mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 20:18:20 +00:00
b22ca5d0a3
Notable changes: - libmagic is no longer used at all. All MIME type detection is done through new Bro signatures, and there's no longer a means to get verbose file type descriptions (e.g. "PNG image data, 1435 x 170"). The majority of the default file magic signatures are derived from the default magic database of libmagic ~5.17. - File magic signatures consist of two new constructs in the signature rule parsing grammar: "file-magic" gives a regular expression to match against, and "file-mime" gives the MIME type string of content that matches the magic and an optional strength value for the match. - Modified signature/rule syntax for identifiers: they can no longer start with a '-', which made for ambiguous syntax when doing negative strength values in "file-mime". Also brought syntax for Bro script identifiers in line with reality (they can't start with numbers or include '-' at all). - A new Built-In Function, "file_magic", can be used to get all file magic matches and their corresponding strength against a given chunk of data - The second parameter of the "identify_data" Built-In Function can no longer be used to get verbose file type descriptions, though it can still be used to get the strongest matching file magic signature. - The "file_transferred" event's "descr" parameter no longer contains verbose file type descriptions. - The BROMAGIC environment variable no longer changes any behavior in Bro as magic databases are no longer used/installed. - Reverted back to minimum requirement of CMake 2.6.3 from 2.8.0 (it's back to being the same requirement as the Bro v2.2 release). The bump was to accomodate building libmagic as an external project, which is no longer needed. Addresses BIT-1143.
100 lines
2 KiB
C++
100 lines
2 KiB
C++
#include "config.h"
|
|
|
|
#include "Rule.h"
|
|
#include "RuleMatcher.h"
|
|
|
|
// Start at one as we want search for this within a list,
|
|
// and List's is_member returns zero for non-membership ...
|
|
unsigned int Rule::rule_counter = 1;
|
|
unsigned int Rule::pattern_counter = 0;
|
|
rule_list Rule::rule_table;
|
|
|
|
Rule::~Rule()
|
|
{
|
|
delete [] id;
|
|
|
|
loop_over_list(patterns, i)
|
|
{
|
|
delete [] patterns[i]->pattern;
|
|
delete patterns[i];
|
|
}
|
|
|
|
loop_over_list(hdr_tests, j)
|
|
delete hdr_tests[j];
|
|
|
|
loop_over_list(conditions, k)
|
|
delete conditions[k];
|
|
|
|
loop_over_list(actions, l)
|
|
delete actions[l];
|
|
|
|
loop_over_list(preconds, m)
|
|
{
|
|
delete [] preconds[m]->id;
|
|
delete preconds[m];
|
|
}
|
|
}
|
|
|
|
const char* Rule::TypeToString(Rule::PatternType type)
|
|
{
|
|
static const char* labels[] = {
|
|
"File Magic", "Payload", "HTTP-REQUEST", "HTTP-REQUEST-BODY",
|
|
"HTTP-REQUEST-HEADER", "HTTP-REPLY-BODY",
|
|
"HTTP-REPLY-HEADER", "FTP", "Finger",
|
|
};
|
|
return labels[type];
|
|
}
|
|
|
|
void Rule::PrintDebug()
|
|
{
|
|
fprintf(stderr, "Rule %s (%d) %s\n", id, idx, active ? "[active]" : "[disabled]");
|
|
|
|
loop_over_list(patterns, i)
|
|
{
|
|
fprintf(stderr, " %-8s |%s| (%d) \n",
|
|
TypeToString(patterns[i]->type), patterns[i]->pattern,
|
|
patterns[i]->id);
|
|
}
|
|
|
|
loop_over_list(hdr_tests, j)
|
|
hdr_tests[j]->PrintDebug();
|
|
|
|
loop_over_list(conditions, k)
|
|
conditions[k]->PrintDebug();
|
|
|
|
loop_over_list(actions, l)
|
|
actions[l]->PrintDebug();
|
|
|
|
fputs("\n", stderr);
|
|
}
|
|
|
|
void Rule::AddPattern(const char* str, Rule::PatternType type,
|
|
uint32 offset, uint32 depth)
|
|
{
|
|
Pattern* p = new Pattern;
|
|
p->pattern = copy_string(str);
|
|
p->type = type;
|
|
p->id = ++pattern_counter;
|
|
p->offset = offset;
|
|
p->depth = depth;
|
|
patterns.append(p);
|
|
|
|
rule_table.append(this);
|
|
}
|
|
|
|
void Rule::AddRequires(const char* id, bool opposite_direction, bool negate)
|
|
{
|
|
Precond* p = new Precond;
|
|
p->id = copy_string(id);
|
|
p->rule = 0;
|
|
p->opposite_dir = opposite_direction;
|
|
p->negate = negate;
|
|
|
|
preconds.append(p);
|
|
}
|
|
|
|
void Rule::SortHdrTests()
|
|
{
|
|
// FIXME: Do nothing for now - we may want to come up with
|
|
// something clever here.
|
|
}
|