From 8879b125d26e8db1a5633de5a9c692eb2d1c4f83 Mon Sep 17 00:00:00 2001 From: Ashlee Young Date: Wed, 9 Sep 2015 22:21:41 -0700 Subject: suricata checkin based on commit id a4bce14770beee46a537eda3c3f6e8e8565d5d0a Change-Id: I9a214fa0ee95e58fc640e50bd604dac7f42db48f --- framework/src/suricata/src/detect-stream_size.c | 532 ++++++++++++++++++++++++ 1 file changed, 532 insertions(+) create mode 100644 framework/src/suricata/src/detect-stream_size.c (limited to 'framework/src/suricata/src/detect-stream_size.c') diff --git a/framework/src/suricata/src/detect-stream_size.c b/framework/src/suricata/src/detect-stream_size.c new file mode 100644 index 00000000..c3eaad90 --- /dev/null +++ b/framework/src/suricata/src/detect-stream_size.c @@ -0,0 +1,532 @@ +/* Copyright (C) 2007-2013 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Gurvinder Singh + * + * Stream size for the engine. + */ + +#include "suricata-common.h" +#include "stream-tcp.h" +#include "util-unittest.h" + +#include "detect.h" +#include "detect-parse.h" + +#include "flow.h" +#include "detect-stream_size.h" +#include "stream-tcp-private.h" +#include "util-debug.h" + +/** + * \brief Regex for parsing our flow options + */ +#define PARSE_REGEX "^\\s*([A-z_]+)\\s*,\\s*([<=>!]+)\\s*,\\s*([0-9]+)\\s*$" + +static pcre *parse_regex; +static pcre_extra *parse_regex_study; + +/*prototypes*/ +int DetectStreamSizeMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); +static int DetectStreamSizeSetup (DetectEngineCtx *, Signature *, char *); +void DetectStreamSizeFree(void *); +void DetectStreamSizeRegisterTests(void); + +/** + * \brief Registration function for stream_size: keyword + */ + +void DetectStreamSizeRegister(void) +{ + sigmatch_table[DETECT_STREAM_SIZE].name = "stream_size"; + sigmatch_table[DETECT_STREAM_SIZE].desc = "match on amount of bytes of a stream"; + sigmatch_table[DETECT_STREAM_SIZE].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Flow-keywords#stream_size"; + sigmatch_table[DETECT_STREAM_SIZE].Match = DetectStreamSizeMatch; + sigmatch_table[DETECT_STREAM_SIZE].Setup = DetectStreamSizeSetup; + sigmatch_table[DETECT_STREAM_SIZE].Free = DetectStreamSizeFree; + sigmatch_table[DETECT_STREAM_SIZE].RegisterTests = DetectStreamSizeRegisterTests; + + const char *eb; + int eo; + int opts = 0; + + parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); + if (parse_regex == NULL) { + SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if (eb != NULL) { + SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); + goto error; + } + return; + +error: + if (parse_regex != NULL) SCFree(parse_regex); + if (parse_regex_study != NULL) SCFree(parse_regex_study); + return; +} + +/** + * \brief Function to comapre the stream size against defined size in the user + * options. + * + * \param diff The stream size of server or client stream. + * \param stream_size User defined stream size + * \param mode The mode defined by user. + * + * \retval 1 on success and 0 on failure. + */ + +static int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) { + + int ret = 0; + switch (mode) { + case DETECTSSIZE_LT: + if (diff < stream_size) + ret = 1; + break; + case DETECTSSIZE_LEQ: + if (diff <= stream_size) + ret = 1; + break; + case DETECTSSIZE_EQ: + if (diff == stream_size) + ret = 1; + break; + case DETECTSSIZE_NEQ: + if (diff != stream_size) + ret = 1; + break; + case DETECTSSIZE_GEQ: + if (diff >= stream_size) + ret = 1; + break; + case DETECTSSIZE_GT: + if (diff > stream_size) + ret = 1; + break; + } + + return ret; +} + +/** + * \brief This function is used to match Stream size rule option on a packet with those passed via stream_size: + * + * \param t pointer to thread vars + * \param det_ctx pointer to the pattern matcher thread + * \param p pointer to the current packet + * \param m pointer to the sigmatch that we will cast into DetectStreamSizeData + * + * \retval 0 no match + * \retval 1 match + */ +int DetectStreamSizeMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) +{ + + int ret = 0; + const DetectStreamSizeData *sd = (const DetectStreamSizeData *)ctx; + + if (!(PKT_IS_TCP(p))) + return ret; + + uint32_t csdiff = 0; + uint32_t ssdiff = 0; + + if (p->flow == NULL) + return ret; + + TcpSession *ssn = (TcpSession *)p->flow->protoctx; + if (ssn == NULL) + return ret; + + if (sd->flags & STREAM_SIZE_SERVER) { + /* get the server stream size */ + ssdiff = ssn->server.next_seq - ssn->server.isn; + ret = DetectStreamSizeCompare(ssdiff, sd->ssize, sd->mode); + + } else if (sd->flags & STREAM_SIZE_CLIENT) { + /* get the client stream size */ + csdiff = ssn->client.next_seq - ssn->client.isn; + ret = DetectStreamSizeCompare(csdiff, sd->ssize, sd->mode); + + } else if (sd->flags & STREAM_SIZE_BOTH) { + ssdiff = ssn->server.next_seq - ssn->server.isn; + csdiff = ssn->client.next_seq - ssn->client.isn; + if (DetectStreamSizeCompare(ssdiff, sd->ssize, sd->mode) && DetectStreamSizeCompare(csdiff, sd->ssize, sd->mode)) + ret = 1; + + } else if (sd->flags & STREAM_SIZE_EITHER) { + ssdiff = ssn->server.next_seq - ssn->server.isn; + csdiff = ssn->client.next_seq - ssn->client.isn; + if (DetectStreamSizeCompare(ssdiff, sd->ssize, sd->mode) || DetectStreamSizeCompare(csdiff, sd->ssize, sd->mode)) + ret = 1; + } + + return ret; +} + +/** + * \brief This function is used to parse stream options passed via stream_size: keyword + * + * \param streamstr Pointer to the user provided stream_size options + * + * \retval sd pointer to DetectStreamSizeData on success + * \retval NULL on failure + */ + +DetectStreamSizeData *DetectStreamSizeParse (char *streamstr) +{ + + DetectStreamSizeData *sd = NULL; + char *arg = NULL; + char *value = NULL; + char *mode = NULL; +#define MAX_SUBSTRINGS 30 + int ret = 0, res = 0; + int ov[MAX_SUBSTRINGS]; + + ret = pcre_exec(parse_regex, parse_regex_study, streamstr, strlen(streamstr), 0, 0, ov, MAX_SUBSTRINGS); + if (ret != 4) { + SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32 ", string %s", ret, streamstr); + goto error; + } + + const char *str_ptr; + + res = pcre_get_substring((char *)streamstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg = (char *)str_ptr; + + res = pcre_get_substring((char *)streamstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + mode = (char *)str_ptr; + + res = pcre_get_substring((char *)streamstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + value = (char *)str_ptr; + + sd = SCMalloc(sizeof(DetectStreamSizeData)); + if (unlikely(sd == NULL)) + goto error; + sd->ssize = 0; + sd->flags = 0; + + if (strlen(mode) == 0) + goto error; + + if (mode[0] == '=') { + sd->mode = DETECTSSIZE_EQ; + } else if (mode[0] == '<') { + sd->mode = DETECTSSIZE_LT; + if (strcmp("<=", mode) == 0) + sd->mode = DETECTSSIZE_LEQ; + } else if (mode[0] == '>') { + sd->mode = DETECTSSIZE_GT; + if (strcmp(">=", mode) == 0) + sd->mode = DETECTSSIZE_GEQ; + } else if (strcmp("!=", mode) == 0) { + sd->mode = DETECTSSIZE_NEQ; + } else { + SCLogError(SC_ERR_INVALID_OPERATOR, "Invalid operator"); + goto error; + } + + /* set the value */ + sd->ssize = (uint32_t)atoi(value); + + /* inspect our options and set the flags */ + if (strcmp(arg, "server") == 0) { + sd->flags |= STREAM_SIZE_SERVER; + } else if (strcmp(arg, "client") == 0) { + sd->flags |= STREAM_SIZE_CLIENT; + } else if ((strcmp(arg, "both") == 0)) { + sd->flags |= STREAM_SIZE_BOTH; + } else if (strcmp(arg, "either") == 0) { + sd->flags |= STREAM_SIZE_EITHER; + } else { + goto error; + } + + SCFree(mode); + SCFree(arg); + SCFree(value); + return sd; + +error: + if (mode != NULL) + SCFree(mode); + if (arg != NULL) + SCFree(arg); + if (value != NULL) + SCFree(value); + if (sd != NULL) + DetectStreamSizeFree(sd); + + return NULL; +} + +/** + * \brief this function is used to add the parsed stream size data into the current signature + * + * \param de_ctx pointer to the Detection Engine Context + * \param s pointer to the Current Signature + * \param streamstr pointer to the user provided stream size options + * + * \retval 0 on Success + * \retval -1 on Failure + */ +static int DetectStreamSizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *streamstr) +{ + + DetectStreamSizeData *sd = NULL; + SigMatch *sm = NULL; + + sd = DetectStreamSizeParse(streamstr); + if (sd == NULL) + goto error; + + sm = SigMatchAlloc(); + if (sm == NULL) + goto error; + + sm->type = DETECT_STREAM_SIZE; + sm->ctx = (SigMatchCtx *)sd; + + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); + + return 0; + +error: + if (sd != NULL) DetectStreamSizeFree(sd); + if (sm != NULL) SCFree(sm); + return -1; +} + +/** + * \brief this function will free memory associated with DetectStreamSizeData + * + * \param ptr pointer to DetectStreamSizeData + */ +void DetectStreamSizeFree(void *ptr) +{ + DetectStreamSizeData *sd = (DetectStreamSizeData *)ptr; + SCFree(sd); +} + +#ifdef UNITTESTS +/** + * \test DetectStreamSizeParseTest01 is a test to make sure that we parse the + * user options correctly, when given valid stream_size options. + */ + +static int DetectStreamSizeParseTest01 (void) +{ + int result = 0; + DetectStreamSizeData *sd = NULL; + sd = DetectStreamSizeParse("server,<,6"); + if (sd != NULL) { + if (sd->flags & STREAM_SIZE_SERVER && sd->mode == DETECTSSIZE_LT && sd->ssize == 6) + result = 1; + DetectStreamSizeFree(sd); + } + + return result; +} + +/** + * \test DetectStreamSizeParseTest02 is a test to make sure that we detect the + * invalid stream_size options. + */ + +static int DetectStreamSizeParseTest02 (void) +{ + int result = 1; + DetectStreamSizeData *sd = NULL; + sd = DetectStreamSizeParse("invalidoption,<,6"); + if (sd != NULL) { + printf("expected: NULL got 0x%02X %" PRId16 ": ",sd->flags, sd->ssize); + result = 0; + DetectStreamSizeFree(sd); + } + + return result; +} + +/** + * \test DetectStreamSizeParseTest03 is a test to make sure that we match the + * packet correctly provided valid stream size. + */ + +static int DetectStreamSizeParseTest03 (void) +{ + + int result = 0; + DetectStreamSizeData *sd = NULL; + TcpSession ssn; + ThreadVars tv; + DetectEngineThreadCtx dtx; + Packet *p = PacketGetFromAlloc(); + if (unlikely(p == NULL)) + return 0; + Signature s; + SigMatch sm; + TcpStream client; + Flow f; + TCPHdr tcph; + + memset(&ssn, 0, sizeof(TcpSession)); + memset(&tv, 0, sizeof(ThreadVars)); + memset(&dtx, 0, sizeof(DetectEngineThreadCtx)); + memset(&s, 0, sizeof(Signature)); + memset(&sm, 0, sizeof(SigMatch)); + memset(&client, 0, sizeof(TcpStream)); + memset(&f, 0, sizeof(Flow)); + memset(&tcph, 0, sizeof(TCPHdr)); + + sd = DetectStreamSizeParse("client,>,8"); + if (sd != NULL) { + if (!(sd->flags & STREAM_SIZE_CLIENT)) { + printf("sd->flags not STREAM_SIZE_CLIENT: "); + DetectStreamSizeFree(sd); + SCFree(p); + return 0; + } + + if (sd->mode != DETECTSSIZE_GT) { + printf("sd->mode not DETECTSSIZE_GT: "); + DetectStreamSizeFree(sd); + SCFree(p); + return 0; + } + + if (sd->ssize != 8) { + printf("sd->ssize is %"PRIu32", not 8: ", sd->ssize); + DetectStreamSizeFree(sd); + SCFree(p); + return 0; + } + } else { + printf("sd == NULL: "); + SCFree(p); + return 0; + } + + client.next_seq = 20; + client.isn = 10; + ssn.client = client; + f.protoctx = &ssn; + p->flow = &f; + p->tcph = &tcph; + sm.ctx = (SigMatchCtx*)sd; + + result = DetectStreamSizeMatch(&tv, &dtx, p, &s, sm.ctx); + if (result == 0) { + printf("result 0 != 1: "); + } + DetectStreamSizeFree(sd); + SCFree(p); + return result; +} + +/** + * \test DetectStreamSizeParseTest04 is a test to make sure that we match the + * stream_size against invalid packet parameters. + */ + +static int DetectStreamSizeParseTest04 (void) +{ + + int result = 0; + DetectStreamSizeData *sd = NULL; + TcpSession ssn; + ThreadVars tv; + DetectEngineThreadCtx dtx; + Packet *p = PacketGetFromAlloc(); + if (unlikely(p == NULL)) + return 0; + Signature s; + SigMatch sm; + TcpStream client; + Flow f; + IPV4Hdr ip4h; + + memset(&ssn, 0, sizeof(TcpSession)); + memset(&tv, 0, sizeof(ThreadVars)); + memset(&dtx, 0, sizeof(DetectEngineThreadCtx)); + memset(&s, 0, sizeof(Signature)); + memset(&sm, 0, sizeof(SigMatch)); + memset(&client, 0, sizeof(TcpStream)); + memset(&f, 0, sizeof(Flow)); + memset(&ip4h, 0, sizeof(IPV4Hdr)); + + sd = DetectStreamSizeParse(" client , > , 8 "); + if (sd != NULL) { + if (!(sd->flags & STREAM_SIZE_CLIENT) && sd->mode != DETECTSSIZE_GT && sd->ssize != 8) { + SCFree(p); + return 0; + } + } else + { + SCFree(p); + return 0; + } + + client.next_seq = 20; + client.isn = 12; + ssn.client = client; + f.protoctx = &ssn; + p->flow = &f; + p->ip4h = &ip4h; + sm.ctx = (SigMatchCtx*)sd; + + if (!DetectStreamSizeMatch(&tv, &dtx, p, &s, sm.ctx)) + result = 1; + + SCFree(p); + return result; +} +#endif /* UNITTESTS */ + +/** + * \brief this function registers unit tests for DetectStreamSize + */ +void DetectStreamSizeRegisterTests(void) +{ +#ifdef UNITTESTS + UtRegisterTest("DetectStreamSizeParseTest01", DetectStreamSizeParseTest01, 1); + UtRegisterTest("DetectStreamSizeParseTest02", DetectStreamSizeParseTest02, 1); + UtRegisterTest("DetectStreamSizeParseTest03", DetectStreamSizeParseTest03, 1); + UtRegisterTest("DetectStreamSizeParseTest04", DetectStreamSizeParseTest04, 1); +#endif /* UNITTESTS */ +} + -- cgit 1.2.3-korg