sp_byte_check.c

著名的入侵检测系统snort的最新版本的源码

   
    if (idx->not_flag && strlen(cptr) == 0) 
    {
        idx->operator = BT_EQUALS;
    }
    else
    {
        /* set the operator */
        switch(*cptr)
        {
            case '<': idx->operator = BT_LESS_THAN;
                      break;

            case '=': idx->operator = BT_EQUALS;
                      break;

            case '>': idx->operator = BT_GREATER_THAN;
                      break;

            case '&': idx->operator = BT_AND;
                      break;

            case '^': idx->operator = BT_OR;
                      break;

            default: FatalError("ERROR %s(%d): byte_test unknown "
                             "operator ('%c, %s')\n", file_name, file_line, 
                             *cptr, toks[1]);
        }
    }

    errno = 0;

    /* set the value to test against */
    idx->cmp_value = strtoul(toks[2], &endp, 0);

    if(toks[2] == endp)
    {
        FatalError("%s(%d): Unable to parse as comparison value %s\n",
                   file_name, file_line, toks[2]);
    }

    if(errno == ERANGE)
    {
        printf("Bad range: %s\n", toks[2]);
    }

    /* set offset */
    idx->offset = strtol(toks[3], &endp, 10);

    
    if(toks[3] == endp)
    {
        FatalError("%s(%d): Unable to parse as offset value %s\n",
                   file_name, file_line, toks[3]);
    }

    
    i = 4;

    /* is it a relative offset? */
    if(num_toks > 4)
    {
        while(i < num_toks)
        {
            cptr = toks[i];

            while(isspace((int)*cptr)) {cptr++;}

            if(!strcasecmp(cptr, "relative"))
            {
                /* the offset is relative to the last pattern match */
                idx->relative_flag = 1;
            }
            else if(!strcasecmp(cptr, "string"))
            {
                /* the data will be represented as a string that needs 
                 * to be converted to an int, binary is assumed otherwise
                 */
                idx->data_string_convert_flag = 1;
            }
            else if(!strcasecmp(cptr, "little"))
            {
                idx->endianess = LITTLE;
            }
            else if(!strcasecmp(cptr, "big"))
            {
                /* this is the default */
                idx->endianess = BIG;
            }
            else if(!strcasecmp(cptr, "hex"))
            {
                idx->base = 16;
            }
            else if(!strcasecmp(cptr, "dec"))
            {
                idx->base = 10;
            }
            else if(!strcasecmp(cptr, "oct"))
            {
                idx->base = 8;
            }
            else
            {
                FatalError("%s(%d): unknown modifier \"%s\"\n", 
                        file_name, file_line, cptr);
            }

            i++;
        }
    }

    /* idx->base is only set if the parameter is specified */
    if(!idx->data_string_convert_flag && idx->base)
    {
        FatalError("%s(%d): hex, dec and oct modifiers must be used in conjunction \n"
                   "        with the 'string' modifier\n", file_name,file_line);
    }
    
    mSplitFree(&toks, num_toks);
}


/****************************************************************************
 * 
 * Function: ByteTest(char *, OptTreeNode *, OptFpList *)
 *
 * Purpose: Use this function to perform the particular detection routine
 *          that this rule keyword is supposed to encompass.
 *
 * Arguments: p => pointer to the decoded packet
 *            otn => pointer to the current rule's OTN
 *            fp_list => pointer to the function pointer list
 *
 * Returns: If the detection test fails, this function *must* return a zero!
 *          On success, it calls the next function in the detection list 
 *
 ****************************************************************************/
int ByteTest(Packet *p, struct _OptTreeNode *otn, OptFpList *fp_list)
{
    ByteTestData *btd;
    u_int32_t value = 0;
    int success = 0;
    int use_alt_buffer = p->packet_flags & PKT_ALT_DECODE;
    int dsize;
    const char *base_ptr, *end_ptr, *start_ptr;

    if(use_alt_buffer)
    {
        dsize = p->alt_dsize;
        start_ptr = (char *)DecodeBuffer;
        DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, 
                    "Using Alternative Decode buffer!\n"););
    }
    else
    {
        dsize = p->dsize;
        start_ptr = (char *) p->data;
    }

    base_ptr = start_ptr;
    end_ptr = start_ptr + dsize;
    
    DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
                "[*] byte test firing...\npayload starts at %p\n", start_ptr););

    if(doe_ptr)
    {
        /* @todo: possibly degrade to use the other buffer, seems non-intuitive*/        
        if(!inBounds((const u_int8_t *)start_ptr, (const u_int8_t *)end_ptr, doe_ptr))
        {
            DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
                                    "[*] byte test bounds check failed..\n"););
            return 0;
        }
    }

    btd = (ByteTestData *) fp_list->context;

    if(btd->relative_flag && doe_ptr)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
                                "Checking relative offset!\n"););
        base_ptr = (const char *)doe_ptr + btd->offset;
    }
    else
    {
        DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
                                "checking absolute offset %d\n", btd->offset););
        base_ptr = start_ptr + btd->offset;
    }


    /* both of these functions below perform their own bounds checking within
     * byte_extract.c
     */
       
    if(!btd->data_string_convert_flag)
    {
        if(byte_extract(btd->endianess, btd->bytes_to_compare,
                        (const u_int8_t *)base_ptr, (const u_int8_t *)start_ptr, (const u_int8_t *)end_ptr, &value))
        {
            DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
                                    "Byte Extraction Failed\n"););

            return 0;
        }
    }
    else
    {
        if(string_extract(btd->bytes_to_compare, btd->base,
                          (const u_int8_t *)base_ptr, (const u_int8_t *)start_ptr, (const u_int8_t *)end_ptr, &value))
        {
            DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,
                                    "String Extraction Failed\n"););

            return 0;
        }

    }

    DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, 
                "Grabbed %d bytes at offset %d, value = 0x%08X(%u)\n",
                btd->bytes_to_compare, btd->offset, value, value); );

    switch(btd->operator)
    {
        case BT_LESS_THAN: if(value < btd->cmp_value)
                               success = 1;
                           break;

        case BT_EQUALS: if(value == btd->cmp_value)
                            success = 1;
                        break;

        case BT_GREATER_THAN: if(value > btd->cmp_value)
                                  success = 1;
                              break;

        case BT_AND: if ((value & btd->cmp_value) > 0)
                         success = 1;
                     break;

        case BT_OR: if ((value ^ btd->cmp_value) > 0)
                        success = 1;
                    break;
    }

    if (btd->not_flag)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, 
                    "checking for not success...flag\n"););
        if (!success)
        {
            return fp_list->next->OptTestFunc(p, otn, fp_list->next);
        }
    }
    else if (success)
    {
        return fp_list->next->OptTestFunc(p, otn, fp_list->next);
    }

    /* if the test isn't successful, this function *must* return 0 */
    return 0;
}