Initial implementation of filemagic keyword.

src/Makefile.am

@@ -154,6 +154,7 @@ detect-asn1.c detect-asn1.h \
 detect-filename.c detect-filename.h \
 detect-fileext.c detect-fileext.h \
 detect-filestore.c detect-filestore.h \
+detect-filemagic.c detect-filemagic.h \
 detect-http-stat-code.c detect-http-stat-code.h \
 detect-ssl-version.c detect-ssl-version.h \
 detect-ssl-state.c detect-ssl-state.h \

src/detect-engine-file.c

@@ -104,6 +104,12 @@ static int DetectFileInspect(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Flo
                 break;
             }
 
+            if (s->file_flags & FILE_SIG_NEED_FILECONTENT && file->chunks_head == NULL) {
+                SCLogDebug("sig needs file content, but we don't have any");
+                r = 0;
+                break;
+            }
+
             /* run the file match functions. */
             for (sm = s->sm_lists[DETECT_SM_LIST_FILEMATCH]; sm != NULL; sm = sm->next) {
                 SCLogDebug("sm %p, sm->next %p", sm, sm->next);

src/detect-filemagic.c

@@ -0,0 +1,363 @@
+/* Copyright (C) 2007-2011 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ *
+ */
+
+#include "suricata-common.h"
+#include "threads.h"
+#include "debug.h"
+#include "decode.h"
+
+#include "detect.h"
+#include "detect-parse.h"
+
+#include "detect-engine.h"
+#include "detect-engine-mpm.h"
+#include "detect-engine-state.h"
+
+#include "flow.h"
+#include "flow-var.h"
+#include "flow-util.h"
+
+#include "util-debug.h"
+#include "util-spm-bm.h"
+#include "util-magic.h"
+
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+
+#include "app-layer.h"
+
+#include "stream-tcp.h"
+
+#include "detect-filemagic.h"
+
+int DetectFilemagicMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t, void *, Signature *, SigMatch *);
+static int DetectFilemagicSetup (DetectEngineCtx *, Signature *, char *);
+void DetectFilemagicRegisterTests(void);
+void DetectFilemagicFree(void *);
+
+/**
+ * \brief Registration function for keyword: filemagic
+ */
+void DetectFilemagicRegister(void) {
+    sigmatch_table[DETECT_FILEMAGIC].name = "filemagic";
+    sigmatch_table[DETECT_FILEMAGIC].Match = NULL;
+    sigmatch_table[DETECT_FILEMAGIC].AppLayerMatch = DetectFilemagicMatch;
+    sigmatch_table[DETECT_FILEMAGIC].alproto = ALPROTO_HTTP;
+    sigmatch_table[DETECT_FILEMAGIC].Setup = DetectFilemagicSetup;
+    sigmatch_table[DETECT_FILEMAGIC].Free  = DetectFilemagicFree;
+    sigmatch_table[DETECT_FILEMAGIC].RegisterTests = DetectFilemagicRegisterTests;
+
+	SCLogDebug("registering filemagic rule option");
+    return;
+}
+
+#define FILEMAGIC_MIN_SIZE  512
+
+/**
+ *  \brief run the magic check
+ *
+ *  \param file the file
+ *
+ *  \retval -1 error
+ *  \retval 0 ok
+ */
+static int FilemagicLookup(FlowFile *file) {
+    if (file == NULL || file->chunks_head == NULL) {
+        SCReturnInt(-1);
+    }
+
+    if (file->chunks_head->len >= FILEMAGIC_MIN_SIZE) {
+        file->magic = MagicLookup(file->chunks_head->data, FILEMAGIC_MIN_SIZE);
+    } else {
+        uint8_t *buf = SCMalloc(FILEMAGIC_MIN_SIZE);
+        uint32_t size = 0;
+
+        if (buf != NULL) {
+            FlowFileData *ffd = file->chunks_head;
+
+            for ( ; ffd != NULL; ffd = ffd->next) {
+                uint32_t copy_len = ffd->len;
+                if (size + ffd->len > FILEMAGIC_MIN_SIZE)
+                    copy_len = FILEMAGIC_MIN_SIZE - size;
+
+                memcpy(buf + size, ffd->data, copy_len);
+                size += copy_len;
+
+                if (size >= FILEMAGIC_MIN_SIZE) {
+                    file->magic = MagicLookup(buf, size);
+                    break;
+                }
+
+                /* file is done but smaller than FILEMAGIC_MIN_SIZE */
+                if (ffd->next == NULL && file->state >= FLOWFILE_STATE_CLOSED) {
+                    file->magic = MagicLookup(buf, size);
+                    break;
+                }
+            }
+
+            SCFree(buf);
+        }
+    }
+
+    SCReturnInt(0);
+}
+
+/**
+ * \brief match the specified filemagic
+ *
+ * \param t pointer to thread vars
+ * \param det_ctx pointer to the pattern matcher thread
+ * \param p pointer to the current packet
+ * \param m pointer to the sigmatch that we will cast into DetectFilemagicData
+ *
+ * \retval 0 no match
+ * \retval 1 match
+ */
+int DetectFilemagicMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m)
+{
+    SCEnter();
+    int ret = 0;
+
+    DetectFilemagicData *filemagic = m->ctx;
+    FlowFile *file = (FlowFile *)state;
+
+    if (file->txid < det_ctx->tx_id)
+        SCReturnInt(0);
+
+    if (file->txid > det_ctx->tx_id)
+        SCReturnInt(0);
+
+    if (file->magic == NULL) {
+        FilemagicLookup(file);
+    }
+
+    if (file->magic != NULL) {
+        SCLogDebug("magic %s", file->magic);
+
+        if (BoyerMooreNocase(filemagic->name, filemagic->len, (uint8_t *)file->magic,
+                    strlen(file->magic), filemagic->bm_ctx->bmGs,
+                    filemagic->bm_ctx->bmBc) != NULL)
+        {
+#ifdef DEBUG
+            if (SCLogDebugEnabled()) {
+                char *name = SCMalloc(filemagic->len + 1);
+                memcpy(name, filemagic->name, filemagic->len);
+                name[filemagic->len] = '\0';
+                SCLogDebug("will look for filemagic %s", name);
+            }
+#endif
+
+            if (!(filemagic->flags & DETECT_CONTENT_NEGATED)) {
+                ret = 1;
+            }
+        }
+
+        if (ret == 0 && filemagic->flags & DETECT_CONTENT_NEGATED) {
+            SCLogDebug("negated match");
+            ret = 1;
+        }
+    }
+
+    SCReturnInt(ret);
+}
+
+/**
+ * \brief Parse the filemagic keyword
+ *
+ * \param idstr Pointer to the user provided option
+ *
+ * \retval filemagic pointer to DetectFilemagicData on success
+ * \retval NULL on failure
+ */
+DetectFilemagicData *DetectFilemagicParse (char *str)
+{
+    DetectFilemagicData *filemagic = NULL;
+
+    /* We have a correct filemagic option */
+    filemagic = SCMalloc(sizeof(DetectFilemagicData));
+    if (filemagic == NULL)
+        goto error;
+
+    memset(filemagic, 0x00, sizeof(DetectFilemagicData));
+
+    if (DetectParseContentString (str, &filemagic->name, &filemagic->len, &filemagic->flags) == -1) {
+        goto error;
+    }
+
+    filemagic->bm_ctx = BoyerMooreCtxInit(filemagic->name, filemagic->len);
+    if (filemagic->bm_ctx == NULL) {
+        goto error;
+    }
+
+    SCLogDebug("flags %02X", filemagic->flags);
+    if (filemagic->flags & DETECT_CONTENT_NEGATED) {
+        SCLogDebug("negated filemagic");
+    }
+
+    BoyerMooreCtxToNocase(filemagic->bm_ctx, filemagic->name, filemagic->len);
+#ifdef DEBUG
+    if (SCLogDebugEnabled()) {
+        char *name = SCMalloc(filemagic->len + 1);
+        memcpy(name, filemagic->name, filemagic->len);
+        name[filemagic->len] = '\0';
+        SCLogDebug("will look for filemagic %s", name);
+    }
+#endif
+
+    return filemagic;
+
+error:
+    if (filemagic != NULL)
+        DetectFilemagicFree(filemagic);
+    return NULL;
+}
+
+/**
+ * \brief this function is used to parse filemagic options
+ * \brief into the current signature
+ *
+ * \param de_ctx pointer to the Detection Engine Context
+ * \param s pointer to the Current Signature
+ * \param str pointer to the user provided "filemagic" option
+ *
+ * \retval 0 on Success
+ * \retval -1 on Failure
+ */
+static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
+{
+    DetectFilemagicData *filemagic = NULL;
+    SigMatch *sm = NULL;
+
+    filemagic = DetectFilemagicParse(str);
+    if (filemagic == NULL)
+        goto error;
+
+    /* Okay so far so good, lets get this into a SigMatch
+     * and put it in the Signature. */
+    sm = SigMatchAlloc();
+    if (sm == NULL)
+        goto error;
+
+    sm->type = DETECT_FILEMAGIC;
+    sm->ctx = (void *)filemagic;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_FILEMATCH);
+
+    if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) {
+        SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords.");
+        goto error;
+    }
+
+    AppLayerHtpNeedFileInspection();
+
+    s->alproto = ALPROTO_HTTP;
+
+    s->file_flags |= (FILE_SIG_NEED_FILE|FILE_SIG_NEED_FILECONTENT);
+    return 0;
+
+error:
+    if (filemagic != NULL)
+        DetectFilemagicFree(filemagic);
+    if (sm != NULL)
+        SCFree(sm);
+    return -1;
+}
+
+/**
+ * \brief this function will free memory associated with DetectFilemagicData
+ *
+ * \param filemagic pointer to DetectFilemagicData
+ */
+void DetectFilemagicFree(void *ptr) {
+    if (ptr != NULL) {
+        DetectFilemagicData *filemagic = (DetectFilemagicData *)ptr;
+        if (filemagic->bm_ctx != NULL) {
+            BoyerMooreCtxDeInit(filemagic->bm_ctx);
+        }
+        SCFree(filemagic);
+    }
+}
+
+#ifdef UNITTESTS /* UNITTESTS */
+
+/**
+ * \test DetectFilemagicTestParse01
+ */
+int DetectFilemagicTestParse01 (void) {
+    DetectFilemagicData *dnd = DetectFilemagicParse("secret.pdf");
+    if (dnd != NULL) {
+        DetectFilemagicFree(dnd);
+        return 1;
+    }
+    return 0;
+}
+
+/**
+ * \test DetectFilemagicTestParse02
+ */
+int DetectFilemagicTestParse02 (void) {
+    int result = 0;
+
+    DetectFilemagicData *dnd = DetectFilemagicParse("\"backup.tar.gz\"");
+    if (dnd != NULL) {
+        if (dnd->len == 13 && memcmp(dnd->name, "backup.tar.gz", 13) == 0) {
+            result = 1;
+        }
+
+        DetectFilemagicFree(dnd);
+        return result;
+    }
+    return 0;
+}
+
+/**
+ * \test DetectFilemagicTestParse03
+ */
+int DetectFilemagicTestParse03 (void) {
+    int result = 0;
+
+    DetectFilemagicData *dnd = DetectFilemagicParse("cmd.exe");
+    if (dnd != NULL) {
+        if (dnd->len == 7 && memcmp(dnd->name, "cmd.exe", 7) == 0) {
+            result = 1;
+        }
+
+        DetectFilemagicFree(dnd);
+        return result;
+    }
+    return 0;
+}
+
+#endif /* UNITTESTS */
+
+/**
+ * \brief this function registers unit tests for DetectFilemagic
+ */
+void DetectFilemagicRegisterTests(void) {
+#ifdef UNITTESTS /* UNITTESTS */
+    UtRegisterTest("DetectFilemagicTestParse01", DetectFilemagicTestParse01, 1);
+    UtRegisterTest("DetectFilemagicTestParse02", DetectFilemagicTestParse02, 1);
+    UtRegisterTest("DetectFilemagicTestParse03", DetectFilemagicTestParse03, 1);
+#endif /* UNITTESTS */
+}

src/detect-filemagic.h

@@ -0,0 +1,39 @@
+/* Copyright (C) 2007-2011 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ */
+
+#ifndef __DETECT_FILEMAGIC_H__
+#define __DETECT_FILEMAGIC_H__
+
+#include "util-spm-bm.h"
+
+typedef struct DetectFilemagicData {
+    uint8_t *name; /** name of the file to match */
+    BmCtx *bm_ctx; /** BM context */
+    uint16_t len; /** name length */
+    uint32_t flags;
+} DetectFilemagicData;
+
+/* prototypes */
+void DetectFilemagicRegister (void);
+
+#endif /* __DETECT_FILEMAGIC_H__ */

src/detect-filename.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2011 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free

src/detect.c

@@ -93,6 +93,7 @@
 #include "detect-filename.h"
 #include "detect-fileext.h"
 #include "detect-filestore.h"
+#include "detect-filemagic.h"
 #include "detect-dsize.h"
 #include "detect-flowvar.h"
 #include "detect-flowint.h"
@@ -4333,6 +4334,7 @@ void SigTableSetup(void) {
     DetectFilenameRegister();
     DetectFileextRegister();
     DetectFilestoreRegister();
+    DetectFilemagicRegister();
 
     uint8_t i = 0;
     for (i = 0; i < DETECT_TBLSIZE; i++) {

src/detect.h

@@ -1042,6 +1042,7 @@ enum {
     DETECT_FILENAME,
     DETECT_FILEEXT,
     DETECT_FILESTORE,
+    DETECT_FILEMAGIC,
 
     /* make sure this stays last */
     DETECT_TBLSIZE,

src/flow-file.h

@@ -58,6 +58,7 @@ typedef struct FlowFile_ {
     uint16_t name_len;
     int16_t state;
     int fd;                         /**< file discriptor for storing files */
+    const char *magic;
     FlowFileData *chunks_head;
     FlowFileData *chunks_tail;
     struct FlowFile_ *next;