suricata
detect-within.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the within keyword
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-engine.h"
33 #include "detect-parse.h"
34 #include "detect-content.h"
35 #include "detect-uricontent.h"
36 #include "detect-bytejump.h"
37 #include "detect-byte-extract.h"
38 #include "app-layer.h"
39 
40 #include "flow-var.h"
41 
42 #include "util-byte.h"
43 #include "util-debug.h"
44 #include "detect-pcre.h"
45 #include "detect-within.h"
46 #include "util-unittest.h"
47 
48 static int DetectWithinSetup(DetectEngineCtx *, Signature *, const char *);
49 void DetectWithinRegisterTests(void);
50 
52 {
53  sigmatch_table[DETECT_WITHIN].name = "within";
54  sigmatch_table[DETECT_WITHIN].desc = "indicate that this content match has to be within a certain distance of the previous content keyword match";
55  sigmatch_table[DETECT_WITHIN].url = "/rules/payload-keywords.html#within";
57  sigmatch_table[DETECT_WITHIN].Setup = DetectWithinSetup;
60 }
61 
62 /** \brief Setup within pattern (content/uricontent) modifier.
63  *
64  * \todo apply to uricontent
65  *
66  * \retval 0 ok
67  * \retval -1 error, sig needs to be invalidated
68  */
69 static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *withinstr)
70 {
71  const char *str = withinstr;
72  SigMatch *pm = NULL;
73  int ret = -1;
74 
75  /* retrieve the sm to apply the within against */
77  if (pm == NULL) {
79  "preceding content option");
80  goto end;
81  }
82 
83  /* verify other conditions */
85  if (cd->flags & DETECT_CONTENT_WITHIN) {
86  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple withins for the same content.");
87  goto end;
88  }
89  if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) {
90  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
91  "keyword like within/distance with a absolute "
92  "relative keyword like depth/offset for the same "
93  "content." );
94  goto end;
95  }
97  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
98  "negated keyword set along with a fast_pattern");
99  goto end;
100  }
102  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
103  "keyword set along with a fast_pattern:only;");
104  goto end;
105  }
106  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
108  if (bed_sm == NULL) {
109  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
110  "seen in within - %s\n", str);
111  goto end;
112  }
113  cd->within = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
115  } else {
116  if (StringParseInt32(&cd->within, 0, 0, str) < 0) {
118  "invalid value for within: %s", str);
119  goto end;
120  }
121 
122  if (cd->within < (int32_t)cd->content_len) {
123  SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is "
124  "less than the content length \"%"PRIu32"\" which is invalid, since "
125  "this will never match. Invalidating signature", cd->within,
126  cd->content_len);
127  goto end;
128  }
129  }
131 
132  /* these are the only ones against which we set a flag. We have other
133  * relative keywords like byttest, isdataat, bytejump, but we don't
134  * set a flag against them */
135  SigMatch *prev_pm = DetectGetLastSMByListPtr(s, pm->prev,
137  if (prev_pm == NULL) {
138  ret = 0;
139  goto end;
140  }
141  if (prev_pm->type == DETECT_CONTENT) {
142  DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx;
143  if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
144  SCLogError(SC_ERR_INVALID_SIGNATURE, "previous keyword "
145  "has a fast_pattern:only; set. Can't "
146  "have relative keywords around a fast_pattern "
147  "only content");
148  goto end;
149  }
150  prev_cd->flags |= DETECT_CONTENT_WITHIN_NEXT;
151  } else if (prev_pm->type == DETECT_PCRE) {
152  DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;
154  }
155 
156  ret = 0;
157  end:
158  return ret;
159 }
160 
161 /***********************************Unittests**********************************/
162 
163 #ifdef UNITTESTS
164 #include "util-unittest-helper.h"
165  /**
166  * \test DetectWithinTestPacket01 is a test to check matches of
167  * within, if the previous keyword is pcre (bug 145)
168  */
169 static int DetectWithinTestPacket01 (void)
170 {
171  uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0"
172  "User-Agent: Wget/1.11.4"
173  "Accept: */*"
174  "Host: www.google.com"
175  "Connection: Keep-Alive"
176  "Date: Mon, 04 Jan 2010 17:29:39 GMT";
177  uint16_t buflen = strlen((char *)buf);
178 
179  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
180  FAIL_IF_NULL(p);
181 
182  char sig[] = "alert tcp any any -> any any (msg:\"pcre with within "
183  "modifier\"; pcre:\"/AllWorkAndNoPlayMakesWillADullBoy/\";"
184  " content:\"HTTP\"; within:5; sid:49; rev:1;)";
185  int result = UTHPacketMatchSig(p, sig);
186  FAIL_IF_NOT(result == 1);
187 
188  UTHFreePacket(p);
189  PASS;
190 }
191 
192 
193 static int DetectWithinTestPacket02 (void)
194 {
195  uint8_t *buf = (uint8_t *)"Zero Five Ten Fourteen";
196  uint16_t buflen = strlen((char *)buf);
197 
198  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
199  FAIL_IF_NULL(p);
200 
201  char sig[] = "alert tcp any any -> any any (msg:\"pcre with within "
202  "modifier\"; content:\"Five\"; content:\"Ten\"; within:3; distance:1; sid:1;)";
203 
204  int result = UTHPacketMatchSig(p, sig);
205  FAIL_IF_NOT(result == 1);
206 
207  UTHFreePacket(p);
208  PASS;
209 }
210 
211 static int DetectWithinTestVarSetup(void)
212 {
213  char sig[] = "alert tcp any any -> any any ( "
214  "msg:\"test rule\"; "
215  "content:\"abc\"; "
216  "http_client_body; "
217  "byte_extract:2,0,somevar,relative; "
218  "content:\"def\"; "
219  "within:somevar; "
220  "http_client_body; "
221  "sid:4; rev:1;)";
222 
225 
227  FAIL_IF_NULL(s);
228 
230  PASS;
231 }
232 
233 #endif /* UNITTESTS */
234 
236 {
237  #ifdef UNITTESTS
238  UtRegisterTest("DetectWithinTestPacket01", DetectWithinTestPacket01);
239  UtRegisterTest("DetectWithinTestPacket02", DetectWithinTestPacket02);
240  UtRegisterTest("DetectWithinTestVarSetup", DetectWithinTestVarSetup);
241  #endif /* UNITTESTS */
242 }
util-byte.h
SigTableElmt_::url
const char * url
Definition: detect.h:1212
SigMatch_::prev
struct SigMatch_ * prev
Definition: detect.h:324
detect-content.h
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1211
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1200
SigTableElmt_::name
const char * name
Definition: detect.h:1209
DetectContentData_::within
int32_t within
Definition: detect-content.h:102
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:59
SC_ERR_OFFSET_MISSING_CONTENT
@ SC_ERR_OFFSET_MISSING_CONTENT
Definition: util-error.h:137
DetectByteExtractData_
Holds data related to byte_extract keyword.
Definition: detect-byte-extract.h:43
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:766
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
StringParseInt32
int StringParseInt32(int32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:613
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2089
UTHPacketMatchSig
int UTHPacketMatchSig(Packet *p, const char *sig)
Definition: util-unittest-helper.c:881
DetectGetLastSMByListPtr
SigMatch * DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list,...)
Returns the sm with the largest index (added last) from the list passed to us as a pointer.
Definition: detect-parse.c:508
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:336
DetectContentData_
Definition: detect-content.h:86
DetectPcreData_::flags
uint16_t flags
Definition: detect-pcre.h:48
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1195
detect-pcre.h
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectWithinRegister
void DetectWithinRegister(void)
Definition: detect-within.c:51
DETECT_CONTENT_DEPTH
#define DETECT_CONTENT_DEPTH
Definition: detect-content.h:33
detect.h
DETECT_CONTENT_NEGATED
#define DETECT_CONTENT_NEGATED
Definition: detect-content.h:40
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:322
Packet_
Definition: decode.h:411
detect-bytejump.h
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:97
DETECT_CONTENT_WITHIN_BE
#define DETECT_CONTENT_WITHIN_BE
Definition: detect-content.h:48
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1178
DetectByteExtractRetrieveSMVar
SigMatch * DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)
Lookup the SigMatch for a named byte_extract variable.
Definition: detect-byte-extract.c:645
DETECT_PCRE
@ DETECT_PCRE
Definition: detect-engine-register.h:61
SigMatch_::type
uint8_t type
Definition: detect.h:320
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2338
suricata-common.h
detect-byte-extract.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
DETECT_CONTENT_WITHIN_NEXT
#define DETECT_CONTENT_WITHIN_NEXT
Definition: detect-content.h:57
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
str
#define str(s)
Definition: suricata-common.h:273
detect-within.h
DetectWithinRegisterTests
void DetectWithinRegisterTests(void)
Definition: detect-within.c:235
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:484
DETECT_CONTENT_OFFSET
#define DETECT_CONTENT_OFFSET
Definition: detect-content.h:32
DETECT_CONTENT_FAST_PATTERN_ONLY
#define DETECT_CONTENT_FAST_PATTERN_ONLY
Definition: detect-content.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:527
SigMatch_
a single match condition for a signature
Definition: detect.h:319
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2044
DETECT_PCRE_RELATIVE_NEXT
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:34
SC_ERR_WITHIN_INVALID
@ SC_ERR_WITHIN_INVALID
Definition: util-error.h:136
DetectPcreData_
Definition: detect-pcre.h:39
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:88
detect-uricontent.h
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:468
DETECT_CONTENT_FAST_PATTERN
#define DETECT_CONTENT_FAST_PATTERN
Definition: detect-content.h:34
DETECT_WITHIN
@ DETECT_WITHIN
Definition: detect-engine-register.h:66
flow-var.h
DETECT_CONTENT_WITHIN
#define DETECT_CONTENT_WITHIN
Definition: detect-content.h:31
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1201
app-layer.h