aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dce_iface, dce_opnum, dce_stub_data keyword support

Browse Source
remotes/origin/master-1.0.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent d284f0d333
commit f684989f98
10 changed files with 1386 additions and 1 deletions
Show Stats Download Patch File Download Diff File

3
src/Makefile.am
Unescape Escape View File

@ -92,6 +92,9 @@ detect-icode.c detect-icode.h \
detect-http-cookie.c detect-http-cookie.h \
detect-tls-version.c detect-tls-version.h \
detect-icmp-id.c detect-icmp-id.h \
detect-dce-iface.c detect-dce-iface.h \
detect-dce-opnum.c detect-dce-opnum.h \
detect-dce-stub-data.c detect-dce-stub-data.h \
util-print.c util-print.h \
util-mpm.c util-mpm.h \
util-binsearch.c util-binsearch.h \

2
src/app-layer-dcerpc.c
Unescape Escape View File

@ -119,7 +119,7 @@ static int DCERPCParseCTXItem(Flow *f, void *dcerpc_state, AppLayerParserState *
}
printf("\n");
#endif
// TAILQ_INSERT_TAIL(&sstate->head, sstate->item, entries);
// TAILQ_INSERT_TAIL(&sstate->head, sstate->item, entries);
if (!(--input_len)) break;
case 20:
p++;

610
src/detect-dce-iface.c
Unescape Escape View File

@ -0,0 +1,610 @@
/** Copyright (c) 2009 Open Information Security Foundation.
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-dce-iface.h"
#include "app-layer-dcerpc.h"
#include "queue.h"
#include "util-debug.h"
#include "util-unittest.h"
#define DETECT_DCE_IFACE_PCRE_PARSE_ARGS "^\\s*([0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12})(?:\\s*,(<|>|=|!)([0-9]{1,5}))?(?:\\s*,(any_frag))?\\s*$"
static pcre *parse_regex = NULL;
static pcre_extra *parse_regex_study = NULL;
int DetectDceIfaceMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceIfaceSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
void DetectDceIfaceFree(void *);
/**
* \brief Registers the keyword handlers for the "dce_iface" keyword.
*/
void DetectDceIfaceRegister(void)
{
const char *eb;
int eo;
int opts = 0;
sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface";
sigmatch_table[DETECT_DCE_IFACE].Match = NULL;
sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch;
sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup;
sigmatch_table[DETECT_DCE_IFACE].Free = DetectDceIfaceFree;
sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests;
parse_regex = pcre_compile(DETECT_DCE_IFACE_PCRE_PARSE_ARGS, opts, &eb,
&eo, NULL);
if (parse_regex == NULL) {
SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
DETECT_DCE_IFACE_PCRE_PARSE_ARGS, eo, eb);
goto error;
}
parse_regex_study = pcre_study(parse_regex, 0, &eb);
if (eb != NULL) {
SCLogDebug("pcre study failed: %s", eb);
goto error;
}
return;
error:
/* we need to handle error?! */
return;
}
/**
* \internal
* \brief Parses the argument sent along with the "dce_iface" keyword.
*
* \param arg Pointer to the string containing the argument to be parsed.
*
* \retval did Pointer to a DetectDceIfaceData instance that holds the data
* from the parsed arg.
*/
static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg)
{
DetectDceIfaceData *did = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
uint8_t hex_value;
const char *pcre_sub_str = NULL;
int i = 0, j = 0;
int len = 0;
char temp_str[3];
int version;
ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov,
MAX_SUBSTRINGS);
if (ret < 2) {
SCLogDebug("pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg);
goto error;
}
if ( (did = malloc(sizeof(DetectDceIfaceData))) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
goto error;
}
memset(did, 0, sizeof(DetectDceIfaceData));
res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 1, &pcre_sub_str);
if (res < 0) {
SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
goto error;
}
len = strlen(pcre_sub_str);
j = 0;
temp_str[2] = '\0';
for (i = 0; i < len; ) {
if (pcre_sub_str[i] == '-') {
i++;
continue;
}
temp_str[0] = pcre_sub_str[i];
temp_str[1] = pcre_sub_str[i + 1];
hex_value = strtol(temp_str, NULL, 16);
did->uuid[j] = hex_value;
i += 2;
j++;
}
if (ret == 3 || ret == 5)
did->any_frag = 1;
if (ret == 4 || ret == 5) {
res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 2, &pcre_sub_str);
if (res < 0) {
SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
goto error;
}
switch (pcre_sub_str[0]) {
case '<':
did->op = DETECT_DCE_IFACE_OP_LT;
break;
case '>':
did->op = DETECT_DCE_IFACE_OP_GT;
break;
case '=':
did->op = DETECT_DCE_IFACE_OP_EQ;
break;
case '!':
did->op = DETECT_DCE_IFACE_OP_NE;
break;
}
res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 3, &pcre_sub_str);
if (res < 0) {
SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
goto error;
}
version = atoi(pcre_sub_str);
if (version > 65535) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "DCE_IFACE interface version "
"invalid: %d\n", version);
goto error;
}
did->version = version;
}
return did;
error:
if (did != NULL)
free(did);
return NULL;
}
int DetectDceIfaceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
uint8_t flags, void *state, Signature *s, SigMatch *m)
{
int ret = 1;
struct entry *item = NULL;
DetectDceIfaceData *dce_data = (DetectDceIfaceData *)m->ctx;
DCERPCState *dcerpc_state = (DCERPCState *)state;
if (dce_rpc_state == NULL) {
SCLogDebug("No DCERPCState for the flow");
return 0;
}
SCMutexLock(&f->m);
int i = 0;
TAILQ_FOREACH(item, &dcerpc_state->head, entries) {
for (i = 0; i < 16; i++) {
if (dce_data->uuid[i] != item->uuid[i]) {
ret = 0;
break;
}
}
}
return 1;
}
/**
* \brief Creates a SigMatch for the "dce_iface" keyword being sent as argument,
* and appends it to the Signature(s).
*
* \param de_ctx Pointer to the detection engine context.
* \param s Pointer to signature for the current Signature being parsed
* from the rules.
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed.
* \param arg Pointer to the string holding the keyword value.
*
* \retval 0 on success, -1 on failure.
*/
int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
char *arg)
{
DetectDceIfaceData *did = NULL;
SigMatch *sm = NULL;
did = DetectDceIfaceArgParse(arg);
if (did == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dec_iface option in "
"signature");
goto error;
}
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_DCE_IFACE;
sm->ctx = (void *)did;
SigMatchAppend(s, m, sm);
return 0;
error:
DetectDceIfaceFree(did);
if (sm != NULL)
free(sm);
return -1;
}
void DetectDceIfaceFree(void *ptr)
{
free(ptr);
return;
}
/************************************Unittests*********************************/
#ifdef UNITTESTS
static int DetectDceIfaceTestParse01(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 0);
result &= (did->op == 0);
result &= (did->any_frag == 0);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse02(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 1);
result &= (did->op == DETECT_DCE_IFACE_OP_GT);
result &= (did->any_frag == 0);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse03(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<10") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 10);
result &= (did->op == DETECT_DCE_IFACE_OP_LT);
result &= (did->any_frag == 0);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse04(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,!10") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 10);
result &= (did->op == DETECT_DCE_IFACE_OP_NE);
result &= (did->any_frag == 0);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse05(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,=10") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 10);
result &= (did->op == DETECT_DCE_IFACE_OP_EQ);
result &= (did->any_frag == 0);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse06(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 0);
result &= (did->op == 0);
result &= (did->any_frag == 1);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse07(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 1);
result &= (did->op == DETECT_DCE_IFACE_OP_GT);
result &= (did->any_frag == 1);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse08(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,<1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 1);
result &= (did->op == DETECT_DCE_IFACE_OP_LT);
result &= (did->any_frag == 1);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse09(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,=1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 1);
result &= (did->op == DETECT_DCE_IFACE_OP_EQ);
result &= (did->any_frag == 1);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse10(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceIfaceData *did = NULL;
uint8_t test_uuid[] = {0x12, 0x34, 0x56, 0x78, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34,
0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC};
SigMatch *temp = NULL;
int i = 0;
result = (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,!1,any_frag") == 0);
if (s->match != NULL) {
temp = s->match;
did = temp->ctx;
result &= 1;
for (i = 0; i < 16; i++) {
if (did->uuid[i] != test_uuid[i]) {
result = 0;
break;
}
}
}
result &= (did->version == 1);
result &= (did->op == DETECT_DCE_IFACE_OP_NE);
result &= (did->any_frag == 1);
SigFree(s);
return result;
}
static int DetectDceIfaceTestParse11(void)
{
Signature *s = SigAlloc();
int result = 1;
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>1,ay_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-12345679ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-134-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-123-124-1234-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "1234568-1234-1234-1234-123456789ABC,>1,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>65536,any_frag") == -1);
result &= (DetectDceIfaceSetup(NULL, s, NULL, "12345678-1234-1234-1234-123456789ABC,>=1,any_frag") == -1);
SigFree(s);
return result;
}
#endif
void DetectDceIfaceRegisterTests(void)
{
#ifdef UNITTESTS
UtRegisterTest("DetectDceIfaceTestParse01", DetectDceIfaceTestParse01, 1);
UtRegisterTest("DetectDceIfaceTestParse02", DetectDceIfaceTestParse02, 1);
UtRegisterTest("DetectDceIfaceTestParse03", DetectDceIfaceTestParse03, 1);
UtRegisterTest("DetectDceIfaceTestParse04", DetectDceIfaceTestParse04, 1);
UtRegisterTest("DetectDceIfaceTestParse05", DetectDceIfaceTestParse05, 1);
UtRegisterTest("DetectDceIfaceTestParse06", DetectDceIfaceTestParse06, 1);
UtRegisterTest("DetectDceIfaceTestParse07", DetectDceIfaceTestParse07, 1);
UtRegisterTest("DetectDceIfaceTestParse08", DetectDceIfaceTestParse08, 1);
UtRegisterTest("DetectDceIfaceTestParse09", DetectDceIfaceTestParse09, 1);
UtRegisterTest("DetectDceIfaceTestParse10", DetectDceIfaceTestParse10, 1);
UtRegisterTest("DetectDceIfaceTestParse11", DetectDceIfaceTestParse11, 1);
#endif
}

25
src/detect-dce-iface.h
Unescape Escape View File

@ -0,0 +1,25 @@
/** Copyright (c) 2009 Open Information Security Foundation.
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#ifndef __DETECT_DCE_IFACE_H__
#define __DETECT_DCE_IFACE_H__
typedef enum DetectDceIfaceOperators_ {
DETECT_DCE_IFACE_OP_LT = 1,
DETECT_DCE_IFACE_OP_GT,
DETECT_DCE_IFACE_OP_EQ,
DETECT_DCE_IFACE_OP_NE,
} DetectDceIfaceOperators;
typedef struct DetectDceIfaceData_ {
uint8_t uuid[16];
uint8_t op;
uint16_t version;
uint8_t any_frag;
} DetectDceIfaceData;
void DetectDceIfaceRegister(void);
void DetectDceIfaceRegisterTests(void);
#endif /* __DETECT_DCE_IFACE_H__ */

601
src/detect-dce-opnum.c
Unescape Escape View File

@ -0,0 +1,601 @@
/** Copyright (c) 2009 Open Information Security Foundation.
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-dce-opnum.h"
#include "util-debug.h"
#include "util-unittest.h"
#define DETECT_DCE_OPNUM_PCRE_PARSE_ARGS "^\\s*([0-9]{1,5}(\\s*-\\s*[0-9]{1,5}\\s*)?)(,\\s*[0-9]{1,5}(\\s*-\\s*[0-9]{1,5})?\\s*)*$"
static pcre *parse_regex = NULL;
static pcre_extra *parse_regex_study = NULL;
int DetectDceOpnumMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceOpnumSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
void DetectDceOpnumFree(void *);
/**
* \brief Registers the keyword handlers for the "dce_opnum" keyword.
*/
void DetectDceOpnumRegister(void)
{
const char *eb;
int eo;
int opts = 0;
sigmatch_table[DETECT_DCE_OPNUM].name = "dce_iface";
sigmatch_table[DETECT_DCE_OPNUM].Match = NULL;
sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch;
sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup;
sigmatch_table[DETECT_DCE_OPNUM].Free = DetectDceOpnumFree;
sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests;
parse_regex = pcre_compile(DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, opts, &eb,
&eo, NULL);
if (parse_regex == NULL) {
SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, eo, eb);
goto error;
}
parse_regex_study = pcre_study(parse_regex, 0, &eb);
if (eb != NULL) {
SCLogDebug("pcre study failed: %s", eb);
goto error;
}
return;
error:
/* we need to handle error?! */
return;
}
/**
* \internal
* \brief Creates and returns a new instance of DetectDceOpnumRange.
*
* \retval dor Pointer to the new instance DetectDceOpnumRange.
*/
static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void)
{
DetectDceOpnumRange *dor = NULL;
if ( (dor = malloc(sizeof(DetectDceOpnumRange))) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memset(dor, 0, sizeof(DetectDceOpnumRange));
dor->range1 = dor->range2 = -1;
return dor;
}
/**
* \internal
* \brief Parses the argument sent along with the "dce_opnum" keyword.
*
* \param arg Pointer to the string containing the argument to be parsed.
*
* \retval did Pointer to a DetectDceIfaceData instance that holds the data
* from the parsed arg.
*/
static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg)
{
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
DetectDceOpnumRange *prev_dor = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
const char *pcre_sub_str = NULL;
char *dup_str = NULL;
char *dup_str_temp = NULL;
char *dup_str_head = NULL;
char *comma_token = NULL;
char *hyphen_token = NULL;
ret = pcre_exec(parse_regex, parse_regex_study, arg, strlen(arg), 0, 0, ov,
MAX_SUBSTRINGS);
if (ret < 2) {
SCLogDebug("pcre_exec parse error, ret %" PRId32 ", string %s", ret, arg);
goto error;
}
res = pcre_get_substring(arg, ov, MAX_SUBSTRINGS, 0, &pcre_sub_str);
if (res < 0) {
SCLogError(SC_PCRE_GET_SUBSTRING_FAILED, "pcre_get_substring failed");
goto error;
}
if ( (dod = malloc(sizeof(DetectDceOpnumData))) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
goto error;
}
memset(dod, 0, sizeof(DetectDceOpnumRange));
if ( (dup_str = strdup(pcre_sub_str)) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
/* keep a copy of the strdup string in dup_str_head so that we can free it
* once we are done using it */
dup_str_head = dup_str;
dup_str_temp = dup_str;
while ( (comma_token = index(dup_str, ',')) != NULL) {
comma_token[0] = '\0';
dup_str = comma_token + 1;
dor = DetectDceOpnumAllocDetectDceOpnumRange();
if ( (hyphen_token = index(dup_str_temp, '-')) != NULL) {
hyphen_token[0] = '\0';
hyphen_token++;
dor->range1 = atoi(dup_str_temp);
if (dor->range1 > 65535)
goto error;
dor->range2 = atoi(hyphen_token);
if (dor->range2 > 65535)
goto error;
if (dor->range1 > dor->range2)
goto error;
}
dor->range1 = atoi(dup_str_temp);
if (dor->range1 > 65535)
goto error;
if (prev_dor == NULL) {
prev_dor = dor;
dod->range = dor;
} else {
prev_dor->next = dor;
prev_dor = dor;
}
dup_str_temp = dup_str;
}
dor = DetectDceOpnumAllocDetectDceOpnumRange();
if ( (hyphen_token = index(dup_str, '-')) != NULL) {
hyphen_token[0] = '\0';
hyphen_token++;
dor->range1 = atoi(dup_str);
if (dor->range1 > 65535)
goto error;
dor->range2 = atoi(hyphen_token);
if (dor->range2 > 65535)
goto error;
if (dor->range1 > dor->range2)
goto error;
}
dor->range1 = atoi(dup_str);
if (dor->range1 > 65535)
goto error;
if (prev_dor == NULL) {
prev_dor = dor;
dod->range = dor;
} else {
prev_dor->next = dor;
prev_dor = dor;
}
if (dup_str_head != NULL)
free(dup_str_head);
return dod;
error:
if (dup_str_head != NULL)
free(dup_str_head);
DetectDceOpnumFree(dod);
return NULL;
}
int DetectDceOpnumMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
uint8_t flags, void *state, Signature *s, SigMatch *m)
{
return 1;
}
/**
* \brief Creates a SigMatch for the "dce_opnum" keyword being sent as argument,
* and appends it to the Signature(s).
*
* \param de_ctx Pointer to the detection engine context.
* \param s Pointer to signature for the current Signature being parsed
* from the rules.
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed.
* \param arg Pointer to the string holding the keyword value.
*
* \retval 0 on success, -1 on failure
*/
int DetectDceOpnumSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
char *arg)
{
DetectDceOpnumData *dod = NULL;
SigMatch *sm = NULL;
dod = DetectDceOpnumArgParse(arg);
if (dod == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Error parsing dce_opnum option in "
"signature");
goto error;
}
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_DCE_OPNUM;
sm->ctx = (void *)dod;
SigMatchAppend(s, m, sm);
return 0;
error:
DetectDceOpnumFree(dod);
if (sm != NULL)
free(sm);
return -1;
}
void DetectDceOpnumFree(void *ptr)
{
DetectDceOpnumData *dod = ptr;
DetectDceOpnumRange *dor = NULL;
DetectDceOpnumRange *dor_temp = NULL;
if (dod != NULL) {
dor = dod->range;
dor_temp = dod->range;
while (dor != NULL) {
dor_temp = dor;
dor = dor->next;
free(dor_temp);
}
free(dod);
}
return;
}
/************************************Unittests*********************************/
#ifdef UNITTESTS
static int DetectDceOpnumTestParse01(void)
{
Signature *s = SigAlloc();
int result = 0;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,24") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,12-24") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12-14,12,121,62-78") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,26,62,61,6513-6666") == 0);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12,26,62,61,6513--") == -1);
result &= (DetectDceOpnumSetup(NULL, s, NULL, "12-14,12,121,62-8") == -1);
if (s->match != NULL) {
SigFree(s);
result &= 1;
}
return result;
}
static int DetectDceOpnumTestParse02(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
SigMatch *temp = NULL;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12") == 0);
if (s->match != NULL) {
temp = s->match;
dod = temp->ctx;
if (dod == NULL)
goto end;
dor = dod->range;
result &= (dor->range1 == 12 && dor->range2 == -1);
result &= (dor->next == NULL);
}
end:
SigFree(s);
return result;
}
static int DetectDceOpnumTestParse03(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
SigMatch *temp = NULL;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12-24") == 0);
if (s->match != NULL) {
temp = s->match;
dod = temp->ctx;
if (dod == NULL)
goto end;
dor = dod->range;
result &= (dor->range1 == 12 && dor->range2 == 24);
result &= (dor->next == NULL);
}
end:
SigFree(s);
return result;
}
static int DetectDceOpnumTestParse04(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
SigMatch *temp = NULL;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "12-24,24,62-72,623-635,62,25,213-235") == 0);
if (s->match != NULL) {
temp = s->match;
dod = temp->ctx;
if (dod == NULL)
goto end;
dor = dod->range;
result &= (dor->range1 == 12 && dor->range2 == 24);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 24 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 62 && dor->range2 == 72);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 623 && dor->range2 == 635);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 62 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 25 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 213 && dor->range2 == 235);
if (result == 0)
goto end;
}
end:
SigFree(s);
return result;
}
static int DetectDceOpnumTestParse05(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
SigMatch *temp = NULL;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "1,2,3,4,5,6,7") == 0);
if (s->match != NULL) {
temp = s->match;
dod = temp->ctx;
if (dod == NULL)
goto end;
dor = dod->range;
result &= (dor->range1 == 1 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 2 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 3 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 4 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 5 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 6 && dor->range2 == -1);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 7 && dor->range2 == -1);
if (result == 0)
goto end;
}
end:
SigFree(s);
return result;
}
static int DetectDceOpnumTestParse06(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
SigMatch *temp = NULL;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "1-2,3-4,5-6,7-8") == 0);
if (s->match != NULL) {
temp = s->match;
dod = temp->ctx;
if (dod == NULL)
goto end;
dor = dod->range;
result &= (dor->range1 == 1 && dor->range2 == 2);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 3 && dor->range2 == 4);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 5 && dor->range2 == 6);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 7 && dor->range2 == 8);
if (result == 0)
goto end;
}
end:
SigFree(s);
return result;
}
static int DetectDceOpnumTestParse07(void)
{
Signature *s = SigAlloc();
int result = 0;
DetectDceOpnumData *dod = NULL;
DetectDceOpnumRange *dor = NULL;
SigMatch *temp = NULL;
memset(s, 0, sizeof(Signature));
result = (DetectDceOpnumSetup(NULL, s, NULL, "1-2,3-4,5-6,7-8,9") == 0);
if (s->match != NULL) {
temp = s->match;
dod = temp->ctx;
if (dod == NULL)
goto end;
dor = dod->range;
result &= (dor->range1 == 1 && dor->range2 == 2);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 3 && dor->range2 == 4);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 5 && dor->range2 == 6);
result &= (dor->next != NULL);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 7 && dor->range2 == 8);
if (result == 0)
goto end;
dor = dor->next;
result &= (dor->range1 == 9 && dor->range2 == -1);
if (result == 0)
goto end;
}
end:
SigFree(s);
return result;
}
#endif
void DetectDceOpnumRegisterTests(void)
{
#ifdef UNITTESTS
UtRegisterTest("DetectDceOpnumTestParse01", DetectDceOpnumTestParse01, 1);
UtRegisterTest("DetectDceOpnumTestParse02", DetectDceOpnumTestParse02, 1);
UtRegisterTest("DetectDceOpnumTestParse03", DetectDceOpnumTestParse03, 1);
UtRegisterTest("DetectDceOpnumTestParse04", DetectDceOpnumTestParse04, 1);
UtRegisterTest("DetectDceOpnumTestParse05", DetectDceOpnumTestParse05, 1);
UtRegisterTest("DetectDceOpnumTestParse06", DetectDceOpnumTestParse06, 1);
UtRegisterTest("DetectDceOpnumTestParse07", DetectDceOpnumTestParse07, 1);
#endif
}

21
src/detect-dce-opnum.h
Unescape Escape View File

@ -0,0 +1,21 @@
/** Copyright (c) 2009 Open Information Security Foundation.
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#ifndef __DETECT_DCE_OPNUM_H__
#define __DETECT_DCE_OPNUM_H__
typedef struct DetectDceOpnumRange_ {
uint32_t range1;
uint32_t range2;
struct DetectDceOpnumRange_ *next;
} DetectDceOpnumRange;
typedef struct DetectDceOpnumData_ {
DetectDceOpnumRange *range;
} DetectDceOpnumData;
void DetectDceOpnumRegister(void);
void DetectDceOpnumRegisterTests(void);
#endif /* __DETECT_DCE_OPNUM_H__ */

105
src/detect-dce-stub-data.c
Unescape Escape View File

@ -0,0 +1,105 @@
/** Copyright (c) 2009 Open Information Security Foundation.
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-dce-stub-data.h"
#include "util-debug.h"
#include "util-unittest.h"
int DetectDceStubDataMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t,
void *, Signature *, SigMatch *);
int DetectDceStubDataSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg);
/**
* \brief Registers the keyword handlers for the "dce_stub_data" keyword.
*/
void DetectDceStubDataRegister(void)
{
sigmatch_table[DETECT_DCE_STUB_DATA].name = "dce_stub_data";
sigmatch_table[DETECT_DCE_STUB_DATA].Match = NULL;
sigmatch_table[DETECT_DCE_STUB_DATA].AppLayerMatch = DetectDceStubDataMatch;
sigmatch_table[DETECT_DCE_STUB_DATA].Setup = DetectDceStubDataSetup;
sigmatch_table[DETECT_DCE_STUB_DATA].Free = NULL;
sigmatch_table[DETECT_DCE_STUB_DATA].RegisterTests = DetectDceStubDataRegisterTests;
return;
}
int DetectDceStubDataMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f,
uint8_t flags, void *state, Signature *s, SigMatch *m)
{
return 1;
}
/**
* \brief Creates a SigMatch for the "dce_stub_data" keyword being sent as argument,
* and appends it to the Signature(s).
*
* \param de_ctx Pointer to the detection engine context
* \param s Pointer to signature for the current Signature being parsed
* from the rules
* \param m Pointer to the head of the SigMatchs for the current rule
* being parsed
* \param arg Pointer to the string holding the keyword value
*
* \retval 0 on success, -1 on failure
*/
int DetectDceStubDataSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
char *arg)
{
SigMatch *sm = NULL;
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
sm->type = DETECT_DCE_STUB_DATA;
sm->ctx = NULL;
SigMatchAppend(s, m, sm);
return 0;
error:
if (sm != NULL)
free(sm);
return -1;
}
/************************************Unittests*********************************/
#ifdef UNITTESTS
static int DetectDceStubDataTestParse01(void)
{
Signature s;
int result = 0;
memset(&s, 0, sizeof(Signature));
result = (DetectDceStubDataSetup(NULL, &s, NULL, NULL) == 0);
if (s.match != NULL) {
result = 1;
}
return result;
}
#endif
void DetectDceStubDataRegisterTests(void)
{
#ifdef UNITTESTS
UtRegisterTest("DetectDceStubDataTestParse01", DetectDceStubDataTestParse01, 1);
#endif
}

11
src/detect-dce-stub-data.h
Unescape Escape View File

@ -0,0 +1,11 @@
/** Copyright (c) 2009 Open Information Security Foundation.
* \author Anoop Saldanha <poonaatsoc@gmail.com>
*/
#ifndef __DETECT_DCE_STUB_DATA_H__
#define __DETECT_DCE_STUB_DATA_H__
void DetectDceStubDataRegister(void);
void DetectDceStubDataRegisterTests(void);
#endif /* __DETECT_DCE_STUB_DATA_H__ */

6
src/detect.c
Unescape Escape View File

@ -69,6 +69,9 @@
#include "detect-itype.h"
#include "detect-icode.h"
#include "detect-icmp-id.h"
#include "detect-dce-iface.h"
#include "detect-dce-opnum.h"
#include "detect-dce-stub-data.h"
#include "util-rule-vars.h"
@ -2995,6 +2998,9 @@ void SigTableSetup(void) {
DetectICodeRegister();
DetectHttpCookieRegister();
DetectIcmpIdRegister();
DetectDceIfaceRegister();
DetectDceOpnumRegister();
DetectDceStubDataRegister();
DetectTlsVersionRegister();

3
src/detect.h
Unescape Escape View File

@ -497,6 +497,9 @@ enum {
DETECT_AL_TLS_VERSION,
DETECT_AL_HTTP_COOKIE,
DETECT_DCE_IFACE,
DETECT_DCE_OPNUM,
DETECT_DCE_STUB_DATA,
/* make sure this stays last */
DETECT_TBLSIZE,

Write Preview
Loading…
Cancel
Save