source: trunk/src/sh_filter.c@ 327

/* SAMHAIN file system integrity testing                                   */
/* Copyright (C) 2009 Rainer Wichmann                                      */
/*                                                                         */
/*  This program is free software; you can redistribute it                 */
/*  and/or modify                                                          */
/*  it under the terms of the GNU General Public License as                */
/*  published by                                                           */
/*  the Free Software Foundation; either version 2 of the License, or      */
/*  (at your option) any later version.                                    */
/*                                                                         */
/*  This program is distributed in the hope that it will be useful,        */
/*  but WITHOUT ANY WARRANTY; without even the implied warranty of         */
/*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          */
/*  GNU General Public License for more details.                           */
/*                                                                         */
/*  You should have received a copy of the GNU General Public License      */
/*  along with this program; if not, write to the Free Software            */
/*  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.              */


#include "config_xor.h"

#include <string.h>
#ifdef HAVE_REGEX_H
#include <regex.h>
#endif

#include "samhain.h"
#include "sh_utils.h"
#include "sh_mem.h"
#include "sh_filter.h"

#undef  FIL__
#define FIL__  _("sh_filter.c")


void sh_filter_free (sh_filter_type * filter)
{
  int i;

  if (filter)
    {
      for (i = 0; i < filter->for_c; ++i) {
#ifdef HAVE_REGEX_H
        if (filter->for_v[i])
          regfree(filter->for_v[i]);
#else
        if (filter->for_v[i])
          SH_FREE(filter->for_v[i]);
#endif
        filter->for_v[i] = NULL; 
      }
      filter->for_c = 0;

      for (i = 0; i < filter->fand_c; ++i) {
#ifdef HAVE_REGEX_H
        if (filter->fand_v[i])
          regfree(filter->fand_v[i]);
#else
        if (filter->fand_v[i])
          SH_FREE(filter->fand_v[i]);
#endif
        filter->fand_v[i] = NULL; 
      }
      filter->fand_c = 0;

      for (i = 0; i < filter->fnot_c; ++i) {
#ifdef HAVE_REGEX_H
        if (filter->fnot_v[i])
          regfree(filter->fnot_v[i]);
#else
        if (filter->fnot_v[i])
          SH_FREE(filter->fnot_v[i]);
#endif
        filter->fnot_v[i] = NULL; 
      }
      filter->fnot_c = 0;
    }
}


int sh_filter_add (const char * str, sh_filter_type * filter, int type)
{
  int     i = 0;
  int     flag = 0;
  size_t  s;

  char  * dupp;
  char  * p;
  char  * end;
  int   * ntok;
  void ** stok;

  SL_ENTER(_("sh_filter_filteradd"));

  if (NULL == str || NULL == filter)
    {
      SL_RETURN((-1), _("sh_filter_filteradd")); 
    }

  if (type == SH_FILT_OR) {
    ntok = &(filter->for_c);
    stok = filter->for_v;
  }
  else if (type == SH_FILT_AND) {
    ntok = &(filter->fand_c);
    stok = filter->fand_v;
  }
  else if (type == SH_FILT_NOT) {
    ntok = &(filter->fnot_c);
    stok = filter->fnot_v;
  }
  else {
    SL_RETURN((-1), _("sh_filter_filteradd")); 
  }

  i = *ntok;
  if (i == SH_FILT_NUM) {
    SL_RETURN((-1), _("sh_filter_filteradd")); 
  }

  dupp = sh_util_strdup(str);
  p   = dupp;

  do
    {
      while (*p == ',' || *p == ' ' || *p == '\t')
        ++p;
      if (*p == '\0')
        break;

      end = p; ++end;
      if (*end == '\0')
        break;

      if (*p == '\'')
        {
          ++p; end = p; if (*end != '\'') ++end;
          if (*p == '\0' || *end == '\0')
            break;
          while (*end != '\0' && *end != '\'')
            ++end;
        }
      else if (*p == '"')
        {
          ++p; end = p; if (*end != '"') ++end;
          if (*p == '\0' || *end == '\0')
            break;
          while (*end != '\0' && *end != '"')
            ++end;
        }
      else
        {
          while (*end != '\0' && *end != ',' && *end != ' ' && *end != '\t')
            ++end;
        }
      if (*end == '\0')
        flag = 1;
      else
        *end = '\0';

      s = strlen(p);
      if (s > 0) 
        {
          ++s;
#ifdef HAVE_REGEX_H
          if (stok[i] != NULL)
            regfree((regex_t *) stok[i]);
          {
            int status;

            stok[i] = SH_ALLOC(sizeof(regex_t));

            status = regcomp((regex_t *) stok[i], p, 
                                 REG_NOSUB|REG_EXTENDED);
            if (status != 0) 
              {
                char * errbuf = SH_ALLOC(BUFSIZ);
                (void) regerror(status, (regex_t *) stok[i], 
                                errbuf, BUFSIZ); 
                errbuf[BUFSIZ-1] = '\0';
                sh_error_handle ((-1), FIL__, __LINE__, status, MSG_E_REGEX,
                                 errbuf, p);
                SH_FREE(errbuf);
              }
          }
#else
          if (stok[i] != NULL)
            SH_FREE(stok[i]);

          stok[i] = SH_ALLOC(s);
          (void) sl_strlcpy((char *) stok[i], p, s);
#endif
          ++i;
        }

      p = end; ++p;

      if (i == SH_FILT_NUM)
        break;
    }
  while (p != NULL && *p != '\0' && flag == 0);

  *ntok = i;
  SH_FREE(dupp);

  SL_RETURN (0, _("sh_filter_filteradd"));
}

#ifdef HAVE_REGEX_H
static int sh_filter_cmp(const char * message, void * pattern)
{
  int result;

  result = regexec((regex_t *)pattern, message, 0, NULL, 0);

  if (result != 0)
    return -1;

  /* Successful match. */
  return 0;
}
#else
static int sh_filter_cmp(const char * message, void * pattern)
{
  if (NULL == sl_strstr(message, (char *)pattern))
    return -1;

  /* Successful match. */
  return 0;
}
#endif

/*
 * -- Check filters. Returns 0 if message passes.
 */ 
int sh_filter_filter (const char * message, sh_filter_type * filter)
{
  int i;

  SL_ENTER(_("sh_filter_filter"));

  if (filter)
    {

      /* Presence of any of these keywords prevents execution.
       */
      if (filter->fnot_c > 0)
        {
          for (i = 0; i < filter->fnot_c; ++i)
            {
              if (0 == sh_filter_cmp(message, filter->fnot_v[i]))
                {
                  SL_RETURN ((-1), _("sh_filter_filter"));
                }
            }
        }
      
      /* Presence of all of these keywords is required for execution.
       */
      if (filter->fand_c > 0)
        {
          for (i = 0; i < filter->fand_c; ++i)
            {
              if (0 != sh_filter_cmp(message, filter->fand_v[i]))
                {
                  SL_RETURN ((-1), _("sh_filter_filter"));
                }
            }
        }
      
      /* Presence of at least one of these keywords is required for execution.
       */
      if (filter->for_c > 0)
        {
          for (i = 0; i < filter->for_c; ++i)
            {
              if (0 == sh_filter_cmp(message, filter->for_v[i]))
                {
                  goto isok;
                }
            }
          SL_RETURN ((-1), _("sh_filter_filter"));
        }
    }

 isok:
  SL_RETURN ((0), _("sh_filter_filter"));
}

sh_filter_type * sh_filter_alloc(void)
{
  sh_filter_type * filter = SH_ALLOC(sizeof(sh_filter_type));

  memset(filter, '\0', sizeof(sh_filter_type));
  filter->for_c  = 0; 
  filter->fand_c = 0; 
  filter->fnot_c = 0;
  return filter;
}