You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/src/detect-id.c

430 lines
11 KiB
C

/**
* Copyright (c) 2009 Open Information Security Foundation
*
* \file detect-id.c
* \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
*
* "id" keyword, IPv4 Identifier keyword, part of the detection engine.
*/
#include "eidps-common.h"
#include "debug.h"
#include "decode.h"
#include "detect.h"
#include "detect-id.h"
#include "flow.h"
#include "flow-var.h"
#include "util-debug.h"
#include "util-unittest.h"
/**
* \brief Regex for parsing "id" option, matching number or "number"
*/
#define PARSE_REGEX "^\\s*([0-9]{1,5}|\"[0-9]{1,5}\")\\s*$"
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectIdMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
Signature *, SigMatch *);
int DetectIdSetup (DetectEngineCtx *, Signature *, SigMatch *, char *);
void DetectIdRegisterTests(void);
void DetectIdFree(void *);
/**
* \brief Registration function for keyword: id
*/
void DetectIdRegister (void) {
sigmatch_table[DETECT_ID].name = "id";
sigmatch_table[DETECT_ID].Match = DetectIdMatch;
sigmatch_table[DETECT_ID].Setup = DetectIdSetup;
sigmatch_table[DETECT_ID].Free = DetectIdFree;
sigmatch_table[DETECT_ID].RegisterTests = DetectIdRegisterTests;
const char *eb;
int eo;
int opts = 0;
SCLogDebug("detect-id: Registering id rule option\n");
parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
if (parse_regex == NULL) {
SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s\n",
PARSE_REGEX, eo, eb);
goto error;
}
parse_regex_study = pcre_study(parse_regex, 0, &eb);
if (eb != NULL) {
SCLogDebug("pcre study failed: %s\n", eb);
goto error;
}
return;
error:
return;
}
/**
* \brief This function is used to match the specified id on a packet
*
* \param t pointer to thread vars
* \param det_ctx pointer to the pattern matcher thread
* \param p pointer to the current packet
* \param m pointer to the sigmatch that we will cast into DetectIdData
*
* \retval 0 no match
* \retval 1 match
*/
int DetectIdMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p,
Signature *s, SigMatch *m)
{
DetectIdData *id_d = (DetectIdData *)m->ctx;
/**
* To match a ipv4 packet with a "id" rule
*/
if (!PKT_IS_IPV4(p)) {
return 0;
}
if (id_d->id == IPV4_GET_IPID(p)) {
SCLogDebug("detect-id: IPV4 Proto and matched with ip_id: %u.\n",
id_d->id);
return 1;
}
return 0;
}
/**
* \brief This function is used to parse IPV4 ip_id passed via keyword: "id"
*
* \param idstr Pointer to the user provided id option
*
* \retval id_d pointer to DetectIdData on success
* \retval NULL on failure
*/
DetectIdData *DetectIdParse (char *idstr)
{
uint32_t temp;
DetectIdData *id_d = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, idstr, strlen(idstr), 0, 0,
ov, MAX_SUBSTRINGS);
if (ret < 1 || ret > 3) {
SCLogDebug("detect-id: invalid id option. The id option value must be"
" in the range %u - %u\n",
DETECT_IPID_MIN, DETECT_IPID_MAX);
goto error;
}
if (ret > 1) {
const char *str_ptr;
char *orig;
char *tmp_str;
res = pcre_get_substring((char *)idstr, ov, MAX_SUBSTRINGS, 1,
&str_ptr);
if (res < 0) {
SCLogDebug("DetectIdParse: pcre_get_substring failed\n");
goto error;
}
/* We have a correct id option */
id_d = malloc(sizeof(DetectIdData));
if (id_d == NULL) {
SCLogDebug("DetectIdParse malloc failed\n");
goto error;
}
orig = strdup((char*)str_ptr);
tmp_str=orig;
/* Let's see if we need to scape "'s */
if (tmp_str[0] == '"')
{
tmp_str[strlen(tmp_str) - 1] = '\0';
tmp_str += 1;
}
/* ok, fill the id data */
temp = atoi((char *)tmp_str);
if (temp > DETECT_IPID_MAX || temp < DETECT_IPID_MIN) {
SCLogDebug("detect-id: \"id\" option must be in "
"the range %u - %u\n",
DETECT_IPID_MIN, DETECT_IPID_MAX);
free(orig);
goto error;
}
id_d->id = temp;
free(orig);
SCLogDebug("detect-id: will look for ip_id: %u\n", id_d->id);
}
return id_d;
error:
if (id_d != NULL) DetectIdFree(id_d);
return NULL;
}
/**
* \brief this function is used to add the parsed "id" option
* \brief into the current signature
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param idstr pointer to the user provided "id" option
*
* \retval 0 on Success
* \retval -1 on Failure
*/
int DetectIdSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
char *idstr)
{
DetectIdData *id_d = NULL;
SigMatch *sm = NULL;
id_d = DetectIdParse(idstr);
if (id_d == NULL) goto error;
/* Okay so far so good, lets get this into a SigMatch
* and put it in the Signature. */
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_ID;
sm->ctx = (void *)id_d;
SigMatchAppend(s,m,sm);
return 0;
error:
if (id_d != NULL) DetectIdFree(id_d);
if (sm != NULL) free(sm);
return -1;
}
/**
* \brief this function will free memory associated with DetectIdData
*
* \param id_d pointer to DetectIdData
*/
void DetectIdFree(void *ptr) {
DetectIdData *id_d = (DetectIdData *)ptr;
free(id_d);
}
#ifdef UNITTESTS /* UNITTESTS */
/**
* \test DetectIdTestParse01 is a test to make sure that we parse the "id"
* option correctly when given valid id option
*/
int DetectIdTestParse01 (void) {
DetectIdData *id_d = NULL;
id_d = DetectIdParse(" 35402 ");
if (id_d != NULL &&id_d->id==35402) {
DetectIdFree(id_d);
return 1;
}
return 0;
}
/**
* \test DetectIdTestParse02 is a test to make sure that we parse the "id"
* option correctly when given an invalid id option
* it should return id_d = NULL
*/
int DetectIdTestParse02 (void) {
DetectIdData *id_d = NULL;
id_d = DetectIdParse("65537");
if (id_d == NULL) {
DetectIdFree(id_d);
return 1;
}
return 0;
}
/**
* \test DetectIdTestParse03 is a test to make sure that we parse the "id"
* option correctly when given an invalid id option
* it should return id_d = NULL
*/
int DetectIdTestParse03 (void) {
DetectIdData *id_d = NULL;
id_d = DetectIdParse("12what?");
if (id_d == NULL) {
DetectIdFree(id_d);
return 1;
}
return 0;
}
/**
* \test DetectIdTestParse04 is a test to make sure that we parse the "id"
* option correctly when given valid id option but wrapped with "'s
*/
int DetectIdTestParse04 (void) {
DetectIdData *id_d = NULL;
/* yep, look if we trim blank spaces correctly and ignore "'s */
id_d = DetectIdParse(" \"35402\" ");
if (id_d != NULL &&id_d->id==35402) {
DetectIdFree(id_d);
return 1;
}
return 0;
}
/**
* \test DetectIdTestPacket01 is a test to check "id" option with constructed
* packets, expecting to match
* Parse Id Data: expecting ip_id == 41158
* The packet has ip_id == 41158 so it must match
*/
int DetectIdTestPacket01 (void) {
DetectIdData *id_d = NULL;
id_d = DetectIdParse(" 41158");
if (id_d == NULL) {
SCLogDebug("DetectIdTestPacket01: expected a DetectIdData pointer"
" (got NULL)\n");
return 0;
}
/* Buid and decode the packet */
uint8_t raw_eth [] = {
0x00, 0x14, 0xf8, 0x50, 0xf9, 0x09, 0x00, 0x10,
0xdc, 0x4f, 0xe6, 0x09, 0x08, 0x00, 0x45, 0x00,
0x00, 0x3c, 0xa0, 0xc6, 0x40, 0x00, 0x40, 0x06,
0xab, 0x46, 0xc0, 0xa8, 0x00, 0xdc, 0x4b, 0x7d,
0xe1, 0xad, 0xbe, 0x23, 0x00, 0x50, 0xf4, 0x66,
0x71, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02,
0x16, 0xd0, 0x45, 0xf0, 0x00, 0x00, 0x02, 0x04,
0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x06, 0xae,
0xd1, 0x23, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03,
0x03, 0x06 };
Packet q;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&q, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodeEthernet(&tv, &dtv, &q, raw_eth, sizeof(raw_eth), NULL);
FlowShutdown();
Packet *p=&q;
if (!(PKT_IS_IPV4(p))) {
SCLogDebug("detect-id: TestPacket01: Packet is not IPV4\n");
return 0;
}
DetectEngineThreadCtx *det_ctx=NULL;
Signature *s=NULL;
SigMatch m;
m.ctx=id_d;
/* Now that we have what we need, just try to Match! */
return DetectIdMatch (&tv, det_ctx, p, s, &m);
}
/**
* \test DetectIdTestPacket02 is a test to check "id" option with
* constructed packets
* Parse Id Data: expecting ip_id == 41159
* The packet has ip_id == 41158 so it must NOT match
*/
int DetectIdTestPacket02 (void) {
DetectIdData *id_d = NULL;
id_d = DetectIdParse("41159 ");
if (id_d == NULL) {
SCLogDebug("DetectIdTestPacket01: expected a DetectIdData pointer"
" (got NULL)\n");
return 0;
}
/* Buid and decode the packet */
uint8_t raw_eth [] = {
0x00, 0x14, 0xf8, 0x50, 0xf9, 0x09, 0x00, 0x10,
0xdc, 0x4f, 0xe6, 0x09, 0x08, 0x00, 0x45, 0x00,
0x00, 0x3c, 0xa0, 0xc6, 0x40, 0x00, 0x40, 0x06,
0xab, 0x46, 0xc0, 0xa8, 0x00, 0xdc, 0x4b, 0x7d,
0xe1, 0xad, 0xbe, 0x23, 0x00, 0x50, 0xf4, 0x66,
0x71, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02,
0x16, 0xd0, 0x45, 0xf0, 0x00, 0x00, 0x02, 0x04,
0x05, 0xb4, 0x04, 0x02, 0x08, 0x0a, 0x06, 0xae,
0xd1, 0x23, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03,
0x03, 0x06 };
Packet q;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&q, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodeEthernet(&tv, &dtv, &q, raw_eth, sizeof(raw_eth), NULL);
FlowShutdown();
Packet *p=&q;
if (!(PKT_IS_IPV4(p))) {
SCLogDebug("detect-id: TestPacket01: Packet is not IPV4\n");
return 0;
}
DetectEngineThreadCtx *det_ctx=NULL;
Signature *s=NULL;
SigMatch m;
m.ctx=id_d;
/* Now that we have what we need, just try "not" to Match! */
if (DetectIdMatch (&tv, det_ctx, p, s, &m))
return 0;
else
return 1;
}
#endif /* UNITTESTS */
/**
* \brief this function registers unit tests for DetectId
*/
void DetectIdRegisterTests(void) {
#ifdef UNITTESTS /* UNITTESTS */
UtRegisterTest("DetectIdTestParse01", DetectIdTestParse01, 1);
UtRegisterTest("DetectIdTestParse02", DetectIdTestParse02, 1);
UtRegisterTest("DetectIdTestParse03", DetectIdTestParse03, 1);
UtRegisterTest("DetectIdTestParse04", DetectIdTestParse04, 1);
UtRegisterTest("DetectIdTestPacket01" , DetectIdTestPacket01 , 1);
UtRegisterTest("DetectIdTestPacket02" , DetectIdTestPacket02 , 1);
#endif /* UNITTESTS */
}