suricata
detect-within.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Implements the within keyword
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "decode.h"
30 
31 #include "detect.h"
32 #include "detect-engine.h"
33 #include "detect-parse.h"
34 #include "detect-content.h"
35 #include "detect-uricontent.h"
36 #include "detect-bytejump.h"
37 #include "detect-byte-extract.h"
38 #include "app-layer.h"
39 
40 #include "flow-var.h"
41 
42 #include "util-byte.h"
43 #include "util-debug.h"
44 #include "detect-pcre.h"
45 #include "detect-within.h"
46 #include "util-unittest.h"
47 
48 static int DetectWithinSetup(DetectEngineCtx *, Signature *, const char *);
49 void DetectWithinRegisterTests(void);
50 
52 {
53  sigmatch_table[DETECT_WITHIN].name = "within";
54  sigmatch_table[DETECT_WITHIN].desc = "indicate that this content match has to be within a certain distance of the previous content keyword match";
55  sigmatch_table[DETECT_WITHIN].url = DOC_URL DOC_VERSION "/rules/payload-keywords.html#within";
57  sigmatch_table[DETECT_WITHIN].Setup = DetectWithinSetup;
60 }
61 
62 /** \brief Setup within pattern (content/uricontent) modifier.
63  *
64  * \todo apply to uricontent
65  *
66  * \retval 0 ok
67  * \retval -1 error, sig needs to be invalidated
68  */
69 static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *withinstr)
70 {
71  const char *str = withinstr;
72  SigMatch *pm = NULL;
73  int ret = -1;
74 
75  /* retrieve the sm to apply the within against */
77  if (pm == NULL) {
79  "preceding content option");
80  goto end;
81  }
82 
83  /* verify other conditions */
85  if (cd->flags & DETECT_CONTENT_WITHIN) {
86  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple withins for the same content.");
87  goto end;
88  }
89  if ((cd->flags & DETECT_CONTENT_DEPTH) || (cd->flags & DETECT_CONTENT_OFFSET)) {
90  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use a relative "
91  "keyword like within/distance with a absolute "
92  "relative keyword like depth/offset for the same "
93  "content." );
94  goto end;
95  }
97  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
98  "negated keyword set along with a fast_pattern");
99  goto end;
100  }
102  SCLogError(SC_ERR_INVALID_SIGNATURE, "can't have a relative "
103  "keyword set along with a fast_pattern:only;");
104  goto end;
105  }
106  if (str[0] != '-' && isalpha((unsigned char)str[0])) {
107  SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
108  if (bed_sm == NULL) {
109  SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
110  "seen in within - %s\n", str);
111  goto end;
112  }
113  cd->within = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
115  } else {
116  if (ByteExtractStringInt32(&cd->within, 0, 0, str) != (int)strlen(str)) {
118  "invalid value for within: %s", str);
119  goto end;
120  }
121 
122  if (cd->within < (int32_t)cd->content_len) {
123  SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is "
124  "less than the content length \"%"PRIu32"\" which is invalid, since "
125  "this will never match. Invalidating signature", cd->within,
126  cd->content_len);
127  goto end;
128  }
129  }
131 
132  /* these are the only ones against which we set a flag. We have other
133  * relative keywords like byttest, isdataat, bytejump, but we don't
134  * set a flag against them */
135  SigMatch *prev_pm = DetectGetLastSMByListPtr(s, pm->prev,
137  if (prev_pm == NULL) {
138  ret = 0;
139  goto end;
140  }
141  if (prev_pm->type == DETECT_CONTENT) {
142  DetectContentData *prev_cd = (DetectContentData *)prev_pm->ctx;
143  if (prev_cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
144  SCLogError(SC_ERR_INVALID_SIGNATURE, "previous keyword "
145  "has a fast_pattern:only; set. Can't "
146  "have relative keywords around a fast_pattern "
147  "only content");
148  goto end;
149  }
150  prev_cd->flags |= DETECT_CONTENT_WITHIN_NEXT;
151  } else if (prev_pm->type == DETECT_PCRE) {
152  DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;
154  }
155 
156  ret = 0;
157  end:
158  return ret;
159 }
160 
161 /***********************************Unittests**********************************/
162 
163 #ifdef UNITTESTS
164 #include "util-unittest-helper.h"
165  /**
166  * \test DetectWithinTestPacket01 is a test to check matches of
167  * within, if the previous keyword is pcre (bug 145)
168  */
169 static int DetectWithinTestPacket01 (void)
170 {
171  uint8_t *buf = (uint8_t *)"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0"
172  "User-Agent: Wget/1.11.4"
173  "Accept: */*"
174  "Host: www.google.com"
175  "Connection: Keep-Alive"
176  "Date: Mon, 04 Jan 2010 17:29:39 GMT";
177  uint16_t buflen = strlen((char *)buf);
178 
179  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
180  FAIL_IF_NULL(p);
181 
182  char sig[] = "alert tcp any any -> any any (msg:\"pcre with within "
183  "modifier\"; pcre:\"/AllWorkAndNoPlayMakesWillADullBoy/\";"
184  " content:\"HTTP\"; within:5; sid:49; rev:1;)";
185  int result = UTHPacketMatchSig(p, sig);
186  FAIL_IF_NOT(result == 1);
187 
188  UTHFreePacket(p);
189  PASS;
190 }
191 
192 
193 static int DetectWithinTestPacket02 (void)
194 {
195  uint8_t *buf = (uint8_t *)"Zero Five Ten Fourteen";
196  uint16_t buflen = strlen((char *)buf);
197 
198  Packet *p = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
199  FAIL_IF_NULL(p);
200 
201  char sig[] = "alert tcp any any -> any any (msg:\"pcre with within "
202  "modifier\"; content:\"Five\"; content:\"Ten\"; within:3; distance:1; sid:1;)";
203 
204  int result = UTHPacketMatchSig(p, sig);
205  FAIL_IF_NOT(result == 1);
206 
207  UTHFreePacket(p);
208  PASS;
209 }
210 
211 static int DetectWithinTestVarSetup(void)
212 {
213  char sig[] = "alert tcp any any -> any any ( "
214  "msg:\"test rule\"; "
215  "content:\"abc\"; "
216  "http_client_body; "
217  "byte_extract:2,0,somevar,relative; "
218  "content:\"def\"; "
219  "within:somevar; "
220  "http_client_body; "
221  "sid:4; rev:1;)";
222 
224  FAIL_IF_NULL(de_ctx);
225 
226  Signature *s = DetectEngineAppendSig(de_ctx, sig);
227  FAIL_IF_NULL(s);
228 
229  DetectEngineCtxFree(de_ctx);
230  PASS;
231 }
232 
233 #endif /* UNITTESTS */
234 
236 {
237  #ifdef UNITTESTS
238  UtRegisterTest("DetectWithinTestPacket01", DetectWithinTestPacket01);
239  UtRegisterTest("DetectWithinTestPacket02", DetectWithinTestPacket02);
240  UtRegisterTest("DetectWithinTestVarSetup", DetectWithinTestVarSetup);
241  #endif /* UNITTESTS */
242 }
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect.h:1403
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1146
int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:315
#define DETECT_CONTENT_FAST_PATTERN
#define PASS
Pass the test.
struct SigMatch_ * prev
Definition: detect.h:329
const char * name
Definition: detect.h:1160
Signature container.
Definition: detect.h:492
#define DETECT_CONTENT_DEPTH
uint16_t flags
Definition: detect-pcre.h:42
main detection engine ctx
Definition: detect.h:720
#define DETECT_CONTENT_WITHIN_BE
SigMatch * DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list,...)
Returns the sm with the largest index (added last) from the list passed to us as a pointer...
Definition: detect-parse.c:441
#define str(s)
void(* Free)(void *)
Definition: detect.h:1151
int UTHPacketMatchSig(Packet *p, const char *sig)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void DetectWithinRegister(void)
Definition: detect-within.c:51
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
#define DETECT_CONTENT_WITHIN_NEXT
uint8_t type
Definition: detect.h:325
#define DETECT_CONTENT_FAST_PATTERN_ONLY
const char * desc
Definition: detect.h:1162
SigMatch * DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)
Lookup the SigMatch for a named byte_extract variable.
SigMatchCtx * ctx
Definition: detect.h:327
#define DETECT_CONTENT_NEGATED
void DetectWithinRegisterTests(void)
int(* Match)(ThreadVars *, DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1129
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us. ...
Definition: detect-parse.c:401
const char * url
Definition: detect.h:1163
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself...
#define DETECT_CONTENT_WITHIN
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
#define DOC_URL
Definition: suricata.h:86
#define DETECT_PCRE_RELATIVE_NEXT
Definition: detect-pcre.h:32
Holds data related to byte_extract keyword.
#define DOC_VERSION
Definition: suricata.h:91
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
#define DETECT_CONTENT_OFFSET
void(* RegisterTests)(void)
Definition: detect.h:1152
a single match condition for a signature
Definition: detect.h:324
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
DetectEngineCtx * DetectEngineCtxInit(void)