From: Russ Combs (rucombs) Date: Wed, 25 May 2016 21:34:55 +0000 (-0400) Subject: Merge pull request #482 in SNORT/snort3 from file_type_ips to master X-Git-Tag: 3.0.0-233~391 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=897d032fc1234eb412bd5c285a18e9b0f89aeed3;p=thirdparty%2Fsnort3.git Merge pull request #482 in SNORT/snort3 from file_type_ips to master Squashed commit of the following: commit 0ee7abae1918f2c5bf73e411a1ed77f8d2e68249 Author: huica Date: Wed May 25 09:01:16 2016 -0400 Change cursor type commit 46a53bc84c40fe82adc07096a7018430148fd393 Merge: d49abab f423c7b Author: huica Date: Wed May 25 08:59:26 2016 -0400 Merge branch 'master' of https://bitbucket-eng-rtp1.cisco.com/bitbucket/scm/snort/snort3.git into capture commit d49abab562d510ba1b6a652ae01f7667d5362e7a Author: huica Date: Fri May 20 13:51:33 2016 -0400 change it to dynamic commit 5f2cdc6ae315d494c0c58fca3241d8198e257ca2 Author: huica Date: Fri May 20 11:39:30 2016 -0400 File type rule options --- diff --git a/src/file_api/file_capture.cc b/src/file_api/file_capture.cc index d9b09cced..addc5c7da 100644 --- a/src/file_api/file_capture.cc +++ b/src/file_api/file_capture.cc @@ -432,6 +432,8 @@ void FileCapture::release_file() fileblock = fileblock->next; file_capture_stats.file_buffers_released_total++; } + + head = last = nullptr; } /* diff --git a/src/ips_options/CMakeLists.txt b/src/ips_options/CMakeLists.txt index aebb941c2..548d85ec5 100644 --- a/src/ips_options/CMakeLists.txt +++ b/src/ips_options/CMakeLists.txt @@ -11,6 +11,7 @@ SET( PLUGIN_LIST ips_byte_test.cc ips_byte_jump.cc ips_cvs.cc + ips_file_type.cc ips_flags.cc ips_fragbits.cc ips_fragoffset.cc @@ -100,6 +101,7 @@ else (STATIC_IPS_OPTIONS) add_shared_library(ips_byte_test ips_options ips_byte_test.cc) add_shared_library(ips_byte_jump ips_options ips_byte_jump.cc) add_shared_library(ips_cvs ips_options ips_cvs.cc) + add_shared_library(ips_file_type ips_options ips_file_type.cc) add_shared_library(ips_flags ips_options ips_flags.cc) add_shared_library(ips_fragbits ips_options ips_fragbits.cc) add_shared_library(ips_fragoffset ips_options ips_fragoffset.cc) diff --git a/src/ips_options/Makefile.am b/src/ips_options/Makefile.am index 94637ca8f..f43e47c41 100644 --- a/src/ips_options/Makefile.am +++ b/src/ips_options/Makefile.am @@ -10,6 +10,7 @@ ips_base64.cc \ ips_byte_test.cc \ ips_byte_jump.cc \ ips_cvs.cc \ +ips_file_type.cc \ ips_flags.cc \ ips_fragbits.cc \ ips_fragoffset.cc \ @@ -112,6 +113,11 @@ libips_cvs_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libips_cvs_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared libips_cvs_la_SOURCES = ips_cvs.cc +optlib_LTLIBRARIES += libips_file_type.la +libips_file_type_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO +libips_file_type_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared +libips_file_type_la_SOURCES = ips_file_type.cc + optlib_LTLIBRARIES += libips_dsize.la libips_dsize_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libips_dsize_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared diff --git a/src/ips_options/ips_file_type.cc b/src/ips_options/ips_file_type.cc new file mode 100644 index 000000000..738b7452c --- /dev/null +++ b/src/ips_options/ips_file_type.cc @@ -0,0 +1,222 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. +// Copyright (C) 2013-2013 Sourcefire, Inc. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// ips_file_type.cc author Victor Roemer + +#include + +#include "profiler/profiler.h" +#include "detection/detection_defines.h" +#include "framework/ips_option.h" +#include "framework/module.h" +#include "file_api/file_identifier.h" +#include "file_api/file_flows.h" + +typedef std::bitset TypeBitSet; + +#define s_name "file_type" + +static THREAD_LOCAL ProfileStats fileTypePerfStats; + +class FileTypeOption : public IpsOption +{ +public: + FileTypeOption(TypeBitSet &); + ~FileTypeOption() { } + + CursorActionType get_cursor_type() const override + { return CAT_NONE; } + + int eval(Cursor&, Packet*) override; + + TypeBitSet types; +}; + +//------------------------------------------------------------------------- +// class methods +//------------------------------------------------------------------------- + +FileTypeOption::FileTypeOption(TypeBitSet& t) : IpsOption(s_name) +{ + types = t; +} + +int FileTypeOption::eval(Cursor&, Packet* pkt) +{ + Profile profile(fileTypePerfStats); + + int ret = DETECTION_OPTION_NO_MATCH; + + if (!pkt->flow) + return ret; + + FileFlows* files = FileFlows::get_file_flows(pkt->flow); + + if (!files) + return ret; + + FileContext* file = files->get_current_file_context(); + + if (!file) + return ret; + + uint32_t current_type = file->get_file_type(); + if (current_type < types.size() and types[current_type] ) + return DETECTION_OPTION_MATCH; + + return ret; +} + +//------------------------------------------------------------------------- +// module +//------------------------------------------------------------------------- + +static const Parameter s_params[] = +{ + { "~", Parameter::PT_STRING, nullptr, nullptr, + "list of file type IDs to match" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +#define s_help \ + "rule option to check file type" + +class FileTypeModule : public Module +{ +public: + FileTypeModule() : Module(s_name, s_help, s_params) { } + + bool begin(const char*, int, SnortConfig*) override; + bool set(const char*, Value&, SnortConfig*) override; + + bool set_types(long); + + ProfileStats* get_profile() const override + { return &fileTypePerfStats; } + + TypeBitSet types; +}; + +bool FileTypeModule::begin(const char*, int, SnortConfig*) +{ + types.reset(); + + return true; +} + +bool FileTypeModule::set_types(long t) +{ + if ( t < 0 or t > FILE_ID_MAX ) + return false; + + types.set((uint32_t)t); + + return true; +} + +bool FileTypeModule::set(const char*, Value& v, SnortConfig*) +{ + if ( !v.is("~") ) + return false; + + v.set_first_token(); + std::string tok; + + while ( v.get_next_token(tok) ) + { + long n; + + if ( tok[0] == '"' ) + tok.erase(0, 1); + + if ( tok[tok.length()-1] == '"' ) + tok.erase(tok.length()-1, 1); + + if ( v.strtol(n, tok) ) + { + if ( !set_types(n) ) + return false; + } + else + return false; + } + return true; +} + +//------------------------------------------------------------------------- +// api methods +//------------------------------------------------------------------------- + +static Module* mod_ctor() +{ + return new FileTypeModule; +} + +static void mod_dtor(Module* m) +{ + delete m; +} + +static IpsOption* file_type_ctor(Module* m, OptTreeNode*) +{ + FileTypeModule* mod = (FileTypeModule*)m; + return new FileTypeOption(mod->types); +} + +static void file_type_dtor(IpsOption* p) +{ + delete p; +} + +static const IpsApi file_type_api = +{ + { + PT_IPS_OPTION, + sizeof(IpsApi), + IPSAPI_VERSION, + 0, + API_RESERVED, + API_OPTIONS, + s_name, + s_help, + mod_ctor, + mod_dtor + }, + OPT_TYPE_DETECTION, + 0, 0, + nullptr, + nullptr, + nullptr, + nullptr, + file_type_ctor, + file_type_dtor, + nullptr +}; + +#ifdef BUILDING_SO +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &file_type_api.base, + nullptr +}; +#else +const BaseApi* ips_file_type = &file_type_api.base; +#endif + diff --git a/src/ips_options/ips_options.cc b/src/ips_options/ips_options.cc index e0d7b7de4..ab8449da2 100644 --- a/src/ips_options/ips_options.cc +++ b/src/ips_options/ips_options.cc @@ -53,6 +53,7 @@ extern const BaseApi* ips_base64_decode; extern const BaseApi* ips_byte_jump; extern const BaseApi* ips_byte_test; extern const BaseApi* ips_cvs; +extern const BaseApi* ips_file_type; extern const BaseApi* ips_flags; extern const BaseApi* ips_fragbits; extern const BaseApi* ips_fragoffset; @@ -124,6 +125,7 @@ const BaseApi* ips_options[] = ips_byte_jump, ips_byte_test, ips_cvs, + ips_file_type, ips_flags, ips_fragbits, ips_fragoffset,