("Unable to allocate iponly signature tracking area");

    }

    io_ctx->sig_mapping_size = 0;

}

SigIntId IPOnlyTrackSigNum(DetectEngineIPOnlyCtx *io_ctx, SigIntId signum)

{

    SigIntId loc = io_ctx->sig_mapping_size;

    io_ctx->sig_mapping[loc] = signum;

    io_ctx->sig_mapping_size++;

    return loc;

}

/**

 * \brief Print stats of the IP Only engine

 *

 * \param de_ctx Pointer to the current detection engine

 * \param io_ctx Pointer to the current ip only detection engine

 */

void IPOnlyPrint(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx)

{

    /* XXX: how are we going to print the stats now? */

}

/**

 * \brief Deinitialize the IP Only detection engine context

 *

 * \param de_ctx Pointer to the current detection engine

 * \param io_ctx Pointer to the current ip only detection engine

 */

void IPOnlyDeinit(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx)

{

    if (io_ctx == NULL)

        return;

    if (io_ctx->tree_ipv4src != NULL)

        SCRadixReleaseRadixTree(io_ctx->tree_ipv4src);

    io_ctx->tree_ipv4src = NULL;

    if (io_ctx->tree_ipv4dst != NULL)

        SCRadixReleaseRadixTree(io_ctx->tree_ipv4dst);

    io_ctx->tree_ipv4dst = NULL;

    if (io_ctx->tree_ipv6src != NULL)

        SCRadixReleaseRadixTree(io_ctx->tree_ipv6src);

    io_ctx->tree_ipv6src = NULL;

    if (io_ctx->tree_ipv6dst != NULL)

        SCRadixReleaseRadixTree(io_ctx->tree_ipv6dst);

    io_ctx->tree_ipv6dst = NULL;

    if (io_ctx->sig_mapping != NULL)

        SCFree(io_ctx->sig_mapping);

    io_ctx->sig_mapping = NULL;

}

static inline

int IPOnlyMatchCompatSMs(ThreadVars *tv,

                         DetectEngineThreadCtx *det_ctx,

                         Signature *s, Packet *p)

{

    KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_MATCH);

    SigMatchData *smd = s->sm_arrays[DETECT_SM_LIST_MATCH];

    if (smd) {

        while (1) {

            DEBUG_VALIDATE_BUG_ON(!(sigmatch_table[smd->type].flags & SIGMATCH_IPONLY_COMPAT));

            KEYWORD_PROFILING_START;

            if (sigmatch_table[smd->type].Match(det_ctx, p, s, smd->ctx) > 0) {

                KEYWORD_PROFILING_END(det_ctx, smd->type, 1);

                if (smd->is_last)

                    break;

                smd++;

                continue;

            }

            KEYWORD_PROFILING_END(det_ctx, smd->type, 0);

            return 0;

        }

    }

    return 1;

}

/**

 * \brief Match a packet against the IP Only detection engine contexts

 *

 * \param de_ctx Pointer to the current detection engine

 * \param io_ctx Pointer to the current ip only detection engine

 * \param io_ctx Pointer to the current ip only thread detection engine

 * \param p Pointer to the Packet to match against

 */

void IPOnlyMatchPacket(ThreadVars *tv, const DetectEngineCtx *de_ctx,

        DetectEngineThreadCtx *det_ctx, const DetectEngineIPOnlyCtx *io_ctx, Packet *p)

{

    SigNumArray *src = NULL;

    SigNumArray *dst = NULL;

    void *user_data_src = NULL, *user_data_dst = NULL;

    SCEnter();

    if (p->src.family == AF_INET) {

        (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)&GET_IPV4_SRC_ADDR_U32(p),

                                              io_ctx->tree_ipv4src, &user_data_src);

    } else if (p->src.family == AF_INET6) {

        (void)SCRadixFindKeyIPV6BestMatch((uint8_t *)&GET_IPV6_SRC_ADDR(p),

                                              io_ctx->tree_ipv6src, &user_data_src);

    }

    if (p->dst.family == AF_INET) {

        (void)SCRadixFindKeyIPV4BestMatch((uint8_t *)&GET_IPV4_DST_ADDR_U32(p),

                                              io_ctx->tree_ipv4dst, &user_data_dst);

    } else if (p->dst.family == AF_INET6) {