From: huica Date: Wed, 15 Jul 2015 20:47:28 +0000 (-0400) Subject: file mime separation X-Git-Tag: 3.0.0-233~828^2~63 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d0aebbbb70e1052e102542ebfa313e68b059f9c4;p=thirdparty%2Fsnort3.git file mime separation --- diff --git a/src/file_api/file_api.h b/src/file_api/file_api.h index 9464dff03..71fd11715 100644 --- a/src/file_api/file_api.h +++ b/src/file_api/file_api.h @@ -41,8 +41,7 @@ #define ENABLE_FILE_CAPTURE 0x4 #define FILE_ALL_ON 0xFFFFFFFF #define FILE_ALL_OFF 0x00000000 -#define MAX_FILE 1024 -#define MAX_EMAIL 1024 + #define FILE_RESUME_BLOCK 0x01 #define FILE_RESUME_LOG 0x02 @@ -113,125 +112,13 @@ struct FileState FileSigState sig_state; }; -/* log flags */ -#define MIME_FLAG_MAIL_FROM_PRESENT 0x00000001 -#define MIME_FLAG_RCPT_TO_PRESENT 0x00000002 -#define MIME_FLAG_FILENAME_PRESENT 0x00000004 -#define MIME_FLAG_EMAIL_HDRS_PRESENT 0x00000008 - -struct FILE_LogState -{ - uint8_t* filenames; - uint16_t file_logged; - uint16_t file_current; -}; - -struct MAIL_LogState -{ - unsigned char* emailHdrs; - uint32_t log_depth; - uint32_t hdrs_logged; - uint8_t* recipients; - uint16_t rcpts_logged; - uint8_t* senders; - uint16_t snds_logged; - FILE_LogState file_log; -}; - -struct MAIL_LogConfig -{ - uint32_t memcap; - char log_mailfrom; - char log_rcptto; - char log_filename; - char log_email_hdrs; - uint32_t email_hdrs_log_depth; -}; - -/* State tracker for data */ -enum MimeDataState -{ - MIME_PAF_FINDING_BOUNDARY_STATE, - MIME_PAF_FOUND_BOUNDARY_STATE -}; - -/* State tracker for Boundary Signature */ -enum MimeBoundaryState -{ - MIME_PAF_BOUNDARY_UNKNOWN = 0, /* UNKNOWN */ - MIME_PAF_BOUNDARY_LF, /* '\n' */ - MIME_PAF_BOUNDARY_HYPEN_FIRST, /* First '-' */ - MIME_PAF_BOUNDARY_HYPEN_SECOND /* Second '-' */ -}; - -/* State tracker for end of pop/smtp command */ -enum DataEndState -{ - PAF_DATA_END_UNKNOWN, /* Start or UNKNOWN */ - PAF_DATA_END_FIRST_CR, /* First '\r' */ - PAF_DATA_END_FIRST_LF, /* First '\n' */ - PAF_DATA_END_DOT, /* '.' */ - PAF_DATA_END_SECOND_CR, /* Second '\r' */ - PAF_DATA_END_SECOND_LF /* Second '\n' */ -}; - -#define MAX_MIME_BOUNDARY_LEN 70 /* Max length of boundary string, defined in RFC 2046 */ - -struct MimeDataPafInfo -{ - MimeDataState data_state; - char boundary[ MAX_MIME_BOUNDARY_LEN + 1]; /* MIME boundary string + '\0' */ - int boundary_len; - char* boundary_search; - MimeBoundaryState boundary_state; -}; - -typedef int (*Handle_header_line_func)(void* conf, const uint8_t* ptr, - const uint8_t* eol, int - max_header_len, void* mime_ssn); -typedef int (*Normalize_data_func)(void* conf, const uint8_t* ptr, - const uint8_t* data_end); -typedef void (*Decode_alert_func)(void* decode_state); -typedef void (*Reset_state_func)(void* ssn); -typedef bool (*Is_end_of_data_func)(void* ssn); - -struct MimeMethods -{ - Handle_header_line_func handle_header_line; - Normalize_data_func normalize_data; - Decode_alert_func decode_alert; - Reset_state_func reset_state; - Is_end_of_data_func is_end_of_data; -}; - -struct DecodeConfig -{ - bool ignore_data; - int max_mime_mem; - int max_depth; - int b64_depth; - int qp_depth; - int bitenc_depth; - int uu_depth; - int64_t file_depth; -}; - -struct MimeState -{ - int data_state; - int state_flags; - int log_flags; - void* decode_state; - MimeDataPafInfo mime_boundary; - DecodeConfig* decode_conf; - MAIL_LogConfig* log_config; - MAIL_LogState* log_state; - void* config; - MimeMethods* methods; -}; - struct FileContext; struct FileCaptureInfo; +struct MAIL_LogState; +struct MAIL_LogConfig; +struct DecodeConfig; +struct MimeState; +struct MimeDataPafInfo; #define FILE_API_VERSION 4 @@ -621,19 +508,5 @@ static inline bool isFileEnd(FilePosition position) return ((position == SNORT_FILE_END) || (position == SNORT_FILE_FULL)); } -static inline bool scanning_boundary(MimeDataPafInfo* mime_info, uint32_t boundary_start, - uint32_t* fp) -{ - if (boundary_start && - mime_info->data_state == MIME_PAF_FOUND_BOUNDARY_STATE && - mime_info->boundary_state != MIME_PAF_BOUNDARY_UNKNOWN) - { - *fp = boundary_start; - return true; - } - - return false; -} - #endif /* FILE_API_H */ diff --git a/src/file_api/file_mime_config.cc b/src/file_api/file_mime_config.cc index 87c5260e3..68a3dfc6d 100644 --- a/src/file_api/file_mime_config.cc +++ b/src/file_api/file_mime_config.cc @@ -33,6 +33,7 @@ #include "snort_types.h" #include "file_api.h" +#include "file_mime_process.h" #include "sf_email_attach_decode.h" #include "util.h" #include "parser.h" diff --git a/src/file_api/file_mime_process.h b/src/file_api/file_mime_process.h index c28664363..2ba6ce273 100644 --- a/src/file_api/file_mime_process.h +++ b/src/file_api/file_mime_process.h @@ -30,7 +30,9 @@ #include "file_api.h" #include "sf_email_attach_decode.h" -#define BOUNDARY 0 +#define MAX_FILE 1024 +#define MAX_EMAIL 1024 +#define BOUNDARY 0 /* state flags */ #define MIME_FLAG_FOLDING 0x00000001 @@ -53,12 +55,145 @@ /* Maximum length of header chars before colon, based on Exim 4.32 exploit */ #define MAX_HEADER_NAME_LEN 64 +struct FILE_LogState +{ + uint8_t* filenames; + uint16_t file_logged; + uint16_t file_current; +}; + +struct MAIL_LogState +{ + unsigned char* emailHdrs; + uint32_t log_depth; + uint32_t hdrs_logged; + uint8_t* recipients; + uint16_t rcpts_logged; + uint8_t* senders; + uint16_t snds_logged; + FILE_LogState file_log; +}; + +struct MAIL_LogConfig +{ + uint32_t memcap; + char log_mailfrom; + char log_rcptto; + char log_filename; + char log_email_hdrs; + uint32_t email_hdrs_log_depth; +}; + +/* State tracker for data */ +enum MimeDataState +{ + MIME_PAF_FINDING_BOUNDARY_STATE, + MIME_PAF_FOUND_BOUNDARY_STATE +}; + +/* State tracker for Boundary Signature */ +enum MimeBoundaryState +{ + MIME_PAF_BOUNDARY_UNKNOWN = 0, /* UNKNOWN */ + MIME_PAF_BOUNDARY_LF, /* '\n' */ + MIME_PAF_BOUNDARY_HYPEN_FIRST, /* First '-' */ + MIME_PAF_BOUNDARY_HYPEN_SECOND /* Second '-' */ +}; + +/* State tracker for end of pop/smtp command */ +enum DataEndState +{ + PAF_DATA_END_UNKNOWN, /* Start or UNKNOWN */ + PAF_DATA_END_FIRST_CR, /* First '\r' */ + PAF_DATA_END_FIRST_LF, /* First '\n' */ + PAF_DATA_END_DOT, /* '.' */ + PAF_DATA_END_SECOND_CR, /* Second '\r' */ + PAF_DATA_END_SECOND_LF /* Second '\n' */ +}; + +#define MAX_MIME_BOUNDARY_LEN 70 /* Max length of boundary string, defined in RFC 2046 */ + +struct MimeDataPafInfo +{ + MimeDataState data_state; + char boundary[ MAX_MIME_BOUNDARY_LEN + 1]; /* MIME boundary string + '\0' */ + int boundary_len; + char* boundary_search; + MimeBoundaryState boundary_state; +}; + typedef struct _MimePcre { pcre* re; pcre_extra* pe; } MimePcre; +/* log flags */ +#define MIME_FLAG_MAIL_FROM_PRESENT 0x00000001 +#define MIME_FLAG_RCPT_TO_PRESENT 0x00000002 +#define MIME_FLAG_FILENAME_PRESENT 0x00000004 +#define MIME_FLAG_EMAIL_HDRS_PRESENT 0x00000008 + + +typedef int (*Handle_header_line_func)(void* conf, const uint8_t* ptr, + const uint8_t* eol, int + max_header_len, void* mime_ssn); +typedef int (*Normalize_data_func)(void* conf, const uint8_t* ptr, + const uint8_t* data_end); +typedef void (*Decode_alert_func)(void* decode_state); +typedef void (*Reset_state_func)(void* ssn); +typedef bool (*Is_end_of_data_func)(void* ssn); + +struct MimeMethods +{ + Handle_header_line_func handle_header_line; + Normalize_data_func normalize_data; + Decode_alert_func decode_alert; + Reset_state_func reset_state; + Is_end_of_data_func is_end_of_data; +}; + +struct DecodeConfig +{ + bool ignore_data; + int max_mime_mem; + int max_depth; + int b64_depth; + int qp_depth; + int bitenc_depth; + int uu_depth; + int64_t file_depth; +}; + +struct MimeState +{ + int data_state; + int state_flags; + int log_flags; + void* decode_state; + MimeDataPafInfo mime_boundary; + DecodeConfig* decode_conf; + MAIL_LogConfig* log_config; + MAIL_LogState* log_state; + void* config; + MimeMethods* methods; +}; + +static inline bool scanning_boundary(MimeDataPafInfo* mime_info, uint32_t boundary_start, + uint32_t* fp) +{ + if (boundary_start && + mime_info->data_state == MIME_PAF_FOUND_BOUNDARY_STATE && + mime_info->boundary_state != MIME_PAF_BOUNDARY_UNKNOWN) + { + *fp = boundary_start; + return true; + } + + return false; +} + + int log_file_name(const uint8_t* start, int length, FILE_LogState* log_state, bool* disp_cont); int set_log_buffers(MAIL_LogState** log_state, MAIL_LogConfig* conf); void init_mime(void); diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h index d9f58e215..352901d94 100644 --- a/src/service_inspectors/http_inspect/hi_ui_config.h +++ b/src/service_inspectors/http_inspect/hi_ui_config.h @@ -39,6 +39,7 @@ #include "sf_ip.h" #include "hi_util_kmap.h" #include "file_api/file_api.h" +#include "file_api/file_mime_process.h" #include "decompress/file_decomp.h" #include "framework/bits.h" diff --git a/src/service_inspectors/imap/imap_config.h b/src/service_inspectors/imap/imap_config.h index 40b1bc50e..e400147e2 100644 --- a/src/service_inspectors/imap/imap_config.h +++ b/src/service_inspectors/imap/imap_config.h @@ -20,7 +20,7 @@ #ifndef IMAP_CONFIG_H #define IMAP_CONFIG_H -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" struct IMAP_PROTO_CONF { diff --git a/src/service_inspectors/imap/imap_paf.h b/src/service_inspectors/imap/imap_paf.h index b38174719..14ec73e5e 100644 --- a/src/service_inspectors/imap/imap_paf.h +++ b/src/service_inspectors/imap/imap_paf.h @@ -24,7 +24,7 @@ #include "snort_types.h" #include "stream/stream_api.h" #include "stream/stream_splitter.h" -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" struct ImapDataInfo { diff --git a/src/service_inspectors/pop/pop_config.h b/src/service_inspectors/pop/pop_config.h index f7e65fda7..487b26990 100644 --- a/src/service_inspectors/pop/pop_config.h +++ b/src/service_inspectors/pop/pop_config.h @@ -20,7 +20,7 @@ #ifndef POP_CONFIG_H #define POP_CONFIG_H -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" struct POP_PROTO_CONF { diff --git a/src/service_inspectors/pop/pop_paf.h b/src/service_inspectors/pop/pop_paf.h index 21d16864a..2ebafdd5e 100644 --- a/src/service_inspectors/pop/pop_paf.h +++ b/src/service_inspectors/pop/pop_paf.h @@ -24,7 +24,7 @@ #include "snort_types.h" #include "stream/stream_api.h" #include "stream/stream_splitter.h" -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" /* Structure used to record expected server termination sequence */ enum PopExpectedResp diff --git a/src/service_inspectors/smtp/smtp_config.h b/src/service_inspectors/smtp/smtp_config.h index 2b03dad6b..6f2996ae2 100644 --- a/src/service_inspectors/smtp/smtp_config.h +++ b/src/service_inspectors/smtp/smtp_config.h @@ -20,7 +20,7 @@ #ifndef SMTP_CONFIG_H #define SMTP_CONFIG_H -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" #include "search_engines/search_tool.h" enum NORM_TYPES { diff --git a/src/service_inspectors/smtp/smtp_paf.h b/src/service_inspectors/smtp/smtp_paf.h index d64e3f916..f1f559738 100644 --- a/src/service_inspectors/smtp/smtp_paf.h +++ b/src/service_inspectors/smtp/smtp_paf.h @@ -22,7 +22,7 @@ #include "snort_types.h" #include "stream/stream_api.h" #include "stream/stream_splitter.h" -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" /* State tracker for SMTP PAF */ enum SmtpPafState