smtp_config.c

Snort为国际上著名的轻量型入侵防御系统,为国内多家著名“自主知识产权”网络安全公司所使用。

**
**  @return an error code integer 
**          (0 = success, >0 = non-fatal error, <0 = fatal error)
**
**  @retval  0 successs
**  @retval -1 generic fatal error
**  @retval  1 generic non-fatal error
*/
static int ProcessPorts(char *ErrorString, int ErrStrLen)
{
    char *pcToken;
    char *pcEnd;
    int  iPort;
    int  iEndPorts = 0;

    pcToken = strtok(NULL, CONF_SEPARATORS);
    if(!pcToken)
    {
        snprintf(ErrorString, ErrStrLen,
                "Invalid port list format.");

        return -1;
    }

    if(strcmp(START_LIST, pcToken))
    {
        snprintf(ErrorString, ErrStrLen,
                "Must start a port list with the '%s' token.",
                START_LIST);

        return -1;
    }

    /* Since ports are specified, clear default ports */
    _smtp_config.ports[SMTP_DEFAULT_SERVER_PORT/8] &= ~(1 << SMTP_DEFAULT_SERVER_PORT%8);
    _smtp_config.ports[XLINK2STATE_DEFAULT_PORT/8] &= ~(1 << XLINK2STATE_DEFAULT_PORT%8);

    while((pcToken = strtok(NULL, CONF_SEPARATORS)))
    {
        if(!strcmp(END_LIST, pcToken))
        {
            iEndPorts = 1;
            break;
        }

        iPort = strtol(pcToken, &pcEnd, 10);

        /*
        **  Validity check for port
        */
        if(*pcEnd)
        {
            snprintf(ErrorString, ErrStrLen,
                    "Invalid port number.");

            return -1;
        }

        if(iPort < 0 || iPort > 65535)
        {
            snprintf(ErrorString, ErrStrLen,
                    "Invalid port number.  Must be between 0 and "
                    "65535.");

            return -1;
        }

        _smtp_config.ports[iPort/8] |= (1 << iPort%8);
    }

    if(!iEndPorts)
    {
        snprintf(ErrorString, ErrStrLen,
                "Must end '%s' configuration with '%s'.",
                PORTS, END_LIST);

        return -1;
    }

    return 0;
}

/*
**  NAME
**    ProcessCmds::
*/
/**
**  Process the command list.
**
**  This configuration is a list of valid ports and is ended by a 
**  delimiter.
**
**  @param ErrorString error string buffer
**  @param ErrStrLen   the length of the error string buffer
**
**  @return an error code integer 
**          (0 = success, >0 = non-fatal error, <0 = fatal error)
**
**  @retval  0 successs
**  @retval -1 generic fatal error
*/
static int ProcessCmds(char *ErrorString, int ErrStrLen, u_int alert)
{
    char *pcToken;
    int   iEndCmds = 0;
    int   ret;
    
    pcToken = strtok(NULL, CONF_SEPARATORS);
    if(!pcToken)
    {
        snprintf(ErrorString, ErrStrLen,
                "Invalid command list format.");

        return -1;
    }

    if(strcmp(START_LIST, pcToken))
    {
        snprintf(ErrorString, ErrStrLen,
                "Must start a command list with the '%s' token.",
                START_LIST);

        return -1;
    }
    
    while((pcToken = strtok(NULL, CONF_SEPARATORS)))
    {
        if(!strcmp(END_LIST, pcToken))
        {
            iEndCmds = 1;
            break;
        }
        if ( alert )
        {
            u_int id = GetCmdId(pcToken);

            ret = AddAlertCmd(pcToken, id, alert == 1 ? 1 : 0);   
            if ( ret == -1 )
            {
                snprintf(ErrorString, ErrStrLen,
                                "Error setting alert for cmd %s.", pcToken);
                return -1;
            }
        }
        else
        {
            ret = AddNormalizeCmd(pcToken);
            if ( ret == -1 )
            {
                snprintf(ErrorString, ErrStrLen,
                                "Error setting normalization for cmd %s.", pcToken);
                return -1;
            }
        }
    }

    if(!iEndCmds)
    {
        if ( alert )
        {
            snprintf(ErrorString, ErrStrLen,
                    "Must end '%s' configuration with '%s'.",
                    alert == 1 ? INVALID_CMDS : VALID_CMDS, END_LIST);
        }
        else
        {
             snprintf(ErrorString, ErrStrLen,
                    "Must end '%s' configuration with '%s'.",
                    NORMALIZE_CMDS, END_LIST);
        }
        return -1;
    }

    return 0;
}

/* Return id associated with a given command string */
static u_int GetCmdId(char *name)
{
    SMTP_cmd *smtp_cmd;

    /*
     *  Build configured list of commands we do not alert on.
     */
    smtp_cmd = _smtp_known_cmds;
    while ( smtp_cmd->name != NULL )
    {
        if ( strcmp(smtp_cmd->name, name) == 0 )
        {
            return smtp_cmd->id;
        }
        smtp_cmd++;
    }
    
    return CMD_OTHER;
}

/* Return -1 on error */
static int AddAlertCmd(char *name, u_int id, u_int alert)
{
    int found = 0;
    int i;

    /* Only add if name valid command name */
    if ( name == NULL )
        return 0;  /* Not necessarily an error */

    /* See if command already in list */
    for ( i = 0; i < _smtp_config.cmd_size; i++ )
    {
        if ( strcmp(_smtp_config.cmd[i].name, name) == 0 )
        {
            found = 1;
            break;
        }
    }

    if ( found )
    {
        _smtp_config.cmd[i].alert = alert;
        return 0;
    }

    if ( _smtp_config.cmd_size == 0 )
    {
        _smtp_config.cmd = (SMTP_token *) malloc(2*sizeof(SMTP_token));
         
        if ( _smtp_config.cmd == NULL )
            return -1;

        _smtp_config.cmd_size++;
    }
    else
    {
        _smtp_config.cmd_size++;
        _smtp_config.cmd = (SMTP_token *) realloc(_smtp_config.cmd,
                                   (1+_smtp_config.cmd_size)*sizeof(SMTP_token));
        if ( _smtp_config.cmd == NULL )
            return -1;
    }
    _smtp_config.cmd[_smtp_config.cmd_size-1].name  = strdup(name);
    if ( _smtp_config.cmd[_smtp_config.cmd_size-1].name == NULL )
        return -1;
    _smtp_config.cmd[_smtp_config.cmd_size-1].name_len = 0;
    _smtp_config.cmd[_smtp_config.cmd_size-1].id    = id;
    _smtp_config.cmd[_smtp_config.cmd_size-1].alert = alert;
    _smtp_config.cmd[_smtp_config.cmd_size-1].normalize = 0;
    _smtp_config.cmd[_smtp_config.cmd_size-1].max_len = 0;
    _smtp_config.cmd[_smtp_config.cmd_size].name    = NULL;
    _smtp_config.cmd[_smtp_config.cmd_size].name_len = 0;
    _smtp_config.cmd[_smtp_config.cmd_size].id      = 0;
    _smtp_config.cmd[_smtp_config.cmd_size].alert   = 0;
    _smtp_config.cmd[_smtp_config.cmd_size].normalize   = 0;
    _smtp_config.cmd[_smtp_config.cmd_size].max_len = 0;
   
    return 0;
}




/* Return -1 on error */
static int AddNormalizeCmd(char *name)
{
    SMTP_token *cmd;

    /* Only add if name valid command name */
    if ( name == NULL )
        return 0;  /* Not necessarily an error */

    /*  Find command */
    for ( cmd = _smtp_config.cmd; cmd->name != NULL; cmd++ )
    {
        if ( !strncasecmp(name, cmd->name, strlen(name)) )
        {
            cmd->normalize = 1;
            return 0;
        }
    }

    return -1;
}



/*
**  NAME
**    ProcessAltMaxCmdLen::
*/
/**
**
**   alt_max_command_line_len <int> { <cmd> [<cmd>] }
**
**  @param ErrorString error string buffer
**  @param ErrStrLen   the length of the error string buffer
**
**  @return an error code integer 
**          (0 = success, >0 = non-fatal error, <0 = fatal error)
**
**  @retval  0 successs
**  @retval -1 generic fatal error
*/
static int ProcessAltMaxCmdLen(char *ErrorString, int ErrStrLen)
{
    char *pcToken;
    char *pcLen;
    int   iEndCmds = 0;
    int   ret;
    int   cmd_len;
    
    /* Find number */
    pcLen = strtok(NULL, CONF_SEPARATORS);
    if(!pcLen)
    {
        snprintf(ErrorString, ErrStrLen,
                "Invalid format for alt_max_command_line_len.");

        return -1;
    }

    pcToken = strtok(NULL, CONF_SEPARATORS);
    if(!pcLen)
    {
        snprintf(ErrorString, ErrStrLen,
                "Invalid format for alt_max_command_line_len.");

        return -1;
    }
    
    cmd_len = atoi(pcLen);

    if(strcmp(START_LIST, pcToken))
    {
        snprintf(ErrorString, ErrStrLen,
                "Must start alt_max_command_line_len list with the '%s' token.",
                START_LIST);

        return -1;
    }
    
    while((pcToken = strtok(NULL, CONF_SEPARATORS)))
    {
        if(!strcmp(END_LIST, pcToken))
        {
            iEndCmds = 1;
            break;
        }
        
        ret = SetCmdLen(pcToken, cmd_len);   
        if ( ret == -1 )
        {
            snprintf(ErrorString, ErrStrLen,
                            "Error setting alert for cmd %s.", pcToken);
            return -1;
        }        
    }

    if(!iEndCmds)
    {
        snprintf(ErrorString, ErrStrLen,
                "Must end alt_max_command_line_len configuration with '%s'.", END_LIST);
     
        return -1;
    }

    return cmd_len;
}


/* Return -1 on error */
static int SetCmdLen(char *name, u_int max_len)
{
    SMTP_token *cmd;

    /* Only add if name valid command name */
    if ( name == NULL )
        return 0;  /* Not necessarily an error */

    /*  Find command */
    for ( cmd = _smtp_config.cmd; cmd->name != NULL; cmd++ )
    {
        if ( !strncasecmp(name, cmd->name, strlen(name)) )
        {
            cmd->max_len = max_len;
            return 0;
        }
    }

    return -1;
}

/*
**  NAME
**    ProcessXlink2State::
*/
/**
**
**   xlink2state { <enable/disable> <drop> }
**
**  @param ErrorString error string buffer
**  @param ErrStrLen   the length of the error string buffer
**
**  @return an error code integer 
**          (0 = success, >0 = non-fatal error, <0 = fatal error)
**
**  @retval  0 successs
**  @retval -1 generic fatal error
*/
static int ProcessXlink2State(char *ErrorString, int ErrStrLen)
{
    char *pcToken;
    int  iEnd = 0;

    pcToken = strtok(NULL, CONF_SEPARATORS);
    if(!pcToken)
    {
        snprintf(ErrorString, ErrStrLen,
                "Invalid xlink2state argument format.");

        return -1;
    }

    if(strcmp(START_LIST, pcToken))
    {
        snprintf(ErrorString, ErrStrLen,
                "Must start xlink2state arguments with the '%s' token.",
                START_LIST);

        return -1;
    }
    
    while((pcToken = strtok(NULL, CONF_SEPARATORS)))
    {
        if(!strcmp(END_LIST, pcToken))
        {
            iEnd = 1;
            break;
        }

        if ( !strcasecmp(DISABLE, pcToken) )
        {
            _smtp_config.alert_xlink2state = 0;
        }
        else if ( !strcasecmp(ENABLE, pcToken) )
        {
            _smtp_config.alert_xlink2state = 1;
        }
        else if ( !strcasecmp(INLINE_DROP, pcToken) )
        {
            if (_dpd.inlineMode())
            {
                _smtp_config.drop_xlink2state = 1;
            }
            else
            {
                _dpd.logMsg("%s(%d) WARNING: drop keyword ignored."
                           "snort is not in inline mode\n",
                           *(_dpd.config_file), *(_dpd.config_line));
            }
        }
    }

    if(!iEnd)
    {
        snprintf(ErrorString, ErrStrLen,
                "Must end '%s' configuration with '%s'.",
                PORTS, END_LIST);

        return -1;
    }

    return 0;
}