64 SCLogError(
"no libmagic support built in, needed for filemagic keyword");
82 typedef struct DetectFilemagicThreadData {
84 } DetectFilemagicThreadData;
86 typedef struct DetectFilemagicData {
91 } DetectFilemagicData;
97 static void DetectFilemagicRegisterTests(
void);
100 static int g_file_match_list_id = 0;
103 static int g_file_magic_buffer_id = 0;
109 void *alstate,
void *txv, uint64_t tx_id);
111 static int g_magic_thread_ctx_id = -1;
143 for (
int i = 0; protos_ts[i] != 0; i++) {
146 DetectEngineInspectFilemagic, NULL);
149 PrefilterMpmFilemagicRegister, NULL, protos_ts[i],
152 for (
int i = 0; protos_tc[i] != 0; i++) {
155 DetectEngineInspectFilemagic, NULL);
158 PrefilterMpmFilemagicRegister, NULL, protos_tc[i],
167 SCLogDebug(
"registering filemagic rule option");
171 #define FILEMAGIC_MIN_SIZE 512
181 int FilemagicThreadLookup(magic_t *ctx,
File *file)
183 if (ctx == NULL || file == NULL ||
FileDataSize(file) == 0) {
187 const uint8_t *data = NULL;
188 uint32_t data_len = 0;
192 &data, &data_len, &
offset);
195 file->magic = MagicThreadLookup(ctx, data, data_len);
197 file->magic = MagicThreadLookup(ctx, data, data_len);
222 DetectFilemagicData *filemagic = (DetectFilemagicData *)
m;
224 DetectFilemagicThreadData *tfilemagic =
226 if (tfilemagic == NULL) {
230 if (file->magic == NULL) {
231 FilemagicThreadLookup(&tfilemagic->ctx, file);
234 if (file->magic != NULL) {
239 if (
BoyerMooreNocase(filemagic->name, filemagic->len, (uint8_t *)file->magic,
240 strlen(file->magic) + 1, filemagic->bm_ctx) != NULL)
244 char *name =
SCMalloc(filemagic->len + 1);
246 memcpy(name, filemagic->name, filemagic->len);
247 name[filemagic->len] =
'\0';
248 SCLogDebug(
"will look for filemagic %s", name);
277 DetectFilemagicData *filemagic = NULL;
280 filemagic =
SCMalloc(
sizeof(DetectFilemagicData));
284 memset(filemagic, 0x00,
sizeof(DetectFilemagicData));
291 if (filemagic->bm_ctx == NULL) {
306 char *name =
SCMalloc(filemagic->len + 1);
308 memcpy(name, filemagic->name, filemagic->len);
309 name[filemagic->len] =
'\0';
310 SCLogDebug(
"will look for filemagic %s", name);
319 if (filemagic != NULL)
320 DetectFilemagicFree(
de_ctx, filemagic);
324 static void *DetectFilemagicThreadInit(
void *data )
326 DetectFilemagicThreadData *t =
SCCalloc(1,
sizeof(DetectFilemagicThreadData));
332 t->ctx = MagicInitContext();
345 static void DetectFilemagicThreadFree(
void *ctx)
348 DetectFilemagicThreadData *t = (DetectFilemagicThreadData *)ctx;
371 if (filemagic == NULL)
375 de_ctx,
"filemagic", DetectFilemagicThreadInit, NULL, DetectFilemagicThreadFree, 1);
376 if (g_magic_thread_ctx_id == -1)
386 sm->
ctx = (
void *)filemagic;
394 DetectFilemagicFree(
de_ctx, filemagic);
408 DetectFilemagicData *filemagic = (DetectFilemagicData *)ptr;
409 if (filemagic->bm_ctx != NULL) {
412 if (filemagic->name != NULL)
434 if (g_magic_thread_ctx_id == -1) {
436 DetectFilemagicThreadInit, NULL,
437 DetectFilemagicThreadFree, 1);
438 if (g_magic_thread_ctx_id == -1)
446 int list_id,
int local_file_id)
456 if (cur_file->magic == NULL) {
457 DetectFilemagicThreadData *tfilemagic =
459 if (tfilemagic == NULL) {
464 FilemagicThreadLookup(&tfilemagic->ctx, cur_file);
466 if (cur_file->magic == NULL) {
470 const uint8_t *data = (
const uint8_t *)cur_file->magic;
471 uint32_t data_len = (uint32_t)strlen(cur_file->magic);
480 void *alstate,
void *txv, uint64_t tx_id)
494 int local_file_id = 0;
495 for (
File *file = ffc->
head; file != NULL; file = file->
next) {
497 det_ctx, transforms, f,
flags, file, engine->
sm_list, local_file_id);
520 typedef struct PrefilterMpmFilemagic {
524 } PrefilterMpmFilemagic;
539 if (!AppLayerParserHasFilesInDir(txd,
flags))
542 const PrefilterMpmFilemagic *ctx = (
const PrefilterMpmFilemagic *)pectx;
543 const MpmCtx *mpm_ctx = ctx->mpm_ctx;
544 const int list_id = ctx->list_id;
549 int local_file_id = 0;
550 for (
File *file = ffc->
head; file != NULL; file = file->
next) {
552 det_ctx, ctx->transforms, f,
flags, file, list_id, local_file_id);
567 static void PrefilterMpmFilemagicFree(
void *ptr)
575 PrefilterMpmFilemagic *pectx =
SCCalloc(1,
sizeof(*pectx));
578 pectx->list_id = list_id;
579 pectx->mpm_ctx = mpm_ctx;
583 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
584 pectx, PrefilterMpmFilemagicFree, mpm_reg->
pname);
591 static int DetectFilemagicTestParse01 (
void)
593 DetectFilemagicData *dnd = DetectFilemagicParse(NULL,
"secret.pdf",
false);
595 DetectFilemagicFree(NULL, dnd);
602 static int DetectFilemagicTestParse02 (
void)
604 DetectFilemagicData *dnd = DetectFilemagicParse(NULL,
"backup.tar.gz",
false);
607 FAIL_IF_NOT(memcmp(dnd->name,
"backup.tar.gz", 13) == 0);
608 DetectFilemagicFree(NULL, dnd);
615 static int DetectFilemagicTestParse03 (
void)
617 DetectFilemagicData *dnd = DetectFilemagicParse(NULL,
"cmd.exe",
false);
621 DetectFilemagicFree(NULL, dnd);
628 void DetectFilemagicRegisterTests(
void)
630 UtRegisterTest(
"DetectFilemagicTestParse01", DetectFilemagicTestParse01);
631 UtRegisterTest(
"DetectFilemagicTestParse02", DetectFilemagicTestParse02);
632 UtRegisterTest(
"DetectFilemagicTestParse03", DetectFilemagicTestParse03);