diff options
Diffstat (limited to 'framework/src/suricata/src/detect-xbits.c')
| -rw-r--r-- | framework/src/suricata/src/detect-xbits.c | 545 |
1 files changed, 545 insertions, 0 deletions
diff --git a/framework/src/suricata/src/detect-xbits.c b/framework/src/suricata/src/detect-xbits.c new file mode 100644 index 00000000..876ddc36 --- /dev/null +++ b/framework/src/suricata/src/detect-xbits.c @@ -0,0 +1,545 @@ +/* Copyright (C) 2007-2010 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Victor Julien <victor@inliniac.net> + * + * Implements the xbits keyword + */ + +#include "suricata-common.h" +#include "decode.h" +#include "detect.h" +#include "threads.h" +#include "flow.h" +#include "flow-util.h" +#include "detect-xbits.h" +#include "detect-hostbits.h" +#include "util-spm.h" + +#include "detect-engine-sigorder.h" + +#include "app-layer-parser.h" + +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "detect-engine-state.h" + +#include "flow-bit.h" +#include "host-bit.h" +#include "ippair-bit.h" +#include "util-var-name.h" +#include "util-unittest.h" +#include "util-debug.h" + +/* + xbits:set,bitname,track ip_pair,expire 60 + */ + +#define PARSE_REGEX "([a-z]+)" "(?:,\\s*([^,]+))?" "(?:,\\s*(?:track\\s+([^,]+)))" "(?:,\\s*(?:expire\\s+([^,]+)))?" +static pcre *parse_regex; +static pcre_extra *parse_regex_study; + +int DetectXbitMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); +static int DetectXbitSetup (DetectEngineCtx *, Signature *, char *); +void DetectXbitFree (void *); +void XBitsRegisterTests(void); + +void DetectXbitsRegister (void) +{ + sigmatch_table[DETECT_XBITS].name = "xbits"; + sigmatch_table[DETECT_XBITS].desc = "operate on bits"; +// sigmatch_table[DETECT_XBITS].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#Flowbits"; + sigmatch_table[DETECT_XBITS].Match = DetectXbitMatch; + sigmatch_table[DETECT_XBITS].Setup = DetectXbitSetup; + sigmatch_table[DETECT_XBITS].Free = DetectXbitFree; + sigmatch_table[DETECT_XBITS].RegisterTests = XBitsRegisterTests; + /* this is compatible to ip-only signatures */ + sigmatch_table[DETECT_XBITS].flags |= SIGMATCH_IPONLY_COMPAT; + + const char *eb; + int eo; + int opts = 0; + + parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); + if(parse_regex == NULL) + { + SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if(eb != NULL) + { + SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); + goto error; + } + + return; + +error: + return; +} + +static int DetectIPPairbitMatchToggle (Packet *p, const DetectXbitsData *fd) +{ + IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 0; + + IPPairBitToggle(pair,fd->idx,p->ts.tv_sec + fd->expire); + IPPairRelease(pair); + return 1; +} + +/* return true even if bit not found */ +static int DetectIPPairbitMatchUnset (Packet *p, const DetectXbitsData *fd) +{ + IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 1; + + IPPairBitUnset(pair,fd->idx); + IPPairRelease(pair); + return 1; +} + +static int DetectIPPairbitMatchSet (Packet *p, const DetectXbitsData *fd) +{ + IPPair *pair = IPPairGetIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 0; + + IPPairBitSet(pair, fd->idx, p->ts.tv_sec + fd->expire); + IPPairRelease(pair); + return 1; +} + +static int DetectIPPairbitMatchIsset (Packet *p, const DetectXbitsData *fd) +{ + int r = 0; + IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 0; + + r = IPPairBitIsset(pair,fd->idx,p->ts.tv_sec); + IPPairRelease(pair); + return r; +} + +static int DetectIPPairbitMatchIsnotset (Packet *p, const DetectXbitsData *fd) +{ + int r = 0; + IPPair *pair = IPPairLookupIPPairFromHash(&p->src, &p->dst); + if (pair == NULL) + return 1; + + r = IPPairBitIsnotset(pair,fd->idx,p->ts.tv_sec); + IPPairRelease(pair); + return r; +} + +static int DetectXbitMatchIPPair(Packet *p, const DetectXbitsData *xd) +{ + switch (xd->cmd) { + case DETECT_XBITS_CMD_ISSET: + return DetectIPPairbitMatchIsset(p,xd); + case DETECT_XBITS_CMD_ISNOTSET: + return DetectIPPairbitMatchIsnotset(p,xd); + case DETECT_XBITS_CMD_SET: + return DetectIPPairbitMatchSet(p,xd); + case DETECT_XBITS_CMD_UNSET: + return DetectIPPairbitMatchUnset(p,xd); + case DETECT_XBITS_CMD_TOGGLE: + return DetectIPPairbitMatchToggle(p,xd); + default: + SCLogError(SC_ERR_UNKNOWN_VALUE, "unknown cmd %" PRIu32 "", xd->cmd); + return 0; + } + return 0; +} + +/* + * returns 0: no match + * 1: match + * -1: error + */ + +int DetectXbitMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) +{ + const DetectXbitsData *fd = (const DetectXbitsData *)ctx; + if (fd == NULL) + return 0; + + switch (fd->type) { + case VAR_TYPE_HOST_BIT: + return DetectXbitMatchHost(p, (const DetectXbitsData *)fd); + break; + case VAR_TYPE_IPPAIR_BIT: + return DetectXbitMatchIPPair(p, (const DetectXbitsData *)fd); + break; + default: + break; + } + return 0; +} + +int DetectXbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) +{ + DetectXbitsData *cd = NULL; + SigMatch *sm = NULL; + uint8_t fb_cmd = 0; + uint8_t hb_dir = 0; +#define MAX_SUBSTRINGS 30 + int ret = 0, res = 0; + int ov[MAX_SUBSTRINGS]; + char fb_cmd_str[16] = "", fb_name[256] = ""; + char hb_dir_str[16] = ""; + enum VarTypes var_type = VAR_TYPE_NOT_SET; + int expire = 30; + + ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS); + if (ret != 2 && ret != 3 && ret != 4 && ret != 5) { + SCLogError(SC_ERR_PCRE_MATCH, "\"%s\" is not a valid setting for xbits.", rawstr); + return -1; + } + SCLogDebug("ret %d, %s", ret, rawstr); + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, fb_cmd_str, sizeof(fb_cmd_str)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + return -1; + } + + if (ret >= 3) { + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, fb_name, sizeof(fb_name)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + goto error; + } + if (ret >= 4) { + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, hb_dir_str, sizeof(hb_dir_str)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + goto error; + } + SCLogDebug("hb_dir_str %s", hb_dir_str); + if (strlen(hb_dir_str) > 0) { + if (strcmp(hb_dir_str, "ip_src") == 0) { + hb_dir = DETECT_XBITS_TRACK_IPSRC; + var_type = VAR_TYPE_HOST_BIT; + } else if (strcmp(hb_dir_str, "ip_dst") == 0) { + hb_dir = DETECT_XBITS_TRACK_IPDST; + var_type = VAR_TYPE_HOST_BIT; + } else if (strcmp(hb_dir_str, "ip_pair") == 0) { + hb_dir = DETECT_XBITS_TRACK_IPPAIR; + var_type = VAR_TYPE_IPPAIR_BIT; + } else { + // TODO + goto error; + } + } + + if (ret >= 5) { + char expire_str[16] = ""; + res = pcre_copy_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 4, expire_str, sizeof(expire_str)); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_copy_substring failed"); + goto error; + } + SCLogDebug("expire_str %s", expire_str); + expire = atoi(expire_str); + SCLogDebug("expire %d", expire); + } + } + } + + if (strcmp(fb_cmd_str,"noalert") == 0) { + fb_cmd = DETECT_XBITS_CMD_NOALERT; + } else if (strcmp(fb_cmd_str,"isset") == 0) { + fb_cmd = DETECT_XBITS_CMD_ISSET; + } else if (strcmp(fb_cmd_str,"isnotset") == 0) { + fb_cmd = DETECT_XBITS_CMD_ISNOTSET; + } else if (strcmp(fb_cmd_str,"set") == 0) { + fb_cmd = DETECT_XBITS_CMD_SET; + } else if (strcmp(fb_cmd_str,"unset") == 0) { + fb_cmd = DETECT_XBITS_CMD_UNSET; + } else if (strcmp(fb_cmd_str,"toggle") == 0) { + fb_cmd = DETECT_XBITS_CMD_TOGGLE; + } else { + SCLogError(SC_ERR_UNKNOWN_VALUE, "ERROR: flowbits action \"%s\" is not supported.", fb_cmd_str); + goto error; + } + + switch (fb_cmd) { + case DETECT_XBITS_CMD_NOALERT: + if (strlen(fb_name) != 0) + goto error; + s->flags |= SIG_FLAG_NOALERT; + return 0; + case DETECT_XBITS_CMD_ISNOTSET: + case DETECT_XBITS_CMD_ISSET: + case DETECT_XBITS_CMD_SET: + case DETECT_XBITS_CMD_UNSET: + case DETECT_XBITS_CMD_TOGGLE: + default: + if (strlen(fb_name) == 0) + goto error; + break; + } + + cd = SCMalloc(sizeof(DetectXbitsData)); + if (unlikely(cd == NULL)) + goto error; + + cd->idx = VariableNameGetIdx(de_ctx, fb_name, var_type); + cd->cmd = fb_cmd; + cd->tracker = hb_dir; + cd->type = var_type; + cd->expire = expire; + + SCLogDebug("idx %" PRIu32 ", cmd %s, name %s", + cd->idx, fb_cmd_str, strlen(fb_name) ? fb_name : "(none)"); + + /* Okay so far so good, lets get this into a SigMatch + * and put it in the Signature. */ + sm = SigMatchAlloc(); + if (sm == NULL) + goto error; + + sm->type = DETECT_XBITS; + sm->ctx = (void *)cd; + + switch (fb_cmd) { + /* case DETECT_XBITS_CMD_NOALERT can't happen here */ + + case DETECT_XBITS_CMD_ISNOTSET: + case DETECT_XBITS_CMD_ISSET: + /* checks, so packet list */ + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); + break; + + case DETECT_XBITS_CMD_SET: + case DETECT_XBITS_CMD_UNSET: + case DETECT_XBITS_CMD_TOGGLE: + /* modifiers, only run when entire sig has matched */ + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH); + break; + } + + return 0; + +error: + if (cd != NULL) + SCFree(cd); + if (sm != NULL) + SCFree(sm); + return -1; +} + +void DetectXbitFree (void *ptr) +{ + DetectXbitsData *fd = (DetectXbitsData *)ptr; + + if (fd == NULL) + return; + + SCFree(fd); +} + +#ifdef UNITTESTS + +static void XBitsTestSetup(void) +{ + StorageInit(); + HostBitInitCtx(); + IPPairBitInitCtx(); + StorageFinalize(); + HostInitConfig(TRUE); + IPPairInitConfig(TRUE); +} + +static void XBitsTestShutdown(void) +{ + HostCleanup(); + IPPairCleanup(); + StorageCleanup(); +} + +/** + * \test HostBitsTestSig01 is a test for a valid noalert flowbits option + * + * \retval 1 on succces + * \retval 0 on failure + */ + +static int XBitsTestSig01(void) +{ + uint8_t *buf = (uint8_t *) + "GET /one/ HTTP/1.1\r\n" + "Host: one.example.org\r\n" + "\r\n"; + uint16_t buflen = strlen((char *)buf); + Packet *p = SCMalloc(SIZE_OF_PACKET); + if (unlikely(p == NULL)) + return 0; + Signature *s = NULL; + ThreadVars th_v; + DetectEngineThreadCtx *det_ctx = NULL; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + memset(&th_v, 0, sizeof(th_v)); + memset(p, 0, SIZE_OF_PACKET); + p->src.family = AF_INET; + p->dst.family = AF_INET; + p->payload = buf; + p->payload_len = buflen; + p->proto = IPPROTO_TCP; + + XBitsTestSetup(); + + de_ctx = DetectEngineCtxInit(); + + if (de_ctx == NULL) { + printf("bad de_ctx: "); + goto end; + } + + de_ctx->flags |= DE_QUIET; + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:1;)"); + if (s == NULL) { + printf("bad sig: "); + goto end; + } + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + + result = 1; + +end: + if (de_ctx != NULL) { + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + } + + if (det_ctx != NULL) { + DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + } + + if (de_ctx != NULL) { + DetectEngineCtxFree(de_ctx); + } + + XBitsTestShutdown(); + + SCFree(p); + return result; +} + +/** + * \test various options + * + * \retval 1 on succces + * \retval 0 on failure + */ + +static int XBitsTestSig02(void) +{ + Signature *s = NULL; + ThreadVars th_v; + DetectEngineCtx *de_ctx = NULL; + int result = 0; + int error_count = 0; + + memset(&th_v, 0, sizeof(th_v)); + + de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) { + goto end; + } + + de_ctx->flags |= DE_QUIET; + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:isset,abc,track ip_src; content:\"GET \"; sid:1;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:isnotset,abc,track ip_dst; content:\"GET \"; sid:2;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:set,abc,track ip_pair; content:\"GET \"; sid:3;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:unset,abc,track ip_src; content:\"GET \"; sid:4;)"); + if (s == NULL) { + error_count++; + } + + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:toggle,abc,track ip_dst; content:\"GET \"; sid:5;)"); + if (s == NULL) { + error_count++; + } + + if (error_count != 0) + goto end; + + result = 1; + + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + return result; +end: + if (de_ctx != NULL) { + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); + } + + return result; +} + +#endif /* UNITTESTS */ + +/** + * \brief this function registers unit tests for XBits + */ +void XBitsRegisterTests(void) +{ +#ifdef UNITTESTS + UtRegisterTest("XBitsTestSig01", XBitsTestSig01, 1); + UtRegisterTest("XBitsTestSig02", XBitsTestSig02, 1); +#endif /* UNITTESTS */ +} |