82 static void DetectFilemagicRegisterTests(
void);
83 static void DetectFilemagicFree(
void *);
84 static int g_file_match_list_id = 0;
102 SCLogDebug(
"registering filemagic rule option");
106 #define FILEMAGIC_MIN_SIZE 512 116 int FilemagicGlobalLookup(
File *file)
122 const uint8_t *data = NULL;
123 uint32_t data_len = 0;
127 &data, &data_len, &offset);
130 file->magic = MagicGlobalLookup(data, data_len);
132 file->magic = MagicGlobalLookup(data, data_len);
147 static int FilemagicThreadLookup(magic_t *ctx,
File *file)
149 if (ctx == NULL || file == NULL ||
FileDataSize(file) == 0) {
153 const uint8_t *data = NULL;
154 uint32_t data_len = 0;
158 &data, &data_len, &offset);
161 file->magic = MagicThreadLookup(ctx, data, data_len);
163 file->magic = MagicThreadLookup(ctx, data, data_len);
188 DetectFilemagicData *filemagic = (DetectFilemagicData *)m;
191 if (tfilemagic == NULL) {
195 if (file->magic == NULL) {
196 FilemagicThreadLookup(&tfilemagic->ctx, file);
199 if (file->magic != NULL) {
204 if (
BoyerMooreNocase(filemagic->name, filemagic->len, (uint8_t *)file->magic,
205 strlen(file->magic) + 1, filemagic->bm_ctx) != NULL)
209 char *name =
SCMalloc(filemagic->len + 1);
211 memcpy(name, filemagic->name, filemagic->len);
212 name[filemagic->len] =
'\0';
213 SCLogDebug(
"will look for filemagic %s", name);
239 static DetectFilemagicData *DetectFilemagicParse (
const char *
str,
bool negate)
241 DetectFilemagicData *filemagic = NULL;
244 filemagic =
SCMalloc(
sizeof(DetectFilemagicData));
248 memset(filemagic, 0x00,
sizeof(DetectFilemagicData));
255 if (filemagic->bm_ctx == NULL) {
270 char *name =
SCMalloc(filemagic->len + 1);
272 memcpy(name, filemagic->name, filemagic->len);
273 name[filemagic->len] =
'\0';
274 SCLogDebug(
"will look for filemagic %s", name);
283 if (filemagic != NULL)
284 DetectFilemagicFree(filemagic);
288 static void *DetectFilemagicThreadInit(
void *data)
290 const char *filename = NULL;
292 DetectFilemagicData *filemagic = (DetectFilemagicData *)data;
293 BUG_ON(filemagic == NULL);
295 DetectFilemagicThreadData *t =
SCMalloc(
sizeof(DetectFilemagicThreadData));
300 memset(t, 0x00,
sizeof(DetectFilemagicThreadData));
302 t->ctx = magic_open(0);
303 if (t->ctx == NULL) {
308 (void)
ConfGet(
"magic-file", &filename);
309 if (filename != NULL) {
310 if (strlen(filename) == 0) {
312 SCLogInfo(
"using system default magic-file");
316 SCLogInfo(
"using magic-file %s", filename);
318 if ( (fd = fopen(filename,
"r")) == NULL) {
326 if (magic_load(t->ctx, filename) != 0) {
340 static void DetectFilemagicThreadFree(
void *ctx)
343 DetectFilemagicThreadData *t = (DetectFilemagicThreadData *)ctx;
363 DetectFilemagicData *filemagic = NULL;
367 if (filemagic == NULL)
371 DetectFilemagicThreadInit, (
void *)filemagic,
372 DetectFilemagicThreadFree, 1);
373 if (filemagic->thread_ctx_id == -1)
383 sm->
ctx = (
void *)filemagic;
391 if (filemagic != NULL)
392 DetectFilemagicFree(filemagic);
403 static void DetectFilemagicFree(
void *ptr)
406 DetectFilemagicData *filemagic = (DetectFilemagicData *)ptr;
407 if (filemagic->bm_ctx != NULL) {
410 if (filemagic->name != NULL)
421 static int DetectFilemagicTestParse01 (
void)
423 DetectFilemagicData *dnd = DetectFilemagicParse(
"secret.pdf",
false);
425 DetectFilemagicFree(dnd);
434 static int DetectFilemagicTestParse02 (
void)
438 DetectFilemagicData *dnd = DetectFilemagicParse(
"backup.tar.gz",
false);
440 if (dnd->len == 13 && memcmp(dnd->name,
"backup.tar.gz", 13) == 0) {
444 DetectFilemagicFree(dnd);
453 static int DetectFilemagicTestParse03 (
void)
457 DetectFilemagicData *dnd = DetectFilemagicParse(
"cmd.exe",
false);
459 if (dnd->len == 7 && memcmp(dnd->name,
"cmd.exe", 7) == 0) {
463 DetectFilemagicFree(dnd);
474 void DetectFilemagicRegisterTests(
void)
477 UtRegisterTest(
"DetectFilemagicTestParse01", DetectFilemagicTestParse01);
478 UtRegisterTest(
"DetectFilemagicTestParse02", DetectFilemagicTestParse02);
479 UtRegisterTest(
"DetectFilemagicTestParse03", DetectFilemagicTestParse03);
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
SignatureInitData * init_data
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
void * DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *det_ctx, int id)
Retrieve thread local keyword ctx by id.
uint64_t FileDataSize(const File *file)
get the size of the file data
int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen)
Parse a content string, ie "abc|DE|fgh".
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
main detection engine ctx
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
uint8_t * BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, uint32_t n, BmCtx *bm_ctx)
Boyer Moore search algorithm Is better as the pattern length increases and for big buffers to search ...
void BoyerMooreCtxDeInit(BmCtx *bmctx)
Free the memory allocated to Booyer Moore context.
int(* FileMatch)(ThreadVars *, DetectEngineThreadCtx *, Flow *, uint8_t flags, File *, const Signature *, const SigMatchCtx *)
Data structures and function prototypes for keeping state for the detection engine.
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
#define FILE_SIG_NEED_MAGIC
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define SIGMATCH_QUOTES_MANDATORY
int StreamingBufferGetData(const StreamingBuffer *sb, const uint8_t **data, uint32_t *data_len, uint64_t *stream_offset)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
#define FILE_SIG_NEED_FILE
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
int DetectBufferTypeRegister(const char *name)
int DetectRegisterThreadCtxFuncs(DetectEngineCtx *de_ctx, const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *), int mode)
Register Thread keyword context Funcs.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define DETECT_CONTENT_NEGATED
void DetectFilemagicRegister(void)
Registration function for keyword: filemagic.
BmCtx * BoyerMooreNocaseCtxInit(uint8_t *needle, uint16_t needle_len)
Setup a Booyer Moore context for nocase search.
SigMatch * SigMatchAlloc(void)
Per thread variable structure.
#define SIGMATCH_HANDLE_NEGATION
void(* RegisterTests)(void)
a single match condition for a signature