From: Victor Julien Date: Thu, 29 Jun 2023 19:05:36 +0000 (+0200) Subject: detect/fileext: reimplement based on file.name X-Git-Tag: suricata-6.0.14~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=69895fbe00f52a3ba76551b15ab9b1772aa3bd97;p=thirdparty%2Fsuricata.git detect/fileext: reimplement based on file.name Ticket: #6194. (cherry picked from commit 9b09b29350f846e917dab5a3a8351ef7988362b1) --- diff --git a/src/Makefile.am b/src/Makefile.am index 650a0945e9..ff962da84a 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -166,7 +166,6 @@ detect-engine-uint.c detect-engine-uint.h \ detect-fast-pattern.c detect-fast-pattern.h \ detect-file-data.c detect-file-data.h \ detect-file-hash-common.c detect-file-hash-common.h \ -detect-fileext.c detect-fileext.h \ detect-filemagic.c detect-filemagic.h \ detect-filemd5.c detect-filemd5.h \ detect-filesha1.c detect-filesha1.h \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 3f849125a5..e131fe3e8b 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -117,7 +117,6 @@ #include "detect-rpc.h" #include "detect-asn1.h" #include "detect-filename.h" -#include "detect-fileext.h" #include "detect-filestore.h" #include "detect-filemagic.h" #include "detect-filemd5.h" @@ -462,7 +461,6 @@ void SigTableSetup(void) DetectHttpCookieRegister(); DetectFilenameRegister(); - DetectFileextRegister(); DetectFilestoreRegister(); DetectFilemagicRegister(); DetectFileMd5Register(); diff --git a/src/detect-fileext.c b/src/detect-fileext.c deleted file mode 100644 index 35805d6b90..0000000000 --- a/src/detect-fileext.c +++ /dev/null @@ -1,310 +0,0 @@ -/* Copyright (C) 2007-2012 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Victor Julien - * \author Pablo Rincon - * - */ - -#include "suricata-common.h" -#include "threads.h" -#include "debug.h" -#include "decode.h" - -#include "detect.h" -#include "detect-parse.h" - -#include "detect-engine.h" -#include "detect-engine-mpm.h" -#include "detect-engine-state.h" - -#include "flow.h" -#include "flow-var.h" -#include "flow-util.h" - -#include "util-debug.h" -#include "util-unittest.h" -#include "util-unittest-helper.h" -#include "util-spm-bm.h" -#include "util-print.h" -#include "util-memcmp.h" - -#include "app-layer.h" - -#include "stream-tcp.h" -#include "detect-fileext.h" - -static int DetectFileextMatch (DetectEngineThreadCtx *, Flow *, - uint8_t, File *, const Signature *, const SigMatchCtx *); -static int DetectFileextSetup (DetectEngineCtx *, Signature *, const char *); -#ifdef UNITTESTS -static void DetectFileextRegisterTests(void); -#endif -static void DetectFileextFree(DetectEngineCtx *, void *); -static int g_file_match_list_id = 0; - -/** - * \brief Registration function for keyword: fileext - */ -void DetectFileextRegister(void) -{ - sigmatch_table[DETECT_FILEEXT].name = "fileext"; - sigmatch_table[DETECT_FILEEXT].desc = "match on the extension of a file name"; - sigmatch_table[DETECT_FILEEXT].url = "/rules/file-keywords.html#fileext"; - sigmatch_table[DETECT_FILEEXT].FileMatch = DetectFileextMatch; - sigmatch_table[DETECT_FILEEXT].Setup = DetectFileextSetup; - sigmatch_table[DETECT_FILEEXT].Free = DetectFileextFree; -#ifdef UNITTESTS - sigmatch_table[DETECT_FILEEXT].RegisterTests = DetectFileextRegisterTests; -#endif - sigmatch_table[DETECT_FILEEXT].flags = SIGMATCH_QUOTES_OPTIONAL|SIGMATCH_HANDLE_NEGATION; - sigmatch_table[DETECT_FILEEXT].alternative = DETECT_FILE_NAME; - - g_file_match_list_id = DetectBufferTypeRegister("files"); - - SCLogDebug("registering fileext rule option"); - return; -} - -/** - * \brief match the specified file extension - * - * \param t thread local vars - * \param det_ctx pattern matcher thread local data - * \param f *LOCKED* flow - * \param flags direction flags - * \param file file being inspected - * \param s signature being inspected - * \param m sigmatch that we will cast into DetectFileextData - * - * \retval 0 no match - * \retval 1 match - */ -static int DetectFileextMatch (DetectEngineThreadCtx *det_ctx, - Flow *f, uint8_t flags, File *file, const Signature *s, const SigMatchCtx *m) -{ - SCEnter(); - int ret = 0; - - DetectFileextData *fileext = (DetectFileextData *)m; - - if (file->name == NULL) - SCReturnInt(0); - - if (file->name_len <= fileext->len) - SCReturnInt(0); - - int offset = file->name_len - fileext->len; - - /* fileext->ext is already in lowercase, as SCMemcmpLowercase requires */ - if (file->name[offset - 1] == '.' && - SCMemcmpLowercase(fileext->ext, file->name + offset, fileext->len) == 0) - { - if (!(fileext->flags & DETECT_CONTENT_NEGATED)) { - ret = 1; - SCLogDebug("File ext found"); - } - } else if (fileext->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("negated match"); - ret = 1; - } - - SCReturnInt(ret); -} - -/** - * \brief This function is used to parse fileet - * - * \param de_ctx Pointer to the detection engine context - * \param str Pointer to the fileext value string - * - * \retval pointer to DetectFileextData on success - * \retval NULL on failure - */ -static DetectFileextData *DetectFileextParse( - DetectEngineCtx *de_ctx, const char *str, bool negate, bool *warning) -{ - DetectFileextData *fileext = NULL; - - /* We have a correct filename option */ - fileext = SCMalloc(sizeof(DetectFileextData)); - if (unlikely(fileext == NULL)) - goto error; - - memset(fileext, 0x00, sizeof(DetectFileextData)); - - if (DetectContentDataParse("fileext", str, &fileext->ext, &fileext->len, warning) == -1) { - goto error; - } - uint16_t u; - for (u = 0; u < fileext->len; u++) - fileext->ext[u] = tolower(fileext->ext[u]); - - if (negate) { - fileext->flags |= DETECT_CONTENT_NEGATED; - } - - SCLogDebug("flags %02X", fileext->flags); - if (fileext->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("negated fileext"); - } - -#ifdef DEBUG - if (SCLogDebugEnabled()) { - char *ext = SCMalloc(fileext->len + 1); - if (ext != NULL) { - memcpy(ext, fileext->ext, fileext->len); - ext[fileext->len] = '\0'; - SCLogDebug("will look for fileext %s", ext); - SCFree(ext); - } - } -#endif - - return fileext; - -error: - if (fileext != NULL) - DetectFileextFree(de_ctx, fileext); - return NULL; - -} - -/** - * \brief this function is used to add the parsed "id" option - * into the current signature - * - * \param de_ctx pointer to the Detection Engine Context - * \param s pointer to the Current Signature - * \param idstr pointer to the user provided "id" option - * - * \retval 0 on Success - * \retval -1 on Failure - */ -static int DetectFileextSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str) -{ - DetectFileextData *fileext= NULL; - SigMatch *sm = NULL; - bool warning = false; - - fileext = DetectFileextParse(de_ctx, str, s->init_data->negated, &warning); - if (fileext == NULL) - goto error; - - /* Okay so far so good, lets get this into a SigMatch - * and put it in the Signature. */ - sm = SigMatchAlloc(); - if (sm == NULL) - goto error; - - sm->type = DETECT_FILEEXT; - sm->ctx = (void *)fileext; - - SigMatchAppendSMToList(s, sm, g_file_match_list_id); - - s->file_flags |= (FILE_SIG_NEED_FILE|FILE_SIG_NEED_FILENAME); - return 0; - -error: - if (fileext != NULL) - DetectFileextFree(de_ctx, fileext); - if (sm != NULL) - SCFree(sm); - return warning ? -4 : -1; -} - -/** - * \brief this function will free memory associated with DetectFileextData - * - * \param fileext pointer to DetectFileextData - */ -static void DetectFileextFree(DetectEngineCtx *de_ctx, void *ptr) -{ - if (ptr != NULL) { - DetectFileextData *fileext = (DetectFileextData *)ptr; - if (fileext->ext != NULL) - SCFree(fileext->ext); - SCFree(fileext); - } -} - -#ifdef UNITTESTS /* UNITTESTS */ - -/** - * \test DetectFileextTestParse01 - */ -static int DetectFileextTestParse01 (void) -{ - DetectFileextData *dfd = DetectFileextParse(NULL, "doc", false, NULL); - if (dfd != NULL) { - DetectFileextFree(NULL, dfd); - return 1; - } - return 0; -} - -/** - * \test DetectFileextTestParse02 - */ -static int DetectFileextTestParse02 (void) -{ - int result = 0; - - DetectFileextData *dfd = DetectFileextParse(NULL, "tar.gz", false, NULL); - if (dfd != NULL) { - if (dfd->len == 6 && memcmp(dfd->ext, "tar.gz", 6) == 0) { - result = 1; - } - - DetectFileextFree(NULL, dfd); - return result; - } - return 0; -} - -/** - * \test DetectFileextTestParse03 - */ -static int DetectFileextTestParse03 (void) -{ - int result = 0; - - DetectFileextData *dfd = DetectFileextParse(NULL, "pdf", false, NULL); - if (dfd != NULL) { - if (dfd->len == 3 && memcmp(dfd->ext, "pdf", 3) == 0) { - result = 1; - } - - DetectFileextFree(NULL, dfd); - return result; - } - return 0; -} - -/** - * \brief this function registers unit tests for DetectFileext - */ -void DetectFileextRegisterTests(void) -{ - UtRegisterTest("DetectFileextTestParse01", DetectFileextTestParse01); - UtRegisterTest("DetectFileextTestParse02", DetectFileextTestParse02); - UtRegisterTest("DetectFileextTestParse03", DetectFileextTestParse03); -} -#endif /* UNITTESTS */ diff --git a/src/detect-fileext.h b/src/detect-fileext.h deleted file mode 100644 index 4981763bba..0000000000 --- a/src/detect-fileext.h +++ /dev/null @@ -1,38 +0,0 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Pablo Rincon - */ - -#ifndef __DETECT_FILEEXT_H__ -#define __DETECT_FILEEXT_H__ - -#include "util-spm-bm.h" - -typedef struct DetectFileextData_ { - uint8_t *ext; /** file extension to match */ - uint16_t len; /** length of the file */ - uint32_t flags; -} DetectFileextData; - -/* prototypes */ -void DetectFileextRegister (void); - -#endif /* __DETECT_FILEEXT_H__ */ diff --git a/src/detect-filename.c b/src/detect-filename.c index 4945d02152..2df4fd478a 100644 --- a/src/detect-filename.c +++ b/src/detect-filename.c @@ -54,6 +54,7 @@ #include "detect-filename.h" #include "app-layer-parser.h" +static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str); static int DetectFilenameSetup (DetectEngineCtx *, Signature *, const char *); static int DetectFilenameSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str); #ifdef UNITTESTS @@ -86,6 +87,13 @@ void DetectFilenameRegister(void) sigmatch_table[DETECT_FILENAME].flags = SIGMATCH_QUOTES_OPTIONAL|SIGMATCH_HANDLE_NEGATION; sigmatch_table[DETECT_FILENAME].alternative = DETECT_FILE_NAME; + sigmatch_table[DETECT_FILEEXT].name = "fileext"; + sigmatch_table[DETECT_FILEEXT].desc = "match on the extension of a file name"; + sigmatch_table[DETECT_FILEEXT].url = "/rules/file-keywords.html#fileext"; + sigmatch_table[DETECT_FILEEXT].Setup = DetectFileextSetup; + sigmatch_table[DETECT_FILEEXT].flags = SIGMATCH_QUOTES_OPTIONAL | SIGMATCH_HANDLE_NEGATION; + sigmatch_table[DETECT_FILEEXT].alternative = DETECT_FILE_NAME; + sigmatch_table[DETECT_FILE_NAME].name = "file.name"; sigmatch_table[DETECT_FILE_NAME].desc = "sticky buffer to match on the file name"; sigmatch_table[DETECT_FILE_NAME].url = "/rules/file-keywords.html#filename"; @@ -166,6 +174,47 @@ void DetectFilenameRegister(void) return; } +static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) +{ + if (s->init_data->transforms.cnt) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "previous transforms not consumed before 'fileext'"); + SCReturnInt(-1); + } + s->init_data->list = DETECT_SM_LIST_NOTSET; + s->file_flags |= (FILE_SIG_NEED_FILE | FILE_SIG_NEED_FILENAME); + + size_t dotstr_len = strlen(str) + 2; + char *dotstr = SCCalloc(1, dotstr_len); + if (dotstr == NULL) + return -1; + dotstr[0] = '.'; + strlcat(dotstr, str, dotstr_len); + + if (DetectContentSetup(de_ctx, s, dotstr) < 0) { + SCFree(dotstr); + return -1; + } + SCFree(dotstr); + + SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1); + if (sm == NULL) + return -1; + + DetectContentData *cd = (DetectContentData *)sm->ctx; + cd->flags |= DETECT_CONTENT_NOCASE; + cd->flags |= DETECT_CONTENT_ENDS_WITH; + /* Recreate the context with nocase chars */ + SpmDestroyCtx(cd->spm_ctx); + cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx); + if (cd->spm_ctx == NULL) { + return -1; + } + if (DetectEngineContentModifierBufferSetup( + de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0) + return -1; + + return 0; +} /** * \brief this function is used to parse filename options * \brief into the current signature