suricata
detect-depth.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the depth keyword.
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-content.h"
34 #include "detect-uricontent.h"
35 #include "detect-byte.h"
36 #include "detect-byte-extract.h"
37 #include "detect-depth.h"
38 
39 #include "flow-var.h"
40 #include "app-layer.h"
41 
42 #include "util-byte.h"
43 #include "util-debug.h"
44 
45 static int DetectDepthSetup (DetectEngineCtx *, Signature *, const char *);
46 static int DetectStartsWithSetup (DetectEngineCtx *, Signature *, const char *);
47 
49 {
50  sigmatch_table[DETECT_DEPTH].name = "depth";
51  sigmatch_table[DETECT_DEPTH].desc = "designate how many bytes from the beginning of the payload will be checked";
52  sigmatch_table[DETECT_DEPTH].url = "/rules/payload-keywords.html#depth";
54  sigmatch_table[DETECT_DEPTH].Setup = DetectDepthSetup;
56 
57  sigmatch_table[DETECT_STARTS_WITH].name = "startswith";
58  sigmatch_table[DETECT_STARTS_WITH].desc = "pattern must be at the start of a buffer (same as 'depth:<pattern len>')";
59  sigmatch_table[DETECT_STARTS_WITH].url = "/rules/payload-keywords.html#startswith";
60  sigmatch_table[DETECT_STARTS_WITH].Setup = DetectStartsWithSetup;
62 }
63 
64 static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, const char *depthstr)
65 {
66  const char *str = depthstr;
67  SigMatch *pm = NULL;
68  int ret = -1;
69 
70  /* retrive the sm to apply the depth against */
72  if (pm == NULL) {
74  "preceding content, uricontent option, http_client_body, "
75  "http_server_body, http_header option, http_raw_header option, "
76  "http_method option, http_cookie, http_raw_uri, "
77  "http_stat_msg, http_stat_code, http_user_agent, "
78  "http_host, http_raw_host or "
79  "file_data/dce_stub_data sticky buffer options.");
80  goto end;
81  }
82 
83  /* verify other conditions. */
85 
86  if (cd->flags & DETECT_CONTENT_DEPTH) {
87  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple depths for the same content.");
88  goto end;
89  }
91  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
92  "keyword like within/distance with a absolute "
93  "relative keyword like depth/offset for the same "
94  "content." );
95  goto end;
96  }
98  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
99  "negated keyword set along with 'fast_pattern'.");
100  goto end;
101  }
103  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
104  "keyword set along with 'fast_pattern:only;'.");
105  goto end;
106  }
107  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
108  DetectByteIndexType index;
109  if (!DetectByteRetrieveSMVar(str, s, &index)) {
110  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
111  "seen in depth - %s.", str);
112  goto end;
113  }
114  cd->depth = index;
116  } else {
117  if (StringParseUint16(&cd->depth, 0, 0, str) < 0)
118  {
120  "invalid value for depth: %s.", str);
121  goto end;
122  }
123 
124  if (cd->depth < cd->content_len) {
125  SCLogError(SC_ERR_INVALID_SIGNATURE, "depth:%u smaller than "
126  "content of len %u.", cd->depth, cd->content_len);
127  return -1;
128  }
129  /* Now update the real limit, as depth is relative to the offset */
130  cd->depth += cd->offset;
131  }
133 
134  ret = 0;
135  end:
136  return ret;
137 }
138 
139 static int DetectStartsWithSetup (DetectEngineCtx *de_ctx, Signature *s, const char *unused)
140 {
141  SigMatch *pm = NULL;
142  int ret = -1;
143 
144  /* retrieve the sm to apply the depth against */
146  if (pm == NULL) {
147  SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "startswith needs a "
148  "preceding content option.");
149  goto end;
150  }
151 
152  /* verify other conditions. */
154 
155  if (cd->flags & DETECT_CONTENT_DEPTH) {
156  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple "
157  "depth/startswith settings for the same content.");
158  goto end;
159  }
160  if ((cd->flags & DETECT_CONTENT_WITHIN) || (cd->flags & DETECT_CONTENT_DISTANCE)) {
161  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
162  "keyword like within/distance with a absolute "
163  "relative keyword like depth/offset for the same "
164  "content.");
165  goto end;
166  }
168  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
169  "negated keyword set along with a 'fast_pattern'.");
170  goto end;
171  }
173  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
174  "keyword set along with 'fast_pattern:only;'.");
175  goto end;
176  }
177  if (cd->flags & DETECT_CONTENT_OFFSET) {
178  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't mix offset "
179  "with startswith.");
180  goto end;
181  }
182 
183  cd->depth = cd->content_len;
186 
187  ret = 0;
188  end:
189  return ret;
190 }
DETECT_DEPTH
@ DETECT_DEPTH
Definition: detect-engine-register.h:62
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:100
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1214
detect-content.h
StringParseUint16
int StringParseUint16(uint16_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:336
SigTableElmt_::desc
const char * desc
Definition: detect.h:1213
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1201
SigTableElmt_::name
const char * name
Definition: detect.h:1211
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:59
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1205
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
DETECT_CONTENT_DEPTH_VAR
#define DETECT_CONTENT_DEPTH_VAR
Definition: detect-content.h:46
DetectContentData_
Definition: detect-content.h:86
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
detect-depth.h
DetectByteIndexType
uint8_t DetectByteIndexType
Definition: detect-byte.h:26
SC_ERR_DEPTH_MISSING_CONTENT
@ SC_ERR_DEPTH_MISSING_CONTENT
Definition: util-error.h:138
decode.h
util-debug.h
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
detect.h
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:99
DetectDepthRegister
void DetectDepthRegister(void)
Definition: detect-depth.c:48
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1179
detect-byte.h
DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_STARTS_WITH
Definition: detect-content.h:59
DetectByteRetrieveSMVar
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index)
Used to retrieve args from BM.
Definition: detect-byte.c:39
suricata-common.h
detect-byte-extract.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
str
#define str(s)
Definition: suricata-common.h:273
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DETECT_STARTS_WITH
@ DETECT_STARTS_WITH
Definition: detect-engine-register.h:63
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:88
detect-uricontent.h
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1380
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:468
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
flow-var.h
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
app-layer.h