mirror of https://github.com/OISF/suricata
Support for app layer decoder events added + app_layer_event keyword added
Anoop Saldanha
14 years ago
committed by
Victor Julien
parent
4c1e417d49
commit
eea5ab4a7a
@ -0,0 +1,130 @@
|
||||
/* Copyright (C) 2007-2011 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "decode-events.h"
|
||||
#include "flow.h"
|
||||
|
||||
AppLayerDecoderEventsModule *decoder_events_module = NULL;
|
||||
|
||||
void AppLayerDecoderEventsModuleRegister(uint16_t alproto, SCEnumCharMap *table)
|
||||
{
|
||||
AppLayerDecoderEventsModule *dvm = decoder_events_module;
|
||||
|
||||
if (table == NULL) {
|
||||
SCLogError(SC_ERR_INVALID_ARGUMENT, "argument \"table\" NULL");
|
||||
return;
|
||||
}
|
||||
|
||||
while (dvm != NULL) {
|
||||
if (dvm->alproto == alproto) {
|
||||
SCLogInfo("Decoder event module for alproto - %"PRIu16" already "
|
||||
"registered", alproto);
|
||||
return;
|
||||
}
|
||||
dvm = dvm->next;
|
||||
}
|
||||
|
||||
AppLayerDecoderEventsModule *new_dev =
|
||||
SCMalloc(sizeof(AppLayerDecoderEventsModule));
|
||||
if (new_dev == NULL)
|
||||
return;
|
||||
|
||||
new_dev->alproto = alproto;
|
||||
new_dev->table = table;
|
||||
new_dev->next = NULL;
|
||||
|
||||
if (decoder_events_module != NULL)
|
||||
new_dev->next = decoder_events_module;
|
||||
decoder_events_module = new_dev;
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
uint16_t AppLayerDecoderEventsModuleGetAlproto(const char *alproto)
|
||||
{
|
||||
return AppLayerGetProtoByName(alproto);
|
||||
}
|
||||
|
||||
int AppLayerDecoderEventsModuleGetEventId(uint16_t alproto,
|
||||
const char *event_name)
|
||||
{
|
||||
AppLayerDecoderEventsModule *dvm = decoder_events_module;
|
||||
|
||||
while (dvm != NULL) {
|
||||
if (dvm->alproto != alproto)
|
||||
dvm = dvm->next;
|
||||
break;
|
||||
}
|
||||
if (dvm == NULL) {
|
||||
SCLogError(SC_ERR_FATAL, "decoder event module not found for "
|
||||
"alproto - %"PRIu16, alproto);
|
||||
return -1;
|
||||
}
|
||||
|
||||
int event_id = SCMapEnumNameToValue(event_name, dvm->table);
|
||||
if (event_id == -1) {
|
||||
SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in "
|
||||
"module enum map table.", event_name);
|
||||
/* yes this is fatal */
|
||||
return -1;
|
||||
}
|
||||
|
||||
return event_id;
|
||||
}
|
||||
|
||||
void AppLayerDecoderEventsModuleDeRegister(void)
|
||||
{
|
||||
AppLayerDecoderEventsModule *dvm = decoder_events_module;
|
||||
AppLayerDecoderEventsModule *prev_dvm;
|
||||
|
||||
while (dvm != NULL) {
|
||||
prev_dvm = dvm;
|
||||
dvm = dvm->next;
|
||||
SCFree(prev_dvm);
|
||||
}
|
||||
|
||||
decoder_events_module = NULL;
|
||||
}
|
||||
|
||||
/************************************Unittests*********************************/
|
||||
|
||||
AppLayerDecoderEventsModule *decoder_events_module_backup = NULL;
|
||||
|
||||
void AppLayerDecoderEventsModuleCreateBackup(void)
|
||||
{
|
||||
decoder_events_module_backup = decoder_events_module;
|
||||
decoder_events_module = NULL;
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
void AppLayerDecoderEventsModuleRestoreBackup(void)
|
||||
{
|
||||
AppLayerDecoderEventsModuleDeRegister();
|
||||
decoder_events_module = decoder_events_module_backup;
|
||||
decoder_events_module_backup = NULL;
|
||||
|
||||
return;
|
||||
}
|
||||
@ -0,0 +1,297 @@
|
||||
/* Copyright (C) 2007-2011 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "app-layer-protos.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-smtp.h"
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-state.h"
|
||||
#include "detect-app-layer-event.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
|
||||
#include "decode-events.h"
|
||||
#include "util-byte.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
|
||||
|
||||
int DetectAppLayerEventMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *,
|
||||
uint8_t, void *, Signature *, SigMatch *);
|
||||
int DetectAppLayerEventSetup(DetectEngineCtx *, Signature *, char *);
|
||||
void DetectAppLayerEventRegisterTests(void);
|
||||
void DetectAppLayerEventFree(void *);
|
||||
|
||||
/**
|
||||
* \brief Registers the keyword handlers for the "app_layer_event" keyword.
|
||||
*/
|
||||
void DetectAppLayerEventRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].name = "app_layer_event";
|
||||
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Match = NULL;
|
||||
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].AppLayerMatch =
|
||||
DetectAppLayerEventMatch;
|
||||
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Setup = DetectAppLayerEventSetup;
|
||||
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].Free = DetectAppLayerEventFree;
|
||||
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].RegisterTests =
|
||||
DetectAppLayerEventRegisterTests;
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
int DetectAppLayerEventMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
|
||||
Flow *f, uint8_t flags, void *state, Signature *s,
|
||||
SigMatch *m)
|
||||
{
|
||||
DetectAppLayerEventData *aled = (DetectAppLayerEventData *)m->ctx;
|
||||
|
||||
AppLayerDecoderEvents *decoder_events = AppLayerGetDecoderEventsForFlow(f);
|
||||
if (decoder_events == NULL)
|
||||
return 0;
|
||||
|
||||
if (AppLayerDecoderEventsIsEventSet(decoder_events, aled->event_id)) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static DetectAppLayerEventData *DetectAppLayerEventParse(const char *arg)
|
||||
{
|
||||
/* period index */
|
||||
const char *p_idx;
|
||||
|
||||
if (arg == NULL) {
|
||||
SCLogError(SC_ERR_INVALID_SIGNATURE, "app_layer_event keyword supplied "
|
||||
"with no arguments. This keyword needs an argument.");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
while (*arg != '\0' && isspace(*arg)) {
|
||||
arg++;
|
||||
}
|
||||
|
||||
p_idx = strchr(arg, '.');
|
||||
if (p_idx == NULL) {
|
||||
SCLogError(SC_ERR_INVALID_SIGNATURE, "app_layer_event keyword supplied "
|
||||
"with an argument which is not in the right format. The "
|
||||
"right format is \"<alproto>.<event>\"");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
char buffer[50];
|
||||
strncpy(buffer, arg, p_idx - arg);
|
||||
buffer[p_idx - arg] = '\0';
|
||||
|
||||
//int module_id = DecoderEventModuleGetModuleId(buffer);
|
||||
//uint16_t alproto = AppLayerGetProtoByName(buffer);
|
||||
uint16_t alproto = AppLayerDecoderEventsModuleGetAlproto(buffer);
|
||||
if (alproto == ALPROTO_UNKNOWN)
|
||||
return NULL;
|
||||
int event_id = AppLayerDecoderEventsModuleGetEventId(alproto, p_idx + 1);
|
||||
if (event_id == -1)
|
||||
return NULL;
|
||||
|
||||
DetectAppLayerEventData *aled = SCMalloc(sizeof(DetectAppLayerEventData));
|
||||
if (aled == NULL)
|
||||
return NULL;
|
||||
aled->alproto = alproto;
|
||||
aled->event_id = event_id;
|
||||
|
||||
return aled;
|
||||
}
|
||||
|
||||
int DetectAppLayerEventSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
|
||||
{
|
||||
DetectAppLayerEventData *data = NULL;
|
||||
SigMatch *sm = NULL;
|
||||
|
||||
data = DetectAppLayerEventParse(arg);
|
||||
if (data == NULL)
|
||||
goto error;
|
||||
|
||||
sm = SigMatchAlloc();
|
||||
if (sm == NULL)
|
||||
goto error;
|
||||
|
||||
sm->type = DETECT_AL_APP_LAYER_EVENT;
|
||||
sm->ctx = (void *)data;
|
||||
|
||||
if (s->alproto != ALPROTO_UNKNOWN) {
|
||||
if (s->alproto != ((DetectAppLayerEventData *)sm->ctx)->alproto) {
|
||||
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains "
|
||||
"conflicting keywords needing different alprotos");
|
||||
goto error;
|
||||
}
|
||||
} else {
|
||||
s->alproto = ((DetectAppLayerEventData *)sm->ctx)->alproto;
|
||||
}
|
||||
|
||||
SigMatchAppendAppLayer(s, sm);
|
||||
s->flags |= SIG_FLAG_APPLAYER;
|
||||
|
||||
return 0;
|
||||
|
||||
error:
|
||||
return -1;
|
||||
}
|
||||
|
||||
void DetectAppLayerEventFree(void *ptr)
|
||||
{
|
||||
SCFree(ptr);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/**********************************Unittests***********************************/
|
||||
|
||||
#ifdef UNITTESTS /* UNITTESTS */
|
||||
|
||||
#define APP_LAYER_EVENT_TEST_MAP_EVENT1 0
|
||||
#define APP_LAYER_EVENT_TEST_MAP_EVENT2 1
|
||||
#define APP_LAYER_EVENT_TEST_MAP_EVENT3 2
|
||||
#define APP_LAYER_EVENT_TEST_MAP_EVENT4 3
|
||||
#define APP_LAYER_EVENT_TEST_MAP_EVENT5 4
|
||||
#define APP_LAYER_EVENT_TEST_MAP_EVENT6 5
|
||||
|
||||
SCEnumCharMap app_layer_event_test_map[ ] = {
|
||||
{ "event1", APP_LAYER_EVENT_TEST_MAP_EVENT1 },
|
||||
{ "event2", APP_LAYER_EVENT_TEST_MAP_EVENT2 },
|
||||
{ "event3", APP_LAYER_EVENT_TEST_MAP_EVENT3 },
|
||||
{ "event4", APP_LAYER_EVENT_TEST_MAP_EVENT4 },
|
||||
{ "event5", APP_LAYER_EVENT_TEST_MAP_EVENT5 },
|
||||
{ "event6", APP_LAYER_EVENT_TEST_MAP_EVENT6 },
|
||||
};
|
||||
|
||||
int DetectAppLayerEventTest01(void)
|
||||
{
|
||||
AppLayerDecoderEventsModuleCreateBackup();
|
||||
AppLayerDecoderEventsModuleRegister(ALPROTO_SMTP, app_layer_event_test_map);
|
||||
|
||||
int result = 0;
|
||||
|
||||
DetectAppLayerEventData *aled = DetectAppLayerEventParse("smtp.event1");
|
||||
if (aled == NULL)
|
||||
goto end;
|
||||
if (aled->alproto != ALPROTO_SMTP ||
|
||||
aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT1) {
|
||||
printf("test failure. Holding wrong state\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
result = 1;
|
||||
|
||||
end:
|
||||
AppLayerDecoderEventsModuleRestoreBackup();
|
||||
if (aled != NULL)
|
||||
DetectAppLayerEventFree(aled);
|
||||
return result;
|
||||
}
|
||||
|
||||
int DetectAppLayerEventTest02(void)
|
||||
{
|
||||
AppLayerDecoderEventsModuleCreateBackup();
|
||||
AppLayerDecoderEventsModuleRegister(ALPROTO_SMTP, app_layer_event_test_map);
|
||||
AppLayerDecoderEventsModuleRegister(ALPROTO_HTTP, app_layer_event_test_map);
|
||||
AppLayerDecoderEventsModuleRegister(ALPROTO_SMB, app_layer_event_test_map);
|
||||
AppLayerDecoderEventsModuleRegister(ALPROTO_FTP, app_layer_event_test_map);
|
||||
|
||||
int result = 0;
|
||||
|
||||
DetectAppLayerEventData *aled = DetectAppLayerEventParse("smtp.event1");
|
||||
if (aled == NULL)
|
||||
goto end;
|
||||
if (aled->alproto != ALPROTO_SMTP ||
|
||||
aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT1) {
|
||||
printf("test failure. Holding wrong state\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
aled = DetectAppLayerEventParse("smtp.event4");
|
||||
if (aled == NULL)
|
||||
goto end;
|
||||
if (aled->alproto != ALPROTO_SMTP ||
|
||||
aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT4) {
|
||||
printf("test failure. Holding wrong state\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
aled = DetectAppLayerEventParse("http.event2");
|
||||
if (aled == NULL)
|
||||
goto end;
|
||||
if (aled->alproto != ALPROTO_HTTP ||
|
||||
aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT2) {
|
||||
printf("test failure. Holding wrong state\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
aled = DetectAppLayerEventParse("smb.event3");
|
||||
if (aled == NULL)
|
||||
goto end;
|
||||
if (aled->alproto != ALPROTO_SMB ||
|
||||
aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT3) {
|
||||
printf("test failure. Holding wrong state\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
aled = DetectAppLayerEventParse("ftp.event5");
|
||||
if (aled == NULL)
|
||||
goto end;
|
||||
if (aled->alproto != ALPROTO_FTP ||
|
||||
aled->event_id != APP_LAYER_EVENT_TEST_MAP_EVENT5) {
|
||||
printf("test failure. Holding wrong state\n");
|
||||
goto end;
|
||||
}
|
||||
|
||||
result = 1;
|
||||
|
||||
end:
|
||||
AppLayerDecoderEventsModuleRestoreBackup();
|
||||
if (aled != NULL)
|
||||
DetectAppLayerEventFree(aled);
|
||||
return result;
|
||||
}
|
||||
|
||||
#endif /* UNITTESTS */
|
||||
|
||||
/**
|
||||
* \brief This function registers unit tests for "app_layer_event" keyword.
|
||||
*/
|
||||
void DetectAppLayerEventRegisterTests(void)
|
||||
{
|
||||
#ifdef UNITTESTS /* UNITTESTS */
|
||||
UtRegisterTest("DetectAppLayerEventTest01", DetectAppLayerEventTest01, 1);
|
||||
UtRegisterTest("DetectAppLayerEventTest02", DetectAppLayerEventTest02, 1);
|
||||
#endif /* UNITTESTS */
|
||||
|
||||
return;
|
||||
}
|
||||
@ -0,0 +1,34 @@
|
||||
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_APP_LAYER_EVENT_H__
|
||||
#define __DETECT_APP_LAYER_EVENT_H__
|
||||
|
||||
typedef struct DetectAppLayerEventData_ {
|
||||
uint16_t alproto;
|
||||
int event_id;
|
||||
} DetectAppLayerEventData;
|
||||
|
||||
void DetectAppLayerEventRegister(void);
|
||||
|
||||
#endif /* __DETECT_APP_LAYER_EVENT_H__ */
|
||||
Loading…
Reference in New Issue