location: Add support for the anonymous-proxy keyword

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h
index df6c10533e98c75539adb8f5cc30dcc7469eadf9..8c4edaf88a82a6750b37aeb6ea395f880319f5d4 100644 (file)
--- a/src/detect-engine-register.h
+++ b/src/detect-engine-register.h
@@ -98,6 +98,7 @@ enum DetectKeywordId {
     DETECT_DETECTION_FILTER,
     DETECT_DATASET,
     DETECT_DATAREP,
+    DETECT_ANONYMOUS_PROXY,
     DETECT_ANYCAST,
 
     DETECT_DECODE_EVENT,

diff --git a/src/detect-location.c b/src/detect-location.c
index 9b2bdd8de014517775ee6a15efa5a4b9549f2975..ef7f00707ec4e4651d26d9c2ddba1cf2bc1a79d8 100644 (file)
--- a/src/detect-location.c
+++ b/src/detect-location.c
@@ -49,6 +49,7 @@ struct DetectLocationData {
     struct loc_ctx* ctx;
     struct loc_database* db;
     char** countries;
+    int anonymous_proxy:1;
     int anycast:1;
     int flags;
 };
@@ -301,6 +302,38 @@ ERROR:
     return NULL;
 }
 
+static struct DetectLocationData* DetectLocationParseAnonymousProxy(DetectEngineCtx* ctx,
+        const char* string) {
+    // Check for valid input
+    if (!string || !*string)
+        return NULL;
+
+    // Allocate DetectLocationData
+    struct DetectLocationData* data = SCCalloc(1, sizeof(*data));
+    if (!data)
+        return NULL;
+
+    // Match anonymous-proxy
+    data->anonymous_proxy = 1;
+
+    // Which direction?
+    data->flags = DetectLocationParseDirection(string);
+    if (!data->flags)
+        goto ERROR;
+
+    // Open location database
+    int r = DetectLocationOpenDatabase(data);
+    if (r)
+        goto ERROR;
+
+    return data;
+
+ERROR:
+    DetectLocationFree(ctx, data);
+
+    return NULL;
+}
+
 static int DetectLocationCreateMatch(Signature* signature, const enum DetectKeywordId type,
         SigMatchCtx* ctx) {
     // Allocate a new SigMatch structure
@@ -350,6 +383,25 @@ static int DetectLocationSetupGeoIP(DetectEngineCtx* ctx, Signature* signature,
     return 0;
 }
 
+static int DetectLocationSetupAnonymousProxy(DetectEngineCtx* ctx, Signature* signature,
+        const char* optstring) {
+    int r;
+
+    // Parse the option string
+    struct DetectLocationData* data = DetectLocationParseAnonymousProxy(ctx, optstring);
+    if (!data)
+        return -1;
+
+    // Create a match
+    r = DetectLocationCreateMatch(signature, DETECT_ANONYMOUS_PROXY, (SigMatchCtx*)data);
+    if (r) {
+        DetectLocationFree(ctx, data);
+        return r;
+    }
+
+    return 0;
+}
+
 static int DetectLocationSetupAnycast(DetectEngineCtx* ctx, Signature* signature,
         const char* optstring) {
     int r;
@@ -398,7 +450,10 @@ static int DetectLocationMatchAddress(const struct DetectLocationData* data, con
             if (DetectLocationMatchCountryCode(data, network))
                 r = 1;
 
-        } else if (data->anycast)
+        } else if (data->anonymous_proxy)
+            r = loc_network_has_flag(network, LOC_NETWORK_FLAG_ANONYMOUS_PROXY);
+
+        else if (data->anycast)
             r = loc_network_has_flag(network, LOC_NETWORK_FLAG_ANYCAST);
 
         loc_network_unref(network);
@@ -513,6 +568,12 @@ static int DetectLocationSetupGeoIP(DetectEngineCtx* ctx, Signature* signature,
     return -1;
 }
 
+static int DetectLocationSetupAnonymousProxy(DetectEngineCtx* ctx, Signature* signature, const char* optstring) {
+    SCLogError(SC_ERR_NO_LOCATION_SUPPORT,
+        "Support for IPFire Location is not built in (needed for anonymous-proxy keyword)");
+    return -1;
+}
+
 static int DetectLocationSetupAnycast(DetectEngineCtx* ctx, Signature* signature, const char* optstring) {
     SCLogError(SC_ERR_NO_LOCATION_SUPPORT,
         "Support for IPFire Location is not built in (needed for anycast keyword)");
@@ -534,6 +595,15 @@ void DetectLocationRegister(void) {
     sigmatch_table[DETECT_GEOIP].Free = DetectLocationFree;
 #endif /* HAVE_LIBLOC */
 
+    sigmatch_table[DETECT_ANONYMOUS_PROXY].name = "anonymous-proxy";
+    sigmatch_table[DETECT_ANONYMOUS_PROXY].desc = "match on the source, destination or source and destination IP addresses and check if are an anonymous proxy";
+    sigmatch_table[DETECT_ANONYMOUS_PROXY].url = "/rules/header-keywords.html#anonymous-proxy";
+    sigmatch_table[DETECT_ANONYMOUS_PROXY].Setup = DetectLocationSetupAnonymousProxy;
+#ifdef HAVE_LIBLOC
+    sigmatch_table[DETECT_ANONYMOUS_PROXY].Match = DetectLocationMatch;
+    sigmatch_table[DETECT_ANONYMOUS_PROXY].Free = DetectLocationFree;
+#endif /* HAVE_LIBLOC */
+
     sigmatch_table[DETECT_ANYCAST].name = "anycast";
     sigmatch_table[DETECT_ANYCAST].desc = "match on the source, destination or source and destination IP addresses and check if they belong to an anycast network";
     sigmatch_table[DETECT_ANYCAST].url = "/rules/header-keywords.html#anycast";