C++ DynamicPreprocessorData类代码示例

/* Initializes the DNS preprocessor module and registers
 * it in the preprocessor list.
 * 
 * PARAMETERS:  
 *
 * argp:        Pointer to argument string to process for config
 *                      data.
 *
 * RETURNS:     Nothing. 
 */
static void DNSInit( u_char* argp )
{
    _dpd.addPreproc( ProcessDNS, PRIORITY_APPLICATION, PP_DNS );
    _dpd.addPreprocConfCheck( DNSConfigCheck );
    
    ParseDNSArgs( argp );
    
#ifdef PERF_PROFILING
    _dpd.addPreprocProfileFunc("dns", (void *)&dnsPerfStats, 0, _dpd.totalPerfStats);
#endif
}

/* Called at preprocessor setup time. Links preprocessor keyword
 * to corresponding preprocessor initialization function.
 *
 * PARAMETERS:	None.
* 
 * RETURNS:	Nothing.
 *
 */
void SetupSSH(void)
{
	/* Link preprocessor keyword to initialization function 
 	 * in the preprocessor list. */
#ifndef SNORT_RELOAD
	_dpd.registerPreproc( "ssh", SSHInit );
#else
	_dpd.registerPreproc("ssh", SSHInit, SSHReload,
                         SSHReloadSwap, SSHReloadSwapFree);
#endif
}

static int SSHCheckPolicyConfig(
        tSfPolicyUserContextId config,
        tSfPolicyId policyId, 
        void* pData
        )
{
    _dpd.setParserPolicy(policyId);

    if (!_dpd.isPreprocEnabled(PP_STREAM5))
    {
        DynamicPreprocessorFatalMessage("SSHCheckPolicyConfig(): The Stream preprocessor must be enabled.\n");
    }
    return 0;
}

/* Display the configuration for the DNS preprocessor. 
 * 
 * PARAMETERS:  None.
 *
 * RETURNS: Nothing.
 */
static void PrintDNSConfig()
{
    int index;
    
    _dpd.logMsg("DNS config: \n");
#if 0
    _dpd.logMsg("    Autodetection: %s\n", 
        dns_config.autodetect ? 
        "ENABLED":"DISABLED");
#endif
    _dpd.logMsg("    DNS Client rdata txt Overflow Alert: %s\n",
        dns_config.enabled_alerts & DNS_ALERT_RDATA_OVERFLOW ?
        "ACTIVE" : "INACTIVE" );
    _dpd.logMsg("    Obsolete DNS RR Types Alert: %s\n",
        dns_config.enabled_alerts & DNS_ALERT_OBSOLETE_TYPES ?
        "ACTIVE" : "INACTIVE" );
    _dpd.logMsg("    Experimental DNS RR Types Alert: %s\n",
        dns_config.enabled_alerts & DNS_ALERT_EXPERIMENTAL_TYPES ?
        "ACTIVE" : "INACTIVE" );
    
    /* Printing ports */
    _dpd.logMsg("    Ports:"); 
    for(index = 0; index < MAX_PORTS; index++) 
    {
        if( dns_config.ports[ PORT_INDEX(index) ] & CONV_PORT(index) )
        {
            _dpd.logMsg(" %d", index);
        }
    }
    _dpd.logMsg("\n");
}

static void SSHReload(char *args)
{
    tSfPolicyId policy_id = _dpd.getParserPolicy();
    SSHConfig * pPolicyConfig = NULL;

    if (ssh_swap_config == NULL)
    {
        //create a context
        ssh_swap_config = sfPolicyConfigCreate();
        if (ssh_swap_config == NULL)
        {
            DynamicPreprocessorFatalMessage("Failed to allocate memory "
                                            "for SSH config.\n");
        }

        if (_dpd.streamAPI == NULL)
        {
            DynamicPreprocessorFatalMessage("SetupSSH(): The Stream preprocessor must be enabled.\n");
        }
    }

    sfPolicyUserPolicySet (ssh_swap_config, policy_id);
    pPolicyConfig = (SSHConfig *)sfPolicyUserDataGetCurrent(ssh_swap_config);
    if (pPolicyConfig != NULL)
    {
        DynamicPreprocessorFatalMessage("SSH preprocessor can only be "
                                        "configured once.\n");
    }

    pPolicyConfig = (SSHConfig *)calloc(1, sizeof(SSHConfig));
    if (!pPolicyConfig)
    {
        DynamicPreprocessorFatalMessage("Could not allocate memory for "
                                        "SSH preprocessor configuration.\n");
    }
    sfPolicyUserDataSetCurrent(ssh_swap_config, pPolicyConfig);

	ParseSSHArgs(pPolicyConfig, (u_char *)args);

	_dpd.addPreproc( ProcessSSH, PRIORITY_APPLICATION, PP_SSH, PROTO_BIT__TCP );
    _dpd.addPreprocReloadVerify(SSHReloadVerify);

    _addPortsToStream5Filter(pPolicyConfig, policy_id);

#ifdef TARGET_BASED
    _addServicesToStream5Filter(policy_id);
#endif
}

/* Initializes the SSH preprocessor module and registers
 * it in the preprocessor list.
 * 
 * PARAMETERS:  
 *
 * argp:        Pointer to argument string to process for config
 *                      data.
 *
 * RETURNS:     Nothing. 
 */
static  void
SSHInit( u_char* argp )
{
    if(!_dpd.streamAPI) 
    {
        _dpd.fatalMsg("SetupSSH(): The Stream preprocessor must be enabled.\n");
    }

	_dpd.addPreproc( ProcessSSH, PRIORITY_APPLICATION, PP_SSH );

	ParseSSHArgs( argp );

#ifdef PERF_PROFILING
    _dpd.addPreprocProfileFunc("ssh", (void *)&sshPerfStats, 0, _dpd.totalPerfStats);
#endif
}

/* Called at preprocessor setup time. Links preprocessor keyword
 * to corresponding preprocessor initialization function.
 *
 * PARAMETERS:	None.
* 
 * RETURNS:	Nothing.
 *
 */
void SetupSSH()
{
	/* Link preprocessor keyword to initialization function 
 	 * in the preprocessor list.
 	 */
	_dpd.registerPreproc( "ssh", SSHInit );
}

/********************************************************************
 * Function: DCE2_GetDebugLevel()
 *
 * Gets the debugging level set by the DCE2 debugging environment
 * variable on the first call.  Subsequent calls will used the
 * cached value.
 *
 * Arguments: None
 *
 * Returns:
 *  uint32_t
 *      The debugging level set by the environment variable.
 *
 ********************************************************************/
static uint32_t DCE2_GetDebugLevel(void)
{
    static int debug_init = 0;
    static uint32_t debug_level = 0;
    const char* value;

    if (debug_init)
        return debug_level;

    value = getenv(DCE2_DEBUG_VARIABLE);

    if (value != NULL)
    {
        char *endptr;

        debug_level = _dpd.SnortStrtoul(value, &endptr, 0);
        if ((errno == ERANGE) || (*endptr != '\0'))
        {
            DCE2_Log(DCE2_LOG_TYPE__WARN,
                     "\"%s\" value out of range or not a number: %s. "
                     "Debugging will not be turned on.",
                     DCE2_DEBUG_VARIABLE, value);

            debug_level = 0;
        }
    }

    debug_init = 1;

    return debug_level;
}

/* Display the configuration for the SSL preprocessor. 
 * 
 * PARAMETERS:  None.
 *
 * RETURNS: Nothing.
 */
static void PrintSSLConfig( const SSLConfig* ssl_config )
{
	int index;

	if (ssl_config->server_cnt > 0)
	{
		_dpd.logMsg("SSL Config:\n");
		_dpd.logMsg(" Server(s):\n");

		for(index = 0; index < ssl_config->server_cnt; index++) 
		{
			_dpd.logMsg("IP address: %s\n", inet_ntoa(ssl_config->server[index]->server_ip));
			_dpd.logMsg("      Port: %i\n", ssl_config->server[index]->port);    
			_dpd.logMsg("   Keyfile: %s\n\n", ssl_config->server[index]->server_keyfile);
		}
	}
}

static int SSHReloadVerify(void)
{
    if (!_dpd.isPreprocEnabled(PP_STREAM5))
    {
        DynamicPreprocessorFatalMessage("SetupSSH(): The Stream preprocessor must be enabled.\n");
    }

    return 0;
}

/* Called at preprocessor setup time. Links preprocessor keyword
 * to corresponding preprocessor initialization function.
 *
 * PARAMETERS:  None.
 * 
 * RETURNS: Nothing.
 *
 */
void SetupDNS()
{
    /* Link preprocessor keyword to initialization function 
     * in the preprocessor list.
     */
    _dpd.registerPreproc( "dns", DNSInit );

    memset(dns_config.ports, 0, sizeof(char) * (MAX_PORTS/8));
}

NORETURN void DynamicPreprocessorFatalMessage(const char *format, ...)
{
    char buf[STD_BUF];
    va_list ap;

    va_start(ap, format);
    vsnprintf(buf, STD_BUF, format, ap);
    va_end(ap);

    buf[STD_BUF - 1] = '\0';

    _dpd.fatalMsg("%s", buf);

    exit(1);
}

int LoadConfig( const u_char* conf, SSLConfig* cfg )
{
	ParseContext ctx;
	u_char* conf_copy = NULL;
	ConfigToken TopLevelTokens[] = { Token_Server, Token_EOF };
	ConfigToken token = Token_Unknown;

	error_buffer[0] = 0;

	conf_copy = (u_char*) malloc( strlen( conf ) + 1 );
	strcpy( conf_copy, conf );

	memset( &ctx, 0, sizeof(ctx) );
	ctx.input = conf_copy;
	ctx.config = cfg;

	do 
	{
		token = ParseOneOf( &ctx, TopLevelTokens, ARRAY_SIZE( TopLevelTokens ) );

		if( token == Token_Server ) 
		{
			if( ParseServer( &ctx ) == CONFIG_PARSE_ERROR ) token = CONFIG_PARSE_ERROR;
		}
	} while ( token == Token_Server );

	free( conf_copy ); conf_copy = ctx.input = NULL;

	/* make sure we have at least one server set up */
	if( token != CONFIG_PARSE_ERROR && ctx.config->server_cnt == 0 )
	{
		sprintf( error_buffer, "%s: at least one SSL server's configuration is expected", ERROR_PREFIX );
		token = CONFIG_PARSE_ERROR;
	}

	if( token == CONFIG_PARSE_ERROR ) 
	{
		if( strlen( error_buffer ) )
		{
			_dpd.fatalMsg( "%s(%d) => %s", *(_dpd.config_file), *(_dpd.config_line), error_buffer );
		}
		return CONFIG_PARSE_ERROR;
	}

	PrintSSLConfig( ctx.config );
	return 0;
}

void ExampleSetup()
{
    _dpd.registerPreproc("dynamic_example", ExampleInit, 0, 0, 0);

    DEBUG_WRAP(_dpd.debugMsg(DEBUG_PLUGIN, "Preprocessor: Example is setup\n"););

/*
 * Handle X-Link2State vulnerability
 *   
 *  From Lurene Grenier:
 
    The X-LINK2STATE command always takes the following form:

    X-LINK2STATE [FIRST|NEXT|LAST] CHUNK=<SOME DATA>

    The overwrite occurs when three criteria are met:

    No chunk identifier exists - ie neither FIRST, NEXT, or LAST are specified
    No previous FIRST chunk was sent
    <SOME DATA> has a length greater than 520 bytes

    Normally you send a FIRST chunk, then some intermediary chunks marked with
    either NEXT or not marked, then finally a LAST chunk.  If no first chunk is
    sent, and a chunk with no specifier is sent, it assumes it must append to
    something, but it has nothing to append to, so an overwrite occurs. Sending out
    of order chunks WITH specifiers results in an exception.

    So simply:

    if (gotFirstChunk)
        next; # chunks came with proper first chunk specified
    if (/X-LINK2STATE [FIRST|NEXT|LAST] CHUNK/) {
        if (/X-LINK2STATE FIRST CHUNK/) gotFirstChunk = TRUE;
        next; # some specifier is marked 
    }
    if (chunkLen > 520)
       attempt = TRUE; # Gotcha!

    Usually it takes more than one unspecified packet in a row, but I think this is
    just a symptom of the fact that we're triggering a heap overwrite, and not a
    condition of the bug. However, if we're still getting FPs this might be an
    avenue to try.

 *
 * @param   p           standard Packet structure
 * @param   x           pointer to "X-LINK2STATE" in buffer
 *
 * @retval  1           if alert raised
 * @retval  0           if no alert raised
 */
int ParseXLink2State(SFSnortPacket *p, const uint8_t *ptr)
{
    uint8_t  *lf = NULL;
    uint32_t  len = 0;
    char       x_keyword;
    const uint8_t  *end;

    if (p == NULL || ptr == NULL)
        return 0;

    /* If we got a FIRST chunk on this stream, this is not an exploit */
    if (smtp_ssn->session_flags & SMTP_FLAG_XLINK2STATE_GOTFIRSTCHUNK)
        return 0;

    /* Calculate length from pointer to end of packet data */
    end = p->payload + p->payload_size;
    if (ptr >= end)
        return 0;

    /* Check for "FIRST" or "CHUNK" after X-LINK2STATE */
    x_keyword = get_xlink_keyword(ptr, end);
    if (x_keyword != XLINK_CHUNK)
    {
        if (x_keyword == XLINK_FIRST)
            smtp_ssn->session_flags |= SMTP_FLAG_XLINK2STATE_GOTFIRSTCHUNK;

        return 0;
    }

    ptr = (uint8_t *)memchr((char *)ptr, '=', end - ptr);
    if (ptr == NULL)
        return 0;

    /* move past '=' and make sure we're within bounds */
    ptr++;
    if (ptr >= end)
        return 0;

    /*  Look for one of two patterns:
     *
     *  ... CHUNK={0000006d} MULTI (5) ({00000000051} ...
     *  ... CHUNK=AAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n
     */

    if (*ptr == '{')
    {
        /* move past '{' and make sure we're within bounds */
        ptr++;
        if ((ptr + 8) >= end)
            return 0;

        /* Get length - can we always trust it? */
        len = get_xlink_hex_value(ptr, end);
    }
    else
    {
//.........这里部分代码省略.........