suricata
detect-pktvar.c
Go to the documentation of this file.
1
/* Copyright (C) 2007-2020 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
*
23
* Implements the pktvar keyword
24
*/
25
26
#include "
suricata-common.h
"
27
#include "
decode.h
"
28
29
#include "
detect.h
"
30
#include "
detect-parse.h
"
31
32
#include "
threads.h
"
33
#include "
pkt-var.h
"
34
#include "
detect-pktvar.h
"
35
#include "
detect-content.h
"
36
#include "
util-spm.h
"
37
#include "
util-debug.h
"
38
39
#define PARSE_REGEX "(.*),(.*)"
40
static
DetectParseRegex
parse_regex;
41
42
static
int
DetectPktvarMatch (
DetectEngineThreadCtx
*,
Packet
*,
43
const
Signature
*,
const
SigMatchCtx
*);
44
static
int
DetectPktvarSetup (
DetectEngineCtx
*,
Signature
*,
const
char
*);
45
static
void
DetectPktvarFree(
DetectEngineCtx
*,
void
*data);
46
47
void
DetectPktvarRegister
(
void
)
48
{
49
sigmatch_table
[
DETECT_PKTVAR
].
name
=
"pktvar"
;
50
sigmatch_table
[
DETECT_PKTVAR
].
Match
= DetectPktvarMatch;
51
sigmatch_table
[
DETECT_PKTVAR
].
Setup
= DetectPktvarSetup;
52
sigmatch_table
[
DETECT_PKTVAR
].
Free
= DetectPktvarFree;
53
54
DetectSetupParseRegexes
(
PARSE_REGEX
, &parse_regex);
55
}
56
57
/*
58
* returns 0: no match
59
* 1: match
60
* -1: error
61
*/
62
63
static
int
DetectPktvarMatch (
DetectEngineThreadCtx
*det_ctx,
Packet
*p,
64
const
Signature
*s,
const
SigMatchCtx
*ctx)
65
{
66
int
ret = 0;
67
const
DetectPktvarData
*pd = (
const
DetectPktvarData
*)ctx;
68
69
PktVar
*pv =
PktVarGet
(p, pd->
id
);
70
if
(pv != NULL) {
71
uint8_t *ptr =
SpmSearch
(pv->
value
, pv->
value_len
, pd->
content
, pd->
content_len
);
72
if
(ptr != NULL)
73
ret = 1;
74
}
75
76
return
ret;
77
}
78
79
static
void
DetectPktvarFree(
DetectEngineCtx
*
de_ctx
,
void
*ptr)
80
{
81
DetectPktvarData
*data = ptr;
82
if
(data != NULL) {
83
SCFree
(data->
content
);
84
SCFree
(data);
85
}
86
}
87
88
static
int
DetectPktvarSetup (
DetectEngineCtx
*
de_ctx
,
Signature
*s,
const
char
*rawstr)
89
{
90
char
*varname = NULL, *varcontent = NULL;
91
int
ret = 0,
res
= 0;
92
size_t
pcre2_len;
93
uint8_t *content = NULL;
94
uint16_t
len
= 0;
95
96
ret =
DetectParsePcreExec
(&parse_regex, rawstr, 0, 0);
97
if
(ret != 3) {
98
SCLogError
(
SC_ERR_PCRE_MATCH
,
"\"%s\" is not a valid setting for pktvar."
, rawstr);
99
return
-1;
100
}
101
102
const
char
*str_ptr;
103
res
= pcre2_substring_get_bynumber(parse_regex.
match
, 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
104
if
(
res
< 0) {
105
SCLogError
(
SC_ERR_PCRE_GET_SUBSTRING
,
"pcre2_substring_get_bynumber failed"
);
106
return
-1;
107
}
108
varname = (
char
*)str_ptr;
109
110
res
= pcre2_substring_get_bynumber(parse_regex.
match
, 2, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
111
if
(
res
< 0) {
112
pcre2_substring_free((PCRE2_UCHAR8 *)varname);
113
SCLogError
(
SC_ERR_PCRE_GET_SUBSTRING
,
"pcre2_substring_get_bynumber failed"
);
114
return
-1;
115
}
116
varcontent = (
char
*)str_ptr;
117
118
SCLogDebug
(
"varname '%s', varcontent '%s'"
, varname, varcontent);
119
120
char
*parse_content;
121
if
(strlen(varcontent) >= 2 && varcontent[0] ==
'"'
&&
122
varcontent[strlen(varcontent) - 1] ==
'"'
)
123
{
124
parse_content = varcontent + 1;
125
varcontent[strlen(varcontent) - 1] =
'\0'
;
126
}
else
{
127
parse_content = varcontent;
128
}
129
130
ret =
DetectContentDataParse
(
"pktvar"
, parse_content, &content, &
len
);
131
if
(ret == -1 || content == NULL) {
132
pcre2_substring_free((PCRE2_UCHAR8 *)varname);
133
pcre2_substring_free((PCRE2_UCHAR8 *)varcontent);
134
return
-1;
135
}
136
pcre2_substring_free((PCRE2_UCHAR8 *)varcontent);
137
138
DetectPktvarData
*cd =
SCCalloc
(1,
sizeof
(
DetectPktvarData
));
139
if
(
unlikely
(cd == NULL)) {
140
pcre2_substring_free((PCRE2_UCHAR8 *)varname);
141
SCFree
(content);
142
return
-1;
143
}
144
145
cd->
content
= content;
146
cd->
content_len
=
len
;
147
cd->
id
=
VarNameStoreSetupAdd
(varname,
VAR_TYPE_PKT_VAR
);
148
pcre2_substring_free((PCRE2_UCHAR8 *)varname);
149
150
/* Okay so far so good, lets get this into a SigMatch
151
* and put it in the Signature. */
152
SigMatch
*sm =
SigMatchAlloc
();
153
if
(
unlikely
(sm == NULL)) {
154
DetectPktvarFree(
de_ctx
, cd);
155
return
-1;
156
}
157
sm->
type
=
DETECT_PKTVAR
;
158
sm->
ctx
= (
SigMatchCtx
*)cd;
159
160
SigMatchAppendSMToList
(s, sm,
DETECT_SM_LIST_MATCH
);
161
return
0;
162
}
DetectParseRegex::match
pcre2_match_data * match
Definition:
detect-parse.h:45
detect-content.h
PktVarGet
PktVar * PktVarGet(Packet *p, uint32_t id)
Definition:
pkt-var.c:40
len
uint8_t len
Definition:
app-layer-dnp3.h:2
DetectParsePcreExec
int DetectParsePcreExec(DetectParseRegex *parse_regex, const char *str, int start_offset, int options)
Definition:
detect-parse.c:2474
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition:
detect.h:1257
DetectParseRegex
Definition:
detect-parse.h:42
SigTableElmt_::name
const char * name
Definition:
detect.h:1267
detect-pktvar.h
unlikely
#define unlikely(expr)
Definition:
util-optimize.h:35
DetectPktvarData_::id
uint32_t id
Definition:
detect-pktvar.h:28
SCLogDebug
#define SCLogDebug(...)
Definition:
util-debug.h:298
threads.h
DetectEngineCtx_
main detection engine ctx
Definition:
detect.h:811
SC_ERR_PCRE_GET_SUBSTRING
@ SC_ERR_PCRE_GET_SUBSTRING
Definition:
util-error.h:34
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition:
detect.h:1252
DetectPktvarData_::content
uint8_t * content
Definition:
detect-pktvar.h:31
decode.h
util-debug.h
SC_ERR_PCRE_MATCH
@ SC_ERR_PCRE_MATCH
Definition:
util-error.h:32
de_ctx
DetectEngineCtx * de_ctx
Definition:
fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition:
detect.h:1060
res
PoolThreadReserved res
Definition:
stream-tcp-private.h:0
PktVar_::value
uint8_t * value
Definition:
decode.h:337
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition:
detect-parse.c:2597
detect.h
pkt-var.h
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition:
detect.h:89
SigMatch_::ctx
SigMatchCtx * ctx
Definition:
detect.h:324
Packet_
Definition:
decode.h:427
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition:
detect.h:1235
PARSE_REGEX
#define PARSE_REGEX
Definition:
detect-pktvar.c:39
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition:
detect-parse.c:235
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition:
detect.h:316
DetectContentDataParse
int DetectContentDataParse(const char *keyword, const char *contentstr, uint8_t **pstr, uint16_t *plen)
Parse a content string, ie "abc|DE|fgh".
Definition:
detect-content.c:82
suricata-common.h
SigMatch_::type
uint16_t type
Definition:
detect.h:322
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition:
detect-parse.c:73
util-spm.h
VarNameStoreSetupAdd
uint32_t VarNameStoreSetupAdd(const char *name, const enum VarTypes type)
add to staging or return existing id if already in there
Definition:
util-var-name.c:323
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition:
util-debug.h:257
DetectPktvarData_::content_len
uint8_t content_len
Definition:
detect-pktvar.h:29
SCFree
#define SCFree(p)
Definition:
util-mem.h:61
detect-parse.h
Signature_
Signature container.
Definition:
detect.h:548
SigMatch_
a single match condition for a signature
Definition:
detect.h:321
PktVar_::value_len
uint16_t value_len
Definition:
decode.h:335
DetectPktvarRegister
void DetectPktvarRegister(void)
Definition:
detect-pktvar.c:47
PktVar_
Definition:
decode.h:329
SpmSearch
#define SpmSearch(text, textlen, needle, needlelen)
Definition:
util-spm.h:101
DetectPktvarData_
Definition:
detect-pktvar.h:27
SCCalloc
#define SCCalloc(nm, sz)
Definition:
util-mem.h:53
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition:
detect-parse.c:349
VAR_TYPE_PKT_VAR
@ VAR_TYPE_PKT_VAR
Definition:
util-var.h:32
DETECT_PKTVAR
@ DETECT_PKTVAR
Definition:
detect-engine-register.h:86
src
detect-pktvar.c
Generated on Fri May 20 2022 23:30:36 for suricata by
1.8.18