85 static void DetectFilemagicRegisterTests(
void);
88 static int g_file_match_list_id = 0;
91 static int g_file_magic_buffer_id = 0;
96 static int DetectEngineInspectFilemagic(
100 Flow *f, uint8_t
flags,
void *alstate,
void *txv, uint64_t tx_id);
102 static int g_magic_thread_ctx_id = -1;
134 for (
int i = 0; protos_ts[i] != 0; i++) {
137 DetectEngineInspectFilemagic, NULL);
140 PrefilterMpmFilemagicRegister, NULL, protos_ts[i],
143 for (
int i = 0; protos_tc[i] != 0; i++) {
146 DetectEngineInspectFilemagic, NULL);
149 PrefilterMpmFilemagicRegister, NULL, protos_tc[i],
157 SCLogDebug(
"registering filemagic rule option");
161 #define FILEMAGIC_MIN_SIZE 512
171 int FilemagicThreadLookup(magic_t *ctx,
File *file)
173 if (ctx == NULL || file == NULL ||
FileDataSize(file) == 0) {
177 const uint8_t *data = NULL;
178 uint32_t data_len = 0;
182 &data, &data_len, &
offset);
185 file->magic = MagicThreadLookup(ctx, data, data_len);
187 file->magic = MagicThreadLookup(ctx, data, data_len);
212 DetectFilemagicData *filemagic = (DetectFilemagicData *)
m;
214 DetectFilemagicThreadData *tfilemagic =
216 if (tfilemagic == NULL) {
220 if (file->magic == NULL) {
221 FilemagicThreadLookup(&tfilemagic->ctx, file);
224 if (file->magic != NULL) {
229 if (
BoyerMooreNocase(filemagic->name, filemagic->len, (uint8_t *)file->magic,
230 strlen(file->magic) + 1, filemagic->bm_ctx) != NULL)
234 char *name =
SCMalloc(filemagic->len + 1);
236 memcpy(name, filemagic->name, filemagic->len);
237 name[filemagic->len] =
'\0';
238 SCLogDebug(
"will look for filemagic %s", name);
267 DetectFilemagicData *filemagic = NULL;
270 filemagic =
SCMalloc(
sizeof(DetectFilemagicData));
274 memset(filemagic, 0x00,
sizeof(DetectFilemagicData));
281 if (filemagic->bm_ctx == NULL) {
296 char *name =
SCMalloc(filemagic->len + 1);
298 memcpy(name, filemagic->name, filemagic->len);
299 name[filemagic->len] =
'\0';
300 SCLogDebug(
"will look for filemagic %s", name);
309 if (filemagic != NULL)
310 DetectFilemagicFree(
de_ctx, filemagic);
314 static void *DetectFilemagicThreadInit(
void *data )
316 DetectFilemagicThreadData *t =
SCCalloc(1,
sizeof(DetectFilemagicThreadData));
322 t->ctx = MagicInitContext();
335 static void DetectFilemagicThreadFree(
void *ctx)
338 DetectFilemagicThreadData *t = (DetectFilemagicThreadData *)ctx;
361 if (filemagic == NULL)
365 de_ctx,
"filemagic", DetectFilemagicThreadInit, NULL, DetectFilemagicThreadFree, 1);
366 if (g_magic_thread_ctx_id == -1)
376 sm->
ctx = (
void *)filemagic;
384 DetectFilemagicFree(
de_ctx, filemagic);
398 DetectFilemagicData *filemagic = (DetectFilemagicData *)ptr;
399 if (filemagic->bm_ctx != NULL) {
402 if (filemagic->name != NULL)
424 if (g_magic_thread_ctx_id == -1) {
426 DetectFilemagicThreadInit, NULL,
427 DetectFilemagicThreadFree, 1);
428 if (g_magic_thread_ctx_id == -1)
436 Flow *f, uint8_t flow_flags,
File *cur_file,
437 int list_id,
int local_file_id,
bool first)
444 if (!first && buffer->
inspect != NULL)
447 if (cur_file->magic == NULL) {
448 DetectFilemagicThreadData *tfilemagic =
450 if (tfilemagic == NULL) {
454 FilemagicThreadLookup(&tfilemagic->ctx, cur_file);
456 if (cur_file->magic == NULL) {
460 const uint8_t *data = (
const uint8_t *)cur_file->magic;
461 uint32_t data_len = (uint32_t)strlen(cur_file->magic);
468 static int DetectEngineInspectFilemagic(
472 Flow *f, uint8_t
flags,
void *alstate,
void *txv, uint64_t tx_id)
485 int local_file_id = 0;
486 for (
File *file = ffc->
head; file != NULL; file = file->
next) {
487 if (file->
txid != tx_id)
491 transforms, f,
flags, file, engine->
sm_list, local_file_id,
false);
514 typedef struct PrefilterMpmFilemagic {
518 } PrefilterMpmFilemagic;
531 const uint64_t idx,
const uint8_t
flags)
535 const PrefilterMpmFilemagic *ctx = (
const PrefilterMpmFilemagic *)pectx;
536 const MpmCtx *mpm_ctx = ctx->mpm_ctx;
537 const int list_id = ctx->list_id;
541 int local_file_id = 0;
542 for (
File *file = ffc->
head; file != NULL; file = file->
next) {
543 if (file->
txid != idx)
547 ctx->transforms, f,
flags, file, list_id, local_file_id,
true);
561 static void PrefilterMpmFilemagicFree(
void *ptr)
570 PrefilterMpmFilemagic *pectx =
SCCalloc(1,
sizeof(*pectx));
573 pectx->list_id = list_id;
574 pectx->mpm_ctx = mpm_ctx;
578 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
579 pectx, PrefilterMpmFilemagicFree, mpm_reg->
pname);
586 static int DetectFilemagicTestParse01 (
void)
588 DetectFilemagicData *dnd = DetectFilemagicParse(NULL,
"secret.pdf",
false);
590 DetectFilemagicFree(NULL, dnd);
599 static int DetectFilemagicTestParse02 (
void)
603 DetectFilemagicData *dnd = DetectFilemagicParse(NULL,
"backup.tar.gz",
false);
605 if (dnd->len == 13 && memcmp(dnd->name,
"backup.tar.gz", 13) == 0) {
609 DetectFilemagicFree(NULL, dnd);
618 static int DetectFilemagicTestParse03 (
void)
622 DetectFilemagicData *dnd = DetectFilemagicParse(NULL,
"cmd.exe",
false);
624 if (dnd->len == 7 && memcmp(dnd->name,
"cmd.exe", 7) == 0) {
628 DetectFilemagicFree(NULL, dnd);
637 void DetectFilemagicRegisterTests(
void)
639 UtRegisterTest(
"DetectFilemagicTestParse01", DetectFilemagicTestParse01);
640 UtRegisterTest(
"DetectFilemagicTestParse02", DetectFilemagicTestParse02);
641 UtRegisterTest(
"DetectFilemagicTestParse03", DetectFilemagicTestParse03);