root/pehunter/spp_pehunter.c

/*
 * spp_pehunter.c
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) 2007 Tillmann Werner
 *
 * Description:
 *
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif  /* HAVE_CONFIG_H */

#include <string.h>
#include <errno.h>

#include "sf_snort_packet.h"
#include "sf_dynamic_preprocessor.h"
#include "sf_snort_plugin_api.h"
#include "preprocids.h"

#include "spp_pehunter.h"
#include "pehunter.h"

#include "profiler.h"
#ifdef PERF_PROFILING
PreprocStats pehuntPerfStats;
PreprocStats pehuntDetectPerfStats;
int pehuntDetectCalled = 0;
#endif

#define CONF_SEPARATORS             " \t\n\r"


extern DynamicPreprocessorData _dpd;

static void PEHunterInit(u_char *);
void PEHunter_ParseArgs(u_char *args);
static void PrintPEHunterConfig(void);
static void FreePEHunterConfig(void);
static void HuntPE(void *, void *context);
static void PEHunterCleanExitFunction(int, void *);
static void PEHunterRestartFunction(int, void *);
static void HuntPE(void *pkt, void *context);


/*
 * Function: SetupPEHunter()
 *
 * Purpose: Registers the preprocessor keyword and initialization 
 *          function into the preprocessor list.  This is the function that
 *          gets called from InitPreprocessors() in plugbase.c.
 *
 * Arguments: None.
 *
 * Returns: void function
 *
 */
void SetupPEHunter()
{
    /* link the preprocessor keyword to the init function in
     * the preproc list */
    _dpd.registerPreproc("pehunter", PEHunterInit);
}


/*
 * Function: PEHunterInit(u_char *)
 *
 * Purpose: Calls the argument parsing function, performs final setup on data
 *          structs, links the preproc function into the function list.
 *
 * Arguments: args => ptr to argument string
 *
 * Returns: void function
 *
 */
static void PEHunterInit(u_char *args)
{
    static int bFirstConfig = 1;


    if(!_dpd.streamAPI)
    {
        _dpd.fatalMsg("PEHunterInit(): The Stream preprocessor must be enabled.\n");
    }


    /* Parse the argument list from the rules file */
    PEHunter_ParseArgs(args);


    /* Perform any other initialization functions that are required here */
//    PEHunter_Init();

    /* Put the preprocessor function into the function list */
    if ( bFirstConfig )
    {
        _dpd.addPreproc(HuntPE, PRIORITY_APPLICATION, PP_PEHUNTER);
        _dpd.addPreprocExit(PEHunterCleanExitFunction, NULL, PRIORITY_LAST, PP_PEHUNTER);
        _dpd.addPreprocRestart(PEHunterRestartFunction, NULL, PRIORITY_LAST, PP_PEHUNTER);
        bFirstConfig = 0;

#ifdef PERF_PROFILING
        _dpd.addPreprocProfileFunc("pehunter", (void*)&pehuntPerfStats, 0, _dpd.totalPerfStats);        
#endif
    }
}


/*
 * Function: PEHunter_ParseArgs(char *)
 *
 * Purpose: Process the preprocessor arguments from the rules file and
 *          initialize the preprocessor's data struct.  This function doesn't
 *          have to exist if it makes sense to parse the args in the init
 *          function.
 *
 * Arguments: args => argument list
 *
 * Returns: void function
 *
 */
void PEHunter_ParseArgs(u_char *args)
{
        char *arg;
        char *value;

        bzero(&_pehunterConfig, sizeof(PEHunterConfig));

        if ((!_dpd.streamAPI) || (_dpd.streamAPI->version < STREAM_API_VERSION4))
                _dpd.fatalMsg("%s(): Streaming & reassembly must be enabled\n", __PRETTY_FUNCTION__);

        if ( args == NULL )
        {
                return;
        }

        /* loop through args */
        arg = strtok((char *)args, CONF_SEPARATORS);
        while (arg != NULL)
        {
                if ( !strcasecmp("dump_dir", arg) ) {
                        value = strtok(NULL, CONF_SEPARATORS);
                        if ( value == NULL ) return;
                        if ((_pehunterConfig.dumpDir = strdup(value)) == NULL) {
                                _dpd.fatalMsg("%s(): Unable to allocate memory: %s\n", __PRETTY_FUNCTION__, strerror(errno));
                        }
                } else if ( !strcasecmp("debug", arg) ) {
                        _pehunterConfig.debug = 1;
                } else { 
                        _dpd.fatalMsg("%s(%d) => Unknown PEHunter configuration option %s\n",
                                *(_dpd.config_file), *(_dpd.config_line), arg);
                }
                /*  Get next token */
                arg = strtok(NULL, CONF_SEPARATORS);
        }

        PrintPEHunterConfig();

        if (_pehunterConfig.dumpDir == NULL)
        {
                _dpd.fatalMsg("%s(): No dump directory given. Check your config file.\n", __PRETTY_FUNCTION__);
        }
}


/*
 * Function: PrintPEHunterConfig(void)
 *
 * Purpose: Does what it's named
 *
 * Arguments: none
 *
 * Returns: void
 *
 */
static void PrintPEHunterConfig(void)
{
        /* print configuration */
        _dpd.logMsg("PEHunter config:\n");
        _dpd.logMsg("    Dump Directory:\t %s\n", _pehunterConfig.dumpDir);
        _dpd.logMsg("    Debug:\t\t %s\n", _pehunterConfig.debug ? "yes" : "no");
        _dpd.logMsg("\n");

        return;
}


/*
 * Function: FreePEHunterConfig(void)
 *
 * Purpose: Frees allocated memory for config options
 *
 * Arguments: none
 *
 * Returns: void
 *
 */
static void FreePEHunterConfig(void)
{
        free(_pehunterConfig.dumpDir);
        return;
}


/*
 * Function: HuntPE(Packet *)
 *
 * Purpose: Perform the preprocessor's intended function.  This can be
 *          simple (statistics collection) or complex (IP defragmentation)
 *          as you like.  Try not to destroy the performance of the whole
 *          system by trying to do too much....
 *
 * Arguments: p => pointer to the current packet data struct 
 *
 * Returns: void function
 *
 */
static void HuntPE(void *initial_pkt, void *context)
{
    SFSnortPacket *p = (SFSnortPacket *)initial_pkt;
    PROFILE_VARS;

    /* Make sure this preprocessor should run. */
    if (( !p ) ||
        ( !p->payload ) ||
        ( !p->payload_size ) ||
        /* check if we're waiting on stream reassembly */
        ( p->flags & FLAG_STREAM_INSERT))
    {
        return;
    }


    PREPROC_PROFILE_START(pehuntPerfStats);

    if (_pehunterConfig.debug) _dpd.logMsg("PEHunter: Processing packet with %u bytes.\n", p->payload_size);
    Hunt(p);
    
    PREPROC_PROFILE_END(pehuntPerfStats);
#ifdef PERF_PROFILING
    if (pehuntDetectCalled)
    {
        pehuntPerfStats.ticks -= pehuntDetectPerfStats.ticks;
        /* And Reset ticks to 0 */
        pehuntDetectPerfStats.ticks = 0;
        pehuntDetectCalled = 0;
    }
#endif

    /* 
     * if you need to issue an alert from your preprocessor, check out 
     * event_wrapper.h, there are some useful helper functions there
     */
}


/* 
 * Function: PEHunterCleanExitFunction(int, void *)
 *
 * Purpose: This function gets called when Snort is exiting, if there's
 *          any cleanup that needs to be performed (e.g. closing files)
 *          it should be done here.
 *
 * Arguments: signal => the code of the signal that was issued to Snort
 *            data => any arguments or data structs linked to this 
 *                    function when it was registered, may be
 *                    needed to properly exit
 *       
 * Returns: void function
 */                   
static void PEHunterCleanExitFunction(int signal, void *data)
{    
    FreePEHunterConfig();
//    PEHunter_Free();
}


/* 
 * Function: PEHunterRestartFunction(int, void *)
 *
 * Purpose: This function gets called when Snort is restarting on a SIGHUP,
 *          if there's any initialization or cleanup that needs to happen
 *          it should be done here.
 *
 * Arguments: signal => the code of the signal that was issued to Snort
 *            data => any arguments or data structs linked to this 
 *                    functioin when it was registered, may be
 *                    needed to properly exit
 *       
 * Returns: void function
 */                   
static void PEHunterRestartFunction(int signal, void *foo)
{
       /* restart code goes here */
}