mirror of https://github.com/OISF/suricata
Implement filestore keyword, including a way for the stateful detection engine to conclude that a file will never have to be stored.
Victor Julien
15 years ago
parent
3e7baa6810
commit
23e01d23d3
@ -0,0 +1,186 @@
|
||||
/* Copyright (C) 2007-2011 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine-state.h"
|
||||
|
||||
#include "detect-engine-uri.h"
|
||||
#include "detect-engine-hcbd.h"
|
||||
#include "detect-engine-hhd.h"
|
||||
#include "detect-engine-hrhd.h"
|
||||
#include "detect-engine-hmd.h"
|
||||
#include "detect-engine-hcd.h"
|
||||
#include "detect-engine-hrud.h"
|
||||
#include "detect-engine-dcepayload.h"
|
||||
|
||||
#include "stream-tcp.h"
|
||||
#include "stream-tcp-private.h"
|
||||
#include "stream-tcp-reassemble.h"
|
||||
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-protos.h"
|
||||
#include "app-layer-htp.h"
|
||||
#include "app-layer-smb.h"
|
||||
#include "app-layer-dcerpc-common.h"
|
||||
#include "app-layer-dcerpc.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "util-profiling.h"
|
||||
|
||||
|
||||
/**
|
||||
* \brief Inspect the file inspecting keywords.
|
||||
*
|
||||
* \param tv thread vars
|
||||
* \param det_ctx detection engine thread ctx
|
||||
* \param f flow
|
||||
* \param s signature to inspect
|
||||
*
|
||||
* \retval 0 no match
|
||||
* \retval 1 match
|
||||
* \retval 2 can't match
|
||||
* \retval 3 can't match filestore signature
|
||||
*
|
||||
* \note flow is not locked at this time
|
||||
*/
|
||||
static int DetectFileInspect(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Flow *f, Signature *s) {
|
||||
SigMatch *sm = NULL;
|
||||
int r = 0;
|
||||
int match = 0;
|
||||
|
||||
SCLogDebug("file inspection...");
|
||||
|
||||
SCMutexLock(&f->files_m);
|
||||
if (f->files != NULL) {
|
||||
FlowFile *file = f->files->head;
|
||||
for (; file != NULL; file = file->next) {
|
||||
SCLogDebug("file");
|
||||
|
||||
if (file->state == FLOWFILE_STATE_NONE) {
|
||||
SCLogDebug("file state FLOWFILE_STATE_NONE");
|
||||
continue;
|
||||
}
|
||||
|
||||
if (file->txid < det_ctx->tx_id) {
|
||||
SCLogDebug("file->txid < det_ctx->tx_id == %u < %u", file->txid, det_ctx->tx_id);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (file->txid > det_ctx->tx_id) {
|
||||
SCLogDebug("file->txid > det_ctx->tx_id == %u > %u", file->txid, det_ctx->tx_id);
|
||||
break;
|
||||
}
|
||||
|
||||
if (s->file_flags & FILE_SIG_NEED_FILENAME && file->name == NULL) {
|
||||
SCLogDebug("sig needs filename, but we don't have any");
|
||||
r = 0;
|
||||
break;
|
||||
}
|
||||
|
||||
/* run the file match functions. */
|
||||
for (sm = s->sm_lists[DETECT_SM_LIST_FILEMATCH]; sm != NULL; sm = sm->next) {
|
||||
SCLogDebug("sm %p, sm->next %p", sm, sm->next);
|
||||
|
||||
if (sigmatch_table[sm->type].AppLayerMatch != NULL) {
|
||||
match = sigmatch_table[sm->type].
|
||||
AppLayerMatch(tv, det_ctx, f, 0, (void *)file, s, sm);
|
||||
if (match == 0) {
|
||||
r = 2;
|
||||
break;
|
||||
} else if (sm->next == NULL) {
|
||||
r = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (r == 1)
|
||||
break;
|
||||
|
||||
/* if this is a filestore sig, and the sig can't match
|
||||
* return 3 so we can distinguish */
|
||||
if (s->init_flags & SIG_FLAG_FILESTORE && r == 2)
|
||||
r = 3;
|
||||
}
|
||||
}
|
||||
|
||||
SCMutexUnlock(&f->files_m);
|
||||
SCReturnInt(r);
|
||||
}
|
||||
|
||||
int DetectFileInspectHttp(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Flow *f, Signature *s, void *alstate) {
|
||||
SCEnter();
|
||||
|
||||
int r = 0;
|
||||
HtpState *htp_state = NULL;
|
||||
size_t idx = 0;
|
||||
size_t start_tx = 0;
|
||||
size_t end_tx = 0;
|
||||
int match = 0;
|
||||
|
||||
htp_state = (HtpState *)alstate;
|
||||
if (htp_state == NULL) {
|
||||
SCLogDebug("no HTTP state");
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
/* locking the flow, we will inspect the htp state */
|
||||
SCMutexLock(&f->m);
|
||||
if (htp_state->connp != NULL && htp_state->connp->conn != NULL)
|
||||
{
|
||||
start_tx = AppLayerTransactionGetInspectId(f);
|
||||
end_tx = list_size(htp_state->connp->conn->transactions);
|
||||
|
||||
}
|
||||
SCMutexUnlock(&f->m);
|
||||
|
||||
for (idx = start_tx ; idx < end_tx; idx++)
|
||||
{
|
||||
/* inspect files for this transaction */
|
||||
det_ctx->tx_id = (uint16_t)idx;
|
||||
|
||||
match = DetectFileInspect(tv, det_ctx, f, s);
|
||||
if (match == 1) {
|
||||
r = 1;
|
||||
} else if (match == 2) {
|
||||
if (r != 1) {
|
||||
SCLogDebug("sid %u can't match on this transaction", s->id);
|
||||
r = 2;
|
||||
}
|
||||
} else if (match == 3) {
|
||||
if (r != 1) {
|
||||
SCLogDebug("sid %u can't match on this transaction (filestore sig)", s->id);
|
||||
r = 3;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
SCReturnInt(r);
|
||||
}
|
||||
@ -0,0 +1,29 @@
|
||||
/* Copyright (C) 2007-2011 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_ENGINE_FILE_H__
|
||||
#define __DETECT_ENGINE_FILE_H__
|
||||
|
||||
int DetectFileInspectHttp(ThreadVars *, DetectEngineThreadCtx *, Flow *, Signature *, void *);
|
||||
|
||||
#endif /* __DETECT_ENGINE_FILE_H__ */
|
||||
@ -0,0 +1,131 @@
|
||||
/* Copyright (C) 2007-2011 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-state.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
|
||||
#include "util-debug.h"
|
||||
#include "util-spm-bm.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
|
||||
#include "stream-tcp.h"
|
||||
|
||||
#include "detect-filestore.h"
|
||||
|
||||
int DetectFilestoreMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *);
|
||||
static int DetectFilestoreSetup (DetectEngineCtx *, Signature *, char *);
|
||||
|
||||
/**
|
||||
* \brief Registration function for keyword: filestore
|
||||
*/
|
||||
void DetectFilestoreRegister(void) {
|
||||
sigmatch_table[DETECT_FILESTORE].name = "filestore";
|
||||
sigmatch_table[DETECT_FILESTORE].Match = NULL;
|
||||
sigmatch_table[DETECT_FILESTORE].AppLayerMatch = DetectFilestoreMatch;
|
||||
sigmatch_table[DETECT_FILESTORE].alproto = ALPROTO_HTTP;
|
||||
sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup;
|
||||
sigmatch_table[DETECT_FILESTORE].Free = NULL;
|
||||
sigmatch_table[DETECT_FILESTORE].RegisterTests = NULL;
|
||||
|
||||
SCLogDebug("registering filestore rule option");
|
||||
return;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief match the specified filestore
|
||||
*
|
||||
* \param t pointer to thread vars
|
||||
* \param det_ctx pointer to the pattern matcher thread
|
||||
* \param p pointer to the current packet
|
||||
* \param m pointer to the sigmatch that we will cast into DetectFilestoreData
|
||||
*
|
||||
* \retval 0 no match
|
||||
* \retval 1 match
|
||||
*/
|
||||
int DetectFilestoreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
|
||||
uint8_t flags, void *state, Signature *s, SigMatch *m)
|
||||
{
|
||||
SCEnter();
|
||||
FlowFile *file = (FlowFile *)state;
|
||||
FlowFileStore(file);
|
||||
SCReturnInt(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function is used to parse filestore options
|
||||
* \brief into the current signature
|
||||
*
|
||||
* \param de_ctx pointer to the Detection Engine Context
|
||||
* \param s pointer to the Current Signature
|
||||
* \param str pointer to the user provided "filestore" option
|
||||
*
|
||||
* \retval 0 on Success
|
||||
* \retval -1 on Failure
|
||||
*/
|
||||
static int DetectFilestoreSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
|
||||
{
|
||||
SigMatch *sm = NULL;
|
||||
|
||||
sm = SigMatchAlloc();
|
||||
if (sm == NULL)
|
||||
goto error;
|
||||
|
||||
sm->type = DETECT_FILESTORE;
|
||||
sm->ctx = NULL;
|
||||
|
||||
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH);
|
||||
|
||||
if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) {
|
||||
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords.");
|
||||
goto error;
|
||||
}
|
||||
|
||||
AppLayerHtpNeedFileInspection();
|
||||
|
||||
s->alproto = ALPROTO_HTTP;
|
||||
|
||||
s->init_flags |= SIG_FLAG_FILESTORE;
|
||||
return 0;
|
||||
|
||||
error:
|
||||
if (sm != NULL)
|
||||
SCFree(sm);
|
||||
return -1;
|
||||
}
|
||||
@ -0,0 +1,30 @@
|
||||
/* Copyright (C) 2007-2011 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_FILESTORE_H__
|
||||
#define __DETECT_FILESTORE_H__
|
||||
|
||||
/* prototypes */
|
||||
void DetectFilestoreRegister (void);
|
||||
|
||||
#endif /* __DETECT_FILESTORE_H__ */
|
||||
Loading…
Reference in New Issue