From a85dc9b0e2de6379be97e469cf69d778cbd609f0 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Tue, 16 Aug 2011 19:20:56 +0200 Subject: [PATCH] Add support for replace keyword. This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match. --- src/Makefile.am | 1 + src/detect-content.c | 89 ++-- src/detect-content.h | 7 + src/detect-engine-payload.c | 12 +- src/detect-parse.c | 18 + src/detect-replace.c | 819 ++++++++++++++++++++++++++++++++++++ src/detect-replace.h | 32 ++ src/detect.c | 18 +- src/detect.h | 10 + 9 files changed, 979 insertions(+), 27 deletions(-) create mode 100644 src/detect-replace.c create mode 100644 src/detect-replace.h diff --git a/src/Makefile.am b/src/Makefile.am index b499c0e26b..64746cf7bc 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -152,6 +152,7 @@ detect-http-stat-code.c detect-http-stat-code.h \ detect-ssl-version.c detect-ssl-version.h \ detect-ssl-state.c detect-ssl-state.h \ detect-byte-extract.c detect-byte-extract.h \ +detect-replace.c detect-replace.h \ util-atomic.h \ util-print.c util-print.h \ util-fmemopen.c util-fmemopen.h \ diff --git a/src/detect-content.c b/src/detect-content.c index 9e86a5084c..c273515cf9 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -64,13 +64,8 @@ uint32_t DetectContentMaxId(DetectEngineCtx *de_ctx) { return MpmPatternIdStoreGetMaxId(de_ctx->mpm_pattern_id_store); } -/** - * \brief DetectContentParse - * \initonly - */ -DetectContentData *DetectContentParse (char *contentstr) +int DetectContentDataParse(char *contentstr, char** pstr, uint16_t *plen, int *flags) { - DetectContentData *cd = NULL; char *str = NULL; char *temp = NULL; uint16_t len; @@ -84,16 +79,9 @@ DetectContentData *DetectContentParse (char *contentstr) if (strlen(temp) == 0) { SCFree(temp); - return NULL; + return -1; } - cd = SCMalloc(sizeof(DetectContentData)); - if (cd == NULL) { - exit(EXIT_FAILURE); - } - - memset(cd, 0, sizeof(DetectContentData)); - /* skip the first spaces */ slen = strlen(temp); while (pos < slen && isspace(temp[pos])) { @@ -108,8 +96,9 @@ DetectContentData *DetectContentParse (char *contentstr) } pos = 0; - cd->flags |= DETECT_CONTENT_NEGATED; - } + *flags = DETECT_CONTENT_NEGATED; + } else + *flags = 0; if (temp[pos] == '\"' && strlen(temp + pos) == 1) goto error; @@ -226,8 +215,48 @@ DetectContentData *DetectContentParse (char *contentstr) } } + *plen = len; + *pstr = str; + return 0; + +error: + SCFree(str); + SCFree(temp); + return -1; +} +/** + * \brief DetectContentParse + * \initonly + */ +DetectContentData *DetectContentParse (char *contentstr) +{ + DetectContentData *cd = NULL; + char *str = NULL; + uint16_t len; + int flags; + int ret; + + ret = DetectContentDataParse(contentstr, &str, &len, &flags); + + if (ret == -1) { + return NULL; + } + + cd = SCMalloc(sizeof(DetectContentData)); + if (cd == NULL) { + SCFree(str); + exit(EXIT_FAILURE); + } + + memset(cd, 0, sizeof(DetectContentData)); + + if (flags == DETECT_CONTENT_NEGATED) + cd->flags |= DETECT_CONTENT_NEGATED; + cd->content = SCMalloc(len); if (cd->content == NULL) { + SCFree(str); + SCFree(cd); exit(EXIT_FAILURE); } @@ -244,15 +273,6 @@ DetectContentData *DetectContentParse (char *contentstr) SCFree(str); return cd; -error: - SCFree(str); - SCFree(temp); - if (cd != NULL) { - if (cd->content != NULL) - SCFree(cd->content); - SCFree(cd); - } - return NULL; } /** @@ -292,6 +312,25 @@ void DetectContentPrint(DetectContentData *cd) SCLogDebug("flags: %u ", cd->flags); SCLogDebug("negated: %s ", cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false"); SCLogDebug("relative match next: %s ", cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false"); + if (cd->replace && cd->replace_len) { + char *tmpstr=SCMalloc(sizeof(char) * cd->replace_len + 1); + + if (tmpstr != NULL) { + for (i = 0; i < cd->replace_len; i++) { + if (isprint(cd->replace[i])) + tmpstr[i] = cd->replace[i]; + else + tmpstr[i] = '.'; + } + tmpstr[i] = '\0'; + SCLogDebug("Replace: \"%s\"", tmpstr); + SCFree(tmpstr); + } else { + SCLogDebug("Replace: "); + for (i = 0; i < cd->replace_len; i++) + SCLogDebug("%c", cd->replace[i]); + } + } SCLogDebug("-----------"); } diff --git a/src/detect-content.h b/src/detect-content.h index 52bf6f0c8c..ecf156e849 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -58,6 +58,9 @@ #define DETECT_CONTENT_DISTANCE_BE 0x00400000 #define DETECT_CONTENT_WITHIN_BE 0x00800000 +/* replace data */ +#define DETECT_CONTENT_REPLACE 0x01000000 + #define DETECT_CONTENT_IS_SINGLE(c) (!((c)->flags & DETECT_CONTENT_DISTANCE || \ (c)->flags & DETECT_CONTENT_WITHIN || \ (c)->flags & DETECT_CONTENT_RELATIVE_NEXT || \ @@ -84,12 +87,16 @@ typedef struct DetectContentData_ { uint16_t fp_chop_offset; /* for chopped fast pattern, the length */ uint16_t fp_chop_len; + /* pointer to replacement data */ + uint8_t *replace; + uint8_t replace_len; } DetectContentData; /* prototypes */ void DetectContentRegister (void); uint32_t DetectContentMaxId(DetectEngineCtx *); DetectContentData *DetectContentParse (char *contentstr); +int DetectContentDataParse(char *contentstr, char** pstr, uint16_t *plen, int *flags); void DetectContentPrint(DetectContentData *); diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c index c5b849fb0e..a7b1e63611 100644 --- a/src/detect-engine-payload.c +++ b/src/detect-engine-payload.c @@ -37,6 +37,7 @@ #include "detect-bytetest.h" #include "detect-bytejump.h" #include "detect-byte-extract.h" +#include "detect-replace.h" #include "util-spm.h" #include "util-spm-bm.h" @@ -91,6 +92,7 @@ static int DoInspectPacketPayload(DetectEngineCtx *de_ctx, switch(sm->type) { case DETECT_CONTENT: { + DetectContentData *cd = (DetectContentData *)sm->ctx; SCLogDebug("inspecting content %"PRIu32" payload_len %"PRIu32, cd->id, payload_len); @@ -262,6 +264,14 @@ static int DoInspectPacketPayload(DetectEngineCtx *de_ctx, SCLogDebug("content %"PRIu32" matched at offset %"PRIu32"", cd->id, match_offset); det_ctx->payload_offset = match_offset; + /* Match branch, add replace to the list if needed */ + if (cd->flags & DETECT_CONTENT_REPLACE) { + if (p) { + /* we will need to replace content if match is confirmed */ + det_ctx->replist = DetectReplaceAddToList(det_ctx->replist, found, cd); + } else + SCLogWarning(SC_ERR_INVALID_VALUE, "Can't modify payload without packet"); + } if (!(cd->flags & DETECT_CONTENT_RELATIVE_NEXT)) { SCLogDebug("no relative match coming up, so this is a match"); goto match; @@ -465,6 +475,7 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, det_ctx->payload_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; + det_ctx->replist = NULL; //det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], p, f, p->payload, p->payload_len); @@ -472,7 +483,6 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, if (r == 1) { SCReturnInt(1); } - SCReturnInt(0); } diff --git a/src/detect-parse.c b/src/detect-parse.c index dbe37593d2..a544ce1f66 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1322,6 +1322,24 @@ static int SigValidate(Signature *s) { } } + if (s->flags & SIG_FLAG_REQUIRE_PACKET) { + SigMatch *pm = SigMatchGetLastSMFromLists(s, 14, + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_UMATCH], + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HRUDMATCH], + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HCBDMATCH], + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HHDMATCH], + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HRHDMATCH], + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HMDMATCH], + DETECT_REPLACE, s->sm_lists_tail[DETECT_SM_LIST_HCDMATCH]); + if (pm != NULL) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Signature has" + " replace keyword linked with a modified content" + " keyword (http_*, dce_*). It only supports content on" + " raw payload"); + SCReturnInt(0); + } + } + SCReturnInt(1); } diff --git a/src/detect-replace.c b/src/detect-replace.c new file mode 100644 index 0000000000..50866219f5 --- /dev/null +++ b/src/detect-replace.c @@ -0,0 +1,819 @@ +/* Copyright (C) 2011 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Eric Leblond + * + * Replace part of the detection engine. + * + * If previous filter is of content type, replace can be used to change + * the matched part to a new value. + */ + +#include "suricata-common.h" + +#include "runmodes.h" + +extern int run_mode; + +#include "decode.h" + +#include "detect.h" +#include "detect-parse.h" +#include "detect-content.h" +#include "detect-uricontent.h" +#include "detect-byte-extract.h" +#include "detect-replace.h" +#include "app-layer.h" + +#include "detect-engine-mpm.h" +#include "detect-engine.h" +#include "detect-engine-state.h" +#include "util-unittest.h" +#include "util-unittest-helper.h" + +#include "flow-var.h" + +#include "util-debug.h" + +static int DetectReplaceSetup (DetectEngineCtx *, Signature *, char *); +void DetectReplaceRegisterTests(void); + +void DetectReplaceRegister (void) { + sigmatch_table[DETECT_REPLACE].name = "replace"; + sigmatch_table[DETECT_REPLACE].Match = NULL; + sigmatch_table[DETECT_REPLACE].Setup = DetectReplaceSetup; + sigmatch_table[DETECT_REPLACE].Free = NULL; + sigmatch_table[DETECT_REPLACE].RegisterTests = DetectReplaceRegisterTests; + + sigmatch_table[DETECT_REPLACE].flags |= SIGMATCH_PAYLOAD; +} + +int DetectReplaceSetup(DetectEngineCtx *de_ctx, Signature *s, char *replacestr) +{ + char *str = NULL; + uint16_t len = 0; + int flags; + SigMatch *pm = NULL; + DetectContentData *ud = NULL; + int ret = DetectContentDataParse(replacestr, &str, &len, &flags); + + if (ret == -1) + goto error; + + if (flags & DETECT_CONTENT_NEGATED) { + SCLogError(SC_ERR_INVALID_VALUE, "Can't negate replacement string: %s", + replacestr); + goto error; + } + + switch (run_mode) { + case RUNMODE_NFQ: + case RUNMODE_IPFW: + break; + default: + SCLogWarning(SC_ERR_RUNMODE, + "Can't use 'replace' keyword in non IPS mode: %s", + s->sig_str); + /* this is a success, having the alert is interesting */ + return 0; + } + + /* add to the latest "content" keyword from either dmatch or pmatch */ + pm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + if (pm == NULL) { + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "replace needs" + "preceeding content option for raw sig"); + SCFree(str); + return -1; + } + + /* we can remove this switch now with the unified structure */ + ud = (DetectContentData *)pm->ctx; + if (ud == NULL) { + SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); + SCFree(str); + return -1; + } + if (ud->flags & DETECT_CONTENT_NEGATED) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " + "negated keyword set along with a replacement"); + goto error; + } + if (ud->content_len != len) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a content " + "length different from replace length"); + goto error; + } + + ud->replace = SCMalloc(len); + if (ud->replace == NULL) { + goto error; + } + memcpy(ud->replace, str, len); + ud->replace_len = len; + ud->flags |= DETECT_CONTENT_REPLACE; + /* want packet matching only won't be able to replace data with + * a flow. + */ + s->flags |= SIG_FLAG_REQUIRE_PACKET; + SCFree(str); + + return 0; + +error: + SCFree(str); + return -1; +} + +DetectReplaceList * DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd) +{ + DetectReplaceList *newlist; + + if (cd->content_len != cd->replace_len) + return NULL; + SCLogDebug("replace: Adding match"); + + newlist = SCMalloc(sizeof(DetectReplaceList)); + newlist->found = found; + newlist->cd = cd; + newlist->next = NULL; + + if (replist) { + replist->next = newlist; + return replist; + } else + return newlist; +} + + +void DetectReplaceExecute(Packet *p, DetectReplaceList *replist) +{ + DetectReplaceList *tlist = NULL; + + if (p == NULL) + return; + + SCLogDebug("replace: Executing match"); + while(replist) { + memcpy(replist->found, replist->cd->replace, replist->cd->replace_len); + SCLogDebug("replace: injecting '%s'", replist->cd->replace); + p->flags |= PKT_STREAM_MODIFIED; + if (PKT_IS_IPV4(p)) { + if (PKT_IS_TCP(p)) { + /* TCP */ + p->tcph->th_sum = 0; + p->tcph->th_sum = TCPCalculateChecksum((uint16_t *)&(p->ip4h->ip_src), + (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); + } else if (PKT_IS_UDP(p)) { + p->udph->uh_sum = 0; + p->udph->uh_sum = UDPV4CalculateChecksum((uint16_t *)&(p->ip4h->ip_src), + (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN)); + } + /* IPV4 */ + p->ip4h->ip_csum = 0; + p->ip4h->ip_csum = IPV4CalculateChecksum((uint16_t *)p->ip4h, + IPV4_GET_RAW_HLEN(p->ip4h)); + } else if (PKT_IS_IPV6(p)) { + /* just TCP for IPV6 */ + if (PKT_IS_TCP(p)) { + p->tcph->th_sum = 0; + p->tcph->th_sum = TCPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src), + (uint16_t *)p->tcph, (p->payload_len + TCP_GET_HLEN(p))); + } else if (PKT_IS_UDP(p)) { + p->udph->uh_sum = 0; + p->udph->uh_sum = UDPV6CalculateChecksum((uint16_t *)&(p->ip6h->ip6_src), + (uint16_t *)p->udph, (p->payload_len + UDP_HEADER_LEN)); + } + } + tlist = replist; + replist = replist->next; + SCFree(tlist); + } +} + + +void DetectReplaceFree(DetectReplaceList *replist) +{ + DetectReplaceList *tlist = NULL; + while(replist) { + SCLogDebug("replace: Freing match"); + tlist = replist; + replist = replist->next; + SCFree(tlist); + } +} + +#ifdef UNITTESTS /* UNITTESTS */ + +/** + * \test Test packet Matches + * \param raw_eth_pkt pointer to the ethernet packet + * \param pktsize size of the packet + * \param sig pointer to the signature to test + * \param sid sid number of the signature + * \retval return 1 if match + * \retval return 0 if not + */ +int DetectReplaceLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize, char *sig, + uint32_t sid, uint8_t *pp, uint16_t *len) +{ + int result = 0; + + Packet *p = NULL; + p = SCMalloc(SIZE_OF_PACKET); + if (p == NULL) + return 0; + + DecodeThreadVars dtv; + + ThreadVars th_v; + DetectEngineThreadCtx *det_ctx = NULL; + + if (pp == NULL) { + SCLogDebug("replace: looks like a second run"); + } + + memset(p, 0, SIZE_OF_PACKET); + p->pkt = (uint8_t *)(p + 1); + PacketCopyData(p, raw_eth_pkt, pktsize); + memset(&dtv, 0, sizeof(DecodeThreadVars)); + memset(&th_v, 0, sizeof(th_v)); + + + FlowInitConfig(FLOW_QUIET); + DecodeEthernet(&th_v, &dtv, p, GET_PKT_DATA(p), pktsize, NULL); + + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) { + goto end; + } + de_ctx->flags |= DE_QUIET; + + de_ctx->sig_list = SigInit(de_ctx, sig); + if (de_ctx->sig_list == NULL) { + goto end; + } + de_ctx->sig_list->next = NULL; + + if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->type == DETECT_CONTENT) { + DetectContentData *co = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; + if (co->flags & DETECT_CONTENT_RELATIVE_NEXT) { + printf("relative next flag set on final match which is content: "); + goto end; + } + } + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + + if (PacketAlertCheck(p, sid) != 1) { + SCLogDebug("replace: no alert on sig %d", sid); + goto end; + } + + if (pp) { + memcpy(pp, GET_PKT_DATA(p), GET_PKT_LEN(p)); + *len = pktsize; + SCLogDebug("replace: copying %d on %p", *len, pp); + } + + + result = 1; +end: + if (de_ctx != NULL) + { + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + if (det_ctx != NULL) + DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineCtxFree(de_ctx); + } + FlowShutdown(); + SCFree(p); + + + return result; +} + + +/** + * \brief Wrapper for DetectContentLongPatternMatchTest + */ +int DetectReplaceLongPatternMatchTestWrp(char *sig, uint32_t sid, char *sig_rep, uint32_t sid_rep) { + int ret; + /** Real packet with the following tcp data: + * "Hi, this is a big test to check content matches of splitted" + * "patterns between multiple chunks!" + * (without quotes! :) ) + */ + uint8_t raw_eth_pkt[] = { + 0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00, + 0x00,0x00,0x00,0x00,0x08,0x00,0x45,0x00, + 0x00,0x85,0x00,0x01,0x00,0x00,0x40,0x06, + 0x7c,0x70,0x7f,0x00,0x00,0x01,0x7f,0x00, + 0x00,0x01,0x00,0x14,0x00,0x50,0x00,0x00, + 0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02, + 0x20,0x00,0xc9,0xad,0x00,0x00,0x48,0x69, + 0x2c,0x20,0x74,0x68,0x69,0x73,0x20,0x69, + 0x73,0x20,0x61,0x20,0x62,0x69,0x67,0x20, + 0x74,0x65,0x73,0x74,0x20,0x74,0x6f,0x20, + 0x63,0x68,0x65,0x63,0x6b,0x20,0x63,0x6f, + 0x6e,0x74,0x65,0x6e,0x74,0x20,0x6d,0x61, + 0x74,0x63,0x68,0x65,0x73,0x20,0x6f,0x66, + 0x20,0x73,0x70,0x6c,0x69,0x74,0x74,0x65, + 0x64,0x20,0x70,0x61,0x74,0x74,0x65,0x72, + 0x6e,0x73,0x20,0x62,0x65,0x74,0x77,0x65, + 0x65,0x6e,0x20,0x6d,0x75,0x6c,0x74,0x69, + 0x70,0x6c,0x65,0x20,0x63,0x68,0x75,0x6e, + 0x6b,0x73,0x21 }; /* end raw_eth_pkt */ + uint8_t p[sizeof(raw_eth_pkt)]; + uint16_t psize = sizeof(raw_eth_pkt); + + run_mode = RUNMODE_NFQ; + ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt), + sig, sid, p, &psize); + if (ret != 1) { + return ret; + } else { + SCLogDebug("replace: test1 phase1"); + ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL); + return ret; + } +} + + +/** + * \brief Wrapper for DetectContentLongPatternMatchTest + */ +int DetectReplaceLongPatternMatchTestUDPWrp(char *sig, uint32_t sid, char *sig_rep, uint32_t sid_rep) { + int ret; + /** Real UDP DNS packet with a request A to a1.twimg.com + */ + uint8_t raw_eth_pkt[] = { + 0x8c, 0xa9, 0x82, 0x75, 0x5d, 0x62, 0xb4, 0x07, + 0xf9, 0xf3, 0xc7, 0x0a, 0x08, 0x00, 0x45, 0x00, + 0x00, 0x3a, 0x92, 0x4f, 0x40, 0x00, 0x40, 0x11, + 0x31, 0x1a, 0xc0, 0xa8, 0x00, 0x02, 0xc1, 0xbd, + 0xf4, 0xe1, 0x3b, 0x7e, 0x00, 0x35, 0x00, 0x26, + 0xcb, 0x81, 0x37, 0x62, 0x01, 0x00, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x61, + 0x31, 0x05, 0x74, 0x77, 0x69, 0x6d, 0x67, 0x03, + 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01 }; + + uint8_t p[sizeof(raw_eth_pkt)]; + uint16_t psize = sizeof(raw_eth_pkt); + + run_mode = RUNMODE_NFQ; + ret = DetectReplaceLongPatternMatchTest(raw_eth_pkt, (uint16_t)sizeof(raw_eth_pkt), + sig, sid, p, &psize); + if (ret != 1) { + return ret; + } else { + SCLogDebug("replace: test1 phase1 ok: %d vs %d",sizeof(raw_eth_pkt),psize); + ret = DetectReplaceLongPatternMatchTest(p, psize, sig_rep, sid_rep, NULL, NULL); + return ret; + } +} + +/** + * \test Check if replace is working + */ +int DetectReplaceMatchTest01() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; replace:\"pig\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"this is a pig test\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with offset + */ +int DetectReplaceMatchTest02() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"th\"; offset: 4; replace:\"TH\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"THis\"; offset:4; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with offset and keyword inversion + */ +int DetectReplaceMatchTest03() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"th\"; replace:\"TH\"; offset: 4; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"THis\"; offset:4; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with second content + */ +int DetectReplaceMatchTest04() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"th\"; replace:\"TH\"; content:\"patter\"; replace:\"matter\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"THis\"; content:\"matterns\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is not done when second content don't match + */ +int DetectReplaceMatchTest05() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"th\"; replace:\"TH\"; content:\"nutella\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"TH\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is not done when second content match and not + * first + */ +int DetectReplaceMatchTest06() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"nutella\"; replace:\"commode\"; content:\"this is\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"commode\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working when nocase used + */ +int DetectReplaceMatchTest07() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"BiG\"; nocase; replace:\"pig\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"this is a pig test\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working when depth is used + */ +int DetectReplaceMatchTest08() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; depth:17; replace:\"pig\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"this is a pig test\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working when depth block match used + */ +int DetectReplaceMatchTest09() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; depth:16; replace:\"pig\"; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"this is a pig test\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working when depth block match used + */ +int DetectReplaceMatchTest10() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; depth:17; replace:\"pig\"; offset: 14; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"pig\"; depth:17; offset:14; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with within + */ +int DetectReplaceMatchTest11() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; replace:\"pig\"; content:\"to\"; within: 11; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"pig\"; depth:17; offset:14; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with within + */ +int DetectReplaceMatchTest12() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; replace:\"pig\"; content:\"to\"; within: 4; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"pig\"; depth:17; offset:14; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with within + */ +int DetectReplaceMatchTest13() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; replace:\"pig\"; content:\"test\"; distance: 1; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"pig\"; depth:17; offset:14; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with within + */ +int DetectReplaceMatchTest14() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\";" + " content:\"big\"; replace:\"pig\"; content:\"test\"; distance: 2; sid:1;)"; + char *sig_rep = "alert tcp any any -> any any (msg:\"replace worked\";" + " content:\"pig\"; depth:17; offset:14; sid:2;)"; + return DetectReplaceLongPatternMatchTestWrp(sig, 1, sig_rep, 2); +} + +/** + * \test Check if replace is working with within + */ +int DetectReplaceMatchTest15() +{ + char *sig = "alert udp any any -> any any (msg:\"Nothing..\";" + " content:\"com\"; replace:\"org\"; sid:1;)"; + char *sig_rep = "alert udp any any -> any any (msg:\"replace worked\";" + " content:\"twimg|03|org\"; sid:2;)"; + return DetectReplaceLongPatternMatchTestUDPWrp(sig, 1, sig_rep, 2); +} + + +/** + * \test Parsing test + */ +int DetectReplaceParseTest01(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert udp any any -> any any " + "(msg:\"test\"; content:\"doh\"; replace:\"; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + +/** + * \test Parsing test: non valid because of http protocol + */ +int DetectReplaceParseTest02(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert http any any -> any any " + "(msg:\"test\"; content:\"doh\"; replace:\"bon\"; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + +/** + * \test Parsing test: non valid because of http_header on same content + * as replace keyword + */ +int DetectReplaceParseTest03(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"test\"; content:\"doh\"; replace:\"don\"; http_header; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + +/** + * \test Parsing test no content + */ +int DetectReplaceParseTest04(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"test\"; replace:\"don\"; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + +/** + * \test Parsing test content after replace + */ +int DetectReplaceParseTest05(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"test\"; replace:\"don\"; content:\"doh\"; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + +/** + * \test Parsing test content and replace length differ + */ +int DetectReplaceParseTest06(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"test\"; content:\"don\"; replace:\"donut\"; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + +/** + * \test Parsing test content and replace length differ + */ +int DetectReplaceParseTest07(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 1; + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"test\"; content:\"don\"; replace:\"dou\"; content:\"jpg\"; http_header; sid:238012;)"); + if (de_ctx->sig_list != NULL) { + result = 0; + goto end; + } + + end: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + + return result; +} + + + +#endif /* UNITTESTS */ + +/** + * \brief this function registers unit tests for DetectContent + */ +void DetectReplaceRegisterTests(void) +{ +#ifdef UNITTESTS /* UNITTESTS */ +/* matching */ + UtRegisterTest("DetectReplaceMatchTest01", DetectReplaceMatchTest01, 1); + UtRegisterTest("DetectReplaceMatchTest02", DetectReplaceMatchTest02, 1); + UtRegisterTest("DetectReplaceMatchTest03", DetectReplaceMatchTest03, 1); + UtRegisterTest("DetectReplaceMatchTest04", DetectReplaceMatchTest04, 1); + UtRegisterTest("DetectReplaceMatchTest05", DetectReplaceMatchTest05, 0); + UtRegisterTest("DetectReplaceMatchTest06", DetectReplaceMatchTest06, 0); + UtRegisterTest("DetectReplaceMatchTest07", DetectReplaceMatchTest07, 1); + UtRegisterTest("DetectReplaceMatchTest08", DetectReplaceMatchTest08, 1); + UtRegisterTest("DetectReplaceMatchTest09", DetectReplaceMatchTest09, 0); + UtRegisterTest("DetectReplaceMatchTest10", DetectReplaceMatchTest10, 1); + UtRegisterTest("DetectReplaceMatchTest11", DetectReplaceMatchTest11, 1); + UtRegisterTest("DetectReplaceMatchTest12", DetectReplaceMatchTest12, 0); + UtRegisterTest("DetectReplaceMatchTest13", DetectReplaceMatchTest13, 1); + UtRegisterTest("DetectReplaceMatchTest14", DetectReplaceMatchTest14, 0); + UtRegisterTest("DetectReplaceMatchTest15", DetectReplaceMatchTest15, 1); +/* parsing */ + UtRegisterTest("DetectReplaceParseTest01", DetectReplaceParseTest01, 1); + UtRegisterTest("DetectReplaceParseTest02", DetectReplaceParseTest02, 0); + UtRegisterTest("DetectReplaceParseTest03", DetectReplaceParseTest03, 0); + UtRegisterTest("DetectReplaceParseTest04", DetectReplaceParseTest04, 1); + UtRegisterTest("DetectReplaceParseTest05", DetectReplaceParseTest05, 1); + UtRegisterTest("DetectReplaceParseTest06", DetectReplaceParseTest06, 1); + UtRegisterTest("DetectReplaceParseTest07", DetectReplaceParseTest07, 0); +#endif /* UNITTESTS */ +} diff --git a/src/detect-replace.h b/src/detect-replace.h new file mode 100644 index 0000000000..f7b7c214d2 --- /dev/null +++ b/src/detect-replace.h @@ -0,0 +1,32 @@ +/* Copyright (C) 2011 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Eric Leblond + */ + +#ifndef __DETECT_REPLACE_H__ +#define __DETECT_REPLACE_H__ + +DetectReplaceList * DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd); +void DetectReplaceExecute(Packet *p, DetectReplaceList *replist); +void DetectReplaceFree(DetectReplaceList *replist); +void DetectReplaceRegister (void); + +#endif diff --git a/src/detect.c b/src/detect.c index d26791168f..b5737815fd 100644 --- a/src/detect.c +++ b/src/detect.c @@ -123,6 +123,7 @@ #include "detect-engine-hcd.h" #include "detect-engine-hrud.h" #include "detect-byte-extract.h" +#include "detect-replace.h" #include "util-rule-vars.h" @@ -1540,7 +1541,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { /* if we have stream msgs, inspect against those first, * but not for a "dsize" signature */ - if (!(s->flags & SIG_FLAG_DSIZE) && smsg != NULL) { + if (!(s->flags & SIG_FLAG_DSIZE) && !(s->flags & SIG_FLAG_REQUIRE_PACKET) && smsg != NULL) { char pmatch = 0; uint8_t pmq_idx = 0; StreamMsg *smsg_inspect = smsg; @@ -1664,6 +1665,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh SCLogDebug("signature matched without sigmatches"); fmatch = 1; + + DetectReplaceExecute(p, det_ctx->replist); + det_ctx->replist = NULL; if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, alert_flags, NULL); } @@ -1682,6 +1686,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* only if the last matched as well, we have a hit */ if (sm == NULL) { + + DetectReplaceExecute(p, det_ctx->replist); + det_ctx->replist = NULL; if (!(s->flags & SIG_FLAG_NOALERT)) { /* only add once */ if (rmatch == 0) { @@ -1695,6 +1702,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* done with this sig */ sm = NULL; rmatch = 0; + + DetectReplaceFree(det_ctx->replist); + det_ctx->replist = NULL; } } @@ -1717,11 +1727,16 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* only if the last matched as well, we have a hit */ if (sm == NULL) { fmatch = 1; + DetectReplaceExecute(p, det_ctx->replist); + det_ctx->replist = NULL; + if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertAppend(det_ctx, s, p, alert_flags, alert_msg); } } } else { + DetectReplaceFree(det_ctx->replist); + det_ctx->replist = NULL; /* done with this sig */ sm = NULL; } @@ -4260,6 +4275,7 @@ void SigTableSetup(void) { DetectWithinRegister(); DetectDistanceRegister(); DetectOffsetRegister(); + DetectReplaceRegister(); DetectFlowRegister(); DetectWindowRegister(); DetectRpcRegister(); diff --git a/src/detect.h b/src/detect.h index b949b84c2c..d35a4e12dc 100644 --- a/src/detect.h +++ b/src/detect.h @@ -474,6 +474,12 @@ typedef struct Signature_ { struct Signature_ *next; } Signature; +typedef struct DetectReplaceList_ { + struct DetectContentData_ *cd; + uint8_t *found; + struct DetectReplaceList_ *next; +} DetectReplaceList; + typedef struct DetectEngineIPOnlyThreadCtx_ { uint8_t *sig_match_array; /* bit array of sig nums */ uint32_t sig_match_size; /* size in bytes of the array */ @@ -791,6 +797,9 @@ typedef struct DetectionEngineThreadCtx_ { /* byte jump values */ uint64_t *bj_values; + /* string to replace */ + DetectReplaceList *replist; + DetectEngineCtx *de_ctx; #ifdef __SC_CUDA_SUPPORT__ /* each detection thread would have it's own queue where the cuda dispatcher @@ -941,6 +950,7 @@ enum { DETECT_DISTANCE, DETECT_WITHIN, DETECT_OFFSET, + DETECT_REPLACE, DETECT_NOCASE, DETECT_FAST_PATTERN, DETECT_RECURSIVE,