From: huica Date: Mon, 20 Jul 2015 19:53:46 +0000 (-0400) Subject: Add mime log class X-Git-Tag: 3.0.0-233~828^2~52 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fb3ba2b30aed3ca776777f7f71008e03aa63dcb5;p=thirdparty%2Fsnort3.git Add mime log class --- diff --git a/src/file_api/file_mime_config.h b/src/file_api/file_mime_config.h index c79b40271..cb2fe6e59 100644 --- a/src/file_api/file_mime_config.h +++ b/src/file_api/file_mime_config.h @@ -23,7 +23,7 @@ #define FILE_MIME_CONFIG_H // List of MIME decode and log configuration functions -#include "snort_types.h" +#include "main/snort_types.h" /*These are temporary values*/ #define DEFAULT_MAX_MIME_MEM 838860 diff --git a/src/file_api/file_mime_log.cc b/src/file_api/file_mime_log.cc new file mode 100644 index 000000000..50c6ff64d --- /dev/null +++ b/src/file_api/file_mime_log.cc @@ -0,0 +1,197 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved. +// Copyright (C) 2012-2013 Sourcefire, Inc. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +/* +** Author(s): Hui Cao +** +** NOTES +** 9.25.2012 - Initial Source Code. Hui Cao +*/ + +#include "file_mime_log.h" + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "snort_types.h" +#include "file_api.h" + +/* Extract the filename from the header */ +int MailLogState::extract_file_name(const char** start, int length, bool* disp_cont) +{ + const char* tmp = NULL; + const char* end = *start+length; + + if (length <= 0) + return -1; + + if (!(*disp_cont)) + { + tmp = SnortStrcasestr(*start, length, "filename"); + + if ( tmp == NULL ) + return -1; + + tmp = tmp + 8; + while ( (tmp < end) && ((isspace(*tmp)) || (*tmp == '=') )) + { + tmp++; + } + } + else + tmp = *start; + + if (tmp < end) + { + if (*tmp == '"' || (*disp_cont)) + { + if (*tmp == '"') + { + if (*disp_cont) + { + *disp_cont = false; + return (tmp - *start); + } + tmp++; + } + *start = tmp; + tmp = SnortStrnPbrk(*start,(end - tmp),"\""); + if (tmp == NULL ) + { + if ((end - tmp) > 0 ) + { + tmp = end; + *disp_cont = true; + } + else + return -1; + } + else + *disp_cont = false; + end = tmp; + } + else + { + *start = tmp; + } + return (end - *start); + } + else + { + return -1; + } +} + +/* accumulate MIME attachment filenames. The filenames are appended by commas */ +int MailLogState::log_file_name(const uint8_t* start, int length, bool* disp_cont) +{ + uint8_t* alt_buf; + int alt_size; + uint16_t* alt_len; + int ret=0; + int cont =0; + int log_avail = 0; + + if (!start || (length <= 0)) + { + *disp_cont = false; + return -1; + } + + if (*disp_cont) + cont = 1; + + ret = extract_file_name((const char**)(&start), length, disp_cont); + + if (ret == -1) + return ret; + + length = ret; + + alt_buf = log_state->filenames; + alt_size = MAX_FILE; + alt_len = &(log_state->file_logged); + log_avail = alt_size - *alt_len; + + if (!alt_buf || (log_avail <= 0)) + return -1; + + if ( *alt_len > 0 && ((*alt_len + 1) < alt_size)) + { + if (!cont) + { + alt_buf[*alt_len] = ','; + *alt_len = *alt_len + 1; + } + } + + ret = SafeMemcpy(alt_buf + *alt_len, start, length, alt_buf, alt_buf + alt_size); + + if (ret != SAFEMEM_SUCCESS) + { + if (*alt_len != 0) + *alt_len = *alt_len - 1; + return -1; + } + + log_state->file_current = *alt_len; + *alt_len += length; + + return 0; +} + + +void MailLogState::set_file_name_from_log(void* pv) +{ + Flow* ssn = (Flow*)pv; // FIXIT-M eliminate need for cast + + if ((log_state) && (log_state->file_logged > log_state->file_current)) + { + file_api->set_file_name(ssn, log_state->filenames + log_state->file_current, + log_state->file_logged -log_state->file_current); + } + else + { + file_api->set_file_name(ssn, NULL, 0); + } +} + +MailLogState::MailLogState(MailLogConfig* conf) +{ + if (conf && (conf->log_email_hdrs || conf->log_filename + || conf->log_mailfrom || conf->log_rcptto)) + { + uint32_t bufsz = (2* MAX_EMAIL) + MAX_FILE + conf->email_hdrs_log_depth; + uint8_t* buf = (uint8_t*)SnortAlloc(bufsz); + + if (buf != NULL) + { + log_depth = conf->email_hdrs_log_depth; + recipients = buf; + rcpts_logged = 0; + senders = buf + MAX_EMAIL; + snds_logged = 0; + file_log.filenames = buf + (2*MAX_EMAIL); + file_log.file_logged = 0; + file_log.file_current = 0; + emailHdrs = buf + (2*MAX_EMAIL) + MAX_FILE; + hdrs_logged = 0; + } + } +} diff --git a/src/file_api/file_mime_log.h b/src/file_api/file_mime_log.h new file mode 100644 index 000000000..1f1337fbd --- /dev/null +++ b/src/file_api/file_mime_log.h @@ -0,0 +1,80 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved. +// Copyright (C) 2012-2013 Sourcefire, Inc. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- + +// author Hui Cao + +#ifndef FILE_MIME_LOG_H +#define FILE_MIME_LOG_H + +// Provides list of MIME processing functions. Encoded file data will be decoded +// and file name will be extracted from MIME header + +#include "file_api/file_api.h" +#include "file_api/file_mime_config.h" +#include "file_api/file_mime_log.h" + +#define MAX_FILE 1024 +#define MAX_EMAIL 1024 + +struct FileLogState +{ + uint8_t* filenames; + uint16_t file_logged; + uint16_t file_current; +}; + +class MailLogState +{ +public: + MailLogState(MailLogConfig* conf); + /* accumulate MIME attachment filenames. The filenames are appended by commas */ + int log_file_name(const uint8_t* start, int length, bool* disp_cont); + void MailLogState::set_file_name_from_log(void* pv); + +private: + int extract_file_name(const char** start, int length, bool* disp_cont); + unsigned char* emailHdrs; + uint32_t log_depth; + uint32_t hdrs_logged; + uint8_t* recipients; + uint16_t rcpts_logged; + uint8_t* senders; + uint16_t snds_logged; + FileLogState log_state; +}; + +struct MailLogConfig +{ + uint32_t memcap = DEFAULT_MIME_MEMCAP; + char log_mailfrom = 0; + char log_rcptto = 0; + char log_filename = 0; + char log_email_hdrs = 0; + uint32_t email_hdrs_log_depth = 0; +}; + + +/* log flags */ +#define MIME_FLAG_MAIL_FROM_PRESENT 0x00000001 +#define MIME_FLAG_RCPT_TO_PRESENT 0x00000002 +#define MIME_FLAG_FILENAME_PRESENT 0x00000004 +#define MIME_FLAG_EMAIL_HDRS_PRESENT 0x00000008 + +#endif + diff --git a/src/file_api/file_mime_process.h b/src/file_api/file_mime_process.h index 58533a46d..01db3d025 100644 --- a/src/file_api/file_mime_process.h +++ b/src/file_api/file_mime_process.h @@ -29,6 +29,7 @@ #include "file_api/file_api.h" #include "file_api/file_mime_config.h" #include "file_api/file_mime_paf.h" +#include "file_api/file_mime_log.h" #include "utils/sf_email_attach_decode.h" #define MAX_FILE 1024 diff --git a/src/file_api/libs/file_lib.cc b/src/file_api/libs/file_lib.cc index f7a306ec6..5575af598 100644 --- a/src/file_api/libs/file_lib.cc +++ b/src/file_api/libs/file_lib.cc @@ -36,6 +36,8 @@ #include "file_identifier.h" #include "file_config.h" +#include "hash/hashes.h" +#include "utils/util.h" #include "file_api/file_capture.h" FileContext::FileContext ()