suricata
detect-distance.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the distance keyword
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "app-layer.h"
35 
36 #include "detect-content.h"
37 #include "detect-uricontent.h"
38 #include "detect-pcre.h"
39 #include "detect-byte.h"
40 #include "detect-byte-extract.h"
41 #include "detect-distance.h"
42 
43 #include "flow-var.h"
44 
45 #include "util-byte.h"
46 #include "util-debug.h"
47 #include "util-unittest.h"
48 #include "detect-bytejump.h"
49 #include "util-unittest-helper.h"
50 
51 static int DetectDistanceSetup(DetectEngineCtx *, Signature *, const char *);
52 #ifdef UNITTESTS
53 static void DetectDistanceRegisterTests(void);
54 #endif
55 
57 {
58  sigmatch_table[DETECT_DISTANCE].name = "distance";
59  sigmatch_table[DETECT_DISTANCE].desc = "indicates a relation between this content keyword and the content preceding it";
60  sigmatch_table[DETECT_DISTANCE].url = "/rules/payload-keywords.html#distance";
62  sigmatch_table[DETECT_DISTANCE].Setup = DetectDistanceSetup;
64 #ifdef UNITTESTS
65  sigmatch_table[DETECT_DISTANCE].RegisterTests = DetectDistanceRegisterTests;
66 #endif
67 }
68 
69 static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
70  const char *distancestr)
71 {
72  const char *str = distancestr;
73  SigMatch *pm = NULL;
74  int ret = -1;
75 
76  /* retrieve the sm to apply the distance against */
78  if (pm == NULL) {
79  SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "distance needs "
80  "preceding content, uricontent option, http_client_body, "
81  "http_server_body, http_header option, http_raw_header option, "
82  "http_method option, http_cookie, http_raw_uri, "
83  "http_stat_msg, http_stat_code, http_user_agent or "
84  "file_data/dce_stub_data sticky buffer option");
85  goto end;
86  }
87 
88  /* verify other conditions */
90  if (cd->flags & DETECT_CONTENT_DISTANCE) {
91  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple distances for the same content.");
92  goto end;
93  }
94  if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) {
95  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
96  "keyword like within/distance with a absolute "
97  "relative keyword like depth/offset for the same "
98  "content." );
99  goto end;
100  }
102  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
103  "negated keyword set along with a fast_pattern");
104  goto end;
105  }
107  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
108  "keyword set along with a fast_pattern:only;");
109  goto end;
110  }
111  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
112  DetectByteIndexType index;
113  if (!DetectByteRetrieveSMVar(str, s, &index)) {
114  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
115  "seen in distance - %s\n", str);
116  goto end;
117  }
118  cd->distance = index;
120  } else {
121  if (StringParseInt32(&cd->distance, 0, 0, str) < 0) {
123  "invalid value for distance: %s", str);
124  goto end;
125  }
126  }
128 
129  SigMatch *prev_pm = DetectGetLastSMByListPtr(s, pm->prev,
131  if (prev_pm == NULL) {
132  ret = 0;
133  goto end;
134  }
135  if (prev_pm->type == DETECT_CONTENT) {
136  DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx;
137  if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
138  SCLogError(SC_ERR_INVALID_SIGNATURE, "previous keyword "
139  "has a fast_pattern:only; set. Can't "
140  "have relative keywords around a fast_pattern "
141  "only content");
142  goto end;
143  }
144  if ((cd->flags & DETECT_CONTENT_NEGATED) == 0) {
146  } else {
148  }
149  } else if (prev_pm->type == DETECT_PCRE) {
150  DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;
152  }
153 
154  ret = 0;
155  end:
156  return ret;
157 }
158 
159 #ifdef UNITTESTS
160 
161 static int DetectDistanceTest01(void)
162 {
163  int result = 0;
164 
166  if (de_ctx == NULL) {
167  printf("no de_ctx: ");
168  goto end;
169  }
170 
171  de_ctx->flags |= DE_QUIET;
172 
173  de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any (content:\"|AA BB|\"; content:\"|CC DD EE FF 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE|\"; distance: 4; within: 19; sid:1; rev:1;)");
174  if (de_ctx->sig_list == NULL) {
175  printf("sig parse failed: ");
176  goto end;
177  }
178 
179  SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
180  if (sm == NULL) {
181  printf("sm NULL: ");
182  goto end;
183  }
184 
185  sm = sm->next;
186  if (sm == NULL) {
187  printf("sm2 NULL: ");
188  goto end;
189  }
190 
192  if (co == NULL) {
193  printf("co == NULL: ");
194  goto end;
195  }
196 
197  if (co->distance != 4) {
198  printf("distance %"PRIi32", expected 4: ", co->distance);
199  goto end;
200  }
201 
202  /* within needs to be 23: distance + content_len as Snort auto fixes this */
203  if (co->within != 19) {
204  printf("within %"PRIi32", expected 23: ", co->within);
205  goto end;
206  }
207 
208  result = 1;
209 end:
211  return result;
212 }
213 
214 /**
215  * \test DetectDistanceTestPacket01 is a test to check matches of
216  * distance works, if the previous keyword is byte_jump and content
217  * (bug 163)
218  */
219 static int DetectDistanceTestPacket01 (void)
220 {
221  int result = 0;
222  uint8_t buf[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
223  uint16_t buflen = sizeof(buf);
224  Packet *p;
225  p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
226 
227  if (p == NULL)
228  goto end;
229 
230  char sig[] = "alert tcp any any -> any any (msg:\"suricata test\"; "
231  "byte_jump:1,2; content:\"|00|\"; "
232  "within:1; distance:2; sid:98711212; rev:1;)";
233 
235  result = UTHPacketMatchSig(p, sig);
236 
237  UTHFreePacket(p);
238 end:
239  return result;
240 }
241 
242 static void DetectDistanceRegisterTests(void)
243 {
244  UtRegisterTest("DetectDistanceTest01 -- distance / within mix",
245  DetectDistanceTest01);
246  UtRegisterTest("DetectDistanceTestPacket01", DetectDistanceTestPacket01);
247 }
248 #endif /* UNITTESTS */
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1214
DETECT_CONTENT_RELATIVE_NEXT
#define DETECT_CONTENT_RELATIVE_NEXT
Definition: detect-content.h:64
SigMatch_::prev
struct SigMatch_ * prev
Definition: detect.h:325
detect-content.h
detect-engine.h
DETECT_SM_LIST_PMATCH
@ DETECT_SM_LIST_PMATCH
Definition: detect.h:90
SigTableElmt_::desc
const char * desc
Definition: detect.h:1213
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1201
DETECT_CONTENT_DISTANCE_VAR
#define DETECT_CONTENT_DISTANCE_VAR
Definition: detect-content.h:47
SigTableElmt_::name
const char * name
Definition: detect.h:1211
DetectContentData_::within
int32_t within
Definition: detect-content.h:102
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:59
SC_ERR_OFFSET_MISSING_CONTENT
@ SC_ERR_OFFSET_MISSING_CONTENT
Definition: util-error.h:137
SigInit
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
Definition: detect-parse.c:2056
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
StringParseInt32
int StringParseInt32(int32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:613
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2093
DE_QUIET
#define DE_QUIET
Definition: detect.h:294
UTHPacketMatchSig
int UTHPacketMatchSig(Packet *p, const char *sig)
Definition: util-unittest-helper.c:882
DetectGetLastSMByListPtr
SigMatch * DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list,...)
Returns the sm with the largest index (added last) from the list passed to us as a pointer.
Definition: detect-parse.c:508
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
DetectContentData_
Definition: detect-content.h:86
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:48
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:445
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
detect-pcre.h
DetectByteIndexType
uint8_t DetectByteIndexType
Definition: detect-byte.h:26
util-unittest.h
util-unittest-helper.h
decode.h
util-debug.h
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:324
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
Packet_
Definition: decode.h:414
detect-bytejump.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
DETECT_CONTENT_DISTANCE_NEXT
#define DETECT_CONTENT_DISTANCE_NEXT
Definition: detect-content.h:58
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1179
detect-byte.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:220
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:61
SigMatch_::type
uint8_t type
Definition: detect.h:321
DETECT_DISTANCE
@ DETECT_DISTANCE
Definition: detect-engine-register.h:65
DetectByteRetrieveSMVar
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index)
Used to retrieve args from BM.
Definition: detect-byte.c:39
suricata-common.h
detect-byte-extract.h
DetectContentData_::distance
int32_t distance
Definition: detect-content.h:101
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
DetectEngineCtx_::sig_list
Signature * sig_list
Definition: detect.h:773
str
#define str(s)
Definition: suricata-common.h:273
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:485
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DetectDistanceRegister
void DetectDistanceRegister(void)
Definition: detect-distance.c:56
FLOW_PKT_ESTABLISHED
#define FLOW_PKT_ESTABLISHED
Definition: flow.h:221
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2048
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
DetectPcreData_
Definition: detect-pcre.h:39
detect-uricontent.h
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:468
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:768
detect-distance.h
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
flow-var.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1203
app-layer.h