diff options
Diffstat (limited to 'framework/src/suricata/src/detect-urilen.c')
-rw-r--r-- | framework/src/suricata/src/detect-urilen.c | 700 |
1 files changed, 700 insertions, 0 deletions
diff --git a/framework/src/suricata/src/detect-urilen.c b/framework/src/suricata/src/detect-urilen.c new file mode 100644 index 00000000..1355f559 --- /dev/null +++ b/framework/src/suricata/src/detect-urilen.c @@ -0,0 +1,700 @@ +/* Copyright (C) 2007-2010 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Gurvinder Singh <gurvindersighdahiya@gmail.com> + * + * Implements the urilen keyword + */ + +#include "suricata-common.h" +#include "app-layer.h" +#include "app-layer-protos.h" +#include "app-layer-htp.h" +#include "util-unittest.h" +#include "util-unittest-helper.h" + +#include "detect.h" +#include "detect-parse.h" +#include "detect-engine-state.h" + +#include "detect-urilen.h" +#include "util-debug.h" +#include "util-byte.h" +#include "flow-util.h" +#include "stream-tcp.h" + +/** + * \brief Regex for parsing our urilen + */ +#define PARSE_REGEX "^(?:\\s*)(<|>)?(?:\\s*)([0-9]{1,5})(?:\\s*)(?:(<>)(?:\\s*)([0-9]{1,5}))?\\s*(?:,\\s*(norm|raw))?\\s*$" + +static pcre *parse_regex; +static pcre_extra *parse_regex_study; + +/*prototypes*/ +static int DetectUrilenSetup (DetectEngineCtx *, Signature *, char *); +void DetectUrilenFree (void *); +void DetectUrilenRegisterTests (void); + +/** + * \brief Registration function for urilen: keyword + */ + +void DetectUrilenRegister(void) +{ + sigmatch_table[DETECT_AL_URILEN].name = "urilen"; + sigmatch_table[DETECT_AL_URILEN].desc = "match on the length of the HTTP uri"; + sigmatch_table[DETECT_AL_URILEN].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords#Urilen"; + sigmatch_table[DETECT_AL_URILEN].Match = NULL; + sigmatch_table[DETECT_AL_URILEN].alproto = ALPROTO_HTTP; + sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = NULL /**< We handle this at detect-engine-uri.c now */; + sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup; + sigmatch_table[DETECT_AL_URILEN].Free = DetectUrilenFree; + sigmatch_table[DETECT_AL_URILEN].RegisterTests = DetectUrilenRegisterTests; + sigmatch_table[DETECT_AL_URILEN].flags |= SIGMATCH_PAYLOAD; + + const char *eb; + int eo; + int opts = 0; + + parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); + if (parse_regex == NULL) { + SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s", + PARSE_REGEX, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if (eb != NULL) { + SCLogDebug("pcre study failed: %s", eb); + goto error; + } + return; + +error: + if (parse_regex != NULL) + pcre_free(parse_regex); + if (parse_regex_study != NULL) + pcre_free_study(parse_regex_study); + return; +} + +/** + * \brief This function is used to parse urilen options passed via urilen: keyword + * + * \param urilenstr Pointer to the user provided urilen options + * + * \retval urilend pointer to DetectUrilenData on success + * \retval NULL on failure + */ + +DetectUrilenData *DetectUrilenParse (char *urilenstr) +{ + + DetectUrilenData *urilend = NULL; + char *arg1 = NULL; + char *arg2 = NULL; + char *arg3 = NULL; + char *arg4 = NULL; + char *arg5 = NULL; +#define MAX_SUBSTRINGS 30 + int ret = 0, res = 0; + int ov[MAX_SUBSTRINGS]; + + ret = pcre_exec(parse_regex, parse_regex_study, urilenstr, strlen(urilenstr), + 0, 0, ov, MAX_SUBSTRINGS); + if (ret < 3 || ret > 6) { + SCLogError(SC_ERR_PCRE_PARSE, "urilen option pcre parse error: \"%s\"", urilenstr); + goto error; + } + const char *str_ptr; + + SCLogDebug("ret %d", ret); + + res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg1 = (char *) str_ptr; + SCLogDebug("Arg1 \"%s\"", arg1); + + res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg2 = (char *) str_ptr; + SCLogDebug("Arg2 \"%s\"", arg2); + + if (ret > 3) { + res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg3 = (char *) str_ptr; + SCLogDebug("Arg3 \"%s\"", arg3); + + if (ret > 4) { + res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 4, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg4 = (char *) str_ptr; + SCLogDebug("Arg4 \"%s\"", arg4); + } + if (ret > 5) { + res = pcre_get_substring((char *)urilenstr, ov, MAX_SUBSTRINGS, 5, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg5 = (char *) str_ptr; + SCLogDebug("Arg5 \"%s\"", arg5); + } + } + + urilend = SCMalloc(sizeof (DetectUrilenData)); + if (unlikely(urilend == NULL)) + goto error; + memset(urilend, 0, sizeof(DetectUrilenData)); + + if (arg1[0] == '<') + urilend->mode = DETECT_URILEN_LT; + else if (arg1[0] == '>') + urilend->mode = DETECT_URILEN_GT; + else + urilend->mode = DETECT_URILEN_EQ; + + if (arg3 != NULL && strcmp("<>", arg3) == 0) { + if (strlen(arg1) != 0) { + SCLogError(SC_ERR_INVALID_ARGUMENT,"Range specified but mode also set"); + goto error; + } + urilend->mode = DETECT_URILEN_RA; + } + + /** set the first urilen value */ + if (ByteExtractStringUint16(&urilend->urilen1,10,strlen(arg2),arg2) <= 0){ + SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size :\"%s\"",arg2); + goto error; + } + + /** set the second urilen value if specified */ + if (arg4 != NULL && strlen(arg4) > 0) { + if (urilend->mode != DETECT_URILEN_RA) { + SCLogError(SC_ERR_INVALID_ARGUMENT,"Multiple urilen values specified" + " but mode is not range"); + goto error; + } + + if(ByteExtractStringUint16(&urilend->urilen2,10,strlen(arg4),arg4) <= 0) + { + SCLogError(SC_ERR_INVALID_ARGUMENT,"Invalid size :\"%s\"",arg4); + goto error; + } + + if (urilend->urilen2 <= urilend->urilen1){ + SCLogError(SC_ERR_INVALID_ARGUMENT,"urilen2:%"PRIu16" <= urilen:" + "%"PRIu16"",urilend->urilen2,urilend->urilen1); + goto error; + } + } + + if (arg5 != NULL) { + if (strcasecmp("raw", arg5) == 0) { + urilend->raw_buffer = 1; + } + } + + pcre_free_substring(arg1); + pcre_free_substring(arg2); + if (arg3 != NULL) + pcre_free_substring(arg3); + if (arg4 != NULL) + pcre_free_substring(arg4); + if (arg5 != NULL) + pcre_free_substring(arg5); + return urilend; + +error: + if (urilend) + SCFree(urilend); + if (arg1 != NULL) + SCFree(arg1); + if (arg2 != NULL) + SCFree(arg2); + if (arg3 != NULL) + SCFree(arg3); + if (arg4 != NULL) + SCFree(arg4); + return NULL; +} + +/** + * \brief this function is used to parse urilen data into the current signature + * + * \param de_ctx pointer to the Detection Engine Context + * \param s pointer to the Current Signature + * \param urilenstr pointer to the user provided urilen options + * + * \retval 0 on Success + * \retval -1 on Failure + */ +static int DetectUrilenSetup (DetectEngineCtx *de_ctx, Signature *s, char *urilenstr) +{ + SCEnter(); + DetectUrilenData *urilend = NULL; + SigMatch *sm = NULL; + + if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) { + SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains a non http " + "alproto set"); + goto error; + } + + urilend = DetectUrilenParse(urilenstr); + if (urilend == NULL) + goto error; + sm = SigMatchAlloc(); + if (sm == NULL) + goto error; + sm->type = DETECT_AL_URILEN; + sm->ctx = (void *)urilend; + + if (urilend->raw_buffer) + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRUDMATCH); + else + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_UMATCH); + + /* Flagged the signature as to inspect the app layer data */ + s->flags |= SIG_FLAG_APPLAYER; + s->alproto = ALPROTO_HTTP; + + SCReturnInt(0); + +error: + DetectUrilenFree(urilend); + SCReturnInt(-1); +} + +/** + * \brief this function will free memory associated with DetectUrilenData + * + * \param ptr pointer to DetectUrilenData + */ +void DetectUrilenFree(void *ptr) +{ + if (ptr == NULL) + return; + + DetectUrilenData *urilend = (DetectUrilenData *)ptr; + SCFree(urilend); +} + +#ifdef UNITTESTS + +#include "stream.h" +#include "stream-tcp-private.h" +#include "stream-tcp-reassemble.h" +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "app-layer-parser.h" + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest01(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse("10"); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_EQ && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest02(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse(" < 10 "); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_LT && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest03(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse(" > 10 "); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_GT && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest04(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse(" 5 <> 10 "); + if (urilend != NULL) { + if (urilend->urilen1 == 5 && urilend->urilen2 == 10 && + urilend->mode == DETECT_URILEN_RA && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest05(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse("5<>10,norm"); + if (urilend != NULL) { + if (urilend->urilen1 == 5 && urilend->urilen2 == 10 && + urilend->mode == DETECT_URILEN_RA && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest06(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse("5<>10,raw"); + if (urilend != NULL) { + if (urilend->urilen1 == 5 && urilend->urilen2 == 10 && + urilend->mode == DETECT_URILEN_RA && + urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest07(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse(">10, norm "); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_GT && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest08(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse("<10, norm "); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_LT && + !urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest09(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse(">10, raw "); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_GT && + urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** \test Test the Urilen keyword setup */ +static int DetectUrilenParseTest10(void) +{ + int ret = 0; + DetectUrilenData *urilend = NULL; + + urilend = DetectUrilenParse("<10, raw "); + if (urilend != NULL) { + if (urilend->urilen1 == 10 && urilend->mode == DETECT_URILEN_LT && + urilend->raw_buffer) + ret = 1; + + DetectUrilenFree(urilend); + } + return ret; +} + +/** + * \brief this function is used to initialize the detection engine context and + * setup the signature with passed values. + * + */ + +static int DetectUrilenInitTest(DetectEngineCtx **de_ctx, Signature **sig, + DetectUrilenData **urilend, char *str) +{ + char fullstr[1024]; + int result = 0; + + *de_ctx = NULL; + *sig = NULL; + + if (snprintf(fullstr, 1024, "alert ip any any -> any any (msg:\"Urilen " + "test\"; urilen:%s; sid:1;)", str) >= 1024) { + goto end; + } + + *de_ctx = DetectEngineCtxInit(); + if (*de_ctx == NULL) { + goto end; + } + + (*de_ctx)->flags |= DE_QUIET; + + (*de_ctx)->sig_list = SigInit(*de_ctx, fullstr); + if ((*de_ctx)->sig_list == NULL) { + goto end; + } + + *sig = (*de_ctx)->sig_list; + + *urilend = DetectUrilenParse(str); + + result = 1; + +end: + return result; +} + +/** + * \test DetectUrilenSetpTest01 is a test for setting up an valid urilen values + * with valid "<>" operator and include spaces arround the given values. + * In the test the values are setup with initializing the detection engine + * context and setting up the signature itself. + */ + +static int DetectUrilenSetpTest01(void) +{ + + DetectUrilenData *urilend = NULL; + uint8_t res = 0; + Signature *sig = NULL; + DetectEngineCtx *de_ctx = NULL; + + res = DetectUrilenInitTest(&de_ctx, &sig, &urilend, "1 <> 2 "); + if (res == 0) { + goto end; + } + + if(urilend == NULL) + goto cleanup; + + if (urilend != NULL) { + if (urilend->urilen1 == 1 && urilend->urilen2 == 2 && + urilend->mode == DETECT_URILEN_RA) + res = 1; + } + +cleanup: + if (urilend) SCFree(urilend); + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); +end: + return res; +} + +/** \test Check a signature with gievn urilen */ +static int DetectUrilenSigTest01(void) +{ + int result = 0; + Flow f; + uint8_t httpbuf1[] = "POST /suricata HTTP/1.0\r\n" + "Host: foo.bar.tld\r\n" + "\r\n"; + uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */ + TcpSession ssn; + Packet *p = NULL; + Signature *s = NULL; + ThreadVars th_v; + DetectEngineThreadCtx *det_ctx; + AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc(); + + memset(&th_v, 0, sizeof(th_v)); + memset(&f, 0, sizeof(f)); + memset(&ssn, 0, sizeof(ssn)); + + p = UTHBuildPacket(NULL, 0, IPPROTO_TCP); + + FLOW_INITIALIZE(&f); + f.protoctx = (void *)&ssn; + f.proto = IPPROTO_TCP; + f.flags |= FLOW_IPV4; + + p->flow = &f; + p->flowflags |= FLOW_PKT_TOSERVER; + p->flowflags |= FLOW_PKT_ESTABLISHED; + p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; + f.alproto = ALPROTO_HTTP; + + StreamTcpInitConfig(TRUE); + + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) { + goto end; + } + + de_ctx->flags |= DE_QUIET; + + s = de_ctx->sig_list = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"Testing urilen\"; " + "urilen: <5; sid:1;)"); + if (s == NULL) { + goto end; + } + + s = s->next = SigInit(de_ctx, + "alert tcp any any -> any any " + "(msg:\"Testing http_method\"; " + "urilen: >5; sid:2;)"); + if (s == NULL) { + goto end; + } + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + SCMutexLock(&f.m); + int r = AppLayerParserParse(alp_tctx, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf1, httplen1); + if (r != 0) { + SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r); + SCMutexUnlock(&f.m); + goto end; + } + SCMutexUnlock(&f.m); + + HtpState *htp_state = f.alstate; + if (htp_state == NULL) { + SCLogDebug("no http state: "); + goto end; + } + + SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + + if ((PacketAlertCheck(p, 1))) { + printf("sid 1 alerted, but should not have: \n"); + goto end; + } + if (!PacketAlertCheck(p, 2)) { + printf("sid 2 did not alerted, but should have: \n"); + goto end; + } + + result = 1; + +end: + if (alp_tctx != NULL) + AppLayerParserThreadCtxFree(alp_tctx); + if (de_ctx != NULL) SigGroupCleanup(de_ctx); + if (de_ctx != NULL) SigCleanSignatures(de_ctx); + if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); + + StreamTcpFreeConfig(TRUE); + FLOW_DESTROY(&f); + UTHFreePackets(&p, 1); + return result; +} + +#endif /* UNITTESTS */ + +/** + * \brief this function registers unit tests for DetectUrilen + */ +void DetectUrilenRegisterTests(void) +{ +#ifdef UNITTESTS + UtRegisterTest("DetectUrilenParseTest01", DetectUrilenParseTest01, 1); + UtRegisterTest("DetectUrilenParseTest02", DetectUrilenParseTest02, 1); + UtRegisterTest("DetectUrilenParseTest03", DetectUrilenParseTest03, 1); + UtRegisterTest("DetectUrilenParseTest04", DetectUrilenParseTest04, 1); + UtRegisterTest("DetectUrilenParseTest05", DetectUrilenParseTest05, 1); + UtRegisterTest("DetectUrilenParseTest06", DetectUrilenParseTest06, 1); + UtRegisterTest("DetectUrilenParseTest07", DetectUrilenParseTest07, 1); + UtRegisterTest("DetectUrilenParseTest08", DetectUrilenParseTest08, 1); + UtRegisterTest("DetectUrilenParseTest09", DetectUrilenParseTest09, 1); + UtRegisterTest("DetectUrilenParseTest10", DetectUrilenParseTest10, 1); + UtRegisterTest("DetectUrilenSetpTest01", DetectUrilenSetpTest01, 1); + UtRegisterTest("DetectUrilenSigTest01", DetectUrilenSigTest01, 1); +#endif /* UNITTESTS */ +} |