mirror of https://github.com/OISF/suricata
ippair: xbit implementation
detect xbits for ippair: initial implementationpull/1422/head
Victor Julien
11 years ago
parent
4c6d564211
commit
61cb2abc8d
@ -0,0 +1,513 @@
|
||||
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*
|
||||
* Implements the xbits keyword
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
#include "threads.h"
|
||||
#include "flow.h"
|
||||
#include "flow-util.h"
|
||||
#include "detect-xbits.h"
|
||||
#include "util-spm.h"
|
||||
|
||||
#include "detect-engine-sigorder.h"
|
||||
|
||||
#include "app-layer-parser.h"
|
||||
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-state.h"
|
||||
|
||||
#include "flow-bit.h"
|
||||
#include "host-bit.h"
|
||||
#include "ippair-bit.h"
|
||||
#include "util-var-name.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-debug.h"
|
||||
|
||||
/*
|
||||
xbits:set,bitname,track ip_pair
|
||||
*/
|
||||
|
||||
#define PARSE_REGEX "([a-z]+)(?:,([^,]+))?(?:,(?:track\\s+([^,]+)))"
|
||||
static pcre *parse_regex;
|
||||
static pcre_extra *parse_regex_study;
|
||||
|
||||
int DetectXbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *);
|
||||
static int DetectXbitSetup (DetectEngineCtx *, Signature *, char *);
|
||||
void DetectXbitFree (void *);
|
||||
void XBitsRegisterTests(void);
|
||||
|
||||
void DetectXbitsRegister (void)
|
||||
{
|
||||
sigmatch_table[DETECT_XBITS].name = "xbits";
|
||||
sigmatch_table[DETECT_XBITS].desc = "operate on bits";
|
||||
// sigmatch_table[DETECT_XBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flowbits";
|
||||
sigmatch_table[DETECT_XBITS].Match = DetectXbitMatch;
|
||||
sigmatch_table[DETECT_XBITS].Setup = DetectXbitSetup;
|
||||
sigmatch_table[DETECT_XBITS].Free = DetectXbitFree;
|
||||
sigmatch_table[DETECT_XBITS].RegisterTests = XBitsRegisterTests;
|
||||
/* this is compatible to ip-only signatures */
|
||||
sigmatch_table[DETECT_XBITS].flags |= SIGMATCH_IPONLY_COMPAT;
|
||||
|
||||
const char *eb;
|
||||
int eo;
|
||||
int opts = 0;
|
||||
|
||||
parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
|
||||
if(parse_regex == NULL)
|
||||
{
|
||||
SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb);
|
||||
goto error;
|
||||
}
|
||||
|
||||
parse_regex_study = pcre_study(parse_regex, 0, &eb);
|
||||
if(eb != NULL)
|
||||
{
|
||||
SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
|
||||
goto error;
|
||||
}
|
||||
|
||||
return;
|
||||
|
||||
error:
|
||||
return;
|
||||
}
|
||||
|
||||
static int DetectIPPairbitMatchToggle (Packet *p, const DetectXbitsData *fd)
|
||||
{
|
||||
IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst);
|
||||
if (pair == NULL)
|
||||
return 0;
|
||||
|
||||
IPPairBitToggle(pair,fd->idx);
|
||||
IPPairRelease(pair);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* return true even if bit not found */
|
||||
static int DetectIPPairbitMatchUnset (Packet *p, const DetectXbitsData *fd)
|
||||
{
|
||||
IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst);
|
||||
if (pair == NULL)
|
||||
return 1;
|
||||
|
||||
IPPairBitUnset(pair,fd->idx);
|
||||
IPPairRelease(pair);
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int DetectIPPairbitMatchSet (Packet *p, const DetectXbitsData *fd)
|
||||
{
|
||||
IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst);
|
||||
if (pair == NULL)
|
||||
return 0;
|
||||
|
||||
IPPairBitSet(pair,fd->idx);
|
||||
IPPairRelease(pair);
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int DetectIPPairbitMatchIsset (Packet *p, const DetectXbitsData *fd)
|
||||
{
|
||||
int r = 0;
|
||||
IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst);
|
||||
if (pair == NULL)
|
||||
return 0;
|
||||
|
||||
r = IPPairBitIsset(pair,fd->idx);
|
||||
IPPairRelease(pair);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int DetectIPPairbitMatchIsnotset (Packet *p, const DetectXbitsData *fd)
|
||||
{
|
||||
int r = 0;
|
||||
IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst);
|
||||
if (pair == NULL)
|
||||
return 1;
|
||||
|
||||
r = IPPairBitIsnotset(pair,fd->idx);
|
||||
IPPairRelease(pair);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* returns 0: no match
|
||||
* 1: match
|
||||
* -1: error
|
||||
*/
|
||||
|
||||
int DetectXbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx)
|
||||
{
|
||||
const DetectXbitsData *fd = (const DetectXbitsData *)ctx;
|
||||
if (fd == NULL)
|
||||
return 0;
|
||||
|
||||
switch (fd->cmd) {
|
||||
case DETECT_XBITS_CMD_ISSET:
|
||||
return DetectIPPairbitMatchIsset(p,fd);
|
||||
case DETECT_XBITS_CMD_ISNOTSET:
|
||||
return DetectIPPairbitMatchIsnotset(p,fd);
|
||||
case DETECT_XBITS_CMD_SET:
|
||||
return DetectIPPairbitMatchSet(p,fd);
|
||||
case DETECT_XBITS_CMD_UNSET:
|
||||
return DetectIPPairbitMatchUnset(p,fd);
|
||||
case DETECT_XBITS_CMD_TOGGLE:
|
||||
return DetectIPPairbitMatchToggle(p,fd);
|
||||
default:
|
||||
SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown cmd %" PRIu32 "", fd->cmd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int DetectXbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
|
||||
{
|
||||
DetectXbitsData *cd = NULL;
|
||||
SigMatch *sm = NULL;
|
||||
uint8_t fb_cmd = 0;
|
||||
uint8_t hb_dir = 0;
|
||||
#define MAX_SUBSTRINGS 30
|
||||
int ret = 0, res = 0;
|
||||
int ov[MAX_SUBSTRINGS];
|
||||
char fb_cmd_str[16] = "", fb_name[256] = "";
|
||||
char hb_dir_str[16] = "";
|
||||
|
||||
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
|
||||
if (ret != 2 && ret != 3 && ret != 4) {
|
||||
SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for hostbits.", rawstr);
|
||||
return -1;
|
||||
}
|
||||
SCLogDebug("ret %d, %s", ret, rawstr);
|
||||
res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, fb_cmd_str, sizeof(fb_cmd_str));
|
||||
if (res < 0) {
|
||||
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (ret >= 3) {
|
||||
res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, fb_name, sizeof(fb_name));
|
||||
if (res < 0) {
|
||||
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed");
|
||||
goto error;
|
||||
}
|
||||
if (ret >= 4) {
|
||||
res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, hb_dir_str, sizeof(hb_dir_str));
|
||||
if (res < 0) {
|
||||
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed");
|
||||
goto error;
|
||||
}
|
||||
SCLogDebug("hb_dir_str %s", hb_dir_str);
|
||||
if (strlen(hb_dir_str) > 0) {
|
||||
if (strcmp(hb_dir_str, "ip_src") == 0)
|
||||
hb_dir = DETECT_XBITS_TRACK_IPSRC;
|
||||
else if (strcmp(hb_dir_str, "ip_dst") == 0)
|
||||
hb_dir = DETECT_XBITS_TRACK_IPDST;
|
||||
else if (strcmp(hb_dir_str, "ip_pair") == 0) {
|
||||
hb_dir = DETECT_XBITS_TRACK_IPPAIR;
|
||||
} else {
|
||||
// TODO
|
||||
goto error;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (strcmp(fb_cmd_str,"noalert") == 0) {
|
||||
fb_cmd = DETECT_XBITS_CMD_NOALERT;
|
||||
} else if (strcmp(fb_cmd_str,"isset") == 0) {
|
||||
fb_cmd = DETECT_XBITS_CMD_ISSET;
|
||||
} else if (strcmp(fb_cmd_str,"isnotset") == 0) {
|
||||
fb_cmd = DETECT_XBITS_CMD_ISNOTSET;
|
||||
} else if (strcmp(fb_cmd_str,"set") == 0) {
|
||||
fb_cmd = DETECT_XBITS_CMD_SET;
|
||||
} else if (strcmp(fb_cmd_str,"unset") == 0) {
|
||||
fb_cmd = DETECT_XBITS_CMD_UNSET;
|
||||
} else if (strcmp(fb_cmd_str,"toggle") == 0) {
|
||||
fb_cmd = DETECT_XBITS_CMD_TOGGLE;
|
||||
} else {
|
||||
SCLogError(SC_ERR_UNKNOWN_VALUE, "ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str);
|
||||
goto error;
|
||||
}
|
||||
|
||||
switch (fb_cmd) {
|
||||
case DETECT_XBITS_CMD_NOALERT:
|
||||
if (strlen(fb_name) != 0)
|
||||
goto error;
|
||||
s->flags |= SIG_FLAG_NOALERT;
|
||||
return 0;
|
||||
case DETECT_XBITS_CMD_ISNOTSET:
|
||||
case DETECT_XBITS_CMD_ISSET:
|
||||
case DETECT_XBITS_CMD_SET:
|
||||
case DETECT_XBITS_CMD_UNSET:
|
||||
case DETECT_XBITS_CMD_TOGGLE:
|
||||
default:
|
||||
if (strlen(fb_name) == 0)
|
||||
goto error;
|
||||
break;
|
||||
}
|
||||
|
||||
cd = SCMalloc(sizeof(DetectXbitsData));
|
||||
if (unlikely(cd == NULL))
|
||||
goto error;
|
||||
|
||||
cd->idx = VariableNameGetIdx(de_ctx, fb_name, DETECT_XBITS);
|
||||
cd->cmd = fb_cmd;
|
||||
cd->tracker = hb_dir;
|
||||
|
||||
SCLogDebug("idx %" PRIu32 ", cmd %s, name %s",
|
||||
cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)");
|
||||
|
||||
/* Okay so far so good, lets get this into a SigMatch
|
||||
* and put it in the Signature. */
|
||||
sm = SigMatchAlloc();
|
||||
if (sm == NULL)
|
||||
goto error;
|
||||
|
||||
sm->type = DETECT_XBITS;
|
||||
sm->ctx = (void *)cd;
|
||||
|
||||
switch (fb_cmd) {
|
||||
case DETECT_XBITS_CMD_NOALERT:
|
||||
/* nothing to do */
|
||||
break;
|
||||
|
||||
case DETECT_XBITS_CMD_ISNOTSET:
|
||||
case DETECT_XBITS_CMD_ISSET:
|
||||
/* checks, so packet list */
|
||||
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
|
||||
break;
|
||||
|
||||
case DETECT_XBITS_CMD_SET:
|
||||
case DETECT_XBITS_CMD_UNSET:
|
||||
case DETECT_XBITS_CMD_TOGGLE:
|
||||
/* modifiers, only run when entire sig has matched */
|
||||
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH);
|
||||
break;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
error:
|
||||
if (cd != NULL)
|
||||
SCFree(cd);
|
||||
if (sm != NULL)
|
||||
SCFree(sm);
|
||||
return -1;
|
||||
}
|
||||
|
||||
void DetectXbitFree (void *ptr)
|
||||
{
|
||||
DetectXbitsData *fd = (DetectXbitsData *)ptr;
|
||||
|
||||
if (fd == NULL)
|
||||
return;
|
||||
|
||||
SCFree(fd);
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
|
||||
static void XBitsTestSetup(void)
|
||||
{
|
||||
StorageInit();
|
||||
HostBitInitCtx();
|
||||
IPPairBitInitCtx();
|
||||
StorageFinalize();
|
||||
HostInitConfig(TRUE);
|
||||
IPPairInitConfig(TRUE);
|
||||
}
|
||||
|
||||
static void XBitsTestShutdown(void)
|
||||
{
|
||||
HostCleanup();
|
||||
IPPairCleanup();
|
||||
StorageCleanup();
|
||||
}
|
||||
|
||||
/**
|
||||
* \test HostBitsTestSig01 is a test for a valid noalert flowbits option
|
||||
*
|
||||
* \retval 1 on succces
|
||||
* \retval 0 on failure
|
||||
*/
|
||||
|
||||
static int XBitsTestSig01(void)
|
||||
{
|
||||
uint8_t *buf = (uint8_t *)
|
||||
"GET /one/ HTTP/1.1\r\n"
|
||||
"Host: one.example.org\r\n"
|
||||
"\r\n";
|
||||
uint16_t buflen = strlen((char *)buf);
|
||||
Packet *p = SCMalloc(SIZE_OF_PACKET);
|
||||
if (unlikely(p == NULL))
|
||||
return 0;
|
||||
Signature *s = NULL;
|
||||
ThreadVars th_v;
|
||||
DetectEngineThreadCtx *det_ctx = NULL;
|
||||
DetectEngineCtx *de_ctx = NULL;
|
||||
int result = 0;
|
||||
|
||||
memset(&th_v, 0, sizeof(th_v));
|
||||
memset(p, 0, SIZE_OF_PACKET);
|
||||
p->src.family = AF_INET;
|
||||
p->dst.family = AF_INET;
|
||||
p->payload = buf;
|
||||
p->payload_len = buflen;
|
||||
p->proto = IPPROTO_TCP;
|
||||
|
||||
XBitsTestSetup();
|
||||
|
||||
de_ctx = DetectEngineCtxInit();
|
||||
|
||||
if (de_ctx == NULL) {
|
||||
printf("bad de_ctx: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
de_ctx->flags |= DE_QUIET;
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:1;)");
|
||||
if (s == NULL) {
|
||||
printf("bad sig: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
|
||||
|
||||
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
|
||||
|
||||
result = 1;
|
||||
|
||||
end:
|
||||
if (de_ctx != NULL) {
|
||||
SigGroupCleanup(de_ctx);
|
||||
SigCleanSignatures(de_ctx);
|
||||
}
|
||||
|
||||
if (det_ctx != NULL) {
|
||||
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
|
||||
}
|
||||
|
||||
if (de_ctx != NULL) {
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
}
|
||||
|
||||
XBitsTestShutdown();
|
||||
|
||||
SCFree(p);
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* \test various options
|
||||
*
|
||||
* \retval 1 on succces
|
||||
* \retval 0 on failure
|
||||
*/
|
||||
|
||||
static int XBitsTestSig02(void)
|
||||
{
|
||||
Signature *s = NULL;
|
||||
ThreadVars th_v;
|
||||
DetectEngineCtx *de_ctx = NULL;
|
||||
int result = 0;
|
||||
int error_count = 0;
|
||||
|
||||
memset(&th_v, 0, sizeof(th_v));
|
||||
|
||||
de_ctx = DetectEngineCtxInit();
|
||||
if (de_ctx == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
de_ctx->flags |= DE_QUIET;
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert ip any any -> any any (xbits:isset,abc,track ip_src; content:\"GET \"; sid:1;)");
|
||||
if (s == NULL) {
|
||||
error_count++;
|
||||
}
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert ip any any -> any any (xbits:isnotset,abc,track ip_dst; content:\"GET \"; sid:2;)");
|
||||
if (s == NULL) {
|
||||
error_count++;
|
||||
}
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:3;)");
|
||||
if (s == NULL) {
|
||||
error_count++;
|
||||
}
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert ip any any -> any any (xbits:unset,abc,track ip_src; content:\"GET \"; sid:4;)");
|
||||
if (s == NULL) {
|
||||
error_count++;
|
||||
}
|
||||
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert ip any any -> any any (xbits:toggle,abc,track ip_dst; content:\"GET \"; sid:5;)");
|
||||
if (s == NULL) {
|
||||
error_count++;
|
||||
}
|
||||
|
||||
if (error_count != 0)
|
||||
goto end;
|
||||
|
||||
result = 1;
|
||||
|
||||
SigGroupCleanup(de_ctx);
|
||||
SigCleanSignatures(de_ctx);
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
return result;
|
||||
end:
|
||||
if (de_ctx != NULL) {
|
||||
SigGroupCleanup(de_ctx);
|
||||
SigCleanSignatures(de_ctx);
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#endif /* UNITTESTS */
|
||||
|
||||
/**
|
||||
* \brief this function registers unit tests for XBits
|
||||
*/
|
||||
void XBitsRegisterTests(void)
|
||||
{
|
||||
#ifdef UNITTESTS
|
||||
UtRegisterTest("XBitsTestSig01", XBitsTestSig01, 1);
|
||||
UtRegisterTest("XBitsTestSig02", XBitsTestSig02, 1);
|
||||
#endif /* UNITTESTS */
|
||||
}
|
||||
@ -0,0 +1,49 @@
|
||||
/* Copyright (C) 2007-2014 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_XBITS_H__
|
||||
#define __DETECT_XBITS_H__
|
||||
|
||||
#define DETECT_XBITS_CMD_SET 0
|
||||
#define DETECT_XBITS_CMD_TOGGLE 1
|
||||
#define DETECT_XBITS_CMD_UNSET 2
|
||||
#define DETECT_XBITS_CMD_ISNOTSET 3
|
||||
#define DETECT_XBITS_CMD_ISSET 4
|
||||
#define DETECT_XBITS_CMD_NOALERT 5
|
||||
#define DETECT_XBITS_CMD_MAX 6
|
||||
|
||||
#define DETECT_XBITS_TRACK_IPSRC 0
|
||||
#define DETECT_XBITS_TRACK_IPDST 1
|
||||
#define DETECT_XBITS_TRACK_IPPAIR 2
|
||||
#define DETECT_XBITS_TRACK_FLOW 3
|
||||
|
||||
typedef struct DetectXbitsData_ {
|
||||
uint16_t idx;
|
||||
uint8_t cmd;
|
||||
uint8_t tracker;
|
||||
} DetectXbitsData;
|
||||
|
||||
/* prototypes */
|
||||
void DetectXbitsRegister (void);
|
||||
|
||||
#endif /* __DETECT_XBITS_H__ */
|
||||
@ -0,0 +1,489 @@
|
||||
/* Copyright (C) 2014 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*
|
||||
* Implements per ippair bits. Actually, not a bit,
|
||||
* but called that way because of Snort's flowbits.
|
||||
* It's a binary storage.
|
||||
*
|
||||
* \todo move away from a linked list implementation
|
||||
* \todo use different datatypes, such as string, int, etc.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "ippair-bit.h"
|
||||
#include "ippair.h"
|
||||
#include "detect.h"
|
||||
#include "util-var.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "ippair-storage.h"
|
||||
|
||||
static int ippair_bit_id = -1; /**< IPPair storage id for bits */
|
||||
|
||||
void XBitFreeAll(void *store) {
|
||||
GenericVar *gv = store;
|
||||
GenericVarFree(gv);
|
||||
}
|
||||
|
||||
void IPPairBitInitCtx(void)
|
||||
{
|
||||
ippair_bit_id = IPPairStorageRegister("bit", sizeof(void *), NULL, XBitFreeAll);
|
||||
if (ippair_bit_id == -1) {
|
||||
SCLogError(SC_ERR_IPPAIR_INIT, "Can't initiate ippair storage for bits");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
|
||||
/* lock before using this */
|
||||
int IPPairHasBits(IPPair *ippair)
|
||||
{
|
||||
if (ippair == NULL)
|
||||
return 0;
|
||||
return IPPairGetStorageById(ippair, ippair_bit_id) ? 1 : 0;
|
||||
}
|
||||
|
||||
/* get the bit with idx from the ippair */
|
||||
static XBit *IPPairBitGet(IPPair *h, uint16_t idx)
|
||||
{
|
||||
GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id);
|
||||
for ( ; gv != NULL; gv = gv->next) {
|
||||
if (gv->type == DETECT_XBITS && gv->idx == idx) {
|
||||
return (XBit *)gv;
|
||||
}
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* add a flowbit to the flow */
|
||||
static void IPPairBitAdd(IPPair *h, uint16_t idx)
|
||||
{
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb == NULL) {
|
||||
fb = SCMalloc(sizeof(XBit));
|
||||
if (unlikely(fb == NULL))
|
||||
return;
|
||||
|
||||
fb->type = DETECT_XBITS;
|
||||
fb->idx = idx;
|
||||
fb->next = NULL;
|
||||
|
||||
GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id);
|
||||
GenericVarAppend(&gv, (GenericVar *)fb);
|
||||
IPPairSetStorageById(h, ippair_bit_id, gv);
|
||||
}
|
||||
}
|
||||
|
||||
static void IPPairBitRemove(IPPair *h, uint16_t idx)
|
||||
{
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb == NULL)
|
||||
return;
|
||||
|
||||
GenericVar *gv = IPPairGetStorageById(h, ippair_bit_id);
|
||||
if (gv) {
|
||||
GenericVarRemove(&gv, (GenericVar *)fb);
|
||||
IPPairSetStorageById(h, ippair_bit_id, gv);
|
||||
}
|
||||
}
|
||||
|
||||
void IPPairBitSet(IPPair *h, uint16_t idx)
|
||||
{
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb == NULL) {
|
||||
IPPairBitAdd(h, idx);
|
||||
}
|
||||
}
|
||||
|
||||
void IPPairBitUnset(IPPair *h, uint16_t idx)
|
||||
{
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb != NULL) {
|
||||
IPPairBitRemove(h, idx);
|
||||
}
|
||||
}
|
||||
|
||||
void IPPairBitToggle(IPPair *h, uint16_t idx)
|
||||
{
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb != NULL) {
|
||||
IPPairBitRemove(h, idx);
|
||||
} else {
|
||||
IPPairBitAdd(h, idx);
|
||||
}
|
||||
}
|
||||
|
||||
int IPPairBitIsset(IPPair *h, uint16_t idx)
|
||||
{
|
||||
int r = 0;
|
||||
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb != NULL) {
|
||||
r = 1;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
|
||||
int IPPairBitIsnotset(IPPair *h, uint16_t idx)
|
||||
{
|
||||
int r = 0;
|
||||
|
||||
XBit *fb = IPPairBitGet(h, idx);
|
||||
if (fb == NULL) {
|
||||
r = 1;
|
||||
}
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
void XBitFree(XBit *fb)
|
||||
{
|
||||
if (fb == NULL)
|
||||
return;
|
||||
|
||||
SCFree(fb);
|
||||
}
|
||||
|
||||
|
||||
/* TESTS */
|
||||
#ifdef UNITTESTS
|
||||
static int IPPairBitTest01 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,0);
|
||||
if (fb != NULL)
|
||||
ret = 1;
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest02 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
XBit *fb = IPPairBitGet(h,0);
|
||||
if (fb == NULL)
|
||||
ret = 1;
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest03 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,0);
|
||||
if (fb == NULL) {
|
||||
printf("fb == NULL although it was just added: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
IPPairBitRemove(h, 0);
|
||||
|
||||
fb = IPPairBitGet(h,0);
|
||||
if (fb != NULL) {
|
||||
printf("fb != NULL although it was just removed: ");
|
||||
goto end;
|
||||
} else {
|
||||
ret = 1;
|
||||
}
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest04 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,0);
|
||||
if (fb != NULL)
|
||||
ret = 1;
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest05 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,1);
|
||||
if (fb != NULL)
|
||||
ret = 1;
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest06 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,2);
|
||||
if (fb != NULL)
|
||||
ret = 1;
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest07 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,3);
|
||||
if (fb != NULL)
|
||||
ret = 1;
|
||||
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest08 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,0);
|
||||
if (fb == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitRemove(h,0);
|
||||
|
||||
fb = IPPairBitGet(h,0);
|
||||
if (fb != NULL) {
|
||||
printf("fb != NULL even though it was removed: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest09 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,1);
|
||||
if (fb == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitRemove(h,1);
|
||||
|
||||
fb = IPPairBitGet(h,1);
|
||||
if (fb != NULL) {
|
||||
printf("fb != NULL even though it was removed: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest10 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,2);
|
||||
if (fb == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitRemove(h,2);
|
||||
|
||||
fb = IPPairBitGet(h,2);
|
||||
if (fb != NULL) {
|
||||
printf("fb != NULL even though it was removed: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int IPPairBitTest11 (void)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
IPPairInitConfig(TRUE);
|
||||
IPPair *h = IPPairAlloc();
|
||||
if (h == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitAdd(h, 0);
|
||||
IPPairBitAdd(h, 1);
|
||||
IPPairBitAdd(h, 2);
|
||||
IPPairBitAdd(h, 3);
|
||||
|
||||
XBit *fb = IPPairBitGet(h,3);
|
||||
if (fb == NULL)
|
||||
goto end;
|
||||
|
||||
IPPairBitRemove(h,3);
|
||||
|
||||
fb = IPPairBitGet(h,3);
|
||||
if (fb != NULL) {
|
||||
printf("fb != NULL even though it was removed: ");
|
||||
goto end;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
IPPairFree(h);
|
||||
end:
|
||||
IPPairCleanup();
|
||||
ret = 1;
|
||||
return ret;
|
||||
}
|
||||
|
||||
#endif /* UNITTESTS */
|
||||
|
||||
void IPPairBitRegisterTests(void)
|
||||
{
|
||||
#ifdef UNITTESTS
|
||||
UtRegisterTest("IPPairBitTest01", IPPairBitTest01, 1);
|
||||
UtRegisterTest("IPPairBitTest02", IPPairBitTest02, 1);
|
||||
UtRegisterTest("IPPairBitTest03", IPPairBitTest03, 1);
|
||||
UtRegisterTest("IPPairBitTest04", IPPairBitTest04, 1);
|
||||
UtRegisterTest("IPPairBitTest05", IPPairBitTest05, 1);
|
||||
UtRegisterTest("IPPairBitTest06", IPPairBitTest06, 1);
|
||||
UtRegisterTest("IPPairBitTest07", IPPairBitTest07, 1);
|
||||
UtRegisterTest("IPPairBitTest08", IPPairBitTest08, 1);
|
||||
UtRegisterTest("IPPairBitTest09", IPPairBitTest09, 1);
|
||||
UtRegisterTest("IPPairBitTest10", IPPairBitTest10, 1);
|
||||
UtRegisterTest("IPPairBitTest11", IPPairBitTest11, 1);
|
||||
#endif /* UNITTESTS */
|
||||
}
|
||||
@ -0,0 +1,52 @@
|
||||
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef __IPPAIR_BIT_H__
|
||||
#define __IPPAIR_BIT_H__
|
||||
|
||||
#include "ippair.h"
|
||||
#include "util-var.h"
|
||||
|
||||
typedef struct XBit_ {
|
||||
uint8_t type; /* type, DETECT_XBITS in this case */
|
||||
uint16_t idx; /* name idx */
|
||||
GenericVar *next; /* right now just implement this as a list,
|
||||
* in the long run we have think of something
|
||||
* faster. */
|
||||
} XBit;
|
||||
|
||||
void XBitFree(XBit *fb);
|
||||
|
||||
void IPPairBitInitCtx(void);
|
||||
void IPPairBitFree(XBit *);
|
||||
void IPPairBitRegisterTests(void);
|
||||
|
||||
int IPPairHasIPPairBits(IPPair *host);
|
||||
|
||||
void IPPairBitSet(IPPair *, uint16_t);
|
||||
void IPPairBitUnset(IPPair *, uint16_t);
|
||||
void IPPairBitToggle(IPPair *, uint16_t);
|
||||
int IPPairBitIsset(IPPair *, uint16_t);
|
||||
int IPPairBitIsnotset(IPPair *, uint16_t);
|
||||
|
||||
#endif /* __IPPAIR_BIT_H__ */
|
||||
Loading…
Reference in New Issue