42 #define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"
45 #if defined OS_WIN32 || defined __CYGWIN__
46 #define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "\\\\classification.config"
48 #define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/classification.config"
53 void *data2, uint16_t datalen2);
58 const char *classtype,
const char *classtype_desc,
int priority);
70 PCRE2_UCHAR errbuffer[256];
71 pcre2_get_error_message(en, errbuffer,
sizeof(errbuffer));
129 const char *filename = SCClassConfGetConfFilename(
de_ctx);
130 if ( (fd = fopen(filename,
"r")) == NULL) {
135 SCLogWarning(
"could not open: \"%s\": %s", filename, strerror(errno));
155 const char *log_filename = NULL;
158 char config_value[256];
159 snprintf(config_value,
sizeof(config_value),
164 if (
ConfGet(config_value, &log_filename) != 1) {
165 if (
ConfGet(
"classification-file", &log_filename) != 1) {
170 if (
ConfGet(
"classification-file", &log_filename) != 1) {
206 static char *SCClassConfStringToLowercase(
const char *
str)
208 char *new_str = NULL;
209 char *temp_str = NULL;
217 while (*temp_str !=
'\0') {
218 *temp_str =
u8_tolower((
unsigned char)*temp_str);
240 char ct_priority_str[16];
241 uint32_t ct_priority = 0;
242 uint16_t ct_id = index;
253 "classification.config file %s: \"%s\"",
254 SCClassConfGetConfFilename(
de_ctx), rawstr);
258 size_t copylen =
sizeof(ct_name);
260 ret = pcre2_substring_copy_bynumber(
263 SCLogInfo(
"pcre2_substring_copy_bynumber() failed");
268 copylen =
sizeof(ct_desc);
269 ret = pcre2_substring_copy_bynumber(
272 SCLogInfo(
"pcre2_substring_copy_bynumber() failed");
277 copylen =
sizeof(ct_priority_str);
278 ret = pcre2_substring_copy_bynumber(
281 SCLogInfo(
"pcre2_substring_copy_bynumber() failed");
289 ct_new = SCClassConfAllocClasstype(ct_id, ct_name, ct_desc, ct_priority);
296 if (ct_lookup == NULL) {
300 SCLogDebug(
"Duplicate classtype found inside classification.config");
324 static int SCClassConfIsLineBlankOrComment(
char *line)
326 while (*line !=
'\0') {
332 if (!isspace((
unsigned char)*line))
354 while (fgets(line,
sizeof(line), fd) != NULL) {
355 if (SCClassConfIsLineBlankOrComment(line))
367 SCLogInfo(
"tenant id %d: Added \"%d\" classification types from the classification file",
370 SCLogInfo(
"Added \"%d\" classification types from the classification file",
390 const char *classtype,
391 const char *classtype_desc,
396 if (classtype == NULL)
402 if ((ct->
classtype = SCClassConfStringToLowercase(classtype)) == NULL) {
403 SCClassConfDeAllocClasstype(ct);
407 if (classtype_desc != NULL &&
411 SCClassConfDeAllocClasstype(ct);
460 for (i = 0; i <
len; i++)
482 void *data2, uint16_t datalen2)
489 if (ct1 == NULL || ct2 == NULL)
499 SCLogDebug(
"Match found inside Classification-Config hash function");
514 SCClassConfDeAllocClasstype(ch);
533 fd = SCClassConfInitContextAndLocalResources(
de_ctx, fd);
540 SCLogError(
"please check the \"classification-file\" "
541 "option in your suricata.yaml file");
546 if (!SCClassConfParseFile(
de_ctx, fd)) {
547 SCLogWarning(
"Error loading classification configuration from %s",
548 SCClassConfGetConfFilename(
de_ctx));
552 SCClassConfDeInitLocalResources(
de_ctx, fd);
571 char name[strlen(ct_name) + 1];
573 for (s = 0; s < strlen(ct_name); s++)
574 name[s] =
u8_tolower((
unsigned char)ct_name[s]);
580 return lookup_ct_info;
597 "config classification: nothing-wrong,Nothing Wrong With Us,3\n"
598 "config classification: unknown,Unknown are we,3\n"
599 "config classification: bad-unknown,We think it's bad, 2\n";
601 FILE *fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
603 SCLogDebug(
"Error with SCFmemopen() called by Classification Config test code");
617 "config classification: not-suspicious,Not Suspicious Traffic,3\n"
618 "onfig classification: unknown,Unknown Traffic,3\n"
619 "config classification: _badunknown,Potentially Bad Traffic, 2\n"
620 "config classification: bamboola1,Unknown Traffic,3\n"
621 "config classification: misc-activity,Misc activity,-1\n"
622 "config classification: policy-violation,Potential Corporate "
623 "config classification: bamboola,Unknown Traffic,3\n";
625 FILE *fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
627 SCLogDebug(
"Error with SCFmemopen() called by Classification Config test code");
641 "conig classification: not-suspicious,Not Suspicious Traffic,3\n"
642 "onfig classification: unknown,Unknown Traffic,3\n"
643 "config classification: _badunknown,Potentially Bad Traffic, 2\n"
644 "config classification: misc-activity,Misc activity,-1\n";
646 FILE *fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
648 SCLogDebug(
"Error with SCFmemopen() called by Classification Config test code");
657 static int SCClassConfTest01(
void)
683 static int SCClassConfTest02(
void)
708 static int SCClassConfTest03(
void)
726 static int SCClassConfTest04(
void)
759 static int SCClassConfTest05(
void)