meta-security/recipes-ids/suricata/files/CVE-2024-45795.patch

From 72456d359bf3064306b62024c809bb30b162f18c Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Mon, 12 Aug 2024 09:54:43 +0200
Subject: [PATCH] detect/datasets: implement unset command

Ticket: 7195

Otherwise, Suricata aborted on such a rule

(cherry picked from commit e47598110a557bb9f87ea498d85ba91a45bb0cb6)

Upstream-Status: Backport [https://github.com/OISF/suricata/commit/72456d359bf3064306b62024c809bb30b162f18c && https://github.com/OISF/suricata/commit/96d5c81aed01f2bc0cd3e2e60057d0deb38caa99]
CVE: CVE-2024-45795
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 doc/userguide/rules/datasets.rst |  2 +-
 src/datasets.c                   | 20 ++++++++++++++++++++
 src/datasets.h                   |  1 +
 src/detect-dataset.c             | 11 +++++++++++
 src/detect-dataset.h             |  5 -----
 5 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst
index 647b12e..dd9ecd2 100644
--- a/doc/userguide/rules/datasets.rst
+++ b/doc/userguide/rules/datasets.rst
@@ -78,7 +78,7 @@ Syntax::
 
     dataset:<cmd>,<name>,<options>;
 
-    dataset:<set|isset|isnotset>,<name> \
+    dataset:<set|unset|isset|isnotset>,<name> \
         [, type <string|md5|sha256|ipv4|ip>, save <file name>, load <file name>, state <file name>, memcap <size>, hashsize <size>];
 
 type <type>
diff --git a/src/datasets.c b/src/datasets.c
index d89ed8d..32bcf6e 100644
--- a/src/datasets.c
+++ b/src/datasets.c
@@ -1741,3 +1741,23 @@ int DatasetRemoveSerialized(Dataset *set, const char *string)
     return DatasetOpSerialized(set, string, DatasetRemoveString, DatasetRemoveMd5,
             DatasetRemoveSha256, DatasetRemoveIPv4, DatasetRemoveIPv6);
 }
+
+int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len)
+{
+    if (set == NULL)
+        return -1;
+
+    switch (set->type) {
+        case DATASET_TYPE_STRING:
+            return DatasetRemoveString(set, data, data_len);
+        case DATASET_TYPE_MD5:
+            return DatasetRemoveMd5(set, data, data_len);
+        case DATASET_TYPE_SHA256:
+            return DatasetRemoveSha256(set, data, data_len);
+        case DATASET_TYPE_IPV4:
+            return DatasetRemoveIPv4(set, data, data_len);
+        case DATASET_TYPE_IPV6:
+            return DatasetRemoveIPv6(set, data, data_len);
+    }
+    return -1;
+}
diff --git a/src/datasets.h b/src/datasets.h
index af4fc17..0f28a9f 100644
--- a/src/datasets.h
+++ b/src/datasets.h
@@ -56,6 +56,7 @@ Dataset *DatasetFind(const char *name, enum DatasetTypes type);
 Dataset *DatasetGet(const char *name, enum DatasetTypes type, const char *save, const char *load,
         uint64_t memcap, uint32_t hashsize);
 int DatasetAdd(Dataset *set, const uint8_t *data, const uint32_t data_len);
+int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len);
 int DatasetLookup(Dataset *set, const uint8_t *data, const uint32_t data_len);
 DataRepResultType DatasetLookupwRep(Dataset *set, const uint8_t *data, const uint32_t data_len,
         const DataRepType *rep);
diff --git a/src/detect-dataset.c b/src/detect-dataset.c
index 3d29646..aad5cf0 100644
--- a/src/detect-dataset.c
+++ b/src/detect-dataset.c
@@ -41,6 +41,11 @@
 #include "util-path.h"
 #include "util-conf.h"
 
+#define DETECT_DATASET_CMD_SET      0
+#define DETECT_DATASET_CMD_UNSET    1
+#define DETECT_DATASET_CMD_ISNOTSET 2
+#define DETECT_DATASET_CMD_ISSET    3
+
 int DetectDatasetMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
         const Signature *, const SigMatchCtx *);
 static int DetectDatasetSetup (DetectEngineCtx *, Signature *, const char *);
@@ -91,6 +96,12 @@ int DetectDatasetBufferMatch(DetectEngineThreadCtx *det_ctx,
                 return 1;
             break;
         }
+        case DETECT_DATASET_CMD_UNSET: {
+            int r = DatasetRemove(sd->set, data, data_len);
+            if (r == 1)
+                return 1;
+            break;
+        }
         default:
             abort();
     }
diff --git a/src/detect-dataset.h b/src/detect-dataset.h
index ca83267..d243552 100644
--- a/src/detect-dataset.h
+++ b/src/detect-dataset.h
@@ -26,11 +26,6 @@
 
 #include "datasets.h"
 
-#define DETECT_DATASET_CMD_SET      0
-#define DETECT_DATASET_CMD_UNSET    1
-#define DETECT_DATASET_CMD_ISNOTSET 2
-#define DETECT_DATASET_CMD_ISSET    3
-
 typedef struct DetectDatasetData_ {
     Dataset *set;
     uint8_t cmd;
-- 
2.25.1