suricata
detect-datarep.c
Go to the documentation of this file.
1 /* Copyright (C) 2018-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements the datarep keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 #include "detect.h"
29 #include "threads.h"
30 #include "datasets.h"
31 #include "detect-datarep.h"
32 
33 #include "detect-parse.h"
34 #include "detect-engine.h"
35 #include "detect-engine-mpm.h"
36 #include "detect-engine-state.h"
37 
38 #include "util-byte.h"
39 #include "util-debug.h"
40 #include "util-print.h"
41 #include "util-misc.h"
42 #include "util-path.h"
43 
44 #define PARSE_REGEX "([a-z]+)(?:,\\s*([\\-_A-z0-9\\s\\.]+)){1,4}"
45 static DetectParseRegex parse_regex;
46 
48  const Signature *, const SigMatchCtx *);
49 static int DetectDatarepSetup (DetectEngineCtx *, Signature *, const char *);
50 void DetectDatarepFree (DetectEngineCtx *, void *);
51 
53 {
54  sigmatch_table[DETECT_DATAREP].name = "datarep";
55  sigmatch_table[DETECT_DATAREP].desc = "operate on datasets (experimental)";
56  sigmatch_table[DETECT_DATAREP].url = "/rules/dataset-keywords.html#datarep";
57  sigmatch_table[DETECT_DATAREP].Setup = DetectDatarepSetup;
59 
60  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
61 }
62 
63 /*
64  1 match
65  0 no match
66  -1 can't match
67  */
69  const DetectDatarepData *sd,
70  const uint8_t *data, const uint32_t data_len)
71 {
72  if (data == NULL || data_len == 0)
73  return 0;
74 
75  DataRepResultType r = DatasetLookupwRep(sd->set, data, data_len, &sd->rep);
76  if (!r.found)
77  return 0;
78 
79  switch (sd->op) {
80  case DATAREP_OP_GT:
81  if (r.rep.value > sd->rep.value)
82  return 1;
83  break;
84  case DATAREP_OP_LT:
85  if (r.rep.value < sd->rep.value)
86  return 1;
87  break;
88  case DATAREP_OP_EQ:
89  if (r.rep.value == sd->rep.value)
90  return 1;
91  break;
92  }
93  return 0;
94 }
95 
96 static int DetectDatarepParse(const char *str, char *cmd, int cmd_len, char *name, int name_len,
97  enum DatasetTypes *type, char *load, size_t load_size, uint16_t *rep_value,
98  uint64_t *memcap, uint32_t *hashsize)
99 {
100  bool cmd_set = false;
101  bool name_set = false;
102  bool value_set = false;
103 
104  char copy[strlen(str)+1];
105  strlcpy(copy, str, sizeof(copy));
106  char *xsaveptr = NULL;
107  char *key = strtok_r(copy, ",", &xsaveptr);
108  while (key != NULL) {
109  while (*key != '\0' && isblank(*key)) {
110  key++;
111  }
112  char *val = strchr(key, ' ');
113  if (val != NULL) {
114  *val++ = '\0';
115  while (*val != '\0' && isblank(*val)) {
116  val++;
117  SCLogDebug("cmd %s val %s", key, val);
118  }
119  } else {
120  SCLogDebug("cmd %s", key);
121  }
122 
123  if (strlen(key) == 0) {
124  goto next;
125  }
126 
127  if (!name_set) {
128  if (val) {
129  return -1;
130  }
131  strlcpy(name, key, name_len);
132  name_set = true;
133  } else if (!cmd_set) {
134  if (val) {
135  return -1;
136  }
137  strlcpy(cmd, key, cmd_len);
138  cmd_set = true;
139  } else if (!value_set) {
140  if (val) {
141  return -1;
142  }
143 
144  if (StringParseUint16(rep_value, 10, 0, key) < 0)
145  return -1;
146 
147  value_set = true;
148  } else {
149  if (val == NULL) {
150  return -1;
151  }
152 
153  if (strcmp(key, "type") == 0) {
154  SCLogDebug("type %s", val);
155 
156  if (strcmp(val, "md5") == 0) {
158  } else if (strcmp(val, "sha256") == 0) {
160  } else if (strcmp(val, "string") == 0) {
162  } else if (strcmp(val, "ipv4") == 0) {
164  } else if (strcmp(val, "ip") == 0) {
166  } else if (strcmp(val, "ipv6") == 0) {
168  } else {
169  SCLogDebug("bad type %s", val);
170  return -1;
171  }
172 
173  } else if (strcmp(key, "load") == 0) {
174  SCLogDebug("load %s", val);
175  strlcpy(load, val, load_size);
176  }
177  if (strcmp(key, "memcap") == 0) {
178  if (ParseSizeStringU64(val, memcap) < 0) {
179  SCLogWarning("invalid value for memcap: %s,"
180  " resetting to default",
181  val);
182  *memcap = 0;
183  }
184  }
185  if (strcmp(key, "hashsize") == 0) {
186  if (ParseSizeStringU32(val, hashsize) < 0) {
187  SCLogWarning("invalid value for hashsize: %s,"
188  " resetting to default",
189  val);
190  *hashsize = 0;
191  }
192  }
193  }
194 
195  SCLogDebug("key: %s, value: %s", key, val);
196 
197  next:
198  key = strtok_r(NULL, ",", &xsaveptr);
199  }
200 
201  if (strlen(load) > 0 && *type == DATASET_TYPE_NOTSET) {
202  SCLogError("if load is used type must be set as well");
203  return 0;
204  }
205 
206  if (!name_set || !cmd_set || !value_set) {
207  SCLogError("missing values");
208  return 0;
209  }
210 
211  /* Trim trailing whitespace. */
212  while (strlen(name) > 0 && isblank(name[strlen(name) - 1])) {
213  name[strlen(name) - 1] = '\0';
214  }
215 
216  /* Validate name, spaces are not allowed. */
217  for (size_t i = 0; i < strlen(name); i++) {
218  if (isblank(name[i])) {
219  SCLogError("spaces not allowed in dataset names");
220  return 0;
221  }
222  }
223 
224  return 1;
225 }
226 
227 /** \brief wrapper around dirname that does leave input untouched */
228 static void GetDirName(const char *in, char *out, size_t outs)
229 {
230  if (strlen(in) == 0) {
231  return;
232  }
233 
234  size_t size = strlen(in) + 1;
235  char tmp[size];
236  strlcpy(tmp, in, size);
237 
238  char *dir = dirname(tmp);
239  BUG_ON(dir == NULL);
240  strlcpy(out, dir, outs);
241  return;
242 }
243 
244 static int SetupLoadPath(const DetectEngineCtx *de_ctx,
245  char *load, size_t load_size)
246 {
247  SCLogDebug("load %s", load);
248 
249  if (PathIsAbsolute(load)) {
250  return 0;
251  }
252 
253  bool done = false;
254 #ifdef HAVE_LIBGEN_H
255  BUG_ON(de_ctx->rule_file == NULL);
256 
257  char dir[PATH_MAX] = "";
258  GetDirName(de_ctx->rule_file, dir, sizeof(dir));
259 
260  SCLogDebug("rule_file %s dir %s", de_ctx->rule_file, dir);
261  char path[PATH_MAX];
262  if (snprintf(path, sizeof(path), "%s/%s", dir, load) >= (int)sizeof(path)) // TODO windows path
263  return -1;
264 
265  if (SCPathExists(path)) {
266  done = true;
267  strlcpy(load, path, load_size);
268  SCLogDebug("using path '%s' (HAVE_LIBGEN_H)", load);
269  } else {
270  SCLogDebug("path '%s' does not exist (HAVE_LIBGEN_H)", path);
271  }
272 #endif
273  if (!done) {
274  char *loadp = DetectLoadCompleteSigPath(de_ctx, load);
275  if (loadp == NULL) {
276  return -1;
277  }
278  SCLogDebug("loadp %s", loadp);
279 
280  if (SCPathExists(loadp)) {
281  strlcpy(load, loadp, load_size);
282  SCLogDebug("using path '%s' (non-HAVE_LIBGEN_H)", load);
283  } else {
284  SCLogDebug("path '%s' does not exist (non-HAVE_LIBGEN_H)", loadp);
285  }
286  SCFree(loadp);
287 
288  // TODO try data-dir as well?
289  }
290  return 0;
291 }
292 
293 static int DetectDatarepSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
294 {
295  char cmd_str[16] = "", name[64] = "";
297  char load[PATH_MAX] = "";
298  uint16_t value = 0;
299  uint64_t memcap = 0;
300  uint32_t hashsize = 0;
301 
302  if (DetectBufferGetActiveList(de_ctx, s) == -1) {
303  SCLogError("datarep is only supported for sticky buffers");
304  SCReturnInt(-1);
305  }
306 
307  int list = s->init_data->list;
308  if (list == DETECT_SM_LIST_NOTSET) {
309  SCLogError("datarep is only supported for sticky buffers");
310  SCReturnInt(-1);
311  }
312 
313  if (!DetectDatarepParse(rawstr, cmd_str, sizeof(cmd_str), name, sizeof(name), &type, load,
314  sizeof(load), &value, &memcap, &hashsize)) {
315  return -1;
316  }
317 
318  if (strlen(load) != 0) {
319  if (SetupLoadPath(de_ctx, load, sizeof(load)) != 0)
320  return -1;
321  }
322 
323  enum DetectDatarepOp op;
324  if (strcmp(cmd_str,">") == 0) {
325  op = DATAREP_OP_GT;
326  } else if (strcmp(cmd_str,"<") == 0) {
327  op = DATAREP_OP_LT;
328  } else if (strcmp(cmd_str,"==") == 0) {
329  op = DATAREP_OP_EQ;
330  } else {
331  SCLogError("datarep operation \"%s\" is not supported.", cmd_str);
332  return -1;
333  }
334 
335  Dataset *set = DatasetGet(name, type, /* no save */ NULL, load, memcap, hashsize);
336  if (set == NULL) {
337  SCLogError("failed to set up datarep set '%s'.", name);
338  return -1;
339  }
340 
341  DetectDatarepData *cd = SCCalloc(1, sizeof(DetectDatarepData));
342  if (unlikely(cd == NULL))
343  goto error;
344 
345  cd->set = set;
346  cd->op = op;
347  cd->rep.value = value;
348 
349  SCLogDebug("cmd %s, name %s",
350  cmd_str, strlen(name) ? name : "(none)");
351 
352  /* Okay so far so good, lets get this into a SigMatch
353  * and put it in the Signature. */
354 
355  if (SigMatchAppendSMToList(de_ctx, s, DETECT_DATAREP, (SigMatchCtx *)cd, list) == NULL) {
356  goto error;
357  }
358  return 0;
359 
360 error:
361  if (cd != NULL)
362  SCFree(cd);
363  return -1;
364 }
365 
367 {
369 
370  if (fd == NULL)
371  return;
372 
373  SCFree(fd);
374 }
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1296
detect-engine.h
DataRepResultType::rep
DataRepType rep
Definition: datasets-reputation.h:33
SigTableElmt_::desc
const char * desc
Definition: detect.h:1295
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1283
DetectParseRegex
Definition: detect-parse.h:62
SigTableElmt_::name
const char * name
Definition: detect.h:1293
DetectEngineCtx_::rule_file
char * rule_file
Definition: detect.h:926
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:198
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DetectDatarepData_
Definition: detect-datarep.h:36
threads.h
DetectDatarepMatch
int DetectDatarepMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:337
DETECT_DATAREP
@ DETECT_DATAREP
Definition: detect-engine-register.h:102
DataRepResultType::found
bool found
Definition: datasets-reputation.h:32
DATASET_TYPE_SHA256
@ DATASET_TYPE_SHA256
Definition: datasets.h:34
DetectDatarepRegister
void DetectDatarepRegister(void)
Definition: detect-datarep.c:52
DATAREP_OP_EQ
@ DATAREP_OP_EQ
Definition: detect-datarep.h:33
DetectBufferGetActiveList
int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s)
Definition: detect-engine.c:1450
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1278
DATASET_TYPE_IPV6
@ DATASET_TYPE_IPV6
Definition: datasets.h:36
hashsize
#define hashsize(n)
Definition: util-hash-lookup3.c:67
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
DataRepResultType
Definition: datasets-reputation.h:31
DatasetGet
Dataset * DatasetGet(const char *name, enum DatasetTypes type, const char *save, const char *load, uint64_t memcap, uint32_t hashsize)
Definition: datasets.c:632
datasets.h
decode.h
util-debug.h
type
uint8_t type
Definition: decode-icmpv4.h:0
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1092
DetectDatarepData_::rep
DataRepType rep
Definition: detect-datarep.h:40
DATASET_TYPE_NOTSET
#define DATASET_TYPE_NOTSET
Definition: datasets.h:31
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:2791
SignatureInitData_::list
int list
Definition: detect.h:562
util-print.h
detect-engine-mpm.h
DetectDatarepOp
DetectDatarepOp
Definition: detect-datarep.h:30
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
Packet_
Definition: decode.h:436
DATAREP_OP_LT
@ DATAREP_OP_LT
Definition: detect-datarep.h:32
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:662
DATASET_TYPE_IPV4
@ DATASET_TYPE_IPV4
Definition: datasets.h:35
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:342
DETECT_SM_LIST_NOTSET
#define DETECT_SM_LIST_NOTSET
Definition: detect.h:138
SCPathExists
bool SCPathExists(const char *path)
Check if a path exists.
Definition: util-path.c:219
DatasetTypes
DatasetTypes
Definition: datasets.h:30
DetectDatarepBufferMatch
int DetectDatarepBufferMatch(DetectEngineThreadCtx *det_ctx, const DetectDatarepData *sd, const uint8_t *data, const uint32_t data_len)
Definition: detect-datarep.c:68
suricata-common.h
DATAREP_OP_GT
@ DATAREP_OP_GT
Definition: detect-datarep.h:31
util-path.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
PathIsAbsolute
int PathIsAbsolute(const char *path)
Check if a path is absolute.
Definition: util-path.c:44
DetectDatarepData_::set
Dataset * set
Definition: detect-datarep.h:37
DataRepType::value
uint16_t value
Definition: datasets-reputation.h:28
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:181
str
#define str(s)
Definition: suricata-common.h:291
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
detect-datarep.h
SCFree
#define SCFree(p)
Definition: util-mem.h:61
detect-parse.h
Signature_
Signature container.
Definition: detect.h:593
DATASET_TYPE_MD5
@ DATASET_TYPE_MD5
Definition: datasets.h:33
DATASET_TYPE_STRING
@ DATASET_TYPE_STRING
Definition: datasets.h:32
DetectDatarepFree
void DetectDatarepFree(DetectEngineCtx *, void *)
Definition: detect-datarep.c:366
DetectLoadCompleteSigPath
char * DetectLoadCompleteSigPath(const DetectEngineCtx *de_ctx, const char *sig_file)
Create the path if default-rule-path was specified.
Definition: detect-engine-loader.c:63
SigMatchAppendSMToList
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:447
Dataset
Definition: datasets.h:40
DetectDatarepData_::op
enum DetectDatarepOp op
Definition: detect-datarep.h:39
util-misc.h
PARSE_REGEX
#define PARSE_REGEX
Definition: detect-datarep.c:44
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
DatasetLookupwRep
DataRepResultType DatasetLookupwRep(Dataset *set, const uint8_t *data, const uint32_t data_len, const DataRepType *rep)
Definition: datasets.c:1333