suricata
detect-distance.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the distance keyword
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "app-layer.h"
35 
36 #include "detect-content.h"
37 #include "detect-uricontent.h"
38 #include "detect-pcre.h"
39 #include "detect-byte.h"
40 #include "detect-byte-extract.h"
41 #include "detect-distance.h"
42 
43 #include "flow-var.h"
44 
45 #include "util-byte.h"
46 #include "util-debug.h"
47 #include "util-unittest.h"
48 #include "detect-bytejump.h"
49 #include "util-unittest-helper.h"
50 
51 static int DetectDistanceSetup(DetectEngineCtx *, Signature *, const char *);
52 #ifdef UNITTESTS
53 static void DetectDistanceRegisterTests(void);
54 #endif
55 
57 {
58  sigmatch_table[DETECT_DISTANCE].name = "distance";
59  sigmatch_table[DETECT_DISTANCE].desc = "indicates a relation between this content keyword and the content preceding it";
60  sigmatch_table[DETECT_DISTANCE].url = "/rules/payload-keywords.html#distance";
62  sigmatch_table[DETECT_DISTANCE].Setup = DetectDistanceSetup;
64 #ifdef UNITTESTS
65  sigmatch_table[DETECT_DISTANCE].RegisterTests = DetectDistanceRegisterTests;
66 #endif
67 }
68 
69 static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
70  const char *distancestr)
71 {
72  const char *str = distancestr;
73  SigMatch *pm = NULL;
74  int ret = -1;
75 
76  /* retrieve the sm to apply the distance against */
78  if (pm == NULL) {
79  SCLogError("distance needs "
80  "preceding content, uricontent option, http_client_body, "
81  "http_server_body, http_header option, http_raw_header option, "
82  "http_method option, http_cookie, http_raw_uri, "
83  "http_stat_msg, http_stat_code, http_user_agent or "
84  "file_data/dce_stub_data sticky buffer option");
85  goto end;
86  }
87 
88  /* verify other conditions */
90  if (cd->flags & DETECT_CONTENT_DISTANCE) {
91  SCLogError("can't use multiple distances for the same content.");
92  goto end;
93  }
94  if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) {
95  SCLogError("can't use a relative "
96  "keyword like within/distance with a absolute "
97  "relative keyword like depth/offset for the same "
98  "content.");
99  goto end;
100  }
102  SCLogError("can't have a relative "
103  "negated keyword set along with a fast_pattern");
104  goto end;
105  }
107  SCLogError("can't have a relative "
108  "keyword set along with a fast_pattern:only;");
109  goto end;
110  }
111  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
112  DetectByteIndexType index;
113  if (!DetectByteRetrieveSMVar(str, s, &index)) {
114  SCLogError("unknown byte_ keyword var "
115  "seen in distance - %s\n",
116  str);
117  goto end;
118  }
119  cd->distance = index;
121  } else {
122  if (StringParseInt32(&cd->distance, 0, 0, str) < 0) {
123  SCLogError("invalid value for distance: %s", str);
124  goto end;
125  }
126  }
128 
129  SigMatch *prev_pm = DetectGetLastSMByListPtr(s, pm->prev,
131  if (prev_pm == NULL) {
132  ret = 0;
133  goto end;
134  }
135  if (prev_pm->type == DETECT_CONTENT) {
136  DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx;
137  if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
138  SCLogError("previous keyword "
139  "has a fast_pattern:only; set. Can't "
140  "have relative keywords around a fast_pattern "
141  "only content");
142  goto end;
143  }
144  if ((cd->flags & DETECT_CONTENT_NEGATED) == 0) {
146  } else {
148  }
149  } else if (prev_pm->type == DETECT_PCRE) {
150  DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;
152  }
153 
154  ret = 0;
155  end:
156  return ret;
157 }
158 
159 #ifdef UNITTESTS
160 
161 static int DetectDistanceTest01(void)
162 {
164 
166 
167  de_ctx->flags |= DE_QUIET;
168 
170  "alert tcp any any -> any any (content:\"|AA BB|\"; content:\"|CC DD EE FF 00 11 22 33 "
171  "44 55 66 77 88 99 AA BB CC DD EE|\"; distance: 4; within: 19; sid:1; rev:1;)");
172  FAIL_IF_NULL(s);
173 
174  SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
175  FAIL_IF_NULL(sm);
176 
177  sm = sm->next;
178  FAIL_IF_NULL(sm);
179 
181  FAIL_IF_NULL(co);
182 
183  FAIL_IF_NOT(co->distance = 4);
184 
185  /* within needs to be 23: distance + content_len as Snort auto fixes this */
186  FAIL_IF_NOT(co->within = 19);
187 
189 
190  PASS;
191 }
192 
193 /**
194  * \test DetectDistanceTestPacket01 is a test to check matches of
195  * distance works, if the previous keyword is byte_jump and content
196  * (bug 163)
197  */
198 static int DetectDistanceTestPacket01 (void)
199 {
200  uint8_t buf[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
201  uint16_t buflen = sizeof(buf);
202  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
203 
204  FAIL_IF_NULL(p);
205  char sig[] = "alert tcp any any -> any any (msg:\"suricata test\"; "
206  "byte_jump:1,2; content:\"|00|\"; "
207  "within:1; distance:2; sid:98711212; rev:1;)";
208 
211 
212  UTHFreePacket(p);
213 
214  PASS;
215 }
216 
217 static void DetectDistanceRegisterTests(void)
218 {
219  UtRegisterTest("DetectDistanceTest01 -- distance / within mix",
220  DetectDistanceTest01);
221  UtRegisterTest("DetectDistanceTestPacket01", DetectDistanceTestPacket01);
222 }
223 #endif /* UNITTESTS */
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1241
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:64
SigMatch_::prev
struct SigMatch_ * prev
Definition: detect.h:318
detect-content.h
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:79
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1240
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1228
DETECT_CONTENT_DISTANCE_VAR
#define DETECT_CONTENT_DISTANCE_VAR
Definition: detect-content.h:47
SigTableElmt_::name
const char * name
Definition: detect.h:1238
DetectContentData_::within
int32_t within
Definition: detect-content.h:102
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:62
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2442
DE_QUIET
#define DE_QUIET
Definition: detect.h:287
UTHPacketMatchSig
int UTHPacketMatchSig(Packet *p, const char *sig)
Definition: util-unittest-helper.c:844
DetectGetLastSMByListPtr
SigMatch * DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list,...)
Returns the sm with the largest index (added last) from the list passed to us as a pointer.
Definition: detect-parse.c:514
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
DetectContentData_
Definition: detect-content.h:86
StringParseInt32
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:622
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:47
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2434
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:459
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1223
detect-pcre.h
DetectByteIndexType
uint8_t DetectByteIndexType
Definition: detect-byte.h:28
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:317
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:316
Packet_
Definition: decode.h:428
detect-bytejump.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
DETECT_CONTENT_DISTANCE_NEXT
#define DETECT_CONTENT_DISTANCE_NEXT
Definition: detect-content.h:58
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1206
detect-byte.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:228
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:64
DETECT_DISTANCE
@ DETECT_DISTANCE
Definition: detect-engine-register.h:68
DetectByteRetrieveSMVar
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index)
Used to retrieve args from BM.
Definition: detect-byte.c:39
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:314
detect-byte-extract.h
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:101
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:791
str
#define str(s)
Definition: suricata-common.h:280
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:485
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:540
SigMatch_
a single match condition for a signature
Definition: detect.h:313
DetectDistanceRegister
void DetectDistanceRegister(void)
Definition: detect-distance.c:56
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:229
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2403
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
DetectPcreData_
Definition: detect-pcre.h:42
detect-uricontent.h
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:474
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:786
detect-distance.h
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
flow-var.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1230
app-layer.h