suricata
detect-depth.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the depth keyword.
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-content.h"
34 #include "detect-uricontent.h"
35 #include "detect-byte-extract.h"
36 #include "detect-depth.h"
37 
38 #include "flow-var.h"
39 #include "app-layer.h"
40 
41 #include "util-byte.h"
42 #include "util-debug.h"
43 
44 static int DetectDepthSetup (DetectEngineCtx *, Signature *, const char *);
45 static int DetectStartsWithSetup (DetectEngineCtx *, Signature *, const char *);
46 
48 {
49  sigmatch_table[DETECT_DEPTH].name = "depth";
50  sigmatch_table[DETECT_DEPTH].desc = "designate how many bytes from the beginning of the payload will be checked";
51  sigmatch_table[DETECT_DEPTH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#depth";
53  sigmatch_table[DETECT_DEPTH].Setup = DetectDepthSetup;
56 
57  sigmatch_table[DETECT_STARTS_WITH].name = "startswith";
58  sigmatch_table[DETECT_STARTS_WITH].desc = "pattern must be at the start of a buffer (same as 'depth:<pattern len>')";
59  sigmatch_table[DETECT_STARTS_WITH].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#startswith";
60  sigmatch_table[DETECT_STARTS_WITH].Setup = DetectStartsWithSetup;
62 }
63 
64 static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, const char *depthstr)
65 {
66  const char *str = depthstr;
67  SigMatch *pm = NULL;
68  int ret = -1;
69 
70  /* retrive the sm to apply the depth against */
72  if (pm == NULL) {
74  "preceding content, uricontent option, http_client_body, "
75  "http_server_body, http_header option, http_raw_header option, "
76  "http_method option, http_cookie, http_raw_uri, "
77  "http_stat_msg, http_stat_code, http_user_agent, "
78  "http_host, http_raw_host or "
79  "file_data/dce_stub_data sticky buffer options.");
80  goto end;
81  }
82 
83  /* verify other conditions. */
85 
86  if (cd->flags & DETECT_CONTENT_DEPTH) {
87  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple depths for the same content.");
88  goto end;
89  }
91  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
92  "keyword like within/distance with a absolute "
93  "relative keyword like depth/offset for the same "
94  "content." );
95  goto end;
96  }
98  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
99  "negated keyword set along with 'fast_pattern'.");
100  goto end;
101  }
103  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
104  "keyword set along with 'fast_pattern:only;'.");
105  goto end;
106  }
107  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
108  SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
109  if (bed_sm == NULL) {
110  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
111  "seen in depth - %s.", str);
112  goto end;
113  }
114  cd->depth = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
116  } else {
117  if (ByteExtractStringUint16(&cd->depth, 0, 0, str) != (int)strlen(str))
118  {
120  "invalid value for depth: %s.", str);
121  goto end;
122  }
123 
124  if (cd->depth < cd->content_len) {
125  SCLogError(SC_ERR_INVALID_SIGNATURE, "depth:%u smaller than "
126  "content of len %u.", cd->depth, cd->content_len);
127  return -1;
128  }
129  /* Now update the real limit, as depth is relative to the offset */
130  cd->depth += cd->offset;
131  }
133 
134  ret = 0;
135  end:
136  return ret;
137 }
138 
139 static int DetectStartsWithSetup (DetectEngineCtx *de_ctx, Signature *s, const char *unused)
140 {
141  SigMatch *pm = NULL;
142  int ret = -1;
143 
144  /* retrieve the sm to apply the depth against */
146  if (pm == NULL) {
147  SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "startswith needs a "
148  "preceding content option.");
149  goto end;
150  }
151 
152  /* verify other conditions. */
154 
155  if (cd->flags & DETECT_CONTENT_DEPTH) {
156  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple "
157  "depth/startswith settings for the same content.");
158  goto end;
159  }
160  if ((cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_DISTANCE)) {
161  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
162  "keyword like within/distance with a absolute "
163  "relative keyword like depth/offset for the same "
164  "content.");
165  goto end;
166  }
168  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
169  "negated keyword set along with a 'fast_pattern'.");
170  goto end;
171  }
173  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
174  "keyword set along with 'fast_pattern:only;'.");
175  goto end;
176  }
177  if (cd->flags & DETECT_CONTENT_OFFSET) {
178  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't mix offset "
179  "with startswith.");
180  goto end;
181  }
182 
183  cd->depth = cd->content_len;
186 
187  ret = 0;
188  end:
189  return ret;
190 }
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1431
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1170
#define DETECT_CONTENT_FAST_PATTERN
void DetectDepthRegister(void)
Definition: detect-depth.c:47
#define DETECT_CONTENT_DISTANCE
const char * name
Definition: detect.h:1184
Signature container.
Definition: detect.h:514
#define DETECT_CONTENT_DEPTH
main detection engine ctx
Definition: detect.h:743
int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:264
#define str(s)
void(* Free)(void *)
Definition: detect.h:1175
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_FAST_PATTERN_ONLY
const char * desc
Definition: detect.h:1186
SigMatch * DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)
Lookup the SigMatch for a named byte_extract variable.
SigMatchCtx * ctx
Definition: detect.h:326
#define DETECT_CONTENT_NEGATED
#define SIGMATCH_NOOPT
Definition: detect.h:1354
int(* Match)(ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1153
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us. ...
Definition: detect-parse.c:407
const char * url
Definition: detect.h:1187
#define DETECT_CONTENT_WITHIN
#define DOC_URL
Definition: suricata.h:86
Holds data related to byte_extract keyword.
#define DOC_VERSION
Definition: suricata.h:91
uint16_t flags
Definition: detect.h:1178
#define DETECT_CONTENT_DEPTH_BE
#define DETECT_CONTENT_OFFSET
void(* RegisterTests)(void)
Definition: detect.h:1176
a single match condition for a signature
Definition: detect.h:323