You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/src/detect-flowvar.c

395 lines
11 KiB
C

/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Victor Julien <victor@inliniac.net>
*
* Simple flowvar content match part of the detection engine.
*/
#include "suricata-common.h"
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-content.h"
#include "threads.h"
#include "flow.h"
#include "flow-var.h"
#include "detect-flowvar.h"
#include "util-spm.h"
#include "util-var-name.h"
#include "util-debug.h"
#define PARSE_REGEX "(.*),(.*)"
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
int DetectFlowvarMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
static int DetectFlowvarSetup (DetectEngineCtx *, Signature *, char *);
static int DetectFlowvarPostMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *sm);
static void DetectFlowvarDataFree(void *ptr);
void DetectFlowvarRegister (void) {
sigmatch_table[DETECT_FLOWVAR].name = "flowvar";
sigmatch_table[DETECT_FLOWVAR].Match = DetectFlowvarMatch;
sigmatch_table[DETECT_FLOWVAR].Setup = DetectFlowvarSetup;
sigmatch_table[DETECT_FLOWVAR].Free = DetectFlowvarDataFree;
sigmatch_table[DETECT_FLOWVAR].RegisterTests = NULL;
/* post-match for flowvar storage */
sigmatch_table[DETECT_FLOWVAR_POSTMATCH].name = "__flowvar__postmatch__";
sigmatch_table[DETECT_FLOWVAR_POSTMATCH].Match = DetectFlowvarPostMatch;
sigmatch_table[DETECT_FLOWVAR_POSTMATCH].Setup = NULL;
sigmatch_table[DETECT_FLOWVAR_POSTMATCH].Free = DetectFlowvarDataFree;
sigmatch_table[DETECT_FLOWVAR_POSTMATCH].RegisterTests = NULL;
const char *eb;
int eo;
int opts = 0;
parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
if(parse_regex == NULL)
{
SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb);
goto error;
}
parse_regex_study = pcre_study(parse_regex, 0, &eb);
if(eb != NULL)
{
SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
goto error;
}
return;
error:
return;
}
/**
* \brief this function will SCFree memory associated with DetectFlowvarData
*
* \param cd pointer to DetectCotentData
*/
static void DetectFlowvarDataFree(void *ptr) {
if (ptr == NULL)
SCReturn;
DetectFlowvarData *fd = (DetectFlowvarData *)ptr;
if (fd->name)
SCFree(fd->name);
if (fd->content)
SCFree(fd->content);
SCFree(fd);
}
/*
* returns 0: no match
* 1: match
* -1: error
*/
int DetectFlowvarMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *m)
{
int ret = 0;
DetectFlowvarData *fd = (DetectFlowvarData *)m->ctx;
/* we need a lock */
FLOWLOCK_RDLOCK(p->flow);
FlowVar *fv = FlowVarGet(p->flow, fd->idx);
if (fv != NULL) {
uint8_t *ptr = SpmSearch(fv->data.fv_str.value,
fv->data.fv_str.value_len,
fd->content, fd->content_len);
if (ptr != NULL)
ret = 1;
}
FLOWLOCK_UNLOCK(p->flow);
return ret;
}
static int DetectFlowvarSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
DetectFlowvarData *cd = NULL;
SigMatch *sm = NULL;
char *str = rawstr;
char dubbed = 0;
uint16_t len;
char *varname = NULL, *varcontent = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret != 3) {
SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for flowvar.", rawstr);
return -1;
}
const char *str_ptr;
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
return -1;
}
varname = (char *)str_ptr;
if (ret > 2) {
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
return -1;
}
varcontent = (char *)str_ptr;
}
if (varcontent[0] == '\"' && varcontent[strlen(varcontent)-1] == '\"') {
str = SCStrdup(varcontent+1);
if (unlikely(str == NULL)) {
return -1;
}
str[strlen(varcontent)-2] = '\0';
dubbed = 1;
}
len = strlen(str);
if (len == 0) {
if (dubbed) SCFree(str);
return -1;
}
cd = SCMalloc(sizeof(DetectFlowvarData));
if (unlikely(cd == NULL))
goto error;
char converted = 0;
{
uint16_t i, x;
uint8_t bin = 0, binstr[3] = "", binpos = 0;
for (i = 0, x = 0; i < len; i++) {
// printf("str[%02u]: %c\n", i, str[i]);
if (str[i] == '|') {
if (bin) {
bin = 0;
} else {
bin = 1;
}
} else {
if (bin) {
if (isdigit((unsigned char)str[i]) ||
str[i] == 'A' || str[i] == 'a' ||
str[i] == 'B' || str[i] == 'b' ||
str[i] == 'C' || str[i] == 'c' ||
str[i] == 'D' || str[i] == 'd' ||
str[i] == 'E' || str[i] == 'e' ||
str[i] == 'F' || str[i] == 'f') {
// printf("part of binary: %c\n", str[i]);
binstr[binpos] = (char)str[i];
binpos++;
if (binpos == 2) {
uint8_t c = strtol((char *)binstr, (char **) NULL, 16) & 0xFF;
binpos = 0;
str[x] = c;
x++;
converted = 1;
}
} else if (str[i] == ' ') {
// printf("space as part of binary string\n");
}
} else {
str[x] = str[i];
x++;
}
}
}
#ifdef DEBUG
if (SCLogDebugEnabled()) {
for (i = 0; i < x; i++) {
if (isprint((unsigned char)str[i])) printf("%c", str[i]);
else printf("\\x%02u", str[i]);
}
printf("\n");
}
#endif
if (converted)
len = x;
}
cd->content = SCMalloc(len);
if (cd->content == NULL) {
if (dubbed) SCFree(str);
SCFree(cd);
return -1;
}
cd->name = SCStrdup(varname);
cd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWVAR);
memcpy(cd->content, str, len);
cd->content_len = len;
cd->flags = 0;
/* Okay so far so good, lets get this into a SigMatch
* and put it in the Signature. */
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_FLOWVAR;
sm->ctx = (void *)cd;
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
if (dubbed) SCFree(str);
return 0;
error:
if (dubbed) SCFree(str);
if (cd) SCFree(cd);
if (sm) SCFree(sm);
return -1;
}
/** \brief Store flowvar in det_ctx so we can exec it post-match */
int DetectFlowvarStoreMatch(DetectEngineThreadCtx *det_ctx, uint16_t idx, uint8_t *buffer, uint16_t len) {
DetectFlowvarList *fs = det_ctx->flowvarlist;
/* first check if we have had a previous match for this idx */
for ( ; fs != NULL; fs = fs->next) {
if (fs->idx == idx) {
/* we're replacing the older store */
SCFree(fs->buffer);
fs->buffer = NULL;
break;
}
}
if (fs == NULL) {
fs = SCMalloc(sizeof(*fs));
if (unlikely(fs == NULL))
return -1;
fs->idx = idx;
fs->next = det_ctx->flowvarlist;
det_ctx->flowvarlist = fs;
}
fs->len = len;
fs->buffer = buffer;
return 0;
}
/** \brief Setup a post-match for flowvar storage
* We're piggyback riding the DetectFlowvarData struct
*/
int DetectFlowvarPostMatchSetup(Signature *s, uint16_t idx) {
SigMatch *sm = NULL;
DetectFlowvarData *fv = NULL;
fv = SCMalloc(sizeof(DetectFlowvarData));
if (unlikely(fv == NULL))
goto error;
memset(fv, 0x00, sizeof(*fv));
/* we only need the idx */
fv->idx = idx;
sm = SigMatchAlloc();
if (unlikely(sm == NULL))
goto error;
sm->type = DETECT_FLOWVAR_POSTMATCH;
sm->ctx = (void *)fv;
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH);
return 0;
error:
if (fv != NULL)
DetectFlowvarDataFree(fv);
return -1;
}
/** \internal
* \brief post-match func to store flowvars in the flow
* \param sm sigmatch containing the idx to store
* \retval 1 or -1 in case of error
*/
static int DetectFlowvarPostMatch(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *sm) {
DetectFlowvarList *fs, *prev;
DetectFlowvarData *fd;
if (det_ctx->flowvarlist == NULL || p->flow == NULL)
return 1;
fd = (DetectFlowvarData *)sm->ctx;
prev = NULL;
fs = det_ctx->flowvarlist;
while (fs != NULL) {
if (fd->idx == fs->idx) {
FlowVarAddStr(p->flow, fs->idx, fs->buffer, fs->len);
/* memory at fs->buffer is now the responsibility of
* the flowvar code. */
if (fs == det_ctx->flowvarlist) {
det_ctx->flowvarlist = fs->next;
SCFree(fs);
fs = det_ctx->flowvarlist;
} else {
prev->next = fs->next;
SCFree(fs);
fs = prev->next;
}
} else {
prev = fs;
fs = fs->next;
}
}
return 1;
}
/** \brief Clean flowvar candidate list in det_ctx */
void DetectFlowvarCleanupList(DetectEngineThreadCtx *det_ctx) {
DetectFlowvarList *fs, *next;
if (det_ctx->flowvarlist != NULL) {
fs = det_ctx->flowvarlist;
while (fs != NULL) {
next = fs->next;
SCFree(fs->buffer);
SCFree(fs);
fs = next;
}
det_ctx->flowvarlist = NULL;
}
}