~ubuntu-branches/ubuntu/utopic/suricata/utopic

Viewing changes to src/util-classification-config.c

Committer: Package Import Robot
Author(s): Pierre Chifflier
Date: 2012-07-22 22:27:36 UTC
mfrom: (1.1.13)
Revision ID: package-import@ubuntu.com-20120722222736-s2bcw3ruzenagjam

Tags: 1.3-1

* Imported Upstream version 1.3
* Add build-dependency on libnss3-dev and libnspr4-dev
* Bump Standards Version to 3.9.3

files added:
.pc

.pc/.quilt_patches

.pc/.quilt_series

.pc/.version

libhtp/config.guess

libhtp/config.sub

libhtp/depcomp

libhtp/install-sh

libhtp/ltmain.sh

libhtp/missing

rules/files.rules

src/app-layer-tls-handshake.c

src/app-layer-tls-handshake.h

src/detect-engine-analyzer.c

src/detect-engine-analyzer.h

src/detect-engine-content-inspection.c

src/detect-engine-content-inspection.h

src/detect-engine-hscd.c

src/detect-engine-hscd.h

src/detect-engine-hsmd.c

src/detect-engine-hsmd.h

src/detect-engine-hua.c

src/detect-engine-hua.h

src/detect-filemd5.c

src/detect-filemd5.h

src/detect-http-ua.c

src/detect-http-ua.h

src/detect-tls.c

src/detect-tls.h

src/host-queue.c

src/host-queue.h

src/host-timeout.c

src/host-timeout.h

src/log-filestore.c

src/log-filestore.h

src/ptxdump.py

src/runmode-napatech.c

src/runmode-napatech.h

src/source-napatech.c

src/source-napatech.h

src/util-atomic.c

src/util-buffer.c

src/util-buffer.h

src/util-decode-der-get.c

src/util-decode-der-get.h

src/util-decode-der.c

src/util-decode-der.h

src/util-hash-lookup3.c

src/util-hash-lookup3.h

src/util-mpm-ac-bs.c

src/util-mpm-ac-bs.h

src/util-mpm-b2g-cuda-kernel.cu

src/util-profiling-locks.c

src/util-profiling-locks.h

src/util-rohash.c

src/util-rohash.h

src/util-signal.c

src/util-signal.h

suricata.yaml.in

files removed:
src/detect-recursive.c

src/detect-recursive.h

suricata.yaml

files modified:
ChangeLog

Makefile.am

Makefile.in

aclocal.m4

config.guess

config.h.in

config.sub

configure

configure.in

debian/changelog

debian/control

debian/rules

depcomp

doc/Makefile.in

install-sh

libhtp/INSTALL

libhtp/Makefile.in

libhtp/aclocal.m4

libhtp/configure

libhtp/configure.ac

libhtp/htp/Makefile.in

libhtp/htp/bstr.c

libhtp/htp/bstr.h

libhtp/htp/htp.h

libhtp/htp/htp_config.c

libhtp/htp/htp_connection_parser.c

libhtp/htp/htp_decompressors.c

libhtp/htp/htp_request.c

libhtp/htp/htp_response.c

libhtp/htp/htp_transaction.c

libhtp/htp/htp_util.c

libhtp/test/Makefile.in

ltmain.sh *

m4/libtool.m4

m4/ltoptions.m4

m4/ltversion.m4

missing

qa/Makefile.in

qa/coccinelle/Makefile.in

qa/coccinelle/access-pkt-packet.cocci

qa/coccinelle/banned-functions.cocci

rules/Makefile.am

rules/Makefile.in

rules/decoder-events.rules

rules/http-events.rules

rules/stream-events.rules

src/Makefile.am

src/Makefile.in

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-pcapinfo.c

src/alert-prelude.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-udp.c

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-detect-proto.h

src/app-layer-ftp.c

src/app-layer-htp-body.c

src/app-layer-htp-file.c

src/app-layer-htp.c

src/app-layer-htp.h

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-smb.c

src/app-layer-smb2.c

src/app-layer-smtp.c

src/app-layer-ssh.c

src/app-layer-ssl.c

src/app-layer-ssl.h

src/app-layer.c

src/conf-yaml-loader.c

src/conf.c

src/conf.h

src/counters.c

src/cuda-packet-batcher.c

src/decode-events.c

src/decode-events.h

src/decode-icmpv4.c

src/decode-icmpv4.h

src/decode-icmpv6.c

src/decode-icmpv6.h

src/decode-ipv4.c

src/decode-ipv4.h

src/decode-ipv6.c

src/decode-ipv6.h

src/decode-tcp.h

src/decode-udp.h

src/decode.c

src/decode.h

src/defrag.c

src/detect-ack.c

src/detect-app-layer-event.c

src/detect-asn1.c

src/detect-byte-extract.c

src/detect-byte-extract.h

src/detect-bytejump.c

src/detect-bytetest.c

src/detect-classtype.c

src/detect-content.c

src/detect-content.h

src/detect-csum.c

src/detect-dce-iface.c

src/detect-dce-opnum.c

src/detect-dce-stub-data.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-distance.c

src/detect-dsize.c

src/detect-engine-address-ipv6.c

src/detect-engine-address.c

src/detect-engine-address.h

src/detect-engine-alert.c

src/detect-engine-alert.h

src/detect-engine-dcepayload.c

src/detect-engine-event.c

src/detect-engine-event.h

src/detect-engine-file.c

src/detect-engine-hcbd.c

src/detect-engine-hcbd.h

src/detect-engine-hcd.c

src/detect-engine-hcd.h

src/detect-engine-hhd.c

src/detect-engine-hmd.c

src/detect-engine-hmd.h

src/detect-engine-hrhd.c

src/detect-engine-hrud.c

src/detect-engine-hrud.h

src/detect-engine-hsbd.c

src/detect-engine-hsbd.h

src/detect-engine-iponly.c

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-port.c

src/detect-engine-port.h

src/detect-engine-proto.c

src/detect-engine-proto.h

src/detect-engine-siggroup.c

src/detect-engine-siggroup.h

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-state.h

src/detect-engine-tag.c

src/detect-engine-tag.h

src/detect-engine-threshold.c

src/detect-engine-threshold.h

src/detect-engine-uri.c

src/detect-engine.c

src/detect-engine.h

src/detect-fast-pattern.c

src/detect-fast-pattern.h

src/detect-file-data.c

src/detect-fileext.c

src/detect-filemagic.c

src/detect-filename.c

src/detect-filestore.c

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-flowint.c

src/detect-flowvar.c

src/detect-fragbits.c

src/detect-fragoffset.c

src/detect-ftpbounce.c

src/detect-http-client-body.c

src/detect-http-cookie.c

src/detect-http-header.c

src/detect-http-method.c

src/detect-http-raw-header.c

src/detect-http-raw-uri.c

src/detect-http-server-body.c

src/detect-http-stat-code.c

src/detect-http-stat-code.h

src/detect-http-stat-msg.c

src/detect-http-uri.c

src/detect-icmp-id.c

src/detect-icmp-seq.c

src/detect-icode.c

src/detect-id.c

src/detect-ipopts.c

src/detect-ipproto.c

src/detect-isdataat.c

src/detect-itype.c

src/detect-mark.c

src/detect-nocase.c

src/detect-offset.c

src/detect-parse.c

src/detect-parse.h

src/detect-pcre.c

src/detect-pcre.h

src/detect-pktvar.c

src/detect-rawbytes.c

src/detect-reference.c

src/detect-replace.c

src/detect-rpc.c

src/detect-sameip.c

src/detect-seq.c

src/detect-ssh-proto-version.c

src/detect-ssh-software-version.c

src/detect-ssl-state.c

src/detect-ssl-version.c

src/detect-ssl-version.h

src/detect-stream_size.c

src/detect-tag.c

src/detect-tag.h

src/detect-threshold.c

src/detect-threshold.h

src/detect-tls-version.c

src/detect-tos.c

src/detect-ttl.c

src/detect-uricontent.c

src/detect-uricontent.h

src/detect-urilen.c

src/detect-window.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-alert-sid.c

src/flow-bit.c

src/flow-hash.c

src/flow-hash.h

src/flow-manager.c

src/flow-manager.h

src/flow-private.h

src/flow-queue.c

src/flow-queue.h

src/flow-timeout.c

src/flow-timeout.h

src/flow-util.c

src/flow-util.h

src/flow-var.c

src/flow.c

src/flow.h

src/host.c

src/host.h

src/log-droplog.c

src/log-file.c

src/log-httplog.c

src/log-pcap.c

src/runmode-af-packet.c

src/runmode-erf-dag.c

src/runmode-erf-dag.h

src/runmode-erf-file.c

src/runmode-erf-file.h

src/runmode-ipfw.c

src/runmode-nfq.c

src/runmode-pcap-file.c

src/runmode-pcap.c

src/runmode-pfring.c

src/runmodes.c

src/runmodes.h

src/source-af-packet.c

src/source-af-packet.h

src/source-erf-dag.c

src/source-erf-file.c

src/source-ipfw.c

src/source-nfq.c

src/source-pcap-file.c

src/source-pcap.c

src/source-pcap.h

src/source-pfring.c

src/stream-tcp-private.h

src/stream-tcp-reassemble.c

src/stream-tcp-reassemble.h

src/stream-tcp-sack.c

src/stream-tcp.c

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threads.h

src/threadvars.h

src/tm-modules.c

src/tm-modules.h

src/tm-queuehandlers.c

src/tm-queuehandlers.h

src/tm-threads-common.h

src/tm-threads.c

src/tm-threads.h

src/tmqh-flow.c

src/tmqh-flow.h

src/tmqh-packetpool.c

src/tmqh-packetpool.h

src/tmqh-ringbuffer.c

src/tmqh-ringbuffer.h

src/tmqh-simple.c

src/util-action.c

src/util-action.h

src/util-affinity.c

src/util-atomic.h

src/util-checksum.c

src/util-classification-config.c

src/util-classification-config.h

src/util-coredump-config.c

src/util-daemon.c

src/util-debug-filters.c

src/util-debug.c

src/util-debug.h

src/util-decode-asn1.c

src/util-device.c

src/util-error.c

src/util-error.h

src/util-file.c

src/util-file.h

src/util-hash.h

src/util-hashlist.h

src/util-logopenfile.c

src/util-magic.c

src/util-mem.h

src/util-misc.c

src/util-misc.h

src/util-mpm-ac-gfbs.c

src/util-mpm-ac.c

src/util-mpm-b2g-cuda.c

src/util-mpm-b2g-cuda.h

src/util-mpm-b3g.c

src/util-mpm-wumanber.c

src/util-mpm.c

src/util-mpm.h

src/util-print.c

src/util-print.h

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-reference-config.c

src/util-reference-config.h

src/util-ringbuffer.c

src/util-runmodes.c

src/util-spm-bm.c

src/util-spm-bm.h

src/util-spm-bs.c

src/util-spm-bs.h

src/util-spm-bs2bm.c

src/util-spm-bs2bm.h

src/util-spm.c

src/util-spm.h

src/util-threshold-config.c

src/util-time.c

src/util-time.h

src/util-unittest-helper.c

src/util-unittest.c

src/util-validate.h

src/util-var-name.c

src/util-var-name.h

Show diffs side-by-side

added added

removed removed

src/util-classification-config.c

#define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"

/* Default path for the classification.config file */

#define SC_CLASS_CONF_DEF_CONF_FILEPATH "classification.config"

#define SC_CLASS_CONF_DEF_CONF_FILEPATH CONFIG_DIR "/classification.config"

/* Holds a pointer to the default path for the classification.config file */

static const char *default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH;

* \retval 0 On success.

* \retval -1 On failure.

int SCClassConfInitContext(DetectEngineCtx *de_ctx)

int SCClassConfInitContextAndLocalResources(DetectEngineCtx *de_ctx)

{

char *filename = NULL;

const char *eb = NULL;

if (de_ctx->class_conf_ht == NULL) {

SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash "

"table");

return -1;

goto error;

}

/* if it is not NULL, use the file descriptor. The hack so that we can

123

fd = NULL;

124

}

125

126

printf("\nPlease check the \"classification-file\" option in your suricata.yaml file.\n");

127

exit(EXIT_FAILURE);

128

// return -1;

126

if (regex != NULL) {

127

pcre_free(regex);

128

regex = NULL;

129

}

130

if (regex_study != NULL) {

131

pcre_free(regex_study);

132

regex_study = NULL;

133

}

134

135

return -1;

129

136

}

130

137

131

138

152

159

/**

153

160

* \brief Releases resources used by the Classification Config API.

154

161

155

static void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)

162

static void SCClassConfDeInitLocalResources(DetectEngineCtx *de_ctx)

156

163

{

157

164

158

165

fclose(fd);

159

166

default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH;

160

167

fd = NULL;

168

if (regex != NULL) {

169

pcre_free(regex);

170

regex = NULL;

171

}

172

if (regex_study != NULL) {

173

pcre_free(regex_study);

174

regex_study = NULL;

175

}

176

177

return;

178

}

179

180

/**

181

* \brief Releases resources used by the Classification Config API.

182

183

void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)

184

{

185

if (de_ctx->class_conf_ht != NULL)

186

HashTableFree(de_ctx->class_conf_ht);

187

188

de_ctx->class_conf_ht = NULL;

189

161

190

return;

162

191

}

163

192

485

514

486

515

void SCClassConfLoadClassficationConfigFile(DetectEngineCtx *de_ctx)

487

516

{

488

if (SCClassConfInitContext(de_ctx) == -1) {

489

SCLogDebug("Error initializing classification config API");

490

return;

517

if (SCClassConfInitContextAndLocalResources(de_ctx) == -1) {

518

SCLogInfo("Please check the \"classification-file\" option in your suricata.yaml file");

519

exit(EXIT_FAILURE);

491

520

}

492

521

493

522

SCClassConfParseFile(de_ctx);

494

SCClassConfDeInitContext(de_ctx);

523

SCClassConfDeInitLocalResources(de_ctx);

495

524

496

525

return;

497

526

}

498

527

528

/**

529

* \brief Gets the classtype from the corresponding hash table stored

530

* in the Detection Engine Context's class conf ht, given the

531

* classtype name.

532

533

* \param ct_name Pointer to the classtype name that has to be looked up.

534

* \param de_ctx Pointer to the Detection Engine Context.

535

536

* \retval lookup_ct_info Pointer to the SCClassConfClasstype instance from

537

* the hash table on success; NULL on failure.

538

539

SCClassConfClasstype *SCClassConfGetClasstype(const char *ct_name,

540

DetectEngineCtx *de_ctx)

541

{

542

SCClassConfClasstype *ct_info = SCClassConfAllocClasstype(0, ct_name, NULL,

543

0);

544

if (ct_info == NULL)

545

return NULL;

546

SCClassConfClasstype *lookup_ct_info = HashTableLookup(de_ctx->class_conf_ht,

547

ct_info, 0);

548

549

SCClassConfDeAllocClasstype(ct_info);

550

return lookup_ct_info;

551

}

499

552

500

553

/*----------------------------------Unittests---------------------------------*/

501

554

668

721

int SCClassConfTest04(void)

669

722

{

670

723

DetectEngineCtx *de_ctx = DetectEngineCtxInit();

671

SCClassConfClasstype *ct = NULL;

672

724

int result = 1;

673

725

674

726

if (de_ctx == NULL)

683

735

684

736

result = (de_ctx->class_conf_ht->count == 3);

685

737

686

ct = SCClassConfAllocClasstype(0, "unknown", NULL, 0);

687

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

688

SCClassConfDeAllocClasstype(ct);

689

690

ct = SCClassConfAllocClasstype(0, "unKnoWn", NULL, 0);

691

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

692

SCClassConfDeAllocClasstype(ct);

693

694

ct = SCClassConfAllocClasstype(0, "bamboo", NULL, 0);

695

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

696

SCClassConfDeAllocClasstype(ct);

697

698

ct = SCClassConfAllocClasstype(0, "bad-unknown", NULL, 0);

699

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

700

SCClassConfDeAllocClasstype(ct);

701

702

ct = SCClassConfAllocClasstype(0, "BAD-UNKnOWN", NULL, 0);

703

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

704

SCClassConfDeAllocClasstype(ct);

705

706

ct = SCClassConfAllocClasstype(0, "bed-unknown", NULL, 0);

707

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

708

SCClassConfDeAllocClasstype(ct);

738

result &= (SCClassConfGetClasstype("unknown", de_ctx) != NULL);

739

result &= (SCClassConfGetClasstype("unKnoWn", de_ctx) != NULL);

740

result &= (SCClassConfGetClasstype("bamboo", de_ctx) == NULL);

741

result &= (SCClassConfGetClasstype("bad-unknown", de_ctx) != NULL);

742

result &= (SCClassConfGetClasstype("BAD-UNKnOWN", de_ctx) != NULL);

743

result &= (SCClassConfGetClasstype("bed-unknown", de_ctx) == NULL);

709

744

710

745

DetectEngineCtxFree(de_ctx);

711

746

720

755

int SCClassConfTest05(void)

721

756

{

722

757

DetectEngineCtx *de_ctx = DetectEngineCtxInit();

723

SCClassConfClasstype *ct = NULL;

724

758

int result = 1;

725

759

726

760

if (de_ctx == NULL)

735

769

736

770

result = (de_ctx->class_conf_ht->count == 0);

737

771

738

ct = SCClassConfAllocClasstype(0, "unknown", NULL, 0);

739

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

740

SCClassConfDeAllocClasstype(ct);

741

742

ct = SCClassConfAllocClasstype(0, "unKnoWn", NULL, 0);

743

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

744

SCClassConfDeAllocClasstype(ct);

745

746

ct = SCClassConfAllocClasstype(0, "bamboo", NULL, 0);

747

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

748

SCClassConfDeAllocClasstype(ct);

749

750

ct = SCClassConfAllocClasstype(0, "bad-unknown", NULL, 0);

751

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

752

SCClassConfDeAllocClasstype(ct);

753

754

ct = SCClassConfAllocClasstype(0, "BAD-UNKnOWN", NULL, 0);

755

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

756

SCClassConfDeAllocClasstype(ct);

757

758

ct = SCClassConfAllocClasstype(0, "bed-unknown", NULL, 0);

759

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

760

SCClassConfDeAllocClasstype(ct);

772

result &= (SCClassConfGetClasstype("unknown", de_ctx) == NULL);

773

result &= (SCClassConfGetClasstype("unKnoWn", de_ctx) == NULL);

774

result &= (SCClassConfGetClasstype("bamboo", de_ctx) == NULL);

775

result &= (SCClassConfGetClasstype("bad-unknown", de_ctx) == NULL);

776

result &= (SCClassConfGetClasstype("BAD-UNKnOWN", de_ctx) == NULL);

777

result &= (SCClassConfGetClasstype("bed-unknown", de_ctx) == NULL);

761

778

762

779

DetectEngineCtxFree(de_ctx);

763

780

771

788

int SCClassConfTest06(void)

772

789

{

773

790

DetectEngineCtx *de_ctx = DetectEngineCtxInit();

774

SCClassConfClasstype *ct = NULL;

775

791

int result = 1;

776

792

777

793

if (de_ctx == NULL)

786

802

787

803

result = (de_ctx->class_conf_ht->count == 3);

788

804

789

ct = SCClassConfAllocClasstype(0, "unknown", NULL, 0);

790

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

791

SCClassConfDeAllocClasstype(ct);

792

793

ct = SCClassConfAllocClasstype(0, "not-suspicious", NULL, 0);

794

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

795

SCClassConfDeAllocClasstype(ct);

796

797

ct = SCClassConfAllocClasstype(0, "bamboola1", NULL, 0);

798

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

799

SCClassConfDeAllocClasstype(ct);

800

801

ct = SCClassConfAllocClasstype(0, "bamboola1", NULL, 0);

802

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

803

SCClassConfDeAllocClasstype(ct);

804

805

ct = SCClassConfAllocClasstype(0, "BAMBOolA1", NULL, 0);

806

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) != NULL);

807

SCClassConfDeAllocClasstype(ct);

808

809

ct = SCClassConfAllocClasstype(0, "unkNOwn", NULL, 0);

810

result &= (HashTableLookup(de_ctx->class_conf_ht, ct, 0) == NULL);

811

SCClassConfDeAllocClasstype(ct);

805

result &= (SCClassConfGetClasstype("unknown", de_ctx) == NULL);

806

result &= (SCClassConfGetClasstype("not-suspicious", de_ctx) != NULL);

807

result &= (SCClassConfGetClasstype("bamboola1", de_ctx) != NULL);

808

result &= (SCClassConfGetClasstype("bamboola1", de_ctx) != NULL);

809

result &= (SCClassConfGetClasstype("BAMBOolA1", de_ctx) != NULL);

810

result &= (SCClassConfGetClasstype("unkNOwn", de_ctx) == NULL);

812

811

813

812

DetectEngineCtxFree(de_ctx);

814

813

Older »