suricata
detect-filesize.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements the filesize keyword
24  */
25 
26 #include "suricata-common.h"
27 #include "app-layer-protos.h"
28 #include "app-layer-htp.h"
29 #include "util-unittest.h"
30 #include "util-unittest-helper.h"
31 #include "util-misc.h"
32 
33 #include "detect.h"
34 #include "detect-parse.h"
35 #include "detect-engine.h"
36 #include "detect-engine-state.h"
37 #include "detect-engine-uint.h"
38 #include "detect-engine-build.h"
39 
40 #include "detect-filesize.h"
41 #include "util-debug.h"
42 #include "util-byte.h"
43 #include "flow-util.h"
44 #include "stream-tcp.h"
45 
46 
47 /*prototypes*/
48 static int DetectFilesizeMatch (DetectEngineThreadCtx *det_ctx, Flow *f,
49  uint8_t flags, File *file, const Signature *s, const SigMatchCtx *m);
50 static int DetectFilesizeSetup (DetectEngineCtx *, Signature *, const char *);
51 static void DetectFilesizeFree (DetectEngineCtx *, void *);
52 #ifdef UNITTESTS
53 static void DetectFilesizeRegisterTests (void);
54 #endif
55 static int g_file_match_list_id = 0;
56 
57 /**
58  * \brief Registration function for filesize: keyword
59  */
60 
62 {
63  sigmatch_table[DETECT_FILESIZE].name = "filesize";
64  sigmatch_table[DETECT_FILESIZE].desc = "match on the size of the file as it is being transferred";
65  sigmatch_table[DETECT_FILESIZE].url = "/rules/file-keywords.html#filesize";
66  sigmatch_table[DETECT_FILESIZE].FileMatch = DetectFilesizeMatch;
67  sigmatch_table[DETECT_FILESIZE].Setup = DetectFilesizeSetup;
68  sigmatch_table[DETECT_FILESIZE].Free = DetectFilesizeFree;
69 #ifdef UNITTESTS
70  sigmatch_table[DETECT_FILESIZE].RegisterTests = DetectFilesizeRegisterTests;
71 #endif
72 
73  g_file_match_list_id = DetectBufferTypeRegister("files");
74 }
75 
76 /**
77  * \brief This function is used to match filesize rule option.
78  *
79  * \param t thread local vars
80  * \param det_ctx pattern matcher thread local data
81  * \param f *LOCKED* flow
82  * \param flags direction flags
83  * \param file file being inspected
84  * \param s signature being inspected
85  * \param m sigmatch that we will cast into DetectU64Data
86  *
87  * \retval 0 no match
88  * \retval 1 match
89  */
90 static int DetectFilesizeMatch (DetectEngineThreadCtx *det_ctx, Flow *f,
91  uint8_t flags, File *file, const Signature *s, const SigMatchCtx *m)
92 {
93  SCEnter();
94 
95  DetectU64Data *fsd = (DetectU64Data *)m;
96  int ret = 0;
97  uint64_t file_size = FileTrackedSize(file);
98 
99  SCLogDebug("file size %" PRIu64 ", check %" PRIu64, file_size, fsd->arg1);
100 
101  if (file->state == FILE_STATE_CLOSED) {
102  return DetectU64Match(file_size, fsd);
103  /* truncated, error: only see if what we have meets the GT condition */
104  } else if (file->state > FILE_STATE_CLOSED) {
105  if (fsd->mode == DETECT_UINT_GT || fsd->mode == DETECT_UINT_GTE) {
106  ret = DetectU64Match(file_size, fsd);
107  }
108  }
109  SCReturnInt(ret);
110 }
111 
112 /**
113  * \brief this function is used to parse filesize data into the current signature
114  *
115  * \param de_ctx pointer to the Detection Engine Context
116  * \param s pointer to the Current Signature
117  * \param str pointer to the user provided options
118  *
119  * \retval 0 on Success
120  * \retval -1 on Failure
121  */
122 static int DetectFilesizeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
123 {
124  SCEnter();
125  DetectU64Data *fsd = NULL;
126 
127  fsd = DetectU64Parse(str);
128  if (fsd == NULL)
129  goto error;
130 
132  de_ctx, s, DETECT_FILESIZE, (SigMatchCtx *)fsd, g_file_match_list_id) == NULL) {
133  goto error;
134  }
135 
137  SCReturnInt(0);
138 
139 error:
140  if (fsd != NULL)
141  DetectFilesizeFree(de_ctx, fsd);
142  SCReturnInt(-1);
143 }
144 
145 /**
146  * \brief this function will free memory associated with DetectU64Data
147  *
148  * \param ptr pointer to DetectU64Data
149  */
150 static void DetectFilesizeFree(DetectEngineCtx *de_ctx, void *ptr)
151 {
152  rs_detect_u64_free(ptr);
153 }
154 
155 #ifdef UNITTESTS
156 #include "stream.h"
157 #include "stream-tcp-private.h"
158 #include "stream-tcp-reassemble.h"
159 #include "detect-engine-mpm.h"
160 #include "app-layer-parser.h"
161 
162 /** \test Test the Filesize keyword setup */
163 static int DetectFilesizeParseTest01(void)
164 {
165  DetectU64Data *fsd = DetectU64Parse("10");
166  FAIL_IF_NULL(fsd);
167  FAIL_IF_NOT(fsd->arg1 == 10);
168  FAIL_IF_NOT(fsd->mode == DETECT_UINT_EQ);
169  DetectFilesizeFree(NULL, fsd);
170 
171  PASS;
172 }
173 
174 /** \test Test the Filesize keyword setup */
175 static int DetectFilesizeParseTest02(void)
176 {
177  DetectU64Data *fsd = DetectU64Parse(" < 10 ");
178  FAIL_IF_NULL(fsd);
179  FAIL_IF_NOT(fsd->arg1 == 10);
180  FAIL_IF_NOT(fsd->mode == DETECT_UINT_LT);
181  DetectFilesizeFree(NULL, fsd);
182 
183  PASS;
184 }
185 
186 /** \test Test the Filesize keyword setup */
187 static int DetectFilesizeParseTest03(void)
188 {
189  DetectU64Data *fsd = DetectU64Parse(" > 10 ");
190  FAIL_IF_NULL(fsd);
191  FAIL_IF_NOT(fsd->arg1 == 10);
192  FAIL_IF_NOT(fsd->mode == DETECT_UINT_GT);
193  DetectFilesizeFree(NULL, fsd);
194 
195  PASS;
196 }
197 
198 /** \test Test the Filesize keyword setup */
199 static int DetectFilesizeParseTest04(void)
200 {
201  DetectU64Data *fsd = DetectU64Parse(" 5 <> 10 ");
202  FAIL_IF_NULL(fsd);
203  FAIL_IF_NOT(fsd->arg1 == 5);
204  FAIL_IF_NOT(fsd->arg2 == 10);
205  FAIL_IF_NOT(fsd->mode == DETECT_UINT_RA);
206  DetectFilesizeFree(NULL, fsd);
207 
208  PASS;
209 }
210 
211 /** \test Test the Filesize keyword setup */
212 static int DetectFilesizeParseTest05(void)
213 {
214  DetectU64Data *fsd = DetectU64Parse("5<>10");
215  FAIL_IF_NULL(fsd);
216  FAIL_IF_NOT(fsd->arg1 == 5);
217  FAIL_IF_NOT(fsd->arg2 == 10);
218  FAIL_IF_NOT(fsd->mode == DETECT_UINT_RA);
219  DetectFilesizeFree(NULL, fsd);
220 
221  PASS;
222 }
223 
224 /**
225  * \brief this function is used to initialize the detection engine context and
226  * setup the signature with passed values.
227  *
228  */
229 
230 static int DetectFilesizeInitTest(
231  DetectEngineCtx **de_ctx, Signature **sig, DetectU64Data **fsd, const char *str)
232 {
233  char fullstr[1024];
234  *de_ctx = NULL;
235 
237  (*de_ctx)->flags |= DE_QUIET;
238  FAIL_IF_NULL((*de_ctx));
239 
240  *sig = NULL;
241 
242  FAIL_IF(snprintf(fullstr, 1024,
243  "alert http any any -> any any (msg:\"Filesize "
244  "test\"; filesize:%s; sid:1;)",
245  str) >= 1024);
246 
247  Signature *s = DetectEngineAppendSig(*de_ctx, fullstr);
248  FAIL_IF_NULL(s);
249 
250  *sig = (*de_ctx)->sig_list;
251 
252  *fsd = DetectU64Parse(str);
253 
254  PASS;
255 }
256 
257 /**
258  * \test DetectFilesizeSetpTest01 is a test for setting up an valid filesize values
259  * with valid "<>" operator and include spaces arround the given values.
260  * In the test the values are setup with initializing the detection engine
261  * context and setting up the signature itself.
262  */
263 
264 static int DetectFilesizeSetpTest01(void)
265 {
266 
267  DetectU64Data *fsd = NULL;
268  uint8_t res = 0;
269  Signature *sig = NULL;
270  DetectEngineCtx *de_ctx = NULL;
271 
272  res = DetectFilesizeInitTest(&de_ctx, &sig, &fsd, "1 <> 3 ");
273  FAIL_IF(res == 0);
274 
275  FAIL_IF_NULL(fsd);
276  FAIL_IF_NOT(fsd->arg1 == 1);
277  FAIL_IF_NOT(fsd->arg2 == 3);
278  FAIL_IF_NOT(fsd->mode == DETECT_UINT_RA);
279 
280  DetectFilesizeFree(NULL, fsd);
282 
283  PASS;
284 }
285 
286 /**
287  * \brief this function registers unit tests for DetectFilesize
288  */
289 void DetectFilesizeRegisterTests(void)
290 {
291  UtRegisterTest("DetectFilesizeParseTest01", DetectFilesizeParseTest01);
292  UtRegisterTest("DetectFilesizeParseTest02", DetectFilesizeParseTest02);
293  UtRegisterTest("DetectFilesizeParseTest03", DetectFilesizeParseTest03);
294  UtRegisterTest("DetectFilesizeParseTest04", DetectFilesizeParseTest04);
295  UtRegisterTest("DetectFilesizeParseTest05", DetectFilesizeParseTest05);
296  UtRegisterTest("DetectFilesizeSetpTest01", DetectFilesizeSetpTest01);
297 }
298 #endif /* UNITTESTS */
util-byte.h
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1296
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1295
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1283
flow-util.h
SigTableElmt_::name
const char * name
Definition: detect.h:1293
stream-tcp.h
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_UINT_LT
#define DETECT_UINT_LT
Definition: detect-engine-uint.h:37
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Flow_
Flow data structure.
Definition: flow.h:351
SigTableElmt_::FileMatch
int(* FileMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, File *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1269
File_::state
FileState state
Definition: util-file.h:82
DetectFilesizeRegister
void DetectFilesizeRegister(void)
Registration function for filesize: keyword.
Definition: detect-filesize.c:61
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2533
DETECT_UINT_EQ
#define DETECT_UINT_EQ
Definition: detect-engine-uint.h:35
DE_QUIET
#define DE_QUIET
Definition: detect.h:321
stream-tcp-reassemble.h
m
SCMutex m
Definition: flow-hash.h:6
DETECT_UINT_GT
#define DETECT_UINT_GT
Definition: detect-engine-uint.h:32
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2620
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1278
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
DETECT_FILESIZE
@ DETECT_FILESIZE
Definition: detect-engine-register.h:225
app-layer-htp.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1092
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
FileTrackedSize
uint64_t FileTrackedSize(const File *file)
get the size of the file
Definition: util-file.c:343
app-layer-parser.h
stream.h
detect-engine-build.h
DETECT_UINT_GTE
#define DETECT_UINT_GTE
Definition: detect-engine-uint.h:33
stream-tcp-private.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:342
FILE_STATE_CLOSED
@ FILE_STATE_CLOSED
Definition: util-file.h:71
File_
Definition: util-file.h:79
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1008
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
Signature_::file_flags
uint8_t file_flags
Definition: detect.h:609
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
DetectU64Parse
DetectUintData_u64 * DetectU64Parse(const char *u64str)
Definition: detect-engine-uint.c:147
str
#define str(s)
Definition: suricata-common.h:291
DetectU64Data
DetectUintData_u64 DetectU64Data
Definition: detect-engine-uint.h:40
detect-parse.h
Signature_
Signature container.
Definition: detect.h:593
DetectU64Match
int DetectU64Match(const uint64_t parg, const DetectUintData_u64 *du64)
Definition: detect-engine-uint.c:142
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2494
detect-filesize.h
app-layer-protos.h
FILE_SIG_NEED_FILE
#define FILE_SIG_NEED_FILE
Definition: detect.h:311
SigMatchAppendSMToList
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:447
util-misc.h
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
DETECT_UINT_RA
#define DETECT_UINT_RA
Definition: detect-engine-uint.h:34
FILE_SIG_NEED_SIZE
#define FILE_SIG_NEED_SIZE
Definition: detect.h:318
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1285