suricata
detect-metadata.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements metadata keyword support
24  *
25  * \todo Do we need to do anything more this is used in snort host attribute table
26  * It is also used for rule managment.
27  */
28 
29 #include "suricata-common.h"
30 #include "detect.h"
31 #include "detect-parse.h"
32 #include "detect-engine.h"
33 #include "detect-metadata.h"
34 #include "util-hash-string.h"
35 #include "util-unittest.h"
36 #include "rust.h"
37 #include "util-validate.h"
38 
39 static int DetectMetadataSetup (DetectEngineCtx *, Signature *, const char *);
40 #ifdef UNITTESTS
41 static void DetectMetadataRegisterTests(void);
42 #endif
43 
45 {
46  sigmatch_table[DETECT_METADATA].name = "metadata";
47  sigmatch_table[DETECT_METADATA].desc = "used for logging";
48  sigmatch_table[DETECT_METADATA].url = "/rules/meta.html#metadata";
50  sigmatch_table[DETECT_METADATA].Setup = DetectMetadataSetup;
52 #ifdef UNITTESTS
53  sigmatch_table[DETECT_METADATA].RegisterTests = DetectMetadataRegisterTests;
54 #endif
55 }
56 
57 /**
58  * \brief Free a Metadata object
59  */
61 {
62  SCEnter();
63 
64  SCFree(mdata);
65 
66  SCReturn;
67 }
68 
70 {
72  return 0;
73 
75  if (de_ctx->metadata_table == NULL)
76  return -1;
77  return 0;
78 }
79 
81 {
84 }
85 
86 static const char *DetectMedatataHashAdd(DetectEngineCtx *de_ctx, const char *string)
87 {
88  const char * hstring = (char *)HashTableLookup(de_ctx->metadata_table, (void *)string, strlen(string));
89  if (hstring) {
90  return hstring;
91  }
92 
93  const char *astring = SCStrdup(string);
94  if (astring == NULL) {
95  return NULL;
96  }
97 
98  if (HashTableAdd(de_ctx->metadata_table, (void *)astring, strlen(astring)) == 0) {
99  return (char *)HashTableLookup(de_ctx->metadata_table, (void *)astring, strlen(astring));
100  } else {
101  SCFree((void *)astring);
102  }
103  return NULL;
104 }
105 
106 static int SortHelper(const void *a, const void *b)
107 {
108  const DetectMetadata *ma = *(const DetectMetadata **)a;
109  const DetectMetadata *mb = *(const DetectMetadata **)b;
110  return strcasecmp(ma->key, mb->key);
111 }
112 
113 static char *CraftPreformattedJSON(const DetectMetadata *head)
114 {
115  int cnt = 0;
116  for (const DetectMetadata *m = head; m != NULL; m = m->next) {
117  cnt++;
118  }
119  if (cnt == 0)
120  return NULL;
121 
122  const DetectMetadata *array[cnt];
123  int i = 0;
124  for (const DetectMetadata *m = head; m != NULL; m = m->next) {
125  array[i++] = m;
126  }
127  BUG_ON(i != cnt);
128  qsort(array, cnt, sizeof(DetectMetadata *), SortHelper);
129 
130  JsonBuilder *js = jb_new_object();
131  if (js == NULL)
132  return NULL;
133 
134  /* array is sorted by key, so we can create a jsonbuilder object
135  * with each key appearing just once with one or more values */
136  bool array_open = false;
137  for (int j = 0; j < cnt; j++) {
138  const DetectMetadata *m = array[j];
139  const DetectMetadata *nm = j + 1 < cnt ? array[j + 1] : NULL;
140  DEBUG_VALIDATE_BUG_ON(m == NULL); // for scan-build
141 
142  if (nm && strcasecmp(m->key, nm->key) == 0) {
143  if (!array_open) {
144  jb_open_array(js, m->key);
145  array_open = true;
146  }
147  jb_append_string(js, m->value);
148  } else {
149  if (!array_open) {
150  jb_open_array(js, m->key);
151  }
152  jb_append_string(js, m->value);
153  jb_close(js);
154  array_open = false;
155  }
156  }
157  jb_close(js);
158  /* we have a complete json builder. Now store it as a C string */
159  const size_t len = jb_len(js);
160 #define MD_STR "\"metadata\":"
161 #define MD_STR_LEN (sizeof(MD_STR) - 1)
162  char *str = SCMalloc(len + MD_STR_LEN + 1);
163  if (str == NULL) {
164  jb_free(js);
165  return NULL;
166  }
167  char *ptr = str;
168  memcpy(ptr, MD_STR, MD_STR_LEN);
169  ptr += MD_STR_LEN;
170  memcpy(ptr, jb_ptr(js), len);
171  ptr += len;
172  *ptr = '\0';
173 #undef MD_STR
174 #undef MD_STR_LEN
175  jb_free(js);
176  return str;
177 }
178 
179 static int DetectMetadataParse(DetectEngineCtx *de_ctx, Signature *s, const char *metadatastr)
180 {
181  DetectMetadata *head = s->metadata ? s->metadata->list : NULL;
182  char copy[strlen(metadatastr)+1];
183  strlcpy(copy, metadatastr, sizeof(copy));
184  char *xsaveptr = NULL;
185  char *key = strtok_r(copy, ",", &xsaveptr);
186  while (key != NULL) {
187  while (*key != '\0' && isblank(*key)) {
188  key++;
189  }
190  char *val = strchr(key, ' ');
191  if (val != NULL) {
192  *val++ = '\0';
193  while (*val != '\0' && isblank(*val)) {
194  val++;
195  }
196  } else {
197  /* Skip metadata without a value. */
198  goto next;
199  }
200 
201  /* Also skip metadata if the key or value is empty. */
202  if (strlen(key) == 0 || strlen(val) == 0) {
203  goto next;
204  }
205 
206  const char *hkey = DetectMedatataHashAdd(de_ctx, key);
207  if (hkey == NULL) {
208  SCLogError(SC_ERR_MEM_ALLOC, "can't create metadata key");
209  continue;
210  }
211 
212  const char *hval = DetectMedatataHashAdd(de_ctx, val);
213  if (hval == NULL) {
214  SCLogError(SC_ERR_MEM_ALLOC, "can't create metadata value");
215  goto next;
216  }
217 
218  SCLogDebug("key: %s, value: %s", hkey, hval);
219 
220  DetectMetadata *dkv = SCMalloc(sizeof(DetectMetadata));
221  if (dkv == NULL) {
222  goto next;
223  }
224  dkv->key = hkey;
225  dkv->value = hval;
226  dkv->next = head;
227  head = dkv;
228 
229  next:
230  key = strtok_r(NULL, ",", &xsaveptr);
231  }
232  if (head != NULL) {
233  if (s->metadata == NULL) {
234  s->metadata = SCCalloc(1, sizeof(*s->metadata));
235  if (s->metadata == NULL) {
236  for (DetectMetadata *m = head; m != NULL; ) {
237  DetectMetadata *next_m = m->next;
239  m = next_m;
240  }
241  return -1;
242  }
243  }
244  s->metadata->list = head;
245  SCFree(s->metadata->json_str);
246  s->metadata->json_str = CraftPreformattedJSON(head);
247  }
248  return 0;
249 }
250 
251 static int DetectMetadataSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
252 {
254  DetectMetadataParse(de_ctx, s, rawstr);
255  }
256 
257  return 0;
258 }
259 
260 #ifdef UNITTESTS
261 
262 static int DetectMetadataParseTest01(void)
263 {
267 
269  "alert tcp any any -> any any "
270  "(metadata: toto 1; sid:1; rev:1;)");
271  FAIL_IF_NULL(sig);
272  FAIL_IF(sig->metadata);
273 
275  PASS;
276 }
277 
278 static int DetectMetadataParseTest02(void)
279 {
284  "alert tcp any any -> any any "
285  "(metadata: toto 1; "
286  "metadata: titi 2, jaivu gros_minet;"
287  "sid:1; rev:1;)");
288  FAIL_IF_NULL(sig);
289  FAIL_IF_NULL(sig->metadata);
290  FAIL_IF_NULL(sig->metadata->list);
291  FAIL_IF_NULL(sig->metadata->list->key);
292  FAIL_IF(strcmp("jaivu", sig->metadata->list->key));
293  FAIL_IF(strcmp("gros_minet", sig->metadata->list->value));
294  FAIL_IF_NULL(sig->metadata->list->next);
295  DetectMetadata *dm = sig->metadata->list->next;
296  FAIL_IF(strcmp("titi", dm->key));
297  dm = dm->next;
298  FAIL_IF_NULL(dm);
299  FAIL_IF(strcmp("toto", dm->key));
300  FAIL_IF_NOT(strcmp(sig->metadata->json_str,
301  "\"metadata\":{\"jaivu\":[\"gros_minet\"],\"titi\":[\"2\"],\"toto\":[\"1\"]}") == 0);
303  PASS;
304 }
305 
306 /**
307  * \brief this function registers unit tests for DetectCipService
308  */
309 static void DetectMetadataRegisterTests(void)
310 {
311  UtRegisterTest("DetectMetadataParseTest01", DetectMetadataParseTest01);
312  UtRegisterTest("DetectMetadataParseTest02", DetectMetadataParseTest02);
313 }
314 #endif /* UNITTESTS */
SigTableElmt_::url
const char * url
Definition: detect.h:1214
util-hash-string.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
DetectMetadataHead::json_str
char * json_str
Definition: detect-metadata.h:40
DetectMetadataFree
void DetectMetadataFree(DetectMetadata *mdata)
Free a Metadata object.
Definition: detect-metadata.c:60
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1213
DetectMetadata_::value
const char * value
Definition: detect-metadata.h:34
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1201
DetectMetadata_::key
const char * key
Definition: detect-metadata.h:32
DetectEngineMustParseMetadata
int DetectEngineMustParseMetadata(void)
Definition: detect-engine.c:4232
SigTableElmt_::name
const char * name
Definition: detect.h:1211
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
DetectMetadataHashInit
int DetectMetadataHashInit(DetectEngineCtx *de_ctx)
Definition: detect-metadata.c:69
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2093
rust.h
m
SCMutex m
Definition: flow-hash.h:6
DetectMetadataRegister
void DetectMetadataRegister(void)
Definition: detect-metadata.c:44
StringHashCompareFunc
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
Definition: util-hash-string.c:35
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
StringHashFunc
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash-string.c:22
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
HashTableFree
void HashTableFree(HashTable *ht)
Definition: util-hash.c:79
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:193
DetectMetadataHashFree
void DetectMetadataHashFree(DetectEngineCtx *de_ctx)
Definition: detect-metadata.c:80
DETECT_METADATA
@ DETECT_METADATA
Definition: detect-engine-register.h:55
detect.h
HashTableAdd
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:113
StringHashFreeFunc
void StringHashFreeFunc(void *data)
Definition: util-hash-string.c:48
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:282
DetectMetadataHead::list
DetectMetadata * list
Definition: detect-metadata.h:41
SCReturn
#define SCReturn
Definition: util-debug.h:302
MD_STR_LEN
#define MD_STR_LEN
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1179
DetectMetadata_
Signature metadata list.
Definition: detect-metadata.h:30
MD_STR
#define MD_STR
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2356
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
suricata-common.h
detect-metadata.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
util-validate.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
str
#define str(s)
Definition: suricata-common.h:273
Signature_::metadata
DetectMetadataHead * metadata
Definition: detect.h:593
head
Flow * head
Definition: flow-hash.h:1
DetectEngineUnsetParseMetadata
void DetectEngineUnsetParseMetadata(void)
Definition: detect-engine.c:4227
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DetectMetadata_::next
struct DetectMetadata_ * next
Definition: detect-metadata.h:36
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
HashTableInit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hash.c:34
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2048
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
DetectEngineSetParseMetadata
void DetectEngineSetParseMetadata(void)
Definition: detect-engine.c:4222
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DetectEngineCtx_::metadata_table
HashTable * metadata_table
Definition: detect.h:922
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1203