51 #define PARSE_REGEX "\\s*(any|src|dst|both)\\s*,\\s*([A-Za-z0-9\\-\\_]+)\\s*,\\s*(\\<|\\>|\\=)\\s*,\\s*([0-9]+)\\s*" 52 static pcre *parse_regex;
53 static pcre_extra *parse_regex_study;
76 static uint8_t GetHostRepSrc(
Packet *p, uint8_t cat, uint32_t
version)
97 if (h->
iprep == NULL) {
115 static uint8_t GetHostRepDst(
Packet *p, uint8_t cat, uint32_t
version)
137 if (h->
iprep == NULL) {
155 static inline int RepMatch(uint8_t op, uint8_t val1, uint8_t val2)
185 val = GetHostRepSrc(p, rd->
cat, version);
189 if (RepMatch(rd->
op, val, rd->
val) == 1)
192 val = GetHostRepDst(p, rd->
cat, version);
196 return RepMatch(rd->
op, val, rd->
val);
201 val = GetHostRepSrc(p, rd->
cat, version);
202 SCLogDebug(
"checking src -- val %u (looking for cat %u, val %u)", val, rd->
cat, rd->
val);
206 return RepMatch(rd->
op, val, rd->
val);
212 val = GetHostRepDst(p, rd->
cat, version);
216 return RepMatch(rd->
op, val, rd->
val);
221 val = GetHostRepSrc(p, rd->
cat, version);
224 if (val == 0 || RepMatch(rd->
op, val, rd->
val) == 0)
226 val = GetHostRepDst(p, rd->
cat, version);
230 return RepMatch(rd->
op, val, rd->
val);
242 char *cmd_str = NULL, *name = NULL, *op_str = NULL, *value = NULL;
244 #define MAX_SUBSTRINGS 30 245 int ret = 0,
res = 0;
248 ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov,
MAX_SUBSTRINGS);
260 cmd_str = (
char *)str_ptr;
267 name = (
char *)str_ptr;
274 op_str = (
char *)str_ptr;
281 value = (
char *)str_ptr;
283 if (strcmp(cmd_str,
"any") == 0) {
285 }
else if (strcmp(cmd_str,
"both") == 0) {
287 }
else if (strcmp(cmd_str,
"src") == 0) {
289 }
else if (strcmp(cmd_str,
"dst") == 0) {
306 if (op_str == NULL || strlen(op_str) != 1) {
325 if (value != NULL && strlen(value) > 0) {
326 int ival = atoi(value);
327 if (ival < 0 || ival > 127)
342 pcre_free_substring(name);
344 pcre_free_substring(cmd_str);
346 pcre_free_substring(op_str);
348 pcre_free_substring(value);
366 pcre_free_substring(name);
368 pcre_free_substring(cmd_str);
370 pcre_free_substring(op_str);
372 pcre_free_substring(value);
391 static FILE *DetectIPRepGenerateCategoriesDummy(
void)
394 const char *buffer =
"1,BadHosts,Know bad hosts";
396 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
403 static FILE *DetectIPRepGenerateCategoriesDummy2(
void)
407 "1,BadHosts,Know bad hosts\n" 408 "2,GoodHosts,Know good hosts\n";
410 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
417 static FILE *DetectIPRepGenerateNetworksDummy(
void)
420 const char *buffer =
"10.0.0.0/24,1,20";
422 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
429 static FILE *DetectIPRepGenerateNetworksDummy2(
void)
434 "192.168.0.0/16,2,127";
436 fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
443 static int DetectIPRepTest01(
void)
449 int result = 0, r = 0;
454 memset(&th_v, 0,
sizeof(th_v));
456 if (de_ctx == NULL || p == NULL)
465 fd = DetectIPRepGenerateCategoriesDummy();
471 fd = DetectIPRepGenerateNetworksDummy();
477 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1;rev:1;)");
505 static int DetectIPRepTest02(
void)
511 int result = 0, r = 0;
516 memset(&th_v, 0,
sizeof(th_v));
518 if (de_ctx == NULL || p == NULL)
527 fd = DetectIPRepGenerateCategoriesDummy();
533 fd = DetectIPRepGenerateNetworksDummy();
539 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:src,BadHosts,>,1; sid:1; rev:1;)");
567 static int DetectIPRepTest03(
void)
573 int result = 0, r = 0;
578 memset(&th_v, 0,
sizeof(th_v));
580 if (de_ctx == NULL || p == NULL)
589 fd = DetectIPRepGenerateCategoriesDummy();
595 fd = DetectIPRepGenerateNetworksDummy();
601 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:dst,BadHosts,>,1; sid:1; rev:1;)");
629 static int DetectIPRepTest04(
void)
635 int result = 0, r = 0;
640 memset(&th_v, 0,
sizeof(th_v));
642 if (de_ctx == NULL || p == NULL)
652 fd = DetectIPRepGenerateCategoriesDummy();
658 fd = DetectIPRepGenerateNetworksDummy();
664 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:both,BadHosts,>,1; sid:1; rev:1;)");
692 static int DetectIPRepTest05(
void)
698 int result = 0, r = 0;
703 memset(&th_v, 0,
sizeof(th_v));
705 if (de_ctx == NULL || p == NULL)
714 fd = DetectIPRepGenerateCategoriesDummy();
720 fd = DetectIPRepGenerateNetworksDummy();
726 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
754 static int DetectIPRepTest06(
void)
760 int result = 0, r = 0;
765 memset(&th_v, 0,
sizeof(th_v));
767 if (de_ctx == NULL || p == NULL)
776 fd = DetectIPRepGenerateCategoriesDummy();
782 fd = DetectIPRepGenerateNetworksDummy();
788 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
816 static int DetectIPRepTest07(
void)
822 int result = 0, r = 0;
827 memset(&th_v, 0,
sizeof(th_v));
829 if (de_ctx == NULL || p == NULL)
838 fd = DetectIPRepGenerateCategoriesDummy();
844 fd = DetectIPRepGenerateNetworksDummy();
850 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
878 static int DetectIPRepTest08(
void)
884 int result = 0, r = 0;
889 memset(&th_v, 0,
sizeof(th_v));
891 if (de_ctx == NULL || p == NULL)
901 fd = DetectIPRepGenerateCategoriesDummy();
907 fd = DetectIPRepGenerateNetworksDummy();
913 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"IPREP High value badhost\"; iprep:any,BadHosts,>,1; sid:1; rev:1;)");
941 static int DetectIPRepTest09(
void)
947 int result = 0, r = 0;
952 memset(&th_v, 0,
sizeof(th_v));
954 if (de_ctx == NULL || p == NULL)
964 fd = DetectIPRepGenerateCategoriesDummy2();
970 fd = DetectIPRepGenerateNetworksDummy2();
976 sig = de_ctx->
sig_list =
SigInit(de_ctx,
"alert tcp any any -> any any (msg:\"test\"; iprep:src,BadHosts,>,9; sid:1; rev:1;)");
void HostShutdown(void)
shutdown the flow engine
#define PKT_HOST_DST_LOOKED_UP
int SRepInit(DetectEngineCtx *de_ctx)
init reputation
void HostRelease(Host *h)
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
void IPRepRegisterTests(void)
this function registers unit tests for IPRep
#define PACKET_TEST_ACTION(p, a)
#define DETECT_IPREP_OP_LT
Signature * SigInit(DetectEngineCtx *, const char *)
Parses a signature and adds it to the Detection Engine Context.
uint32_t UTHSetIPv4Address(const char *str)
return the uint32_t for a ipv4 address string
uint8_t SRepCIDRGetIPRepSrc(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
#define DETECT_IPREP_CMD_BOTH
void SigCleanSignatures(DetectEngineCtx *de_ctx)
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
main detection engine ctx
void HostInitConfig(char quiet)
initialize the configuration
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
void DetectIPRepRegister(void)
uint8_t rep[SREP_MAX_CATS]
#define DETECT_IPREP_CMD_SRC
#define DETECT_IPREP_OP_GT
Data structures and function prototypes for keeping state for the detection engine.
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
void DetectSetupParseRegexes(const char *parse_str, pcre **parse_regex, pcre_extra **parse_regex_study)
int SRepLoadFileFromFD(SRepCIDRTree *cidr_ctx, FILE *fp)
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
int SigGroupCleanup(DetectEngineCtx *de_ctx)
#define PKT_HOST_SRC_LOOKED_UP
#define DETECT_IPREP_CMD_ANY
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
int SRepLoadCatFileFromFD(FILE *fp)
void DetectIPRepFree(void *)
SRepCIDRTree * srepCIDR_ctx
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself...
#define HostReference(dst_h_ptr, h)
#define DETECT_IPREP_OP_EQ
#define SIGMATCH_IPONLY_COMPAT
uint8_t SRepCIDRGetIPRepDst(SRepCIDRTree *cidr_ctx, Packet *p, uint8_t cat, uint32_t version)
uint8_t SRepCatGetByShortname(char *shortname)
SigMatch * SigMatchAlloc(void)
Per thread variable structure.
Host * HostLookupHostFromHash(Address *a)
look up a host in the hash
void SRepResetVersion(void)
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
void(* RegisterTests)(void)
a single match condition for a signature
#define DETECT_IPREP_CMD_DST
DetectEngineCtx * DetectEngineCtxInit(void)