suricata
detect-offset.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the offset keyword.
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-parse.h"
33 #include "detect-content.h"
34 #include "detect-uricontent.h"
35 #include "detect-byte.h"
36 #include "detect-byte-extract.h"
37 #include "detect-offset.h"
38 
39 #include "flow-var.h"
40 
41 #include "util-byte.h"
42 #include "util-debug.h"
43 
44 static int DetectOffsetSetup(DetectEngineCtx *, Signature *, const char *);
45 
47 {
48  sigmatch_table[DETECT_OFFSET].name = "offset";
49  sigmatch_table[DETECT_OFFSET].desc = "designate from which byte in the payload will be checked to find a match";
50  sigmatch_table[DETECT_OFFSET].url = "/rules/payload-keywords.html#offset";
51  sigmatch_table[DETECT_OFFSET].Setup = DetectOffsetSetup;
52 }
53 
54 int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *offsetstr)
55 {
56  const char *str = offsetstr;
57  SigMatch *pm = NULL;
58  int ret = -1;
59 
60  /* retrive the sm to apply the offset against */
62  if (pm == NULL) {
64  "preceding content option.");
65  goto end;
66  }
67 
68  /* verify other conditions */
70 
72  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use offset with startswith.");
73  goto end;
74  }
75  if (cd->flags & DETECT_CONTENT_OFFSET) {
76  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple offsets for the same content.");
77  goto end;
78  }
80  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
81  "keyword like within/distance with a absolute "
82  "relative keyword like depth/offset for the same "
83  "content." );
84  goto end;
85  }
87  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
88  "negated keyword set along with 'fast_pattern'.");
89  goto end;
90  }
92  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
93  "keyword set along with 'fast_pattern:only;'.");
94  goto end;
95  }
96  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
97  DetectByteIndexType index;
98  if (!DetectByteRetrieveSMVar(str, s, &index)) {
99  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
100  "seen in offset - %s.", str);
101  goto end;
102  }
103  cd->offset = index;
105  } else {
106  if (StringParseUint16(&cd->offset, 0, 0, str) < 0)
107  {
108  SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid value for offset: %s.", str);
109  goto end;
110  }
111  if (cd->depth != 0) {
112  if (cd->depth < cd->content_len) {
113  SCLogDebug("depth increased to %"PRIu32" to match pattern len",
114  cd->content_len);
115  cd->depth = cd->content_len;
116  }
117  /* Updating the depth as is relative to the offset */
118  cd->depth += cd->offset;
119  }
120  }
122 
123  ret = 0;
124  end:
125  return ret;
126 }
127 
DetectContentData_::offset
uint16_t offset
Definition: detect-content.h:100
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1215
detect-content.h
StringParseUint16
int StringParseUint16(uint16_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:336
SigTableElmt_::desc
const char * desc
Definition: detect.h:1214
SigTableElmt_::name
const char * name
Definition: detect.h:1212
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:60
SC_ERR_OFFSET_MISSING_CONTENT
@ SC_ERR_OFFSET_MISSING_CONTENT
Definition: util-error.h:137
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
DetectContentData_
Definition: detect-content.h:86
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1197
DetectByteIndexType
uint8_t DetectByteIndexType
Definition: detect-byte.h:26
decode.h
util-debug.h
DETECT_CONTENT_DISTANCE
#define DETECT_CONTENT_DISTANCE
Definition: detect-content.h:30
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
detect.h
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
DetectContentData_::depth
uint16_t depth
Definition: detect-content.h:99
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
detect-byte.h
detect-offset.h
DetectOffsetRegister
void DetectOffsetRegister(void)
Definition: detect-offset.c:46
DETECT_CONTENT_STARTS_WITH
#define DETECT_CONTENT_STARTS_WITH
Definition: detect-content.h:59
DetectByteRetrieveSMVar
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index)
Used to retrieve args from BM.
Definition: detect-byte.c:39
suricata-common.h
detect-byte-extract.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
str
#define str(s)
Definition: suricata-common.h:273
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
DETECT_OFFSET
@ DETECT_OFFSET
Definition: detect-engine-register.h:68
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:88
detect-uricontent.h
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:468
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
flow-var.h
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
DETECT_CONTENT_OFFSET_VAR
#define DETECT_CONTENT_OFFSET_VAR
Definition: detect-content.h:45