diff --git a/rust/src/detect/transforms/mod.rs b/rust/src/detect/transforms/mod.rs index a8fc98234b..01603cabc1 100644 --- a/rust/src/detect/transforms/mod.rs +++ b/rust/src/detect/transforms/mod.rs @@ -25,6 +25,7 @@ pub mod dotprefix; pub mod hash; pub mod http_headers; pub mod strip_whitespace; +pub mod urldecode; pub mod xor; #[repr(C)] diff --git a/rust/src/detect/transforms/urldecode.rs b/rust/src/detect/transforms/urldecode.rs new file mode 100644 index 0000000000..59620ad42d --- /dev/null +++ b/rust/src/detect/transforms/urldecode.rs @@ -0,0 +1,143 @@ +/* Copyright (C) 2024 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +use super::{ + DetectHelperTransformRegister, DetectSignatureAddTransform, InspectionBufferCheckAndExpand, + InspectionBufferLength, InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt, +}; +use crate::detect::SIGMATCH_NOOPT; + +use std::os::raw::{c_int, c_void}; +use std::ptr; + +static mut G_TRANSFORM_URL_DECODE_ID: c_int = 0; + +#[no_mangle] +unsafe extern "C" fn url_decode_setup( + _de: *mut c_void, s: *mut c_void, _opt: *const std::os::raw::c_char, +) -> c_int { + return DetectSignatureAddTransform(s, G_TRANSFORM_URL_DECODE_ID, ptr::null_mut()); +} + +fn hex_value(i: u8) -> Option { + match i { + 0x30..=0x39 => Some(i - 0x30), + 0x41..=0x46 => Some(i - 0x41 + 10), + 0x61..=0x66 => Some(i - 0x61 + 10), + _ => None, + } +} +fn url_decode_transform_do(input: &[u8], output: &mut [u8]) -> u32 { + let mut state = (0u8, 0u8); + let mut nb = 0; + for &i in input.iter() { + if state.0 > 0 { + if let Some(v) = hex_value(i) { + if state.0 == 1 { + state = (2, i); + } else { + output[nb] = v | (hex_value(state.1).unwrap() << 4); + nb += 1; + state = (0u8, 0u8); + } + } else { + output[nb] = b'%'; + nb += 1; + if state.0 > 1 { + output[nb] = state.1; + nb += 1; + } + output[nb] = i; + nb += 1; + state = (0u8, 0u8); + } + } else if i == b'%' { + state = (1u8, 0u8); + } else { + if i == b'+' { + output[nb] = b' '; + } else { + output[nb] = i; + } + nb += 1; + } + } + if state.0 > 0 { + output[nb] = b'%'; + nb += 1; + if state.0 == 2 { + output[nb] = state.1; + nb += 1; + } + } + return nb as u32; +} + +#[no_mangle] +unsafe extern "C" fn url_decode_transform(buffer: *mut c_void, _ctx: *mut c_void) { + let input = InspectionBufferPtr(buffer); + let input_len = InspectionBufferLength(buffer); + if input.is_null() || input_len == 0 { + return; + } + let input = build_slice!(input, input_len as usize); + + let output = InspectionBufferCheckAndExpand(buffer, input_len); + if output.is_null() { + // allocation failure + return; + } + let output = std::slice::from_raw_parts_mut(output, input_len as usize); + + let out_len = url_decode_transform_do(input, output); + + InspectionBufferTruncate(buffer, out_len); +} + +#[no_mangle] +pub unsafe extern "C" fn DetectTransformUrlDecodeRegister() { + let kw = SCTransformTableElmt { + name: b"url_decode\0".as_ptr() as *const libc::c_char, + desc: b"modify buffer to decode urlencoded data before inspection\0".as_ptr() + as *const libc::c_char, + url: b"/rules/transforms.html#url-decode\0".as_ptr() as *const libc::c_char, + Setup: url_decode_setup, + flags: SIGMATCH_NOOPT, + Transform: url_decode_transform, + Free: None, + TransformValidate: None, + }; + unsafe { + G_TRANSFORM_URL_DECODE_ID = DetectHelperTransformRegister(&kw); + if G_TRANSFORM_URL_DECODE_ID < 0 { + SCLogWarning!("Failed registering transform dot_prefix"); + } + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_url_decode_transform() { + let buf = b"Suricata%20is+%27%61wesome%21%27%25%30%30%ZZ%4"; + let mut out = vec![0; buf.len()]; + let nb = url_decode_transform_do(buf, &mut out); + assert_eq!(&out[..nb as usize], b"Suricata is 'awesome!'%00%ZZ%4"); + } +} diff --git a/src/Makefile.am b/src/Makefile.am index d0311e20d9..7d05751ec2 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -307,7 +307,6 @@ noinst_HEADERS = \ detect-tos.h \ detect-transform-base64.h \ detect-transform-pcrexform.h \ - detect-transform-urldecode.h \ detect-ttl.h \ detect-udphdr.h \ detect-uricontent.h \ @@ -866,7 +865,6 @@ libsuricata_c_a_SOURCES = \ detect-tos.c \ detect-transform-base64.c \ detect-transform-pcrexform.c \ - detect-transform-urldecode.c \ detect-ttl.c \ detect-udphdr.c \ detect-uricontent.c \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index cd6001ed54..37fbc98d85 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -216,7 +216,6 @@ #include "detect-engine-content-inspection.h" #include "detect-transform-pcrexform.h" -#include "detect-transform-urldecode.h" #include "detect-transform-base64.h" #include "util-rule-vars.h" diff --git a/src/detect-transform-urldecode.c b/src/detect-transform-urldecode.c deleted file mode 100644 index 13ef03372f..0000000000 --- a/src/detect-transform-urldecode.c +++ /dev/null @@ -1,180 +0,0 @@ -/* Copyright (C) 2020 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Philippe Antoine - * - * Implements the url_decode transform keyword - */ - -#include "suricata-common.h" - -#include "detect.h" -#include "detect-engine.h" -#include "detect-engine-prefilter.h" -#include "detect-engine-build.h" -#include "detect-parse.h" -#include "detect-transform-urldecode.h" - -#include "util-unittest.h" -#include "util-print.h" - -static int DetectTransformUrlDecodeSetup (DetectEngineCtx *, Signature *, const char *); -#ifdef UNITTESTS -static void DetectTransformUrlDecodeRegisterTests(void); -#endif - -static void TransformUrlDecode(InspectionBuffer *buffer, void *options); - -void DetectTransformUrlDecodeRegister(void) -{ - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].name = "url_decode"; - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].desc = - "modify buffer to decode urlencoded data before inspection"; - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].url = "/rules/transforms.html#url-decode"; - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].Transform = - TransformUrlDecode; - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].Setup = - DetectTransformUrlDecodeSetup; -#ifdef UNITTESTS - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].RegisterTests = - DetectTransformUrlDecodeRegisterTests; -#endif - - sigmatch_table[DETECT_TRANSFORM_URL_DECODE].flags |= SIGMATCH_NOOPT; -} - -/** - * \internal - * \brief Apply the transform keyword to the last pattern match - * \param det_ctx detection engine ctx - * \param s signature - * \param nullstr should be null - * \retval 0 ok - * \retval -1 failure - */ -static int DetectTransformUrlDecodeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *nullstr) -{ - SCEnter(); - int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_URL_DECODE, NULL); - SCReturnInt(r); -} - -// util function so as to ease reuse sometimes -static bool BufferUrlDecode(const uint8_t *input, const uint32_t input_len, uint8_t *output, uint32_t *output_size) -{ - bool changed = false; - uint8_t *oi = output; - //PrintRawDataFp(stdout, input, input_len); - for (uint32_t i = 0; i < input_len; i++) { - if (input[i] == '%') { - if (i + 2 < input_len) { - if ((isxdigit(input[i+1])) && (isxdigit(input[i+2]))) { - // Decode %HH encoding. - *oi = (uint8_t)((input[i + 1] >= 'A' ? ((input[i + 1] & 0xdf) - 'A') + 10 - : (input[i + 1] - '0')) - << 4); - *oi |= (input[i+2] >= 'A' ? ((input[i+2] & 0xdf) - 'A') + 10 : (input[i+2] - '0')); - oi++; - // one more increment before looping - i += 2; - changed = true; - } else { - // leaves incorrect percent - // does not handle unicode %u encoding - *oi++ = input[i]; - } - } else { - // leaves trailing incomplete percent - *oi++ = input[i]; - } - } else if (input[i] == '+') { - *oi++ = ' '; - changed = true; - } else { - *oi++ = input[i]; - } - } - *output_size = oi - output; - return changed; -} - -static void TransformUrlDecode(InspectionBuffer *buffer, void *options) -{ - uint32_t output_size; - bool changed; - - const uint8_t *input = buffer->inspect; - const uint32_t input_len = buffer->inspect_len; - if (input_len == 0) { - return; - } - uint8_t output[input_len]; // we can only shrink - - changed = BufferUrlDecode(input, input_len, output, &output_size); - - if (changed) { - InspectionBufferCopy(buffer, output, output_size); - } -} - -#ifdef UNITTESTS -static int DetectTransformUrlDecodeTest01(void) -{ - const uint8_t *input = (const uint8_t *)"Suricata%20is+%27%61wesome%21%27%25%30%30%ZZ%4"; - uint32_t input_len = strlen((char *)input); - - InspectionBuffer buffer; - InspectionBufferInit(&buffer, 8); - InspectionBufferSetup(NULL, -1, &buffer, input, input_len); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - TransformUrlDecode(&buffer, NULL); - PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len); - FAIL_IF (buffer.inspect_len != strlen("Suricata is 'awesome!'%00%ZZ%4")); - FAIL_IF (memcmp(buffer.inspect, "Suricata is 'awesome!'%00%ZZ%4", buffer.inspect_len) != 0); - InspectionBufferFree(&buffer); - PASS; -} - -static int DetectTransformUrlDecodeTest02(void) -{ - const char rule[] = "alert http any any -> any any (http.request_body; url_decode; content:\"mail=test@oisf.net\"; sid:1;)"; - ThreadVars th_v; - DetectEngineThreadCtx *det_ctx = NULL; - memset(&th_v, 0, sizeof(th_v)); - - DetectEngineCtx *de_ctx = DetectEngineCtxInit(); - FAIL_IF_NULL(de_ctx); - Signature *s = DetectEngineAppendSig(de_ctx, rule); - FAIL_IF_NULL(s); - SigGroupBuild(de_ctx); - DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); - DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); - DetectEngineCtxFree(de_ctx); - PASS; -} - -static void DetectTransformUrlDecodeRegisterTests(void) -{ - UtRegisterTest("DetectTransformUrlDecodeTest01", - DetectTransformUrlDecodeTest01); - UtRegisterTest("DetectTransformUrlDecodeTest02", - DetectTransformUrlDecodeTest02); -} -#endif diff --git a/src/detect-transform-urldecode.h b/src/detect-transform-urldecode.h deleted file mode 100644 index cd7267485e..0000000000 --- a/src/detect-transform-urldecode.h +++ /dev/null @@ -1,30 +0,0 @@ -/* Copyright (C) 2020 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Philippe Antoine - */ - -#ifndef SURICATA_DETECT_TRANSFORM_URLDECODE_H -#define SURICATA_DETECT_TRANSFORM_URLDECODE_H - -/* prototypes */ -void DetectTransformUrlDecodeRegister (void); - -#endif /* SURICATA_DETECT_TRANSFORM_URLDECODE_H */