mirror of https://github.com/OISF/suricata
Implement per packet variables and switch the http stuff to it.
Victor Julien
17 years ago
parent
edf8650a7e
commit
c4f2fe4bd7
@ -0,0 +1,211 @@
|
||||
/* Simple pktvar content match part of the detection engine.
|
||||
*
|
||||
* Copyright (C) 2008 by Victor Julien <victor@inliniac.net> */
|
||||
|
||||
#include <ctype.h>
|
||||
#include <pcre.h>
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
#include "threads.h"
|
||||
#include "pkt-var.h"
|
||||
#include "detect-pktvar.h"
|
||||
#include "util-binsearch.h"
|
||||
|
||||
#define PARSE_REGEX "(.*),(.*)"
|
||||
static pcre *parse_regex;
|
||||
static pcre_extra *parse_regex_study;
|
||||
|
||||
int DetectPktvarMatch (ThreadVars *, PatternMatcherThread *, Packet *, Signature *, SigMatch *);
|
||||
int DetectPktvarSetup (Signature *, SigMatch *, char *);
|
||||
|
||||
void DetectPktvarRegister (void) {
|
||||
sigmatch_table[DETECT_PKTVAR].name = "pktvar";
|
||||
sigmatch_table[DETECT_PKTVAR].Match = DetectPktvarMatch;
|
||||
sigmatch_table[DETECT_PKTVAR].Setup = DetectPktvarSetup;
|
||||
sigmatch_table[DETECT_PKTVAR].Free = NULL;
|
||||
sigmatch_table[DETECT_PKTVAR].RegisterTests = NULL;
|
||||
|
||||
const char *eb;
|
||||
int eo;
|
||||
int opts = 0;
|
||||
|
||||
parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL);
|
||||
if(parse_regex == NULL)
|
||||
{
|
||||
printf("pcre compile of \"%s\" failed at offset %d: %s\n", PARSE_REGEX, eo, eb);
|
||||
goto error;
|
||||
}
|
||||
|
||||
parse_regex_study = pcre_study(parse_regex, 0, &eb);
|
||||
if(eb != NULL)
|
||||
{
|
||||
printf("pcre study failed: %s\n", eb);
|
||||
goto error;
|
||||
}
|
||||
|
||||
return;
|
||||
|
||||
error:
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* returns 0: no match
|
||||
* 1: match
|
||||
* -1: error
|
||||
*/
|
||||
|
||||
int DetectPktvarMatch (ThreadVars *t, PatternMatcherThread *pmt, Packet *p, Signature *s, SigMatch *m)
|
||||
{
|
||||
int ret = 0;
|
||||
DetectPktvarData *pd = (DetectPktvarData *)m->ctx;
|
||||
|
||||
PktVar *pv = PktVarGet(p, pd->name);
|
||||
if (pv != NULL) {
|
||||
u_int8_t *ptr = BinSearch(pv->value, pv->value_len, pd->content, pd->content_len);
|
||||
if (ptr != NULL)
|
||||
ret = 1;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
int DetectPktvarSetup (Signature *s, SigMatch *m, char *rawstr)
|
||||
{
|
||||
DetectPktvarData *cd = NULL;
|
||||
SigMatch *sm = NULL;
|
||||
char *str = rawstr;
|
||||
char dubbed = 0;
|
||||
u_int16_t len;
|
||||
char *varname = NULL, *varcontent = NULL;
|
||||
#define MAX_SUBSTRINGS 30
|
||||
int ret = 0, res = 0;
|
||||
int ov[MAX_SUBSTRINGS];
|
||||
|
||||
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
|
||||
if (ret > 1) {
|
||||
const char *str_ptr;
|
||||
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr);
|
||||
if (res < 0) {
|
||||
printf("DetectPcreSetup: pcre_get_substring failed\n");
|
||||
return -1;
|
||||
}
|
||||
varname = (char *)str_ptr;
|
||||
|
||||
if (ret > 2) {
|
||||
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr);
|
||||
if (res < 0) {
|
||||
printf("DetectPcreSetup: pcre_get_substring failed\n");
|
||||
return -1;
|
||||
}
|
||||
varcontent = (char *)str_ptr;
|
||||
}
|
||||
}
|
||||
|
||||
printf("DetectPktvarSetup: varname %s, varcontent %s\n", varname, varcontent);
|
||||
|
||||
if (varcontent[0] == '\"' && varcontent[strlen(varcontent)-1] == '\"') {
|
||||
str = strdup(varcontent+1);
|
||||
str[strlen(varcontent)-2] = '\0';
|
||||
dubbed = 1;
|
||||
}
|
||||
|
||||
len = strlen(str);
|
||||
if (len == 0)
|
||||
return -1;
|
||||
|
||||
cd = malloc(sizeof(DetectPktvarData));
|
||||
if (cd == NULL) {
|
||||
printf("DetectPktvarSetup malloc failed\n");
|
||||
goto error;
|
||||
}
|
||||
|
||||
char converted = 0;
|
||||
|
||||
{
|
||||
u_int16_t i, x;
|
||||
u_int8_t bin = 0, binstr[3] = "", binpos = 0;
|
||||
for (i = 0, x = 0; i < len; i++) {
|
||||
// printf("str[%02u]: %c\n", i, str[i]);
|
||||
if (str[i] == '|') {
|
||||
if (bin) {
|
||||
bin = 0;
|
||||
} else {
|
||||
bin = 1;
|
||||
}
|
||||
} else {
|
||||
if (bin) {
|
||||
if (isdigit(str[i]) ||
|
||||
str[i] == 'A' || str[i] == 'a' ||
|
||||
str[i] == 'B' || str[i] == 'b' ||
|
||||
str[i] == 'C' || str[i] == 'c' ||
|
||||
str[i] == 'D' || str[i] == 'd' ||
|
||||
str[i] == 'E' || str[i] == 'e' ||
|
||||
str[i] == 'F' || str[i] == 'f') {
|
||||
// printf("part of binary: %c\n", str[i]);
|
||||
|
||||
binstr[binpos] = (char)str[i];
|
||||
binpos++;
|
||||
|
||||
if (binpos == 2) {
|
||||
u_int8_t c = strtol((char *)binstr, (char **) NULL, 16) & 0xFF;
|
||||
#ifdef DEBUG
|
||||
printf("Binstr %X\n", c);
|
||||
#endif
|
||||
binpos = 0;
|
||||
str[x] = c;
|
||||
x++;
|
||||
converted = 1;
|
||||
}
|
||||
} else if (str[i] == ' ') {
|
||||
// printf("space as part of binary string\n");
|
||||
}
|
||||
} else {
|
||||
str[x] = str[i];
|
||||
x++;
|
||||
}
|
||||
}
|
||||
}
|
||||
//#ifdef DEBUG
|
||||
for (i = 0; i < x; i++) {
|
||||
if (isprint(str[i])) printf("%c", str[i]);
|
||||
else printf("\\x%02u", str[i]);
|
||||
}
|
||||
printf("\n");
|
||||
//#endif
|
||||
|
||||
if (converted)
|
||||
len = x;
|
||||
}
|
||||
|
||||
cd->content = malloc(len);
|
||||
if (cd->content == NULL)
|
||||
return -1;
|
||||
|
||||
cd->name = strdup(varname);
|
||||
memcpy(cd->content, str, len);
|
||||
cd->content_len = len;
|
||||
cd->flags = 0;
|
||||
|
||||
/* Okay so far so good, lets get this into a SigMatch
|
||||
* and put it in the Signature. */
|
||||
sm = SigMatchAlloc();
|
||||
if (sm == NULL)
|
||||
goto error;
|
||||
|
||||
sm->type = DETECT_FLOWVAR;
|
||||
sm->ctx = (void *)cd;
|
||||
|
||||
SigMatchAppend(s,m,sm);
|
||||
|
||||
if (dubbed) free(str);
|
||||
return 0;
|
||||
|
||||
error:
|
||||
if (dubbed) free(str);
|
||||
if (cd) free(cd);
|
||||
if (sm) free(sm);
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
@ -0,0 +1,17 @@
|
||||
#ifndef __DETECT_PKTVAR_H__
|
||||
#define __DETECT_PKTVAR_H__
|
||||
|
||||
#define DETECT_CONTENT_NOCASE 0x01
|
||||
|
||||
typedef struct _DetectPktvarData {
|
||||
char *name;
|
||||
u_int8_t *content;
|
||||
u_int8_t content_len;
|
||||
u_int8_t flags;
|
||||
} DetectPktvarData;
|
||||
|
||||
/* prototypes */
|
||||
void DetectPktvarRegister (void);
|
||||
|
||||
#endif /* __DETECT_PKTVAR_H__ */
|
||||
|
||||
@ -0,0 +1,93 @@
|
||||
/* implement per packet vars */
|
||||
|
||||
/* TODO
|
||||
* - move away from a linked list implementation
|
||||
* - use different datatypes, such as string, int, etc.
|
||||
* - have more than one instance of the same var, and be able to match on a
|
||||
* specific one, or one all at a time. So if a certain capture matches
|
||||
* multiple times, we can operate on all of them.
|
||||
*/
|
||||
|
||||
#include <ctype.h>
|
||||
#include "decode.h"
|
||||
#include "pkt-var.h"
|
||||
|
||||
/* puts a new value into a pktvar */
|
||||
void PktVarUpdate(PktVar *pv, u_int8_t *value, u_int16_t size) {
|
||||
if (pv->value) free(pv->value);
|
||||
pv->value = value;
|
||||
pv->value_len = size;
|
||||
}
|
||||
|
||||
/* get the pktvar with name 'name' from the pkt
|
||||
*
|
||||
* name is a normal string*/
|
||||
PktVar *PktVarGet(Packet *p, char *name) {
|
||||
PktVar *pv = p->pktvar;
|
||||
|
||||
for (;pv != NULL; pv = pv->next) {
|
||||
if (pv->name && strcmp(pv->name, name) == 0)
|
||||
return pv;
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* add a pktvar to the pkt, or update it */
|
||||
void PktVarAdd(Packet *p, char *name, u_int8_t *value, u_int16_t size) {
|
||||
//printf("Adding packet var \"%s\" with value(%d) \"%s\"\n", name, size, value);
|
||||
|
||||
PktVar *pv = PktVarGet(p, name);
|
||||
if (pv == NULL) {
|
||||
pv = malloc(sizeof(PktVar));
|
||||
if (pv == NULL)
|
||||
return;
|
||||
|
||||
pv->name = name;
|
||||
pv->value = value;
|
||||
pv->value_len = size;
|
||||
pv->next = NULL;
|
||||
|
||||
PktVar *tpv = p->pktvar;
|
||||
if (p->pktvar == NULL) p->pktvar = pv;
|
||||
else {
|
||||
while(tpv) {
|
||||
if (tpv->next == NULL) {
|
||||
tpv->next = pv;
|
||||
return;
|
||||
}
|
||||
|
||||
tpv = tpv->next;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
PktVarUpdate(pv, value, size);
|
||||
}
|
||||
}
|
||||
|
||||
void PktVarFree(PktVar *pv) {
|
||||
if (pv == NULL)
|
||||
return;
|
||||
|
||||
pv->name = NULL;
|
||||
if (pv->value) free(pv->value);
|
||||
|
||||
if (pv->next) PktVarFree(pv->next);
|
||||
}
|
||||
|
||||
void PktVarPrint(PktVar *pv) {
|
||||
u_int16_t i;
|
||||
|
||||
if (pv == NULL)
|
||||
return;
|
||||
|
||||
printf("Name \"%s\", Value \"", pv->name);
|
||||
for (i = 0; i < pv->value_len; i++) {
|
||||
if (isprint(pv->value[i])) printf("%c", pv->value[i]);
|
||||
else printf("\\%02X", pv->value[i]);
|
||||
}
|
||||
printf("\", Len \"%u\"\n", pv->value_len);
|
||||
|
||||
PktVarPrint(pv->next);
|
||||
}
|
||||
|
||||
@ -0,0 +1,11 @@
|
||||
/* Copyright (c) 2008 Victor Julien <victor@inliniac.net> */
|
||||
#ifndef __PKT_VAR_H__
|
||||
#define __PKT_VAR_H__
|
||||
|
||||
void PktVarAdd(Packet *, char *, u_int8_t *, u_int16_t);
|
||||
PktVar *PktVarGet(Packet *, char *);
|
||||
void PktVarFree(PktVar *);
|
||||
void PktVarPrint(PktVar *);
|
||||
|
||||
#endif /* __PKT_VAR_H__ */
|
||||
|
||||
Loading…
Reference in New Issue