42 #define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"
45 #if defined OS_WIN32 || defined __CYGWIN__
46 #define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "\\\\classification.config"
48 #define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/classification.config"
51 static pcre2_code *regex = NULL;
52 static pcre2_match_data *regex_match = NULL;
56 void *data2, uint16_t datalen2);
61 const char *classtype,
const char *classtype_desc,
int priority);
70 regex = pcre2_compile(
73 PCRE2_UCHAR errbuffer[256];
74 pcre2_get_error_message(en, errbuffer,
sizeof(errbuffer));
80 regex_match = pcre2_match_data_create_from_pattern(regex, NULL);
87 pcre2_code_free(regex);
90 if (regex_match != NULL) {
91 pcre2_match_data_free(regex_match);
131 const char *filename = SCClassConfGetConfFilename(
de_ctx);
132 if ( (fd = fopen(filename,
"r")) == NULL) {
137 SCLogWarning(
"could not open: \"%s\": %s", filename, strerror(errno));
157 const char *log_filename = NULL;
160 char config_value[256];
161 snprintf(config_value,
sizeof(config_value),
166 if (
ConfGet(config_value, &log_filename) != 1) {
167 if (
ConfGet(
"classification-file", &log_filename) != 1) {
172 if (
ConfGet(
"classification-file", &log_filename) != 1) {
208 static char *SCClassConfStringToLowercase(
const char *
str)
210 char *new_str = NULL;
211 char *temp_str = NULL;
219 while (*temp_str !=
'\0') {
220 *temp_str =
u8_tolower((
unsigned char)*temp_str);
242 char ct_priority_str[16];
243 uint32_t ct_priority = 0;
244 uint16_t ct_id = index;
251 ret = pcre2_match(regex, (PCRE2_SPTR8)rawstr, strlen(rawstr), 0, 0, regex_match, NULL);
254 "classification.config file %s: \"%s\"",
255 SCClassConfGetConfFilename(
de_ctx), rawstr);
259 size_t copylen =
sizeof(ct_name);
261 ret = pcre2_substring_copy_bynumber(regex_match, 1, (PCRE2_UCHAR8 *)ct_name, ©len);
263 SCLogInfo(
"pcre2_substring_copy_bynumber() failed");
268 copylen =
sizeof(ct_desc);
269 ret = pcre2_substring_copy_bynumber(regex_match, 2, (PCRE2_UCHAR8 *)ct_desc, ©len);
271 SCLogInfo(
"pcre2_substring_copy_bynumber() failed");
276 copylen =
sizeof(ct_priority_str);
277 ret = pcre2_substring_copy_bynumber(regex_match, 3, (PCRE2_UCHAR8 *)ct_priority_str, ©len);
279 SCLogInfo(
"pcre2_substring_copy_bynumber() failed");
287 ct_new = SCClassConfAllocClasstype(ct_id, ct_name, ct_desc, ct_priority);
294 if (ct_lookup == NULL) {
298 SCLogDebug(
"Duplicate classtype found inside classification.config");
322 static int SCClassConfIsLineBlankOrComment(
char *line)
324 while (*line !=
'\0') {
330 if (!isspace((
unsigned char)*line))
352 while (fgets(line,
sizeof(line), fd) != NULL) {
353 if (SCClassConfIsLineBlankOrComment(line))
364 SCLogInfo(
"Added \"%d\" classification types from the classification file",
384 const char *classtype,
385 const char *classtype_desc,
390 if (classtype == NULL)
397 if ((ct->
classtype = SCClassConfStringToLowercase(classtype)) == NULL) {
398 SCClassConfDeAllocClasstype(ct);
402 if (classtype_desc != NULL &&
406 SCClassConfDeAllocClasstype(ct);
455 for (i = 0; i <
len; i++)
477 void *data2, uint16_t datalen2)
484 if (ct1 == NULL || ct2 == NULL)
494 SCLogDebug(
"Match found inside Classification-Config hash function");
509 SCClassConfDeAllocClasstype(ch);
528 fd = SCClassConfInitContextAndLocalResources(
de_ctx, fd);
535 SCLogError(
"please check the \"classification-file\" "
536 "option in your suricata.yaml file");
541 if (!SCClassConfParseFile(
de_ctx, fd)) {
542 SCLogWarning(
"Error loading classification configuration from %s",
543 SCClassConfGetConfFilename(
de_ctx));
547 SCClassConfDeInitLocalResources(
de_ctx, fd);
566 char name[strlen(ct_name) + 1];
568 for (s = 0; s < strlen(ct_name); s++)
569 name[s] =
u8_tolower((
unsigned char)ct_name[s]);
575 return lookup_ct_info;
592 "config classification: nothing-wrong,Nothing Wrong With Us,3\n"
593 "config classification: unknown,Unknown are we,3\n"
594 "config classification: bad-unknown,We think it's bad, 2\n";
596 FILE *fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
598 SCLogDebug(
"Error with SCFmemopen() called by Classification Config test code");
612 "config classification: not-suspicious,Not Suspicious Traffic,3\n"
613 "onfig classification: unknown,Unknown Traffic,3\n"
614 "config classification: _badunknown,Potentially Bad Traffic, 2\n"
615 "config classification: bamboola1,Unknown Traffic,3\n"
616 "config classification: misc-activity,Misc activity,-1\n"
617 "config classification: policy-violation,Potential Corporate "
618 "config classification: bamboola,Unknown Traffic,3\n";
620 FILE *fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
622 SCLogDebug(
"Error with SCFmemopen() called by Classification Config test code");
636 "conig classification: not-suspicious,Not Suspicious Traffic,3\n"
637 "onfig classification: unknown,Unknown Traffic,3\n"
638 "config classification: _badunknown,Potentially Bad Traffic, 2\n"
639 "config classification: misc-activity,Misc activity,-1\n";
641 FILE *fd =
SCFmemopen((
void *)buffer, strlen(buffer),
"r");
643 SCLogDebug(
"Error with SCFmemopen() called by Classification Config test code");
652 static int SCClassConfTest01(
void)
678 static int SCClassConfTest02(
void)
703 static int SCClassConfTest03(
void)
721 static int SCClassConfTest04(
void)
754 static int SCClassConfTest05(
void)