mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 08:38:20 +00:00
Merge remote-tracking branch 'origin/topic/jsiwek/file-analysis' into topic/seth/file-analysis-exe-analyzer
Conflicts: src/CMakeLists.txt src/file_analysis.bif src/file_analysis/Info.cc
This commit is contained in:
Seth Hall
commit
e0276384e7
318 changed files with 8499 additions and 2109 deletions
|
|
@ -16,7 +16,11 @@ class Info;
|
|||
class Action {
|
||||
public:
|
||||
|
||||
virtual ~Action() {}
|
||||
virtual ~Action()
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Destroy action %d", tag);
|
||||
Unref(args);
|
||||
}
|
||||
|
||||
/**
|
||||
* Subclasses may override this to receive file data non-sequentially.
|
||||
|
|
@ -35,7 +39,9 @@ public:
|
|||
{ return true; }
|
||||
|
||||
/**
|
||||
* Subclasses may override this to specifically handle the end of a file.
|
||||
* Subclasses may override this to specifically handle an EOF signal,
|
||||
* which means no more data is going to be incoming and the action/analyzer
|
||||
* may be deleted/cleaned up soon.
|
||||
* @return true if the action is still in a valid state to continue
|
||||
* receiving data/events or false if it's essentially "done".
|
||||
*/
|
||||
|
|
@ -50,17 +56,45 @@ public:
|
|||
virtual bool Undelivered(uint64 offset, uint64 len)
|
||||
{ return true; }
|
||||
|
||||
/**
|
||||
* @return the action type enum value.
|
||||
*/
|
||||
ActionTag Tag() const { return tag; }
|
||||
|
||||
/**
|
||||
* @return the ActionArgs associated with the aciton.
|
||||
*/
|
||||
RecordVal* Args() const { return args; }
|
||||
|
||||
/**
|
||||
* @return the file_analysis::Info object to which the action is attached.
|
||||
*/
|
||||
Info* GetInfo() const { return info; }
|
||||
|
||||
/**
|
||||
* @return the action tag equivalent of the 'act' field from the ActionArgs
|
||||
* value \a args.
|
||||
*/
|
||||
static ActionTag ArgsTag(const RecordVal* args)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionArgs;
|
||||
return static_cast<ActionTag>(
|
||||
args->Lookup(ActionArgs->FieldOffset("act"))->AsEnum());
|
||||
}
|
||||
|
||||
protected:
|
||||
|
||||
Action(Info* arg_info, ActionTag arg_tag) : info(arg_info), tag(arg_tag) {}
|
||||
Action(RecordVal* arg_args, Info* arg_info)
|
||||
: tag(Action::ArgsTag(arg_args)), args(arg_args->Ref()->AsRecordVal()),
|
||||
info(arg_info)
|
||||
{}
|
||||
|
||||
Info* info;
|
||||
ActionTag tag;
|
||||
RecordVal* args;
|
||||
Info* info;
|
||||
};
|
||||
|
||||
typedef Action* (*ActionInstantiator)(const RecordVal* args, Info* info);
|
||||
typedef Action* (*ActionInstantiator)(RecordVal* args, Info* info);
|
||||
|
||||
} // namespace file_analysis
|
||||
|
||||
|
|
|
|||
187
src/file_analysis/ActionSet.cc
Normal file
187
src/file_analysis/ActionSet.cc
Normal file
|
|
@ -0,0 +1,187 @@
|
|||
#include "ActionSet.h"
|
||||
#include "Info.h"
|
||||
#include "Action.h"
|
||||
#include "Extract.h"
|
||||
#include "DataEvent.h"
|
||||
#include "Hash.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
// keep in order w/ declared enum values in file_analysis.bif
|
||||
static ActionInstantiator action_factory[] = {
|
||||
Extract::Instantiate,
|
||||
MD5::Instantiate,
|
||||
SHA1::Instantiate,
|
||||
SHA256::Instantiate,
|
||||
DataEvent::Instantiate,
|
||||
};
|
||||
|
||||
static void action_del_func(void* v)
|
||||
{
|
||||
delete (Action*) v;
|
||||
}
|
||||
|
||||
ActionSet::ActionSet(Info* arg_info) : info(arg_info)
|
||||
{
|
||||
TypeList* t = new TypeList();
|
||||
t->Append(BifType::Record::FileAnalysis::ActionArgs->Ref());
|
||||
action_hash = new CompositeHash(t);
|
||||
Unref(t);
|
||||
action_map.SetDeleteFunc(action_del_func);
|
||||
}
|
||||
|
||||
ActionSet::~ActionSet()
|
||||
{
|
||||
while ( ! mod_queue.empty() )
|
||||
{
|
||||
Modification* mod = mod_queue.front();
|
||||
mod->Abort();
|
||||
delete mod;
|
||||
mod_queue.pop();
|
||||
}
|
||||
delete action_hash;
|
||||
}
|
||||
|
||||
bool ActionSet::AddAction(RecordVal* args)
|
||||
{
|
||||
HashKey* key = GetKey(args);
|
||||
|
||||
if ( action_map.Lookup(key) )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Instantiate action %d skipped for file id"
|
||||
" %s: already exists", Action::ArgsTag(args),
|
||||
info->GetFileID().c_str());
|
||||
delete key;
|
||||
return true;
|
||||
}
|
||||
|
||||
Action* act = InstantiateAction(args);
|
||||
|
||||
if ( ! act )
|
||||
{
|
||||
delete key;
|
||||
return false;
|
||||
}
|
||||
|
||||
InsertAction(act, key);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool ActionSet::QueueAddAction(RecordVal* args)
|
||||
{
|
||||
HashKey* key = GetKey(args);
|
||||
Action* act = InstantiateAction(args);
|
||||
|
||||
if ( ! act )
|
||||
{
|
||||
delete key;
|
||||
return false;
|
||||
}
|
||||
|
||||
mod_queue.push(new Add(act, key));
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool ActionSet::Add::Perform(ActionSet* set)
|
||||
{
|
||||
if ( set->action_map.Lookup(key) )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Add action %d skipped for file id"
|
||||
" %s: already exists", act->Tag(),
|
||||
act->GetInfo()->GetFileID().c_str());
|
||||
Abort();
|
||||
return true;
|
||||
}
|
||||
|
||||
set->InsertAction(act, key);
|
||||
return true;
|
||||
}
|
||||
|
||||
bool ActionSet::RemoveAction(const RecordVal* args)
|
||||
{
|
||||
return RemoveAction(Action::ArgsTag(args), GetKey(args));
|
||||
}
|
||||
|
||||
bool ActionSet::RemoveAction(ActionTag tag, HashKey* key)
|
||||
{
|
||||
Action* act = (Action*) action_map.Remove(key);
|
||||
delete key;
|
||||
|
||||
if ( ! act )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Skip remove action %d for file id %s",
|
||||
tag, info->GetFileID().c_str());
|
||||
return false;
|
||||
}
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Remove action %d for file id %s", act->Tag(),
|
||||
info->GetFileID().c_str());
|
||||
delete act;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool ActionSet::QueueRemoveAction(const RecordVal* args)
|
||||
{
|
||||
HashKey* key = GetKey(args);
|
||||
ActionTag tag = Action::ArgsTag(args);
|
||||
|
||||
mod_queue.push(new Remove(tag, key));
|
||||
|
||||
return action_map.Lookup(key);
|
||||
}
|
||||
|
||||
bool ActionSet::Remove::Perform(ActionSet* set)
|
||||
{
|
||||
return set->RemoveAction(tag, key);
|
||||
}
|
||||
|
||||
HashKey* ActionSet::GetKey(const RecordVal* args) const
|
||||
{
|
||||
HashKey* key = action_hash->ComputeHash(args, 1);
|
||||
if ( ! key )
|
||||
reporter->InternalError("ActionArgs type mismatch");
|
||||
return key;
|
||||
}
|
||||
|
||||
Action* ActionSet::InstantiateAction(RecordVal* args) const
|
||||
{
|
||||
Action* act = action_factory[Action::ArgsTag(args)](args, info);
|
||||
|
||||
if ( ! act )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Instantiate action %d failed for file id",
|
||||
" %s", Action::ArgsTag(args), info->GetFileID().c_str());
|
||||
return 0;
|
||||
}
|
||||
|
||||
return act;
|
||||
}
|
||||
|
||||
void ActionSet::InsertAction(Action* act, HashKey* key)
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Add action %d for file id %s", act->Tag(),
|
||||
info->GetFileID().c_str());
|
||||
action_map.Insert(key, act);
|
||||
delete key;
|
||||
info->GetVal()->Lookup(Info::actions_idx)->AsTableVal()->Assign(act->Args(),
|
||||
new RecordVal(BifType::Record::FileAnalysis::ActionResults));
|
||||
}
|
||||
|
||||
void ActionSet::DrainModifications()
|
||||
{
|
||||
if ( mod_queue.empty() ) return;
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Start flushing action mod queue of file id %s",
|
||||
info->GetFileID().c_str());
|
||||
do
|
||||
{
|
||||
Modification* mod = mod_queue.front();
|
||||
mod->Perform(this);
|
||||
delete mod;
|
||||
mod_queue.pop();
|
||||
} while ( ! mod_queue.empty() );
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "End flushing action mod queue of file id %s",
|
||||
info->GetFileID().c_str());
|
||||
}
|
||||
104
src/file_analysis/ActionSet.h
Normal file
104
src/file_analysis/ActionSet.h
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
#ifndef FILE_ANALYSIS_ACTIONSET_H
|
||||
#define FILE_ANALYSIS_ACTIONSET_H
|
||||
|
||||
#include <queue>
|
||||
|
||||
#include "Action.h"
|
||||
#include "Dict.h"
|
||||
#include "CompHash.h"
|
||||
#include "Val.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
class Info;
|
||||
declare(PDict,Action);
|
||||
|
||||
class ActionSet {
|
||||
public:
|
||||
|
||||
ActionSet(Info* arg_info);
|
||||
|
||||
~ActionSet();
|
||||
|
||||
/**
|
||||
* @return true if action was instantiated/attached, else false.
|
||||
*/
|
||||
bool AddAction(RecordVal* args);
|
||||
|
||||
/**
|
||||
* @return true if action was able to be instantiated, else false.
|
||||
*/
|
||||
bool QueueAddAction(RecordVal* args);
|
||||
|
||||
/**
|
||||
* @return false if action didn't exist and so wasn't removed, else true.
|
||||
*/
|
||||
bool RemoveAction(const RecordVal* args);
|
||||
|
||||
/**
|
||||
* @return true if action exists at time of call, else false;
|
||||
*/
|
||||
bool QueueRemoveAction(const RecordVal* args);
|
||||
|
||||
/**
|
||||
* Perform all queued modifications to the currently active actions.
|
||||
*/
|
||||
void DrainModifications();
|
||||
|
||||
IterCookie* InitForIteration() const
|
||||
{ return action_map.InitForIteration(); }
|
||||
|
||||
Action* NextEntry(IterCookie* c)
|
||||
{ return action_map.NextEntry(c); }
|
||||
|
||||
protected:
|
||||
|
||||
HashKey* GetKey(const RecordVal* args) const;
|
||||
Action* InstantiateAction(RecordVal* args) const;
|
||||
void InsertAction(Action* act, HashKey* key);
|
||||
bool RemoveAction(ActionTag tag, HashKey* key);
|
||||
|
||||
Info* info;
|
||||
CompositeHash* action_hash; /**< ActionArgs hashes Action map lookup. */
|
||||
PDict(Action) action_map; /**< Actions indexed by ActionArgs. */
|
||||
|
||||
class Modification {
|
||||
public:
|
||||
virtual ~Modification() {}
|
||||
virtual bool Perform(ActionSet* set) = 0;
|
||||
virtual void Abort() = 0;
|
||||
};
|
||||
|
||||
class Add : public Modification {
|
||||
public:
|
||||
Add(Action* arg_act, HashKey* arg_key)
|
||||
: Modification(), act(arg_act), key(arg_key) {}
|
||||
virtual ~Add() {}
|
||||
virtual bool Perform(ActionSet* set);
|
||||
virtual void Abort() { delete act; delete key; }
|
||||
|
||||
protected:
|
||||
Action* act;
|
||||
HashKey* key;
|
||||
};
|
||||
|
||||
class Remove : public Modification {
|
||||
public:
|
||||
Remove(ActionTag arg_tag, HashKey* arg_key)
|
||||
: Modification(), tag(arg_tag), key(arg_key) {}
|
||||
virtual ~Remove() {}
|
||||
virtual bool Perform(ActionSet* set);
|
||||
virtual void Abort() { delete key; }
|
||||
|
||||
protected:
|
||||
ActionTag tag;
|
||||
HashKey* key;
|
||||
};
|
||||
|
||||
typedef queue<Modification*> ModQueue;
|
||||
ModQueue mod_queue;
|
||||
};
|
||||
|
||||
} // namespace file_analysiss
|
||||
|
||||
#endif
|
||||
65
src/file_analysis/DataEvent.cc
Normal file
65
src/file_analysis/DataEvent.cc
Normal file
|
|
@ -0,0 +1,65 @@
|
|||
#include <string>
|
||||
|
||||
#include "DataEvent.h"
|
||||
#include "EventRegistry.h"
|
||||
#include "Event.h"
|
||||
#include "util.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
DataEvent::DataEvent(RecordVal* args, Info* info,
|
||||
EventHandlerPtr ce, EventHandlerPtr se)
|
||||
: Action(args, info), chunk_event(ce), stream_event(se)
|
||||
{
|
||||
}
|
||||
|
||||
Action* DataEvent::Instantiate(RecordVal* args, Info* info)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionArgs;
|
||||
|
||||
const char* chunk_field = "chunk_event";
|
||||
const char* stream_field = "stream_event";
|
||||
int chunk_off = ActionArgs->FieldOffset(chunk_field);
|
||||
int stream_off = ActionArgs->FieldOffset(stream_field);
|
||||
|
||||
Val* chunk_val = args->Lookup(chunk_off);
|
||||
Val* stream_val = args->Lookup(stream_off);
|
||||
|
||||
if ( ! chunk_val && ! stream_val ) return 0;
|
||||
|
||||
EventHandlerPtr chunk;
|
||||
EventHandlerPtr stream;
|
||||
|
||||
if ( chunk_val )
|
||||
chunk = event_registry->Lookup(chunk_val->AsFunc()->Name());
|
||||
|
||||
if ( stream_val )
|
||||
stream = event_registry->Lookup(stream_val->AsFunc()->Name());
|
||||
|
||||
return new DataEvent(args, info, chunk, stream);
|
||||
}
|
||||
|
||||
bool DataEvent::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
|
||||
{
|
||||
if ( ! chunk_event ) return true;
|
||||
|
||||
val_list* args = new val_list;
|
||||
args->append(info->GetVal()->Ref());
|
||||
args->append(new StringVal(new BroString(data, len, 0)));
|
||||
args->append(new Val(offset, TYPE_COUNT));
|
||||
mgr.QueueEvent(chunk_event, args);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool DataEvent::DeliverStream(const u_char* data, uint64 len)
|
||||
{
|
||||
if ( ! stream_event ) return true;
|
||||
|
||||
val_list* args = new val_list;
|
||||
args->append(info->GetVal()->Ref());
|
||||
args->append(new StringVal(new BroString(data, len, 0)));
|
||||
mgr.QueueEvent(stream_event, args);
|
||||
|
||||
return true;
|
||||
}
|
||||
35
src/file_analysis/DataEvent.h
Normal file
35
src/file_analysis/DataEvent.h
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
#ifndef FILE_ANALYSIS_DATAEVENT_H
|
||||
#define FILE_ANALYSIS_DATAEVENT_H
|
||||
|
||||
#include <string>
|
||||
|
||||
#include "Val.h"
|
||||
#include "Info.h"
|
||||
#include "Action.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
/**
|
||||
* An action to send file data to script-layer events.
|
||||
*/
|
||||
class DataEvent : public Action {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(RecordVal* args, Info* info);
|
||||
|
||||
virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
|
||||
|
||||
virtual bool DeliverStream(const u_char* data, uint64 len);
|
||||
|
||||
protected:
|
||||
|
||||
DataEvent(RecordVal* args, Info* info,
|
||||
EventHandlerPtr ce, EventHandlerPtr se);
|
||||
|
||||
EventHandlerPtr chunk_event;
|
||||
EventHandlerPtr stream_event;
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
||||
#endif
|
||||
|
|
@ -5,9 +5,8 @@
|
|||
|
||||
using namespace file_analysis;
|
||||
|
||||
Extract::Extract(Info* arg_info, const string& arg_filename)
|
||||
: Action(arg_info, BifEnum::FileAnalysis::ACTION_EXTRACT),
|
||||
filename(arg_filename)
|
||||
Extract::Extract(RecordVal* args, Info* info, const string& arg_filename)
|
||||
: Action(args, info), filename(arg_filename)
|
||||
{
|
||||
fd = open(filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0666);
|
||||
|
||||
|
|
@ -26,21 +25,19 @@ Extract::~Extract()
|
|||
safe_close(fd);
|
||||
}
|
||||
|
||||
Action* Extract::Instantiate(const RecordVal* args, Info* info)
|
||||
Action* Extract::Instantiate(RecordVal* args, Info* info)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionArgs;
|
||||
const char* field = "extract_filename";
|
||||
int off = BifType::Record::FileAnalysis::ActionArgs->FieldOffset(field);
|
||||
Val* v = args->Lookup(off);
|
||||
Val* v = args->Lookup(ActionArgs->FieldOffset(field));
|
||||
|
||||
if ( ! v ) return 0;
|
||||
|
||||
return new Extract(info, v->AsString()->CheckString());
|
||||
return new Extract(args, info, v->AsString()->CheckString());
|
||||
}
|
||||
|
||||
bool Extract::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
|
||||
{
|
||||
Action::DeliverChunk(data, len, offset);
|
||||
|
||||
if ( ! fd ) return false;
|
||||
|
||||
safe_pwrite(fd, data, len, offset);
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ namespace file_analysis {
|
|||
class Extract : public Action {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(const RecordVal* args, Info* info);
|
||||
static Action* Instantiate(RecordVal* args, Info* info);
|
||||
|
||||
virtual ~Extract();
|
||||
|
||||
|
|
@ -23,7 +23,7 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
Extract(Info* arg_info, const string& arg_filename);
|
||||
Extract(RecordVal* args, Info* info, const string& arg_filename);
|
||||
|
||||
string filename;
|
||||
int fd;
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ namespace file_analysis {
|
|||
* identify files, and others which use a pretty hash (the FileID) to identify
|
||||
* files. A FileID is primarily used in methods which interface with the
|
||||
* script-layer, while the unique strings are used for methods which interface
|
||||
* with protocol analyzers (to better accomodate the possibility that a file
|
||||
* can be distributed over different connections and thus analyzer instances).
|
||||
* with protocol analyzers or anything that sends data to the file analysis
|
||||
* framework.
|
||||
*/
|
||||
struct FileID {
|
||||
string id;
|
||||
|
|
|
|||
|
|
@ -5,32 +5,33 @@
|
|||
|
||||
using namespace file_analysis;
|
||||
|
||||
Hash::Hash(Info* arg_info, ActionTag tag, HashVal* hv)
|
||||
: Action(arg_info, tag), hash(hv)
|
||||
Hash::Hash(RecordVal* args, Info* info, HashVal* hv, const char* field)
|
||||
: Action(args, info), hash(hv), fed(false)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionResults;
|
||||
if ( (result_field_idx = ActionResults->FieldOffset(field)) < 0 )
|
||||
reporter->InternalError("Missing ActionResults field: %s", field);
|
||||
hash->Init();
|
||||
}
|
||||
|
||||
Hash::~Hash()
|
||||
{
|
||||
// maybe it's all there...
|
||||
Finalize();
|
||||
delete hash;
|
||||
Unref(hash);
|
||||
}
|
||||
|
||||
bool Hash::DeliverStream(const u_char* data, uint64 len)
|
||||
{
|
||||
Action::DeliverStream(data, len);
|
||||
|
||||
if ( ! hash->IsValid() ) return false;
|
||||
|
||||
if ( ! fed )
|
||||
fed = len > 0;
|
||||
|
||||
hash->Feed(data, len);
|
||||
return true;
|
||||
}
|
||||
|
||||
bool Hash::EndOfFile()
|
||||
{
|
||||
Action::EndOfFile();
|
||||
Finalize();
|
||||
return false;
|
||||
}
|
||||
|
|
@ -42,13 +43,8 @@ bool Hash::Undelivered(uint64 offset, uint64 len)
|
|||
|
||||
void Hash::Finalize()
|
||||
{
|
||||
if ( ! hash->IsValid() ) return;
|
||||
if ( ! hash->IsValid() || ! fed ) return;
|
||||
|
||||
StringVal* sv = hash->Get();
|
||||
int i = GetResultFieldOffset();
|
||||
|
||||
if ( i < 0 )
|
||||
reporter->InternalError("Hash Action result field not found");
|
||||
|
||||
info->Results()->Assign(i, sv);
|
||||
info->GetResults(args)->Assign(result_field_idx, sv);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -26,61 +26,52 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
Hash(Info* arg_info, ActionTag arg_tag, HashVal* hv);
|
||||
Hash(RecordVal* args, Info* info, HashVal* hv, const char* field);
|
||||
|
||||
void Finalize();
|
||||
|
||||
virtual int GetResultFieldOffset() const = 0;
|
||||
|
||||
HashVal* hash;
|
||||
bool fed;
|
||||
int result_field_idx;
|
||||
};
|
||||
|
||||
class MD5 : public Hash {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(const RecordVal* args, Info* info)
|
||||
{ return new MD5(info); }
|
||||
static Action* Instantiate(RecordVal* args, Info* info)
|
||||
{ return new MD5(args, info); }
|
||||
|
||||
protected:
|
||||
|
||||
MD5(Info* arg_info)
|
||||
: Hash(arg_info, BifEnum::FileAnalysis::ACTION_MD5, new MD5Val()) {}
|
||||
|
||||
virtual int GetResultFieldOffset() const
|
||||
{ return BifType::Record::FileAnalysis::ActionResults->
|
||||
FieldOffset("md5"); }
|
||||
MD5(RecordVal* args, Info* info)
|
||||
: Hash(args, info, new MD5Val(), "md5")
|
||||
{}
|
||||
};
|
||||
|
||||
class SHA1 : public Hash {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(const RecordVal* args, Info* info)
|
||||
{ return new SHA1(info); }
|
||||
static Action* Instantiate(RecordVal* args, Info* info)
|
||||
{ return new SHA1(args, info); }
|
||||
|
||||
protected:
|
||||
|
||||
SHA1(Info* arg_info)
|
||||
: Hash(arg_info, BifEnum::FileAnalysis::ACTION_SHA1, new SHA1Val()) {}
|
||||
|
||||
virtual int GetResultFieldOffset() const
|
||||
{ return BifType::Record::FileAnalysis::ActionResults->
|
||||
FieldOffset("sha1"); }
|
||||
SHA1(RecordVal* args, Info* info)
|
||||
: Hash(args, info, new SHA1Val(), "sha1")
|
||||
{}
|
||||
};
|
||||
|
||||
class SHA256 : public Hash {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(const RecordVal* args, Info* info)
|
||||
{ return new SHA256(info); }
|
||||
static Action* Instantiate(RecordVal* args, Info* info)
|
||||
{ return new SHA256(args, info); }
|
||||
|
||||
protected:
|
||||
|
||||
SHA256(Info* arg_info)
|
||||
: Hash(arg_info, BifEnum::FileAnalysis::ACTION_SHA256, new SHA256Val()) {}
|
||||
|
||||
virtual int GetResultFieldOffset() const
|
||||
{ return BifType::Record::FileAnalysis::ActionResults->
|
||||
FieldOffset("sha256"); }
|
||||
SHA256(RecordVal* args, Info* info)
|
||||
: Hash(args, info, new SHA256Val(), "sha256")
|
||||
{}
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
|
|
|||
|
|
@ -1,40 +1,25 @@
|
|||
#include <string>
|
||||
#include <openssl/md5.h>
|
||||
|
||||
#include "Info.h"
|
||||
#include "InfoTimer.h"
|
||||
#include "FileID.h"
|
||||
#include "Manager.h"
|
||||
#include "Reporter.h"
|
||||
#include "Val.h"
|
||||
|
||||
#include "Action.h"
|
||||
#include "Extract.h"
|
||||
#include "Hash.h"
|
||||
#include "analyzers/PE.h"
|
||||
#include "Type.h"
|
||||
#include "Analyzer.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
// keep in order w/ declared enum values in file_analysis.bif
|
||||
static ActionInstantiator action_factory[] = {
|
||||
Extract::Instantiate,
|
||||
MD5::Instantiate,
|
||||
SHA1::Instantiate,
|
||||
SHA256::Instantiate,
|
||||
PE_Analyzer::Instantiate,
|
||||
};
|
||||
|
||||
static TableVal* empty_conn_id_set()
|
||||
static Val* empty_connection_table()
|
||||
{
|
||||
TypeList* set_index = new TypeList(conn_id);
|
||||
set_index->Append(conn_id->Ref());
|
||||
return new TableVal(new SetType(set_index, 0));
|
||||
}
|
||||
|
||||
static StringVal* get_conn_uid_val(Connection* conn)
|
||||
{
|
||||
char tmp[20];
|
||||
if ( ! conn->GetUID() )
|
||||
conn->SetUID(calculate_unique_id());
|
||||
return new StringVal(uitoa_n(conn->GetUID(), tmp, sizeof(tmp), 62));
|
||||
TypeList* tbl_index = new TypeList(conn_id);
|
||||
tbl_index->Append(conn_id->Ref());
|
||||
TableType* tbl_type = new TableType(tbl_index, connection_type->Ref());
|
||||
Val* rval = new TableVal(tbl_type);
|
||||
Unref(tbl_type);
|
||||
return rval;
|
||||
}
|
||||
|
||||
static RecordVal* get_conn_id_val(const Connection* conn)
|
||||
|
|
@ -49,82 +34,112 @@ static RecordVal* get_conn_id_val(const Connection* conn)
|
|||
|
||||
int Info::file_id_idx = -1;
|
||||
int Info::parent_file_id_idx = -1;
|
||||
int Info::protocol_idx = -1;
|
||||
int Info::conn_uids_idx = -1;
|
||||
int Info::conn_ids_idx = -1;
|
||||
int Info::source_idx = -1;
|
||||
int Info::conns_idx = -1;
|
||||
int Info::last_active_idx = -1;
|
||||
int Info::seen_bytes_idx = -1;
|
||||
int Info::total_bytes_idx = -1;
|
||||
int Info::missing_bytes_idx = -1;
|
||||
int Info::overflow_bytes_idx = -1;
|
||||
int Info::timeout_interval_idx = -1;
|
||||
int Info::bof_buffer_size_idx = -1;
|
||||
int Info::bof_buffer_idx = -1;
|
||||
int Info::file_type_idx = -1;
|
||||
int Info::mime_type_idx = -1;
|
||||
int Info::actions_idx = -1;
|
||||
int Info::action_args_idx = -1;
|
||||
int Info::action_results_idx = -1;
|
||||
|
||||
void Info::InitFieldIndices()
|
||||
magic_t Info::magic = 0;
|
||||
magic_t Info::magic_mime = 0;
|
||||
|
||||
string Info::salt;
|
||||
|
||||
void Info::StaticInit()
|
||||
{
|
||||
if ( file_id_idx != -1 ) return;
|
||||
|
||||
file_id_idx = Idx("file_id");
|
||||
parent_file_id_idx = Idx("parent_file_id");
|
||||
protocol_idx = Idx("protocol");
|
||||
conn_uids_idx = Idx("conn_uids");
|
||||
conn_ids_idx = Idx("conn_ids");
|
||||
source_idx = Idx("source");
|
||||
conns_idx = Idx("conns");
|
||||
last_active_idx = Idx("last_active");
|
||||
seen_bytes_idx = Idx("seen_bytes");
|
||||
total_bytes_idx = Idx("total_bytes");
|
||||
missing_bytes_idx = Idx("missing_bytes");
|
||||
overflow_bytes_idx = Idx("overflow_bytes");
|
||||
timeout_interval_idx = Idx("timeout_interval");
|
||||
bof_buffer_size_idx = Idx("bof_buffer_size");
|
||||
bof_buffer_idx = Idx("bof_buffer");
|
||||
file_type_idx = Idx("file_type");
|
||||
mime_type_idx = Idx("mime_type");
|
||||
actions_idx = Idx("actions");
|
||||
action_args_idx = Idx("action_args");
|
||||
action_results_idx = Idx("action_results");
|
||||
|
||||
bro_init_magic(&magic, MAGIC_NONE);
|
||||
bro_init_magic(&magic_mime, MAGIC_MIME);
|
||||
|
||||
salt = BifConst::FileAnalysis::salt->CheckString();
|
||||
}
|
||||
|
||||
Info::Info(const string& unique, Connection* conn, const string& protocol)
|
||||
: file_id(unique), unique(unique), val(0), last_activity_time(network_time),
|
||||
postpone_timeout(false), need_reassembly(false)
|
||||
Info::Info(const string& unique, Connection* conn, AnalyzerTag::Tag tag)
|
||||
: file_id(""), unique(unique), val(0), postpone_timeout(false),
|
||||
need_reassembly(false), done(false), actions(this)
|
||||
{
|
||||
InitFieldIndices();
|
||||
StaticInit();
|
||||
|
||||
char id[20];
|
||||
uitoa_n(calculate_unique_id(), id, sizeof(id), 62);
|
||||
uint64 hash[2];
|
||||
string msg(unique + salt);
|
||||
MD5(reinterpret_cast<const u_char*>(msg.data()), msg.size(),
|
||||
reinterpret_cast<u_char*>(hash));
|
||||
uitoa_n(hash[0], id, sizeof(id), 62);
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new Info object %s", id);
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new Info object %s (%s)", id,
|
||||
unique.c_str());
|
||||
|
||||
val = new RecordVal(BifType::Record::FileAnalysis::Info);
|
||||
val->Assign(file_id_idx, new StringVal(id));
|
||||
file_id = FileID(id);
|
||||
|
||||
UpdateConnectionFields(conn);
|
||||
if ( conn )
|
||||
{
|
||||
// add source and connection fields
|
||||
val->Assign(source_idx, new StringVal(Analyzer::GetTagName(tag)));
|
||||
UpdateConnectionFields(conn);
|
||||
}
|
||||
else
|
||||
// use the unique file handle as source
|
||||
val->Assign(source_idx, new StringVal(unique.c_str()));
|
||||
|
||||
if ( protocol != "" )
|
||||
val->Assign(protocol_idx, new StringVal(protocol.c_str()));
|
||||
|
||||
ScheduleInactivityTimer();
|
||||
UpdateLastActivityTime();
|
||||
}
|
||||
|
||||
Info::~Info()
|
||||
{
|
||||
ActionMap::const_iterator it;
|
||||
for ( it = actions.begin(); it != actions.end(); ++it )
|
||||
delete it->second;
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Destroying Info object %s",file_id.c_str());
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Destroying Info object %s", file_id.c_str());
|
||||
Unref(val);
|
||||
}
|
||||
|
||||
void Info::UpdateLastActivityTime()
|
||||
{
|
||||
val->Assign(last_active_idx, new Val(network_time, TYPE_TIME));
|
||||
}
|
||||
|
||||
double Info::GetLastActivityTime() const
|
||||
{
|
||||
return val->Lookup(last_active_idx)->AsTime();
|
||||
}
|
||||
|
||||
void Info::UpdateConnectionFields(Connection* conn)
|
||||
{
|
||||
if ( ! conn ) return;
|
||||
|
||||
Val* conn_uids = val->Lookup(conn_uids_idx);
|
||||
Val* conn_ids = val->Lookup(conn_ids_idx);
|
||||
if ( ! conn_uids )
|
||||
val->Assign(conn_uids_idx, conn_uids = new TableVal(string_set));
|
||||
if ( ! conn_ids )
|
||||
val->Assign(conn_ids_idx, conn_ids = empty_conn_id_set());
|
||||
Val* conns = val->Lookup(conns_idx);
|
||||
|
||||
conn_uids->AsTableVal()->Assign(get_conn_uid_val(conn), 0);
|
||||
conn_ids->AsTableVal()->Assign(get_conn_id_val(conn), 0);
|
||||
if ( ! conns )
|
||||
val->Assign(conns_idx, conns = empty_connection_table());
|
||||
|
||||
Val* idx = get_conn_id_val(conn);
|
||||
conns->AsTableVal()->Assign(idx, conn->BuildConnVal());
|
||||
Unref(idx);
|
||||
}
|
||||
|
||||
uint64 Info::LookupFieldDefaultCount(int idx) const
|
||||
|
|
@ -152,14 +167,23 @@ int Info::Idx(const string& field)
|
|||
return rval;
|
||||
}
|
||||
|
||||
double Info::TimeoutInterval() const
|
||||
double Info::GetTimeoutInterval() const
|
||||
{
|
||||
return LookupFieldDefaultInterval(timeout_interval_idx);
|
||||
}
|
||||
|
||||
RecordVal* Info::Results() const
|
||||
RecordVal* Info::GetResults(RecordVal* args) const
|
||||
{
|
||||
return val->Lookup(action_results_idx)->AsRecordVal();
|
||||
TableVal* actions_table = val->Lookup(actions_idx)->AsTableVal();
|
||||
RecordVal* rval = actions_table->Lookup(args)->AsRecordVal();
|
||||
|
||||
if ( ! rval )
|
||||
{
|
||||
rval = new RecordVal(BifType::Record::FileAnalysis::ActionResults);
|
||||
actions_table->Assign(args, rval);
|
||||
}
|
||||
|
||||
return rval;
|
||||
}
|
||||
|
||||
void Info::IncrementByteCount(uint64 size, int field_idx)
|
||||
|
|
@ -184,62 +208,96 @@ bool Info::IsComplete() const
|
|||
|
||||
void Info::ScheduleInactivityTimer() const
|
||||
{
|
||||
timer_mgr->Add(new InfoTimer(network_time, file_id, TimeoutInterval()));
|
||||
timer_mgr->Add(new InfoTimer(network_time, file_id, GetTimeoutInterval()));
|
||||
}
|
||||
|
||||
bool Info::AddAction(ActionTag act, RecordVal* args)
|
||||
bool Info::AddAction(RecordVal* args)
|
||||
{
|
||||
if ( actions.find(act) != actions.end() ) return false;
|
||||
return done ? false : actions.QueueAddAction(args);
|
||||
}
|
||||
|
||||
ActionTag tag = static_cast<ActionTag>(act);
|
||||
bool Info::RemoveAction(const RecordVal* args)
|
||||
{
|
||||
return done ? false : actions.QueueRemoveAction(args);
|
||||
}
|
||||
|
||||
Action* a = action_factory[act](args, this);
|
||||
bool Info::BufferBOF(const u_char* data, uint64 len)
|
||||
{
|
||||
if ( bof_buffer.full || bof_buffer.replayed ) return false;
|
||||
|
||||
if ( ! a ) return false;
|
||||
if ( bof_buffer.chunks.size() == 0 )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_BOF, this);
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Add action %d for file id %s", act,
|
||||
file_id.c_str());
|
||||
actions[act] = a;
|
||||
uint64 desired_size = LookupFieldDefaultCount(bof_buffer_size_idx);
|
||||
|
||||
VectorVal* av = val->LookupWithDefault(actions_idx)->AsVectorVal();
|
||||
VectorVal* aav = val->LookupWithDefault(action_args_idx)->AsVectorVal();
|
||||
/* Leaving out this optimization (I think) for now to keep things simpler.
|
||||
// If first chunk satisfies desired size, do everything now without copying.
|
||||
if ( bof_buffer.chunks.empty() && len >= desired_size )
|
||||
{
|
||||
bof_buffer.full = bof_buffer.replayed = true;
|
||||
val->Assign(bof_buffer_idx, new StringVal(new BroString(data, len, 0)));
|
||||
file_mgr->EvaluatePolicy(TRIGGER_BOF_BUFFER, this);
|
||||
// TODO: libmagic stuff
|
||||
return false;
|
||||
}
|
||||
*/
|
||||
|
||||
EnumVal* ev = new EnumVal(act, BifType::Enum::FileAnalysis::Action);
|
||||
av->Assign(av->Size(), ev, 0);
|
||||
aav->Assign(aav->Size(), args->Ref(), 0);
|
||||
bof_buffer.chunks.push_back(new BroString(data, len, 0));
|
||||
bof_buffer.size += len;
|
||||
|
||||
Unref(av);
|
||||
Unref(aav);
|
||||
if ( bof_buffer.size >= desired_size )
|
||||
{
|
||||
bof_buffer.full = true;
|
||||
ReplayBOF();
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool Info::RemoveAction(ActionTag act)
|
||||
void Info::ReplayBOF()
|
||||
{
|
||||
ActionMap::iterator it = actions.find(act);
|
||||
if ( bof_buffer.replayed ) return;
|
||||
bof_buffer.replayed = true;
|
||||
|
||||
if ( it == actions.end() ) return false;
|
||||
if ( bof_buffer.chunks.empty() ) return;
|
||||
|
||||
return RemoveAction(it);
|
||||
}
|
||||
BroString* bs = concatenate(bof_buffer.chunks);
|
||||
const char* desc = bro_magic_buffer(magic, bs->Bytes(), bs->Len());
|
||||
const char* mime = bro_magic_buffer(magic_mime, bs->Bytes(), bs->Len());
|
||||
|
||||
bool Info::RemoveAction(const ActionMap::iterator& it)
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Remove action %d for file id %s", it->first,
|
||||
file_id.c_str());
|
||||
delete it->second;
|
||||
actions.erase(it);
|
||||
return true;
|
||||
val->Assign(bof_buffer_idx, new StringVal(bs));
|
||||
|
||||
if ( desc )
|
||||
val->Assign(file_type_idx, new StringVal(desc));
|
||||
|
||||
if ( mime )
|
||||
val->Assign(mime_type_idx, new StringVal(mime));
|
||||
|
||||
using BifEnum::FileAnalysis::TRIGGER_BOF_BUFFER;
|
||||
file_mgr->EvaluatePolicy(TRIGGER_BOF_BUFFER, this);
|
||||
|
||||
if ( desc || mime )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TYPE, this);
|
||||
|
||||
for ( size_t i = 0; i < bof_buffer.chunks.size(); ++i )
|
||||
DataIn(bof_buffer.chunks[i]->Bytes(), bof_buffer.chunks[i]->Len());
|
||||
}
|
||||
|
||||
void Info::DataIn(const u_char* data, uint64 len, uint64 offset)
|
||||
{
|
||||
ActionMap::iterator it = actions.begin();
|
||||
while ( it != actions.end() )
|
||||
if ( ! it->second->DeliverChunk(data, len, offset) )
|
||||
RemoveAction(it++);
|
||||
else
|
||||
++it;
|
||||
actions.DrainModifications();
|
||||
// TODO: attempt libmagic stuff here before doing reassembly?
|
||||
|
||||
Action* act = 0;
|
||||
IterCookie* c = actions.InitForIteration();
|
||||
|
||||
while ( (act = actions.NextEntry(c)) )
|
||||
{
|
||||
if ( ! act->DeliverChunk(data, len, offset) )
|
||||
actions.QueueRemoveAction(act->Args());
|
||||
}
|
||||
|
||||
actions.DrainModifications();
|
||||
|
||||
// TODO: check reassembly requirement based on buffer size in record
|
||||
if ( need_reassembly )
|
||||
|
|
@ -247,53 +305,86 @@ void Info::DataIn(const u_char* data, uint64 len, uint64 offset)
|
|||
// TODO
|
||||
}
|
||||
|
||||
// TODO: reassembly stuff, possibly having to deliver chunks if buffer full
|
||||
// and incrememt overflow bytes
|
||||
// TODO: reassembly overflow stuff, increment overflow count, eval trigger
|
||||
|
||||
IncrementByteCount(len, seen_bytes_idx);
|
||||
}
|
||||
|
||||
void Info::DataIn(const u_char* data, uint64 len)
|
||||
{
|
||||
ActionMap::iterator it = actions.begin();
|
||||
while ( it != actions.end() )
|
||||
actions.DrainModifications();
|
||||
|
||||
if ( BufferBOF(data, len) ) return;
|
||||
|
||||
Action* act = 0;
|
||||
IterCookie* c = actions.InitForIteration();
|
||||
|
||||
while ( (act = actions.NextEntry(c)) )
|
||||
{
|
||||
if ( ! it->second->DeliverStream(data, len) )
|
||||
if ( ! act->DeliverStream(data, len) )
|
||||
{
|
||||
RemoveAction(it++);
|
||||
actions.QueueRemoveAction(act->Args());
|
||||
continue;
|
||||
}
|
||||
|
||||
uint64 offset = LookupFieldDefaultCount(seen_bytes_idx) +
|
||||
LookupFieldDefaultCount(missing_bytes_idx);
|
||||
|
||||
if ( ! it->second->DeliverChunk(data, len, offset) )
|
||||
RemoveAction(it++);
|
||||
else
|
||||
++it;
|
||||
if ( ! act->DeliverChunk(data, len, offset) )
|
||||
actions.QueueRemoveAction(act->Args());
|
||||
}
|
||||
|
||||
actions.DrainModifications();
|
||||
IncrementByteCount(len, seen_bytes_idx);
|
||||
}
|
||||
|
||||
void Info::EndOfFile()
|
||||
{
|
||||
ActionMap::iterator it = actions.begin();
|
||||
while ( it != actions.end() )
|
||||
if ( ! it->second->EndOfFile() )
|
||||
RemoveAction(it++);
|
||||
else
|
||||
++it;
|
||||
if ( done ) return;
|
||||
|
||||
actions.DrainModifications();
|
||||
|
||||
// Send along anything that's been buffered, but never flushed.
|
||||
ReplayBOF();
|
||||
|
||||
done = true;
|
||||
|
||||
Action* act = 0;
|
||||
IterCookie* c = actions.InitForIteration();
|
||||
|
||||
while ( (act = actions.NextEntry(c)) )
|
||||
{
|
||||
if ( ! act->EndOfFile() )
|
||||
actions.QueueRemoveAction(act->Args());
|
||||
}
|
||||
|
||||
if ( IsComplete() )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_DONE, this);
|
||||
else
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_EOF, this);
|
||||
|
||||
actions.DrainModifications();
|
||||
}
|
||||
|
||||
void Info::Gap(uint64 offset, uint64 len)
|
||||
{
|
||||
ActionMap::iterator it = actions.begin();
|
||||
while ( it != actions.end() )
|
||||
if ( ! it->second->Undelivered(offset, len) )
|
||||
RemoveAction(it++);
|
||||
else
|
||||
++it;
|
||||
actions.DrainModifications();
|
||||
|
||||
// If we were buffering the beginning of the file, a gap means we've got
|
||||
// as much contiguous stuff at the beginning as possible, so work with that.
|
||||
ReplayBOF();
|
||||
|
||||
Action* act = 0;
|
||||
IterCookie* c = actions.InitForIteration();
|
||||
|
||||
while ( (act = actions.NextEntry(c)) )
|
||||
{
|
||||
if ( ! act->Undelivered(offset, len) )
|
||||
actions.QueueRemoveAction(act->Args());
|
||||
}
|
||||
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_GAP, this);
|
||||
|
||||
actions.DrainModifications();
|
||||
IncrementByteCount(len, missing_bytes_idx);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,12 +2,15 @@
|
|||
#define FILE_ANALYSIS_INFO_H
|
||||
|
||||
#include <string>
|
||||
#include <map>
|
||||
#include <vector>
|
||||
#include <magic.h>
|
||||
|
||||
#include "AnalyzerTags.h"
|
||||
#include "Conn.h"
|
||||
#include "Val.h"
|
||||
#include "Action.h"
|
||||
#include "ActionSet.h"
|
||||
#include "FileID.h"
|
||||
#include "BroString.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
|
|
@ -19,10 +22,15 @@ public:
|
|||
|
||||
~Info();
|
||||
|
||||
/**
|
||||
* @return the #val record.
|
||||
*/
|
||||
RecordVal* GetVal() const { return val; }
|
||||
|
||||
/**
|
||||
* @return value (seconds) of the "timeout_interval" field from #val record.
|
||||
*/
|
||||
double TimeoutInterval() const;
|
||||
double GetTimeoutInterval() const;
|
||||
|
||||
/**
|
||||
* @return value of the "file_id" field from #val record.
|
||||
|
|
@ -30,24 +38,26 @@ public:
|
|||
FileID GetFileID() const { return file_id; }
|
||||
|
||||
/**
|
||||
* @return record val of the "action_results" field from #val record.
|
||||
* @return looks up the value of the "actions" field in the #val record at
|
||||
* the index corresponding to \a args. If there was no value at
|
||||
* the index, it is created.
|
||||
*/
|
||||
RecordVal* Results() const;
|
||||
RecordVal* GetResults(RecordVal* args) const;
|
||||
|
||||
/**
|
||||
* @return the string which uniquely identifies the file.
|
||||
*/
|
||||
string Unique() const { return unique; }
|
||||
string GetUnique() const { return unique; }
|
||||
|
||||
/**
|
||||
* @return #last_activity_time
|
||||
* @return value of "last_active" field in #val record;
|
||||
*/
|
||||
double LastActivityTime() const { return last_activity_time; }
|
||||
double GetLastActivityTime() const;
|
||||
|
||||
/**
|
||||
* Refreshes #last_activity_time with current network time.
|
||||
* Refreshes "last_active" field of #val record with current network time.
|
||||
*/
|
||||
void UpdateLastActivityTime() { last_activity_time = network_time; }
|
||||
void UpdateLastActivityTime();
|
||||
|
||||
/**
|
||||
* Set "total_bytes" field of #val record to \a size.
|
||||
|
|
@ -64,21 +74,22 @@ public:
|
|||
/**
|
||||
* Create a timer to be dispatched after the amount of time indicated by
|
||||
* the "timeout_interval" field of the #val record in order to check if
|
||||
* #last_activity_time is old enough to timeout analysis of the file.
|
||||
* "last_active" field is old enough to timeout analysis of the file.
|
||||
*/
|
||||
void ScheduleInactivityTimer() const;
|
||||
|
||||
/**
|
||||
* Attaches an action. Only one action per type can be attached at a time.
|
||||
* @return true if the action was attached, else false.
|
||||
* Queues attaching an action. Only one action per type can be attached at
|
||||
* a time unless the arguments differ.
|
||||
* @return false if action can't be instantiated, else true.
|
||||
*/
|
||||
bool AddAction(ActionTag act, RecordVal* args);
|
||||
bool AddAction(RecordVal* args);
|
||||
|
||||
/**
|
||||
* Removes an action.
|
||||
* @return true if the action was removed, else false.
|
||||
* Queues removal of an action.
|
||||
* @return true if action was active at time of call, else false.
|
||||
*/
|
||||
bool RemoveAction(ActionTag act);
|
||||
bool RemoveAction(const RecordVal* args);
|
||||
|
||||
/**
|
||||
* Pass in non-sequential data and deliver to attached actions/analyzers.
|
||||
|
|
@ -104,13 +115,11 @@ protected:
|
|||
|
||||
friend class Manager;
|
||||
|
||||
typedef map<ActionTag, Action*> ActionMap;
|
||||
|
||||
/**
|
||||
* Constructor; only file_analysis::Manager should be creating these.
|
||||
*/
|
||||
Info(const string& unique, Connection* conn = 0,
|
||||
const string& protocol = "");
|
||||
AnalyzerTag::Tag tag = AnalyzerTag::Error);
|
||||
|
||||
/**
|
||||
* Updates the "conn_ids" and "conn_uids" fields in #val record with the
|
||||
|
|
@ -136,18 +145,34 @@ protected:
|
|||
double LookupFieldDefaultInterval(int idx) const;
|
||||
|
||||
/**
|
||||
* Removes an action.
|
||||
* @return true if the action was removed, else false.
|
||||
* Buffers incoming data at the beginning of a file.
|
||||
* @return true if buffering is still required, else false
|
||||
*/
|
||||
bool RemoveAction(const ActionMap::iterator& it);
|
||||
bool BufferBOF(const u_char* data, uint64 len);
|
||||
|
||||
/**
|
||||
* Forward any beginning-of-file buffered data on to DataIn stream.
|
||||
*/
|
||||
void ReplayBOF();
|
||||
|
||||
FileID file_id; /**< A pretty hash that likely identifies file*/
|
||||
string unique; /**< A string that uniquely identifies file */
|
||||
RecordVal* val; /**< \c FileAnalysis::Info from script layer. */
|
||||
double last_activity_time; /**< Time of last activity. */
|
||||
bool postpone_timeout; /**< Whether postponing timeout is requested. */
|
||||
bool need_reassembly; /**< Whether file stream reassembly is needed. */
|
||||
ActionMap actions; /**< Actions/analysis to perform on file. */
|
||||
bool done; /**< If this object is about to be deleted. */
|
||||
ActionSet actions;
|
||||
|
||||
struct BOF_Buffer {
|
||||
BOF_Buffer() : full(false), replayed(false), size(0) {}
|
||||
~BOF_Buffer()
|
||||
{ for ( size_t i = 0; i < chunks.size(); ++i ) delete chunks[i]; }
|
||||
|
||||
bool full;
|
||||
bool replayed;
|
||||
uint64 size;
|
||||
BroString::CVec chunks;
|
||||
} bof_buffer; /**< Beginning of file buffer. */
|
||||
|
||||
/**
|
||||
* @return the field offset in #val record corresponding to \a field_name.
|
||||
|
|
@ -155,23 +180,31 @@ protected:
|
|||
static int Idx(const string& field_name);
|
||||
|
||||
/**
|
||||
* Initializes the index offsets for fields in \c FileAnalysis::info record.
|
||||
* Initializes static member.
|
||||
*/
|
||||
static void InitFieldIndices();
|
||||
static void StaticInit();
|
||||
|
||||
static magic_t magic;
|
||||
static magic_t magic_mime;
|
||||
|
||||
static string salt;
|
||||
|
||||
public:
|
||||
static int file_id_idx;
|
||||
static int parent_file_id_idx;
|
||||
static int protocol_idx;
|
||||
static int conn_uids_idx;
|
||||
static int conn_ids_idx;
|
||||
static int source_idx;
|
||||
static int conns_idx;
|
||||
static int last_active_idx;
|
||||
static int seen_bytes_idx;
|
||||
static int total_bytes_idx;
|
||||
static int missing_bytes_idx;
|
||||
static int overflow_bytes_idx;
|
||||
static int timeout_interval_idx;
|
||||
static int bof_buffer_size_idx;
|
||||
static int bof_buffer_idx;
|
||||
static int file_type_idx;
|
||||
static int mime_type_idx;
|
||||
static int actions_idx;
|
||||
static int action_args_idx;
|
||||
static int action_results_idx;
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
|
|
|||
|
|
@ -3,13 +3,21 @@
|
|||
|
||||
using namespace file_analysis;
|
||||
|
||||
|
||||
InfoTimer::InfoTimer(double t, const FileID& id, double interval)
|
||||
: Timer(t + interval, TIMER_FILE_ANALYSIS_INACTIVITY), file_id(id)
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "New %f second timeout timer for %s",
|
||||
file_id.c_str(), interval);
|
||||
}
|
||||
|
||||
void InfoTimer::Dispatch(double t, int is_expire)
|
||||
{
|
||||
Info* info = file_mgr->Lookup(file_id);
|
||||
|
||||
if ( ! info ) return;
|
||||
|
||||
double last_active = info->LastActivityTime();
|
||||
double last_active = info->GetLastActivityTime();
|
||||
double inactive_time = t > last_active ? t - last_active : 0.0;
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Checking inactivity for %s, last active at %f, "
|
||||
|
|
@ -23,7 +31,7 @@ void InfoTimer::Dispatch(double t, int is_expire)
|
|||
return;
|
||||
}
|
||||
|
||||
if ( inactive_time >= info->TimeoutInterval() )
|
||||
if ( inactive_time >= info->GetTimeoutInterval() )
|
||||
file_mgr->Timeout(file_id);
|
||||
else if ( ! is_expire )
|
||||
info->ScheduleInactivityTimer();
|
||||
|
|
|
|||
|
|
@ -13,10 +13,7 @@ namespace file_analysis {
|
|||
class InfoTimer : public Timer {
|
||||
public:
|
||||
|
||||
InfoTimer(double t, const FileID& id, double interval)
|
||||
: Timer(t + interval, TIMER_FILE_ANALYSIS_INACTIVITY), file_id(id) {}
|
||||
|
||||
~InfoTimer() {}
|
||||
InfoTimer(double t, const FileID& id, double interval);
|
||||
|
||||
/**
|
||||
* Check inactivity of file_analysis::Info corresponding to #file_id,
|
||||
|
|
|
|||
|
|
@ -4,9 +4,13 @@
|
|||
#include "Manager.h"
|
||||
#include "Info.h"
|
||||
#include "Action.h"
|
||||
#include "Var.h"
|
||||
#include "Event.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
TableVal* Manager::disabled = 0;
|
||||
|
||||
Manager::Manager()
|
||||
{
|
||||
}
|
||||
|
|
@ -25,57 +29,145 @@ void Manager::Terminate()
|
|||
Timeout(keys[i], true);
|
||||
}
|
||||
|
||||
static void check_file_done(Info* info)
|
||||
void Manager::ReceiveHandle(const string& handle)
|
||||
{
|
||||
if ( info->IsComplete() )
|
||||
if ( pending.empty() )
|
||||
reporter->InternalError("File analysis underflow");
|
||||
|
||||
PendingFile* pf = pending.front();
|
||||
if ( ! handle.empty() )
|
||||
pf->Finish(handle);
|
||||
delete pf;
|
||||
pending.pop();
|
||||
}
|
||||
|
||||
void Manager::EventDrainDone()
|
||||
{
|
||||
if ( pending.empty() ) return;
|
||||
|
||||
reporter->Error("Too few return_file_handle() calls, discarding pending"
|
||||
" file analysis input.");
|
||||
|
||||
while ( ! pending.empty() )
|
||||
{
|
||||
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_DONE, info);
|
||||
file_mgr->RemoveFile(info->GetFileID());
|
||||
delete pending.front();
|
||||
pending.pop();
|
||||
}
|
||||
}
|
||||
|
||||
void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
|
||||
uint64 offset, Connection* conn, const string& protocol)
|
||||
void Manager::DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
AnalyzerTag::Tag tag, Connection* conn, bool is_orig)
|
||||
{
|
||||
Info* info = GetInfo(unique, conn, protocol);
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingDataInChunk(data, len, offset, tag, conn));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
const string& unique)
|
||||
{
|
||||
DataIn(data, len, offset, GetInfo(unique));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
Info* info)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
|
||||
info->DataIn(data, len, offset);
|
||||
check_file_done(info);
|
||||
|
||||
if ( info->IsComplete() )
|
||||
RemoveFile(info->GetUnique());
|
||||
}
|
||||
|
||||
void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
|
||||
Connection* conn, const string& protocol)
|
||||
void Manager::DataIn(const u_char* data, uint64 len, AnalyzerTag::Tag tag,
|
||||
Connection* conn, bool is_orig)
|
||||
{
|
||||
Info* info = GetInfo(unique, conn, protocol);
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingDataInStream(data, len, tag, conn));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, const string& unique)
|
||||
{
|
||||
DataIn(data, len, GetInfo(unique));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, Info* info)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
|
||||
info->DataIn(data, len);
|
||||
check_file_done(info);
|
||||
|
||||
if ( info->IsComplete() )
|
||||
RemoveFile(info->GetUnique());
|
||||
}
|
||||
|
||||
void Manager::EndOfFile(const string& unique, Connection* conn,
|
||||
const string& protocol)
|
||||
void Manager::EndOfFile(AnalyzerTag::Tag tag, Connection* conn)
|
||||
{
|
||||
Info* info = GetInfo(unique, conn, protocol);
|
||||
info->EndOfFile();
|
||||
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_EOF, info);
|
||||
EndOfFile(tag, conn, true);
|
||||
EndOfFile(tag, conn, false);
|
||||
}
|
||||
|
||||
void Manager::Gap(const string& unique, uint64 offset, uint64 len,
|
||||
Connection* conn, const string& protocol)
|
||||
void Manager::EndOfFile(AnalyzerTag::Tag tag, Connection* conn, bool is_orig)
|
||||
{
|
||||
Info* info = GetInfo(unique, conn, protocol);
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingEOF(tag, conn));
|
||||
}
|
||||
|
||||
void Manager::EndOfFile(const string& unique)
|
||||
{
|
||||
RemoveFile(unique);
|
||||
}
|
||||
|
||||
void Manager::Gap(uint64 offset, uint64 len, AnalyzerTag::Tag tag,
|
||||
Connection* conn, bool is_orig)
|
||||
{
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingGap(offset, len, tag, conn));
|
||||
}
|
||||
|
||||
void Manager::Gap(uint64 offset, uint64 len, const string& unique)
|
||||
{
|
||||
Gap(offset, len, GetInfo(unique));
|
||||
}
|
||||
|
||||
void Manager::Gap(uint64 offset, uint64 len, Info* info)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
|
||||
info->Gap(offset, len);
|
||||
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_GAP, info);
|
||||
}
|
||||
|
||||
void Manager::SetSize(const string& unique, uint64 size,
|
||||
Connection* conn, const string& protocol)
|
||||
void Manager::SetSize(uint64 size, AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig)
|
||||
{
|
||||
Info* info = GetInfo(unique, conn, protocol);
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingSize(size, tag, conn));
|
||||
}
|
||||
|
||||
void Manager::SetSize(uint64 size, const string& unique)
|
||||
{
|
||||
SetSize(size, GetInfo(unique));
|
||||
}
|
||||
|
||||
void Manager::SetSize(uint64 size, Info* info)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
|
||||
info->SetTotalBytes(size);
|
||||
check_file_done(info);
|
||||
|
||||
if ( info->IsComplete() )
|
||||
RemoveFile(info->GetUnique());
|
||||
}
|
||||
|
||||
void Manager::EvaluatePolicy(BifEnum::FileAnalysis::Trigger t, Info* info)
|
||||
{
|
||||
if ( IsIgnored(info->GetUnique()) ) return;
|
||||
|
||||
const ID* id = global_scope()->Lookup("FileAnalysis::policy");
|
||||
assert(id);
|
||||
const Func* hook = id->ID_Val()->AsFunc();
|
||||
|
|
@ -100,43 +192,46 @@ bool Manager::PostponeTimeout(const FileID& file_id) const
|
|||
return true;
|
||||
}
|
||||
|
||||
bool Manager::AddAction(const FileID& file_id, EnumVal* act,
|
||||
RecordVal* args) const
|
||||
bool Manager::AddAction(const FileID& file_id, RecordVal* args) const
|
||||
{
|
||||
Info* info = Lookup(file_id);
|
||||
|
||||
if ( ! info ) return false;
|
||||
|
||||
return info->AddAction(static_cast<ActionTag>(act->AsEnum()), args);
|
||||
return info->AddAction(args);
|
||||
}
|
||||
|
||||
bool Manager::RemoveAction(const FileID& file_id, EnumVal* act) const
|
||||
bool Manager::RemoveAction(const FileID& file_id, const RecordVal* args) const
|
||||
{
|
||||
Info* info = Lookup(file_id);
|
||||
|
||||
if ( ! info ) return false;
|
||||
|
||||
return info->RemoveAction(static_cast<ActionTag>(act->AsEnum()));
|
||||
return info->RemoveAction(args);
|
||||
}
|
||||
|
||||
Info* Manager::GetInfo(const string& unique, Connection* conn,
|
||||
const string& protocol)
|
||||
AnalyzerTag::Tag tag)
|
||||
{
|
||||
if ( IsIgnored(unique) ) return 0;
|
||||
|
||||
Info* rval = str_map[unique];
|
||||
|
||||
if ( ! rval )
|
||||
{
|
||||
rval = str_map[unique] = new Info(unique, conn, protocol);
|
||||
rval = str_map[unique] = new Info(unique, conn, tag);
|
||||
FileID id = rval->GetFileID();
|
||||
|
||||
if ( id_map[id] )
|
||||
{
|
||||
reporter->Error("Evicted duplicate file ID: %s", id.c_str());
|
||||
RemoveFile(id);
|
||||
RemoveFile(unique);
|
||||
}
|
||||
|
||||
id_map[id] = rval;
|
||||
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_NEW, rval);
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_NEW, rval);
|
||||
rval->ScheduleInactivityTimer();
|
||||
if ( IsIgnored(unique) ) return 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -162,7 +257,7 @@ void Manager::Timeout(const FileID& file_id, bool is_terminating)
|
|||
|
||||
if ( ! info ) return;
|
||||
|
||||
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TIMEOUT, info);
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TIMEOUT, info);
|
||||
|
||||
if ( info->postpone_timeout && ! is_terminating )
|
||||
{
|
||||
|
|
@ -176,18 +271,75 @@ void Manager::Timeout(const FileID& file_id, bool is_terminating)
|
|||
DBG_LOG(DBG_FILE_ANALYSIS, "File analysis timeout for %s",
|
||||
info->GetFileID().c_str());
|
||||
|
||||
RemoveFile(file_id);
|
||||
RemoveFile(info->GetUnique());
|
||||
}
|
||||
|
||||
bool Manager::RemoveFile(const FileID& file_id)
|
||||
bool Manager::IgnoreFile(const FileID& file_id)
|
||||
{
|
||||
IDMap::iterator it = id_map.find(file_id);
|
||||
|
||||
if ( it == id_map.end() ) return false;
|
||||
|
||||
if ( ! str_map.erase(it->second->Unique()) )
|
||||
reporter->Error("No string mapping for file ID %s", file_id.c_str());
|
||||
delete it->second;
|
||||
id_map.erase(it);
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Ignore FileID %s", file_id.c_str());
|
||||
|
||||
ignored.insert(it->second->GetUnique());
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool Manager::RemoveFile(const string& unique)
|
||||
{
|
||||
StrMap::iterator it = str_map.find(unique);
|
||||
|
||||
if ( it == str_map.end() ) return false;
|
||||
|
||||
it->second->EndOfFile();
|
||||
|
||||
FileID id = it->second->GetFileID();
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Remove FileID %s", id.c_str());
|
||||
|
||||
if ( ! id_map.erase(id) )
|
||||
reporter->Error("No mapping for fileID %s", id.c_str());
|
||||
|
||||
ignored.erase(unique);
|
||||
delete it->second;
|
||||
str_map.erase(unique);
|
||||
return true;
|
||||
}
|
||||
|
||||
bool Manager::IsIgnored(const string& unique)
|
||||
{
|
||||
return ignored.find(unique) != ignored.end();
|
||||
}
|
||||
|
||||
bool Manager::IsDisabled(AnalyzerTag::Tag tag)
|
||||
{
|
||||
if ( ! disabled )
|
||||
disabled = internal_const_val("FileAnalysis::disable")->AsTableVal();
|
||||
|
||||
Val* index = new Val(tag, TYPE_COUNT);
|
||||
Val* yield = disabled->Lookup(index);
|
||||
Unref(index);
|
||||
|
||||
if ( ! yield ) return false;
|
||||
|
||||
bool rval = yield->AsBool();
|
||||
Unref(yield);
|
||||
|
||||
return rval;
|
||||
}
|
||||
|
||||
bool Manager::QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig)
|
||||
{
|
||||
if ( ! get_file_handle ) return false;
|
||||
|
||||
val_list* vl = new val_list();
|
||||
vl->append(new Val(tag, TYPE_COUNT));
|
||||
vl->append(conn->BuildConnVal());
|
||||
vl->append(new Val(is_orig, TYPE_BOOL));
|
||||
|
||||
mgr.QueueEvent(get_file_handle, vl);
|
||||
return true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,14 +3,20 @@
|
|||
|
||||
#include <string>
|
||||
#include <map>
|
||||
#include <set>
|
||||
#include <queue>
|
||||
|
||||
#include "Net.h"
|
||||
#include "AnalyzerTags.h"
|
||||
#include "Conn.h"
|
||||
#include "Val.h"
|
||||
#include "Analyzer.h"
|
||||
#include "Timer.h"
|
||||
|
||||
#include "Info.h"
|
||||
#include "InfoTimer.h"
|
||||
#include "FileID.h"
|
||||
#include "PendingFile.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
|
|
@ -29,42 +35,66 @@ public:
|
|||
*/
|
||||
void Terminate();
|
||||
|
||||
/**
|
||||
* Associates a handle with the next element in the #pending queue, which
|
||||
* will immediately push that element all the way through the file analysis
|
||||
* framework, possibly evaluating any policy hooks.
|
||||
*/
|
||||
void ReceiveHandle(const string& handle);
|
||||
|
||||
/**
|
||||
* Called when all events have been drained from the event queue.
|
||||
* There should be no pending file input/data at this point.
|
||||
*/
|
||||
void EventDrainDone();
|
||||
|
||||
/**
|
||||
* Pass in non-sequential file data.
|
||||
*/
|
||||
void DataIn(const string& unique, const u_char* data, uint64 len,
|
||||
uint64 offset, Connection* conn = 0,
|
||||
const string& protocol = "");
|
||||
void DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
AnalyzerTag::Tag tag, Connection* conn, bool is_orig);
|
||||
void DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
const string& unique);
|
||||
void DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
Info* info);
|
||||
|
||||
/**
|
||||
* Pass in sequential file data.
|
||||
*/
|
||||
void DataIn(const string& unique, const u_char* data, uint64 len,
|
||||
Connection* conn = 0, const string& protocol = "");
|
||||
void DataIn(const u_char* data, uint64 len, AnalyzerTag::Tag tag,
|
||||
Connection* conn, bool is_orig);
|
||||
void DataIn(const u_char* data, uint64 len, const string& unique);
|
||||
void DataIn(const u_char* data, uint64 len, Info* info);
|
||||
|
||||
/**
|
||||
* Signal the end of file data.
|
||||
*/
|
||||
void EndOfFile(const string& unique, Connection* conn = 0,
|
||||
const string& protocol = "");
|
||||
void EndOfFile(AnalyzerTag::Tag tag, Connection* conn);
|
||||
void EndOfFile(AnalyzerTag::Tag tag, Connection* conn, bool is_orig);
|
||||
void EndOfFile(const string& unique);
|
||||
|
||||
/**
|
||||
* Signal a gap in the file data stream.
|
||||
*/
|
||||
void Gap(const string& unique, uint64 offset, uint64 len,
|
||||
Connection* conn = 0, const string& protocol = "");
|
||||
void Gap(uint64 offset, uint64 len, AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig);
|
||||
void Gap(uint64 offset, uint64 len, const string& unique);
|
||||
void Gap(uint64 offset, uint64 len, Info* info);
|
||||
|
||||
/**
|
||||
* Provide the expected number of bytes that comprise a file.
|
||||
*/
|
||||
void SetSize(const string& unique, uint64 size, Connection* conn = 0,
|
||||
const string& protocol = "");
|
||||
void SetSize(uint64 size, AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig);
|
||||
void SetSize(uint64 size, const string& unique);
|
||||
void SetSize(uint64 size, Info* info);
|
||||
|
||||
/**
|
||||
* Discard the file_analysis::Info object associated with \a file_id.
|
||||
* Starts ignoring a file, which will finally be removed from internal
|
||||
* mappings on EOF or TIMEOUT.
|
||||
* @return false if file identifier did not map to anything, else true.
|
||||
*/
|
||||
bool RemoveFile(const FileID& file_id);
|
||||
bool IgnoreFile(const FileID& file_id);
|
||||
|
||||
/**
|
||||
* If called during \c FileAnalysis::policy evaluation for a
|
||||
|
|
@ -73,37 +103,43 @@ public:
|
|||
bool PostponeTimeout(const FileID& file_id) const;
|
||||
|
||||
/**
|
||||
* Attaches an action to the file identifier. Only one action of a given
|
||||
* type can be attached per file identifier at a time.
|
||||
* @return true if the action was attached, else false.
|
||||
* Queue attachment of an action to the file identifier. Multiple actions
|
||||
* of a given type can be attached per file identifier at a time as long as
|
||||
* the arguments differ.
|
||||
* @return false if the action failed to be instantiated, else true.
|
||||
*/
|
||||
bool AddAction(const FileID& file_id, EnumVal* act, RecordVal* args) const;
|
||||
bool AddAction(const FileID& file_id, RecordVal* args) const;
|
||||
|
||||
/**
|
||||
* Removes an action for a given file identifier.
|
||||
* @return true if the action was removed, else false.
|
||||
* Queue removal of an action for a given file identifier.
|
||||
* @return true if the action is active at the time of call, else false.
|
||||
*/
|
||||
bool RemoveAction(const FileID& file_id, EnumVal* act) const;
|
||||
bool RemoveAction(const FileID& file_id, const RecordVal* args) const;
|
||||
|
||||
/**
|
||||
* Calls the \c FileAnalysis::policy hook.
|
||||
*/
|
||||
static void EvaluatePolicy(BifEnum::FileAnalysis::Trigger t, Info* info);
|
||||
void EvaluatePolicy(BifEnum::FileAnalysis::Trigger t, Info* info);
|
||||
|
||||
protected:
|
||||
|
||||
friend class InfoTimer;
|
||||
friend class PendingFile;
|
||||
|
||||
typedef map<string, Info*> StrMap;
|
||||
typedef set<string> StrSet;
|
||||
typedef map<FileID, Info*> IDMap;
|
||||
typedef queue<PendingFile*> PendingQueue;
|
||||
|
||||
/**
|
||||
* @return the Info object mapped to \a unique. One is created if mapping
|
||||
* doesn't exist. If it did exist, the activity time is refreshed
|
||||
* and connection-related fields of the record value may be updated.
|
||||
* @return the Info object mapped to \a unique or a null pointer if analysis
|
||||
* is being ignored for the associated file. An Info object may be
|
||||
* created if a mapping doesn't exist, and if it did exist, the
|
||||
* activity time is refreshed along with any connection-related
|
||||
* fields.
|
||||
*/
|
||||
Info* GetInfo(const string& unique, Connection* conn = 0,
|
||||
const string& protocol = "");
|
||||
AnalyzerTag::Tag tag = AnalyzerTag::Error);
|
||||
|
||||
/**
|
||||
* @return the Info object mapped to \a file_id, or a null pointer if no
|
||||
|
|
@ -117,8 +153,35 @@ protected:
|
|||
*/
|
||||
void Timeout(const FileID& file_id, bool is_terminating = ::terminating);
|
||||
|
||||
/**
|
||||
* Immediately remove file_analysis::Info object associated with \a unique.
|
||||
* @return false if file string did not map to anything, else true.
|
||||
*/
|
||||
bool RemoveFile(const string& unique);
|
||||
|
||||
/**
|
||||
* @return whether the file mapped to \a unique is being ignored.
|
||||
*/
|
||||
bool IsIgnored(const string& unique);
|
||||
|
||||
/**
|
||||
* @return whether file analysis is disabled for the given analyzer.
|
||||
*/
|
||||
static bool IsDisabled(AnalyzerTag::Tag tag);
|
||||
|
||||
/**
|
||||
* Queues \c get_file_handle event in order to retrieve unique file handle.
|
||||
* @return true if there is a handler for the event, else false.
|
||||
*/
|
||||
static bool QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig);
|
||||
|
||||
StrMap str_map; /**< Map unique strings to \c FileAnalysis::Info records. */
|
||||
IDMap id_map; /**< Map file IDs to \c FileAnalysis::Info records. */
|
||||
StrSet ignored; /**< Ignored files. Will be finally removed on EOF. */
|
||||
PendingQueue pending; /**< Files awaiting a unique handle. */
|
||||
|
||||
static TableVal* disabled; /**< Table of disabled analyzers. */
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
|
|
|||
111
src/file_analysis/PendingFile.cc
Normal file
111
src/file_analysis/PendingFile.cc
Normal file
|
|
@ -0,0 +1,111 @@
|
|||
#include "PendingFile.h"
|
||||
#include "Manager.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
static void copy_data(const u_char** dst, const u_char* src, uint64 len)
|
||||
{
|
||||
u_char* tmp = new u_char[len];
|
||||
memcpy(tmp, src, len);
|
||||
*dst = tmp;
|
||||
}
|
||||
|
||||
static string conn_str(Connection* c)
|
||||
{
|
||||
char op[256], rp[256];
|
||||
modp_ulitoa10(ntohs(c->OrigPort()), op);
|
||||
modp_ulitoa10(ntohs(c->RespPort()), rp);
|
||||
string rval = c->OrigAddr().AsString() + ":" + op + "->" +
|
||||
c->RespAddr().AsString() + ":" + rp;
|
||||
return rval;
|
||||
}
|
||||
|
||||
PendingFile::PendingFile(Connection* arg_conn, AnalyzerTag::Tag arg_tag)
|
||||
: conn(arg_conn), tag(arg_tag)
|
||||
{
|
||||
Ref(conn);
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "New pending file: %s", conn_str(conn).c_str());
|
||||
}
|
||||
|
||||
PendingFile::~PendingFile()
|
||||
{
|
||||
Unref(conn);
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Delete pending file: %s",
|
||||
conn_str(conn).c_str());
|
||||
}
|
||||
|
||||
Info* PendingFile::GetInfo(const string& handle) const
|
||||
{
|
||||
return file_mgr->GetInfo(handle, conn, tag);
|
||||
}
|
||||
|
||||
PendingDataInChunk::PendingDataInChunk(const u_char* arg_data, uint64 arg_len,
|
||||
uint64 arg_offset,
|
||||
AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), len(arg_len),
|
||||
offset(arg_offset)
|
||||
{
|
||||
copy_data(&data, arg_data, len);
|
||||
}
|
||||
|
||||
void PendingDataInChunk::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->DataIn(data, len, offset, GetInfo(handle));
|
||||
}
|
||||
|
||||
PendingDataInChunk::~PendingDataInChunk()
|
||||
{
|
||||
delete [] data;
|
||||
}
|
||||
|
||||
PendingDataInStream::PendingDataInStream(const u_char* arg_data, uint64 arg_len,
|
||||
AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), len(arg_len)
|
||||
{
|
||||
copy_data(&data, arg_data, len);
|
||||
}
|
||||
|
||||
void PendingDataInStream::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->DataIn(data, len, GetInfo(handle));
|
||||
}
|
||||
|
||||
PendingDataInStream::~PendingDataInStream()
|
||||
{
|
||||
delete [] data;
|
||||
}
|
||||
|
||||
PendingGap::PendingGap(uint64 arg_offset, uint64 arg_len,
|
||||
AnalyzerTag::Tag arg_tag, Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), offset(arg_offset),
|
||||
len(arg_len)
|
||||
{
|
||||
}
|
||||
|
||||
void PendingGap::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->Gap(offset, len, GetInfo(handle));
|
||||
}
|
||||
|
||||
PendingEOF::PendingEOF(AnalyzerTag::Tag arg_tag, Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag)
|
||||
{
|
||||
}
|
||||
|
||||
void PendingEOF::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->EndOfFile(handle);
|
||||
}
|
||||
|
||||
PendingSize::PendingSize(uint64 arg_size, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), size(arg_size)
|
||||
{
|
||||
}
|
||||
|
||||
void PendingSize::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->SetSize(size, GetInfo(handle));
|
||||
}
|
||||
99
src/file_analysis/PendingFile.h
Normal file
99
src/file_analysis/PendingFile.h
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
#ifndef FILE_ANALYSIS_PENDINGFILE_H
|
||||
#define FILE_ANALYSIS_PENDINGFILE_H
|
||||
|
||||
#include "AnalyzerTags.h"
|
||||
#include "Conn.h"
|
||||
#include "Info.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
class PendingFile {
|
||||
public:
|
||||
|
||||
virtual ~PendingFile();
|
||||
|
||||
virtual void Finish(const string& handle) const = 0;
|
||||
|
||||
protected:
|
||||
|
||||
PendingFile(Connection* arg_conn,
|
||||
AnalyzerTag::Tag arg_tag = AnalyzerTag::Error);
|
||||
|
||||
Info* GetInfo(const string& handle) const;
|
||||
|
||||
Connection* conn;
|
||||
AnalyzerTag::Tag tag;
|
||||
};
|
||||
|
||||
class PendingDataInChunk : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingDataInChunk(const u_char* arg_data, uint64 arg_len,
|
||||
uint64 arg_offset, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn);
|
||||
|
||||
virtual ~PendingDataInChunk();
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
const u_char* data;
|
||||
uint64 len;
|
||||
uint64 offset;
|
||||
};
|
||||
|
||||
class PendingDataInStream : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingDataInStream(const u_char* arg_data, uint64 arg_len,
|
||||
AnalyzerTag::Tag arg_tag, Connection* arg_conn);
|
||||
|
||||
virtual ~PendingDataInStream();
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
const u_char* data;
|
||||
uint64 len;
|
||||
};
|
||||
|
||||
class PendingGap : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingGap(uint64 arg_offset, uint64 arg_len, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn);
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
uint64 offset;
|
||||
uint64 len;
|
||||
};
|
||||
|
||||
class PendingEOF : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingEOF(AnalyzerTag::Tag arg_tag, Connection* arg_conn);
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
};
|
||||
|
||||
class PendingSize : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingSize(uint64 arg_size, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn);
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
uint64 size;
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
||||
#endif
|
||||
Loading…
Add table
Add a link
Reference in a new issue