aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FragBits Keyword

Browse Source 
Signed-off-by: Brian Rectanus <brectanu@gmail.com>
remotes/origin/master-1.0.x
Breno Silva 17 years ago committed by Victor Julien
parent 6858192660
commit 6100a7f610
5 changed files with 565 additions and 0 deletions
Show Stats Download Patch File Download Diff File

1
src/Makefile.am
Unescape Escape View File

@ -72,6 +72,7 @@ detect-stream_size.c detect-stream_size.h \
detect-decode-event.c detect-decode-event.h \
detect-ipopts.c detect-ipopts.h \
detect-flags.c detect-flags.h \
detect-fragbits.c detect-fragbits.h \
detect-noalert.c detect-noalert.h \
detect-csum.c detect-csum.h \
util-print.c util-print.h \

520
src/detect-fragbits.c
Unescape Escape View File

@ -0,0 +1,520 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/** \file
* \author Breno Silva <breno.silva@gmail.com>
*/
#include "eidps-common.h"
#include "eidps.h"
#include "decode.h"
#include "detect.h"
#include "flow-var.h"
#include "decode-events.h"
#include "detect-fragbits.h"
#include "util-unittest.h"
/**
* Regex
* fragbits: [!+*](MDR)
*/
#define PARSE_REGEX "^\\s*(?:([\\+\\*!]))?\\s*([MDR]+)"
/**
* FragBits args[0] *(3) +(2) !(1)
*
*/
#define MODIFIER_NOT 1
#define MODIFIER_PLUS 2
#define MODIFIER_ANY 3
static pcre *parse_regex;
static pcre_extra *parse_regex_study;
static int DetectFragBitsMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
static int DetectFragBitsSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *str);
static void DetectFragBitsFree(void *);
/**
* \brief Registration function for fragbits: keyword
*/
void DetectFragBitsRegister (void) {
sigmatch_table[DETECT_FRAGBITS].name = "fragbits";
sigmatch_table[DETECT_FRAGBITS].Match = DetectFragBitsMatch;
sigmatch_table[DETECT_FRAGBITS].Setup = DetectFragBitsSetup;
sigmatch_table[DETECT_FRAGBITS].Free = DetectFragBitsFree;
sigmatch_table[DETECT_FRAGBITS].RegisterTests = FragBitsRegisterTests;
const char *eb;
int opts = 0;
int eo;
parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
if(parse_regex == NULL)
{
printf("pcre compile of \"%s\" failed at offset %" PRId32 ": %s\n", PARSE_REGEX, eo, eb);
goto error;
}
parse_regex_study = pcre_study(parse_regex, 0, &eb);
if(eb != NULL)
{
printf("pcre study failed: %s\n", eb);
goto error;
}
error:
return;
}
/**
* \internal
* \brief This function is used to match fragbits on a packet with those passed via fragbits:
*
* \param t pointer to thread vars
* \param det_ctx pointer to the pattern matcher thread
* \param p pointer to the current packet
* \param s pointer to the Signature
* \param m pointer to the sigmatch
*
* \retval 0 no match
* \retval 1 match
*/
static int DetectFragBitsMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, SigMatch *m)
{
int ret = 0;
uint16_t fragbits = 0;
DetectFragBitsData *de = (DetectFragBitsData *)m->ctx;
if(!de || !PKT_IS_IPV4(p) || !p)
return ret;
if(IPV4_GET_MF(p))
fragbits |= IPV4_CACHE_MF;
if(IPV4_GET_DF(p))
fragbits |= IPV4_CACHE_DF;
if(IPV4_GET_RF(p))
fragbits |= IPV4_CACHE_RF;
switch(de->modifier) {
case MODIFIER_ANY:
if((fragbits & de->fragbits) > 0)
return 1;
return ret;
case MODIFIER_PLUS:
if(((fragbits & de->fragbits) == de->fragbits) && (((fragbits - de->fragbits) > 0)))
return 1;
return ret;
case MODIFIER_NOT:
if((fragbits & de->fragbits) != de->fragbits)
return 1;
return ret;
default:
if(fragbits == de->fragbits)
return 1;
}
return ret;
}
/**
* \internal
* \brief This function is used to parse fragbits options passed via fragbits: keyword
*
* \param rawstr Pointer to the user provided fragbits options
*
* \retval de pointer to DetectFragBitsData on success
* \retval NULL on failure
*/
static DetectFragBitsData *DetectFragBitsParse (char *rawstr)
{
DetectFragBitsData *de = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, found = 0, res = 0;
int ov[MAX_SUBSTRINGS];
const char *str_ptr = NULL;
char *args[2] = { NULL, NULL};
char *ptr;
int i;
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 1) {
goto error;
}
for (i = 0; i < (ret - 1); i++) {
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS,i + 1, &str_ptr);
if (res < 0) {
goto error;
}
args[i] = (char *)str_ptr;
}
if(args[1] == NULL)
goto error;
de = malloc(sizeof(DetectFragBitsData));
if (de == NULL) {
printf("DetectFragBitsSetup malloc failed\n");
goto error;
}
memset(de,0,sizeof(DetectFragBitsData));
/** First parse args[0] */
if(args[0]) {
ptr = args[0];
while (*ptr != '\0') {
switch (*ptr) {
case '!':
de->modifier = MODIFIER_NOT;
break;
case '+':
de->modifier = MODIFIER_PLUS;
break;
case '*':
de->modifier = MODIFIER_ANY;
break;
}
ptr++;
}
}
/** Second parse first set of fragbits */
ptr = args[1];
while (*ptr != '\0') {
switch (*ptr) {
case 'M':
case 'm':
de->fragbits |= IPV4_CACHE_MF;
found++;
break;
case 'D':
case 'd':
de->fragbits |= IPV4_CACHE_DF;
found++;
break;
case 'R':
case 'r':
de->fragbits |= IPV4_CACHE_RF;
found++;
break;
default:
found = 0;
break;
}
ptr++;
}
if(found == 0)
goto error;
for (i = 0; i < (ret - 1); i++){
if (args[i] != NULL) free(args[i]);
}
return de;
error:
for (i = 0; i < (ret - 1); i++){
if (args[i] != NULL) free(args[i]);
}
if (de) free(de);
return NULL;
}
/**
* \internal
* \brief this function is used to add the parsed fragbits into the current signature
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param m pointer to the Current SigMatch
* \param rawstr pointer to the user provided fragbits options
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectFragBitsSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *rawstr)
{
DetectFragBitsData *de = NULL;
SigMatch *sm = NULL;
de = DetectFragBitsParse(rawstr);
if (de == NULL)
goto error;
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_FRAGBITS;
sm->ctx = (void *)de;
SigMatchAppend(s,m,sm);
return 0;
error:
if (de) free(de);
if (sm) free(sm);
return -1;
}
/**
* \internal
* \brief this function will free memory associated with DetectFragBitsData
*
* \param de pointer to DetectFragBitsData
*/
static void DetectFragBitsFree(void *de_ptr) {
DetectFragBitsData *de = (DetectFragBitsData *)de_ptr;
if(de) free(de);
}
/*
* ONLY TESTS BELOW THIS COMMENT
*/
#ifdef UNITTESTS
/**
* \test FragBitsTestParse01 is a test for a valid fragbits value
*
* \retval 1 on succces
* \retval 0 on failure
*/
static int FragBitsTestParse01 (void) {
DetectFragBitsData *de = NULL;
de = DetectFragBitsParse("M");
if (de && (de->fragbits == IPV4_CACHE_MF) ) {
DetectFragBitsFree(de);
return 1;
}
return 0;
}
/**
* \test FragBitsTestParse02 is a test for an invalid fragbits value
*
* \retval 1 on succces
* \retval 0 on failure
*/
static int FragBitsTestParse02 (void) {
DetectFragBitsData *de = NULL;
de = DetectFragBitsParse("G");
if (de) {
DetectFragBitsFree(de);
return 1;
}
return 0;
}
/**
* \test FragBitsTestParse03 test if DONT FRAG is set. Must return success
*
* \retval 1 on success
* \retval 0 on failure
*/
static int FragBitsTestParse03 (void) {
uint8_t raw_eth[] = {
0x00 ,0x40 ,0x33 ,0xd9 ,0x7c ,0xfd ,0x00 ,0x00,
0x39 ,0xcf ,0xd9 ,0xcd ,0x08 ,0x00 ,0x45 ,0x00,
0x01 ,0x13 ,0x9c ,0x5d ,0x40 ,0x00 ,0xf6 ,0x11,
0x44 ,0xca ,0x97 ,0xa4 ,0x01 ,0x08 ,0x0a ,0x00,
0x00 ,0x06 ,0x00 ,0x35 ,0x04 ,0x0b ,0x00 ,0xff,
0x3c ,0x87 ,0x7d ,0x9e ,0x85 ,0x80 ,0x00 ,0x01,
0x00 ,0x01 ,0x00 ,0x05 ,0x00 ,0x05 ,0x06 ,0x70,
0x69 ,0x63 ,0x61 ,0x72 ,0x64 ,0x07 ,0x75 ,0x74,
0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65 ,0x64,
0x75 ,0x00 ,0x00 ,0x01 ,0x00 ,0x01 ,0xc0 ,0x0c,
0x00 ,0x01 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10,
0x00 ,0x04 ,0x81 ,0x6f ,0x1e ,0x1b ,0x07 ,0x75,
0x74 ,0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65,
0x64 ,0x75 ,0x00 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x09 ,0x06 ,0x6b ,0x65,
0x6e ,0x6f ,0x62 ,0x69 ,0xc0 ,0x34 ,0xc0 ,0x34,
0x00 ,0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10,
0x00 ,0x07 ,0x04 ,0x6a ,0x69 ,0x6e ,0x6e ,0xc0,
0x34 ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x0c ,0x04 ,0x64 ,0x6e,
0x73 ,0x31 ,0x04 ,0x6e ,0x6a ,0x69 ,0x74 ,0xc0,
0x3c ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x08 ,0x05 ,0x65 ,0x6c,
0x7a ,0x69 ,0x70 ,0xc0 ,0x34 ,0xc0 ,0x34 ,0x00,
0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10 ,0x00,
0x08 ,0x05 ,0x61 ,0x72 ,0x77 ,0x65 ,0x6e ,0xc0,
0x34 ,0xc0 ,0x4b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a,
0x06 ,0xc0 ,0x60 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a,
0x07 ,0xc0 ,0x73 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x01 ,0x03 ,0x82 ,0x00 ,0x04 ,0x80 ,0xeb ,0xfb,
0x0a ,0xc0 ,0x8b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x01,
0x0b ,0xc0 ,0x9f ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x0b,
0x51};
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
IPV4Hdr ipv4h;
int ret = 0;
DetectFragBitsData *de = NULL;
SigMatch *sm = NULL;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ipv4h, 0, sizeof(IPV4Hdr));
p.ip4h = &ipv4h;
FlowInitConfig(FLOW_QUIET);
DecodeEthernet(&tv, &dtv, &p, raw_eth, sizeof(raw_eth), NULL);
FlowShutdown();
de = DetectFragBitsParse("D");
if (de == NULL || (de->fragbits != IPV4_CACHE_DF))
goto error;
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_FRAGBITS;
sm->ctx = (void *)de;
ret = DetectFragBitsMatch(&tv,NULL,&p,NULL,sm);
if(ret) {
if (de) free(de);
if (sm) free(sm);
return 1;
}
error:
if (de) free(de);
if (sm) free(sm);
return 0;
}
/**
* \test FragBitsTestParse04 test if DONT FRAG is not set. Must fails.
*
* \retval 1 on success
* \retval 0 on failure
*/
static int FragBitsTestParse04 (void) {
uint8_t raw_eth[] = {
0x00 ,0x40 ,0x33 ,0xd9 ,0x7c ,0xfd ,0x00 ,0x00,
0x39 ,0xcf ,0xd9 ,0xcd ,0x08 ,0x00 ,0x45 ,0x00,
0x01 ,0x13 ,0x9c ,0x5d ,0x40 ,0x00 ,0xf6 ,0x11,
0x44 ,0xca ,0x97 ,0xa4 ,0x01 ,0x08 ,0x0a ,0x00,
0x00 ,0x06 ,0x00 ,0x35 ,0x04 ,0x0b ,0x00 ,0xff,
0x3c ,0x87 ,0x7d ,0x9e ,0x85 ,0x80 ,0x00 ,0x01,
0x00 ,0x01 ,0x00 ,0x05 ,0x00 ,0x05 ,0x06 ,0x70,
0x69 ,0x63 ,0x61 ,0x72 ,0x64 ,0x07 ,0x75 ,0x74,
0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65 ,0x64,
0x75 ,0x00 ,0x00 ,0x01 ,0x00 ,0x01 ,0xc0 ,0x0c,
0x00 ,0x01 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10,
0x00 ,0x04 ,0x81 ,0x6f ,0x1e ,0x1b ,0x07 ,0x75,
0x74 ,0x68 ,0x73 ,0x63 ,0x73 ,0x61 ,0x03 ,0x65,
0x64 ,0x75 ,0x00 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x09 ,0x06 ,0x6b ,0x65,
0x6e ,0x6f ,0x62 ,0x69 ,0xc0 ,0x34 ,0xc0 ,0x34,
0x00 ,0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10,
0x00 ,0x07 ,0x04 ,0x6a ,0x69 ,0x6e ,0x6e ,0xc0,
0x34 ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x0c ,0x04 ,0x64 ,0x6e,
0x73 ,0x31 ,0x04 ,0x6e ,0x6a ,0x69 ,0x74 ,0xc0,
0x3c ,0xc0 ,0x34 ,0x00 ,0x02 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x08 ,0x05 ,0x65 ,0x6c,
0x7a ,0x69 ,0x70 ,0xc0 ,0x34 ,0xc0 ,0x34 ,0x00,
0x02 ,0x00 ,0x01 ,0x00 ,0x00 ,0x0e ,0x10 ,0x00,
0x08 ,0x05 ,0x61 ,0x72 ,0x77 ,0x65 ,0x6e ,0xc0,
0x34 ,0xc0 ,0x4b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a,
0x06 ,0xc0 ,0x60 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x1a,
0x07 ,0xc0 ,0x73 ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x01 ,0x03 ,0x82 ,0x00 ,0x04 ,0x80 ,0xeb ,0xfb,
0x0a ,0xc0 ,0x8b ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x01,
0x0b ,0xc0 ,0x9f ,0x00 ,0x01 ,0x00 ,0x01 ,0x00,
0x00 ,0x0e ,0x10 ,0x00 ,0x04 ,0x81 ,0x6f ,0x0b,
0x51};
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
IPV4Hdr ipv4h;
int ret = 0;
DetectFragBitsData *de = NULL;
SigMatch *sm = NULL;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ipv4h, 0, sizeof(IPV4Hdr));
p.ip4h = &ipv4h;
FlowInitConfig(FLOW_QUIET);
DecodeEthernet(&tv, &dtv, &p, raw_eth, sizeof(raw_eth), NULL);
FlowShutdown();
de = DetectFragBitsParse("!D");
if (de == NULL || (de->fragbits != IPV4_CACHE_DF) || (de->modifier != MODIFIER_NOT))
goto error;
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_FRAGBITS;
sm->ctx = (void *)de;
ret = DetectFragBitsMatch(&tv,NULL,&p,NULL,sm);
if(ret) {
if (de) free(de);
if (sm) free(sm);
return 1;
}
error:
if (de) free(de);
if (sm) free(sm);
return 0;
}
#endif /* UNITTESTS */
/**
* \brief this function registers unit tests for FragBits
*/
void FragBitsRegisterTests(void) {
#ifdef UNITTESTS
UtRegisterTest("FragBitsTestParse01", FragBitsTestParse01, 1);
UtRegisterTest("FragBitsTestParse02", FragBitsTestParse02, 0);
UtRegisterTest("FragBitsTestParse03", FragBitsTestParse03, 1);
UtRegisterTest("FragBitsTestParse04", FragBitsTestParse04, 0);
#endif /* UNITTESTS */
}

41
src/detect-fragbits.h
Unescape Escape View File

@ -0,0 +1,41 @@
/* Copyright (c) 2009 Open Information Security Foundation */
/** \file
* \author Breno Silva <breno.silva@gmail.com>
*/
#ifndef __DETECT_FRAGBITS_H__
#define __DETECT_FRAGBITS_H__
#include "decode-events.h"
#include "decode-ipv4.h"
#include "decode-tcp.h"
/**
* \struct DetectFragBitsData_
* DetectFragBitsData_ is used to store fragbits: input value
*/
/**
* \typedef DetectFragBitsData
* A typedef for DetectFragBitsData_
*/
typedef struct DetectFragBitsData_ {
uint16_t fragbits; /**< TCP fragbits */
uint8_t modifier; /**< !(1) +(2) *(3) modifiers */
} DetectFragBitsData;
/**
* Registration function for fragbits: keyword
*/
void DetectFragBitsRegister (void);
/**
* This function registers unit tests for FragBits
*/
void FragBitsRegisterTests(void);
#endif /*__DETECT_FRAGBITS_H__ */

2
src/detect.c
Unescape Escape View File

@ -19,6 +19,7 @@
#include "detect-decode-event.h"
#include "detect-ipopts.h"
#include "detect-flags.h"
#include "detect-fragbits.h"
#include "detect-content.h"
#include "detect-uricontent.h"
@ -2589,6 +2590,7 @@ void SigTableSetup(void) {
DetectDecodeEventRegister();
DetectIpOptsRegister();
DetectFlagsRegister();
DetectFragBitsRegister();
DetectCsumRegister();
DetectStreamSizeRegister();

1
src/detect.h
Unescape Escape View File

@ -435,6 +435,7 @@ enum {
DETECT_DECODE_EVENT,
DETECT_IPOPTS,
DETECT_FLAGS,
DETECT_FRAGBITS,
/* make sure this stays last */
DETECT_TBLSIZE,

Write Preview
Loading…
Cancel
Save