Add check if obfuscation is enabled

This commit is contained in:
Ned Wright 2023-07-27 15:41:41 +00:00
parent 71d198f41a
commit abe275c828
4 changed files with 17 additions and 0 deletions

View File

@ -7,6 +7,14 @@ using namespace std;
namespace IPSHelper namespace IPSHelper
{ {
bool has_deobfuscation = false;
bool
hasDeobfuscation()
{
return has_deobfuscation;
}
string string
deobfuscateString(const string &str) deobfuscateString(const string &str)
{ {

View File

@ -6,6 +6,7 @@
namespace IPSHelper namespace IPSHelper
{ {
bool hasDeobfuscation();
std::string deobfuscateString(const std::string &str); std::string deobfuscateString(const std::string &str);
std::string deobfuscateKeyword(const std::string &str); std::string deobfuscateKeyword(const std::string &str);

View File

@ -25,6 +25,8 @@ RuleSelector::selectSignatures() const
{ {
vector<IPSSignatureSubTypes::SignatureAndAction> res; vector<IPSSignatureSubTypes::SignatureAndAction> res;
if (!IPSHelper::hasDeobfuscation()) return res;
auto all_signatures = getResource<IPSSignaturesResource>("IPS", "protections"); auto all_signatures = getResource<IPSSignaturesResource>("IPS", "protections");
if (!all_signatures.ok()) return res; if (!all_signatures.ok()) return res;
auto signatures_version = getResourceWithDefault<string>("", "IPS", "VersionId"); auto signatures_version = getResourceWithDefault<string>("", "IPS", "VersionId");

View File

@ -23,6 +23,11 @@
using namespace testing; using namespace testing;
using namespace std; using namespace std;
namespace IPSHelper
{
extern bool has_deobfuscation;
} // namespace IPSHelper
MATCHER_P(IsLog, IteratableFields, "") MATCHER_P(IsLog, IteratableFields, "")
{ {
stringstream ss; stringstream ss;
@ -53,6 +58,7 @@ class SignatureTest : public Test
public: public:
SignatureTest() SignatureTest()
{ {
IPSHelper::has_deobfuscation = true;
generic_rulebase.preload(); generic_rulebase.preload();
EXPECT_CALL(logs, getCurrentLogId()).Times(AnyNumber()); EXPECT_CALL(logs, getCurrentLogId()).Times(AnyNumber());
ON_CALL(table, getState(_)).WillByDefault(Return(&ips_state)); ON_CALL(table, getState(_)).WillByDefault(Return(&ips_state));