suricata
detect-within.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the within keyword
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-engine.h"
33 #include "detect-parse.h"
34 #include "detect-content.h"
35 #include "detect-uricontent.h"
36 #include "detect-byte.h"
37 #include "app-layer.h"
38 
39 #include "flow-var.h"
40 
41 #include "util-byte.h"
42 #include "util-debug.h"
43 #include "detect-pcre.h"
44 #include "detect-within.h"
45 #include "util-unittest.h"
46 
47 static int DetectWithinSetup(DetectEngineCtx *, Signature *, const char *);
48 #ifdef UNITTESTS
49 static void DetectWithinRegisterTests(void);
50 #endif
51 
53 {
54  sigmatch_table[DETECT_WITHIN].name = "within";
55  sigmatch_table[DETECT_WITHIN].desc = "indicate that this content match has to be within a certain distance of the previous content keyword match";
56  sigmatch_table[DETECT_WITHIN].url = "/rules/payload-keywords.html#within";
58  sigmatch_table[DETECT_WITHIN].Setup = DetectWithinSetup;
59 #ifdef UNITTESTS
60  sigmatch_table[DETECT_WITHIN].RegisterTests = DetectWithinRegisterTests;
61 #endif
62 }
63 
64 /** \brief Setup within pattern (content/uricontent) modifier.
65  *
66  * \todo apply to uricontent
67  *
68  * \retval 0 ok
69  * \retval -1 error, sig needs to be invalidated
70  */
71 static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *withinstr)
72 {
73  const char *str = withinstr;
74  SigMatch *pm = NULL;
75  int ret = -1;
76 
77  /* retrieve the sm to apply the within against */
79  if (pm == NULL) {
81  "preceding content option");
82  goto end;
83  }
84 
85  /* verify other conditions */
87  if (cd->flags & DETECT_CONTENT_WITHIN) {
88  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple withins for the same content.");
89  goto end;
90  }
91  if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) {
92  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
93  "keyword like within/distance with a absolute "
94  "relative keyword like depth/offset for the same "
95  "content." );
96  goto end;
97  }
99  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
100  "negated keyword set along with a fast_pattern");
101  goto end;
102  }
104  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
105  "keyword set along with a fast_pattern:only;");
106  goto end;
107  }
108  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
109  DetectByteIndexType index;
110  if (!DetectByteRetrieveSMVar(str, s, &index)) {
111  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_ keyword var "
112  "seen in within - %s\n", str);
113  goto end;
114  }
115  cd->within = index;
117  } else {
118  if (StringParseInt32(&cd->within, 0, 0, str) < 0) {
120  "invalid value for within: %s", str);
121  goto end;
122  }
123 
124  if (cd->within < (int32_t)cd->content_len) {
125  SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is "
126  "less than the content length \"%"PRIu32"\" which is invalid, since "
127  "this will never match. Invalidating signature", cd->within,
128  cd->content_len);
129  goto end;
130  }
131  }
133 
134  /* these are the only ones against which we set a flag. We have other
135  * relative keywords like byttest, isdataat, bytejump, but we don't
136  * set a flag against them */
137  SigMatch *prev_pm = DetectGetLastSMByListPtr(s, pm->prev,
139  if (prev_pm == NULL) {
140  ret = 0;
141  goto end;
142  }
143  if (prev_pm->type == DETECT_CONTENT) {
144  DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx;
145  if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
146  SCLogError(SC_ERR_INVALID_SIGNATURE, "previous keyword "
147  "has a fast_pattern:only; set. Can't "
148  "have relative keywords around a fast_pattern "
149  "only content");
150  goto end;
151  }
152  prev_cd->flags |= DETECT_CONTENT_WITHIN_NEXT;
153  } else if (prev_pm->type == DETECT_PCRE) {
154  DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;
156  }
157 
158  ret = 0;
159  end:
160  return ret;
161 }
162 
163 /***********************************Unittests**********************************/
164 
165 #ifdef UNITTESTS
166 #include "util-unittest-helper.h"
167  /**
168  * \test DetectWithinTestPacket01 is a test to check matches of
169  * within, if the previous keyword is pcre (bug 145)
170  */
171 static int DetectWithinTestPacket01 (void)
172 {
173  uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0"
174  "User-Agent: Wget/1.11.4"
175  "Accept: */*"
176  "Host: www.google.com"
177  "Connection: Keep-Alive"
178  "Date: Mon, 04 Jan 2010 17:29:39 GMT";
179  uint16_t buflen = strlen((char *)buf);
180 
181  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
182  FAIL_IF_NULL(p);
183 
184  char sig[] = "alert tcp any any -> any any (msg:\"pcre with within "
185  "modifier\"; pcre:\"/AllWorkAndNoPlayMakesWillADullBoy/\";"
186  " content:\"HTTP\"; within:5; sid:49; rev:1;)";
187  int result = UTHPacketMatchSig(p, sig);
188  FAIL_IF_NOT(result == 1);
189 
190  UTHFreePacket(p);
191  PASS;
192 }
193 
194 
195 static int DetectWithinTestPacket02 (void)
196 {
197  uint8_t *buf = (uint8_t *)"Zero Five Ten Fourteen";
198  uint16_t buflen = strlen((char *)buf);
199 
200  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
201  FAIL_IF_NULL(p);
202 
203  char sig[] = "alert tcp any any -> any any (msg:\"pcre with within "
204  "modifier\"; content:\"Five\"; content:\"Ten\"; within:3; distance:1; sid:1;)";
205 
206  int result = UTHPacketMatchSig(p, sig);
207  FAIL_IF_NOT(result == 1);
208 
209  UTHFreePacket(p);
210  PASS;
211 }
212 
213 static int DetectWithinTestVarSetup(void)
214 {
215  char sig[] = "alert tcp any any -> any any ( "
216  "msg:\"test rule\"; "
217  "content:\"abc\"; "
218  "http_client_body; "
219  "byte_extract:2,0,somevar,relative; "
220  "content:\"def\"; "
221  "within:somevar; "
222  "http_client_body; "
223  "sid:4; rev:1;)";
224 
227 
229  FAIL_IF_NULL(s);
230 
232  PASS;
233 }
234 
235 void DetectWithinRegisterTests(void)
236 {
237  UtRegisterTest("DetectWithinTestPacket01", DetectWithinTestPacket01);
238  UtRegisterTest("DetectWithinTestPacket02", DetectWithinTestPacket02);
239  UtRegisterTest("DetectWithinTestVarSetup", DetectWithinTestVarSetup);
240 }
241 #endif /* UNITTESTS */
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1214
SigMatch_::prev
struct SigMatch_ * prev
Definition: detect.h:325
detect-content.h
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1213
SigTableElmt_::name
const char * name
Definition: detect.h:1211
DetectContentData_::within
int32_t within
Definition: detect-content.h:102
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:59
SC_ERR_OFFSET_MISSING_CONTENT
@ SC_ERR_OFFSET_MISSING_CONTENT
Definition: util-error.h:137
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:767
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
StringParseInt32
int StringParseInt32(int32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:613
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2093
UTHPacketMatchSig
int UTHPacketMatchSig(Packet *p, const char *sig)
Definition: util-unittest-helper.c:882
DetectGetLastSMByListPtr
SigMatch * DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list,...)
Returns the sm with the largest index (added last) from the list passed to us as a pointer.
Definition: detect-parse.c:508
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
DetectContentData_
Definition: detect-content.h:86
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:48
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1196
detect-pcre.h
DetectByteIndexType
uint8_t DetectByteIndexType
Definition: detect-byte.h:26
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectWithinRegister
void DetectWithinRegister(void)
Definition: detect-within.c:52
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
detect.h
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
Packet_
Definition: decode.h:414
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1179
detect-byte.h
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:61
SigMatch_::type
uint8_t type
Definition: detect.h:321
DETECT_CONTENT_WITHIN_VAR
#define DETECT_CONTENT_WITHIN_VAR
Definition: detect-content.h:48
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2361
DetectByteRetrieveSMVar
bool DetectByteRetrieveSMVar(const char *arg, const Signature *s, DetectByteIndexType *index)
Used to retrieve args from BM.
Definition: detect-byte.c:39
suricata-common.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
DETECT_CONTENT_WITHIN_NEXT
#define DETECT_CONTENT_WITHIN_NEXT
Definition: detect-content.h:57
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
str
#define str(s)
Definition: suricata-common.h:273
detect-within.h
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:485
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:528
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2048
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
SC_ERR_WITHIN_INVALID
@ SC_ERR_WITHIN_INVALID
Definition: util-error.h:136
DetectPcreData_
Definition: detect-pcre.h:39
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:88
detect-uricontent.h
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:468
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
DETECT_WITHIN
@ DETECT_WITHIN
Definition: detect-engine-register.h:66
flow-var.h
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1203
app-layer.h