suricata
util-rule-vars.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  *
23  * Rule variable utility functions
24  */
25 
26 #include "suricata-common.h"
27 #include "conf.h"
28 #include "conf-yaml-loader.h"
29 
30 #include "detect.h"
31 #include "detect-content.h"
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-mpm.h"
35 
36 #include "util-rule-vars.h"
37 #include "util-enum.h"
38 #include "util-debug.h"
39 
40 /** An enum-string map, that maps the different vars type in the yaml conf
41  * type with the mapping path in the yaml conf file */
42 SCEnumCharMap sc_rule_vars_type_map[ ] = {
43  { "vars.address-groups", SC_RULE_VARS_ADDRESS_GROUPS },
44  { "vars.port-groups", SC_RULE_VARS_PORT_GROUPS }
45 };
46 
47 /**
48  * \internal
49  * \brief Retrieves a value for a yaml mapping. The sequence from the yaml
50  * conf file, from which the conf value has to be retrieved can be
51  * specified by supplying a SCRuleVarsType enum. The string mapping
52  * for each of the SCRuleVarsType is present in sc_rule_vars_type_map.
53  *
54  * \param conf_var_name Pointer to a character string containing the conf var
55  * name, whose value has to be retrieved from the yaml
56  * conf file.
57  * \param conf_vars_type Holds an enum value that indicates the kind of yaml
58  * mapping that has to be retrieved. Can be one of the
59  * values in SCRuleVarsType.
60  *
61  * \retval conf_var_name_value Pointer to the string containing the conf value
62  * on success; NULL on failure.
63  */
64 const char *SCRuleVarsGetConfVar(const DetectEngineCtx *de_ctx,
65  const char *conf_var_name,
66  SCRuleVarsType conf_vars_type)
67 {
68  SCEnter();
69 
70  const char *conf_var_type_name = NULL;
71  char conf_var_full_name[2048];
72  const char *conf_var_full_name_value = NULL;
73 
74  if (conf_var_name == NULL)
75  goto end;
76 
77  while (conf_var_name[0] != '\0' && isspace((unsigned char)conf_var_name[0])) {
78  conf_var_name++;
79  }
80 
81  (conf_var_name[0] == '$') ? conf_var_name++ : conf_var_name;
82  conf_var_type_name = SCMapEnumValueToName(conf_vars_type,
83  sc_rule_vars_type_map);
84  if (conf_var_type_name == NULL)
85  goto end;
86 
87  if (de_ctx != NULL && strlen(de_ctx->config_prefix) > 0) {
88  if (snprintf(conf_var_full_name, sizeof(conf_var_full_name), "%s.%s.%s",
89  de_ctx->config_prefix, conf_var_type_name, conf_var_name) < 0) {
90  goto end;
91  }
92  } else {
93  if (snprintf(conf_var_full_name, sizeof(conf_var_full_name), "%s.%s",
94  conf_var_type_name, conf_var_name) < 0) {
95  goto end;
96  }
97  }
98 
99  if (SCConfGetNonNull(conf_var_full_name, &conf_var_full_name_value) != 1) {
100  SCLogError("Variable \"%s\" is not defined in "
101  "configuration file",
102  conf_var_name);
103  goto end;
104  }
105 
106  SCLogDebug("Value obtained from the yaml conf file, for the var "
107  "\"%s\" is \"%s\"", conf_var_name, conf_var_full_name_value);
108 
109  end:
110  SCReturnCharPtr(conf_var_full_name_value);
111 }
112 
113 
114 /**********************************Unittests***********************************/
115 #ifdef UNITTESTS
116 
117 static const char *dummy_conf_string =
118  "%YAML 1.1\n"
119  "---\n"
120  "\n"
121  "default-log-dir: /var/log/suricata\n"
122  "\n"
123  "logging:\n"
124  "\n"
125  " default-log-level: debug\n"
126  "\n"
127  " default-format: \"<%t> - <%l>\"\n"
128  "\n"
129  " default-startup-message: Your IDS has started.\n"
130  "\n"
131  " default-output-filter:\n"
132  "\n"
133  " output:\n"
134  "\n"
135  " - interface: console\n"
136  " log-level: info\n"
137  "\n"
138  " - interface: file\n"
139  " filename: /var/log/suricata.log\n"
140  "\n"
141  " - interface: syslog\n"
142  " facility: local5\n"
143  " format: \"%l\"\n"
144  "\n"
145  "pfring:\n"
146  "\n"
147  " interface: eth0\n"
148  "\n"
149  " clusterid: 99\n"
150  "\n"
151  "vars:\n"
152  "\n"
153  " address-groups:\n"
154  "\n"
155  " HOME_NET: \"[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:"
156  "13c5:5AFE::/64,2001:888:13c5:CAFE::/64]\"\n"
157  "\n"
158  " EXTERNAL_NET: \"[!192.168.0.0/16,2000::/3]\"\n"
159  "\n"
160  " HTTP_SERVERS: \"!192.168.0.0/16\"\n"
161  "\n"
162  " SMTP_SERVERS: \"!192.168.0.0/16\"\n"
163  "\n"
164  " SQL_SERVERS: \"!192.168.0.0/16\"\n"
165  "\n"
166  " DNS_SERVERS: any\n"
167  "\n"
168  " TELNET_SERVERS: any\n"
169  "\n"
170  " AIM_SERVERS: any\n"
171  "\n"
172  " port-groups:\n"
173  "\n"
174  " HTTP_PORTS: \"80:81,88\"\n"
175  "\n"
176  " SHELLCODE_PORTS: 80\n"
177  "\n"
178  " ORACLE_PORTS: 1521\n"
179  "\n"
180  " SSH_PORTS: 22\n"
181  "\n";
182 
183 /**
184  * \test Check that valid address and port group vars are correctly retrieved
185  * from the configuration.
186  */
187 static int SCRuleVarsPositiveTest01(void)
188 {
189  SCConfCreateContextBackup();
190  SCConfInit();
191  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
192 
193  /* check for address-groups */
194  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS));
195  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS),
196  "[192.168.0.0/16,10.8.0.0/16,127.0.0.1,2001:888:13c5:"
197  "5AFE::/64,2001:888:13c5:CAFE::/64]") == 0);
198  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$EXTERNAL_NET", SC_RULE_VARS_ADDRESS_GROUPS));
199  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$EXTERNAL_NET", SC_RULE_VARS_ADDRESS_GROUPS),
200  "[!192.168.0.0/16,2000::/3]") == 0);
201  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$HTTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
202  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$HTTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
203  "!192.168.0.0/16") == 0);
204  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$SMTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
205  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$SMTP_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
206  "!192.168.0.0/16") == 0);
207  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$SQL_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
208  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$SQL_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
209  "!192.168.0.0/16") == 0);
210  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$DNS_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
211  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$DNS_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
212  "any") == 0);
213  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$TELNET_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
214  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$TELNET_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
215  "any") == 0);
216  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
217  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
218  "any") == 0);
219 
220  /* Test that a leading space is stripped. */
221  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, " $AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS));
222  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, " $AIM_SERVERS", SC_RULE_VARS_ADDRESS_GROUPS),
223  "any") == 0);
224 
225  /* check for port-groups */
226  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS));
227  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS),
228  "80:81,88") == 0);
229  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$SHELLCODE_PORTS", SC_RULE_VARS_PORT_GROUPS));
230  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$SHELLCODE_PORTS", SC_RULE_VARS_PORT_GROUPS),
231  "80") == 0);
232  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$ORACLE_PORTS", SC_RULE_VARS_PORT_GROUPS));
233  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$ORACLE_PORTS", SC_RULE_VARS_PORT_GROUPS),
234  "1521") == 0);
235  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$SSH_PORTS", SC_RULE_VARS_PORT_GROUPS));
236  FAIL_IF_NOT(
237  strcmp(SCRuleVarsGetConfVar(NULL, "$SSH_PORTS", SC_RULE_VARS_PORT_GROUPS), "22") == 0);
238 
239  SCConfDeInit();
240  SCConfRestoreContextBackup();
241  PASS;
242 }
243 
244 /**
245  * \test Check that invalid address and port groups are properly handled by the
246  * API.
247  */
248 static int SCRuleVarsNegativeTest02(void)
249 {
250  SCConfCreateContextBackup();
251  SCConfInit();
252  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
253 
254  FAIL_IF_NOT_NULL(SCRuleVarsGetConfVar(NULL, "$HOME_NETW", SC_RULE_VARS_ADDRESS_GROUPS));
255  FAIL_IF_NOT_NULL(SCRuleVarsGetConfVar(NULL, "$home_net", SC_RULE_VARS_ADDRESS_GROUPS));
256  FAIL_IF_NOT_NULL(SCRuleVarsGetConfVar(NULL, "$TOMCAT_PORTSW", SC_RULE_VARS_PORT_GROUPS));
257  FAIL_IF_NOT_NULL(SCRuleVarsGetConfVar(NULL, "$tomcat_ports", SC_RULE_VARS_PORT_GROUPS));
258 
259  SCConfDeInit();
260  SCConfRestoreContextBackup();
261  PASS;
262 }
263 
264 /**
265  * \test Check that Signatures with valid address and port groups are parsed
266  * without any errors by the Signature parsing API.
267  */
268 static int SCRuleVarsPositiveTest03(void)
269 {
270  SCConfCreateContextBackup();
271  SCConfInit();
272  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
273 
274  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
275  FAIL_IF_NULL(de_ctx);
276  de_ctx->flags |= DE_QUIET;
277 
278  Signature *s = DetectEngineAppendSig(de_ctx,
279  "alert tcp [$HTTP_SERVERS,$HOME_NET,192.168.2.5] $HTTP_PORTS -> $EXTERNAL_NET "
280  "[80,[!$HTTP_PORTS,$ORACLE_PORTS]] (msg:\"Rule Vars Test\"; sid:1;)");
281  FAIL_IF_NULL(s);
282 
283  SCConfDeInit();
284  SCConfRestoreContextBackup();
285  DetectEngineCtxFree(de_ctx);
286  PASS;
287 }
288 
289 /**
290  * \test Check that Signatures with invalid address and port groups, are
291  * are invalidated by the Signature parsing API.
292  */
293 static int SCRuleVarsNegativeTest04(void)
294 {
295  SCConfCreateContextBackup();
296  SCConfInit();
297  SCConfYamlLoadString(dummy_conf_string, strlen(dummy_conf_string));
298  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
299  FAIL_IF_NULL(de_ctx);
300  de_ctx->flags |= DE_QUIET;
301 
302  Signature *s = DetectEngineAppendSig(
303  de_ctx, "alert tcp $HTTP_SERVER any -> any any (msg:\"Rule Vars Test\"; sid:1;)");
304  FAIL_IF_NOT_NULL(s);
305  s = DetectEngineAppendSig(
306  de_ctx, "alert tcp $http_servers any -> any any (msg:\"Rule Vars Test\"; sid:1;)");
307  FAIL_IF_NOT_NULL(s);
308  s = DetectEngineAppendSig(de_ctx,
309  "alert tcp $http_servers any -> any $HTTP_PORTS (msg:\"Rule Vars Test\"; sid:1;)");
310  FAIL_IF_NOT_NULL(s);
311  s = DetectEngineAppendSig(de_ctx,
312  "alert tcp !$TELNET_SERVERS !80 -> any !$SSH_PORTS (msg:\"Rule Vars Test\"; sid:1;)");
313  FAIL_IF_NOT_NULL(s);
314 
315  DetectEngineCtxFree(de_ctx);
316  SCConfDeInit();
317  SCConfRestoreContextBackup();
318  PASS;
319 }
320 
321 static const char *dummy_mt_conf_string =
322  "%YAML 1.1\n"
323  "---\n"
324  "vars:\n"
325  "\n"
326  " address-groups:\n"
327  "\n"
328  " HOME_NET: \"[1.2.3.4]\"\n"
329  " port-groups:\n"
330  " HTTP_PORTS: \"12345\"\n"
331  "multi-detect:\n"
332  " 0:\n"
333  " vars:\n"
334  "\n"
335  " address-groups:\n"
336  "\n"
337  " HOME_NET: \"[8.8.8.8]\"\n"
338  " port-groups:\n"
339  " HTTP_PORTS: \"54321\"\n"
340  "\n";
341 
342 /**
343  * \test Check that valid address and port group vars are correctly retrieved
344  * from the configuration.
345  */
346 static int SCRuleVarsMTest01(void)
347 {
348  SCConfCreateContextBackup();
349  SCConfInit();
350  SCConfYamlLoadString(dummy_mt_conf_string, strlen(dummy_mt_conf_string));
351 
352  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
353  FAIL_IF_NULL(de_ctx);
354  de_ctx->flags |= DE_QUIET;
355  snprintf(de_ctx->config_prefix, sizeof(de_ctx->config_prefix),
356  "multi-detect.0");
357 
358  /* check for address-groups */
359  FAIL_IF_NULL(SCRuleVarsGetConfVar(de_ctx, "$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS));
360  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(de_ctx, "$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS),
361  "[8.8.8.8]") == 0);
362 
363  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS));
364  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$HOME_NET", SC_RULE_VARS_ADDRESS_GROUPS),
365  "[1.2.3.4]") == 0);
366 
367  /* check for port-groups */
368  FAIL_IF_NULL(SCRuleVarsGetConfVar(de_ctx, "$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS));
369  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(de_ctx, "$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS),
370  "54321") == 0);
371 
372  FAIL_IF_NULL(SCRuleVarsGetConfVar(NULL, "$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS));
373  FAIL_IF_NOT(strcmp(SCRuleVarsGetConfVar(NULL, "$HTTP_PORTS", SC_RULE_VARS_PORT_GROUPS),
374  "12345") == 0);
375 
376  SCConfDeInit();
377  SCConfRestoreContextBackup();
378 
379  DetectEngineCtxFree(de_ctx);
380  PASS;
381 }
382 
383 #endif /* UNITTESTS */
384 
385 void SCRuleVarsRegisterTests(void)
386 {
387 #ifdef UNITTESTS
388  UtRegisterTest("SCRuleVarsPositiveTest01", SCRuleVarsPositiveTest01);
389  UtRegisterTest("SCRuleVarsNegativeTest02", SCRuleVarsNegativeTest02);
390  UtRegisterTest("SCRuleVarsPositiveTest03", SCRuleVarsPositiveTest03);
391  UtRegisterTest("SCRuleVarsNegativeTest04", SCRuleVarsNegativeTest04);
392 
393  UtRegisterTest("SCRuleVarsMTest01", SCRuleVarsMTest01);
394 #endif
395 }
SCConfYamlLoadString
int SCConfYamlLoadString(const char *string, size_t len)
Load configuration from a YAML string.
Definition: conf-yaml-loader.c:535
detect-content.h
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SCReturnCharPtr
#define SCReturnCharPtr(x)
Definition: util-debug.h:296
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:101
SC_RULE_VARS_ADDRESS_GROUPS
@ SC_RULE_VARS_ADDRESS_GROUPS
Definition: util-rule-vars.h:31
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:995
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2912
DE_QUIET
#define DE_QUIET
Definition: detect.h:334
SCRuleVarsType
SCRuleVarsType
Definition: util-rule-vars.h:30
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3971
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SCConfInit
void SCConfInit(void)
Initialize the configuration system.
Definition: conf.c:120
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
SC_RULE_VARS_PORT_GROUPS
@ SC_RULE_VARS_PORT_GROUPS
Definition: util-rule-vars.h:32
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
SCRuleVarsRegisterTests
void SCRuleVarsRegisterTests(void)
Definition: util-rule-vars.c:385
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
detect-engine-mpm.h
SCConfGetNonNull
int SCConfGetNonNull(const char *name, const char **vptr)
Retrieve the non-null value of a configuration node.
Definition: conf.c:380
detect.h
util-rule-vars.h
conf-yaml-loader.h
conf.h
SCConfCreateContextBackup
void SCConfCreateContextBackup(void)
Creates a backup of the conf_hash hash_table used by the conf API.
Definition: conf.c:740
sc_rule_vars_type_map
SCEnumCharMap sc_rule_vars_type_map[]
Definition: util-rule-vars.c:42
DetectEngineCtx_::config_prefix
char config_prefix[64]
Definition: detect.h:1121
SCMapEnumValueToName
const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table)
Maps an enum value to a string name, from the supplied table.
Definition: util-enum.c:68
suricata-common.h
SCEnumCharMap_
Definition: util-enum.h:27
SCConfDeInit
void SCConfDeInit(void)
De-initializes the configuration system.
Definition: conf.c:759
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
SCConfRestoreContextBackup
void SCConfRestoreContextBackup(void)
Restores the backup of the hash_table present in backup_conf_hash back to conf_hash.
Definition: conf.c:750
detect-parse.h
Signature_
Signature container.
Definition: detect.h:692
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2873
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:997
SCRuleVarsGetConfVar
const char * SCRuleVarsGetConfVar(const DetectEngineCtx *de_ctx, const char *conf_var_name, SCRuleVarsType conf_vars_type)
Definition: util-rule-vars.c:64
util-enum.h