Вы не можете выбрать более 25 тем Темы должны начинаться с буквы или цифры, могут содержать дефисы(-) и должны содержать не более 35 символов.

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528
  1. // SNFMulti.hpp
  2. //
  3. // (C) Copyright 2006 - 2020 ARM Research Labs, LLC.
  4. // See www.armresearch.com for the copyright terms.
  5. //
  6. // 20060121_M
  7. // This file creates an API for multi-threaded systems to use the SNF engine.
  8. //
  9. // This API is C++ oriented, meaning it throws exceptions and so forth.
  10. // For use in shared objects and DLLs, the functions in here will be wrapped
  11. // in a C style interface appropriate to that platform.
  12. //
  13. // The interface is based on the following structure.
  14. //
  15. // The application "Opens" one or more rulebases.
  16. // The application "Opens" some number of scanners referencing opened rulebases.
  17. // Each scanner handles one thread's worth of scanning, so it is presumed that
  18. // each processing thread in the calling application will have one scanner to itself.
  19. //
  20. // Rulebases can be reloaded asynchronously. The scanner's grab a reference to the
  21. // rulebase each time they restart. The grabbing and swapping in of new rulebases is
  22. // a very short critical section.
  23. #pragma once
  24. #include <stdexcept>
  25. #include <sys/types.h>
  26. #include <sys/stat.h>
  27. #include <ctime>
  28. #include <string>
  29. #include "../CodeDweller/faults.hpp"
  30. #ifdef WIN32
  31. // Required because threading.hpp includes windows.h.
  32. #include <winsock2.h>
  33. #endif
  34. #include "../CodeDweller/threading.hpp"
  35. #include "GBUdb.hpp"
  36. #include "FilterChain.hpp"
  37. #include "snf_engine.hpp"
  38. #include "snf_match.h"
  39. #include "snfCFGmgr.hpp"
  40. #include "snfLOGmgr.hpp"
  41. #include "snfNETmgr.hpp"
  42. #include "snfGBUdbmgr.hpp"
  43. #include "snfXCImgr.hpp"
  44. #include <cassert>
  45. namespace cd = codedweller;
  46. extern const char* SNF_ENGINE_VERSION;
  47. // snf Result Code Constants
  48. const int snf_SUCCESS = 0;
  49. const int snf_ERROR_CMD_LINE = 65;
  50. const int snf_ERROR_LOG_FILE = 66;
  51. const int snf_ERROR_RULE_FILE = 67;
  52. const int snf_ERROR_RULE_DATA = 68;
  53. const int snf_ERROR_RULE_AUTH = 73;
  54. const int snf_ERROR_MSG_FILE = 69;
  55. const int snf_ERROR_ALLOCATION = 70;
  56. const int snf_ERROR_BAD_MATRIX = 71;
  57. const int snf_ERROR_MAX_EVALS = 72;
  58. const int snf_ERROR_UNKNOWN = 99;
  59. // Settings & Other Constants
  60. const int snf_ScanHorizon = 32768; // Maximum length of message to check.
  61. const int snf_MAX_RULEBASES = 10; // 10 Rulebases is plenty. Most use just 1
  62. const int snf_MAX_SCANNERS = 500; // 500 Scanners at once should be plenty
  63. const int SHUTDOWN = -999; // Shutdown Cursor Value.
  64. // snfCFGPacket encapsulates configuration and rulebase data.
  65. // The rulebase handler can write to it.
  66. // Others can only read from it.
  67. // The engine handler creates and owns one of these. It uses it to
  68. // grab() and drop() cfg and rulebase data from the rulebase handler.
  69. class snf_RulebaseHandler; // We need to know this exists.
  70. class snfCFGPacket { // Our little bundle of, er, cfg stuff.
  71. friend class snf_RulebaseHandler; // RulebaseHandler has write access.
  72. private:
  73. snf_RulebaseHandler* MyRulebase; // Where to grab() and drop()
  74. TokenMatrix* MyTokenMatrix; // We combine the current token matrix
  75. snfCFGData* MyCFGData; // and the current cfg data for each scan.
  76. std::set<int> RulePanics; // Set of known rule panic IDs.
  77. public:
  78. snfCFGPacket(snf_RulebaseHandler* R); // Constructor grab()s the Rulebase.
  79. ~snfCFGPacket(); // Destructor drop()s the Rulebase.
  80. TokenMatrix* Tokens(); // Consumers read the Token Matrix and
  81. snfCFGData* Config(); // the snfCFGData.
  82. bool bad(); // If anything is missing it's not good.
  83. bool isRulePanic(int R); // Test for a rule panic.
  84. };
  85. class ScriptCaller : private cd::Thread { // Calls system() in separate thread.
  86. private:
  87. cd::Mutex MyMutex; // Protects internal data.
  88. std::string SystemCallText; // Text to send to system().
  89. cd::Timeout GuardTimer; // Guard time between triggers.
  90. volatile bool GoFlag; // Go flag true when triggered.
  91. volatile bool DieFlag; // Die flag when it's time to leave.
  92. std::string ScriptToRun(); // Safely grab the script.
  93. bool hasGuardExpired(); // True if guard time has expired.
  94. void myTask(); // Thread task overload.
  95. volatile int myLastResult; // Last result of system() call.
  96. public:
  97. ScriptCaller(std::string Name); // Constructor.
  98. ~ScriptCaller(); // Destructor.
  99. void SystemCall(std::string S); // Set system call text.
  100. void GuardTime(int T); // Change guard time.
  101. void trigger(); // Trigger if possible.
  102. int LastResult(); // Return myLastResult.
  103. const static cd::ThreadType Type; // The thread's type.
  104. const static cd::ThreadState CallingSystem; // State when in system() call.
  105. const static cd::ThreadState PendingGuardTime; // State when waiting for guard time.
  106. const static cd::ThreadState StandingBy; // State when waiting around.
  107. const static cd::ThreadState Disabled; // State when unable to run.
  108. };
  109. class snf_Reloader : private cd::Thread { // Rulebase maintenance thread.
  110. private:
  111. snf_RulebaseHandler& MyRulebase; // We know our rulebase.
  112. bool TimeToStop; // We know if it's time to stop.
  113. std::string RulebaseFileCheckName; // We keep track of these files.
  114. std::string ConfigFileCheckName;
  115. std::string IgnoreListCheckFileName;
  116. time_t RulebaseFileTimestamp; // We watch their timestamps.
  117. time_t ConfigurationTimestamp;
  118. time_t IgnoreListTimestamp;
  119. void captureFileStats(); // Get stats for later comparison.
  120. bool StatsAreDifferent(); // Check file stats for changes.
  121. void myTask(); // How do we do this refresh thing?
  122. ScriptCaller RulebaseGetter; // Reloader owns a RulebaseGetter.
  123. bool RulebaseGetterIsTurnedOn; // True if we should run the getter.
  124. void captureGetterConfig(); // Get RulebaseGetter config.
  125. public:
  126. snf_Reloader(snf_RulebaseHandler& R); // Setup takes some work.
  127. ~snf_Reloader(); // Tear down takes some work.
  128. const static cd::ThreadType Type; // The thread's type.
  129. };
  130. class snf_RulebaseHandler { // Engine Core Manager.
  131. friend class snfCFGPacket;
  132. private:
  133. cd::Mutex MyMutex; // This handler's mutex.
  134. snf_Reloader* MyReloader; // Reloader engine (when in use).
  135. int volatile ReferenceCount; // Associated scanners count.
  136. snfCFGData* volatile Configuration; // Configuration for this handler.
  137. TokenMatrix* volatile Rulebase; // Rulebase for this handler.
  138. int volatile CurrentCount; // Active current scanners count.
  139. TokenMatrix* volatile OldRulebase; // Retiring rulebase holder.
  140. int volatile RetiringCount; // Active retiring scanners count.
  141. bool volatile RefreshInProgress; // Flag for locking the refresh process.
  142. int volatile MyGeneration; // Generation (reload) number.
  143. void _snf_LoadNewRulebase(); // Internal function to load new rulebase.
  144. cd::Mutex XCIServerCommandMutex; // XCI Server Command Serializer.
  145. snfXCIServerCommandHandler* myXCIServerCommandHandler; // ptr to Installed Srv Cmd Handler.
  146. void grab(snfCFGPacket& CP); // Activate this Rulebase for a scan.
  147. void drop(snfCFGPacket& CP); // Deactiveate this Rulebase after it.
  148. public:
  149. class ConfigurationError : public std::runtime_error { // When the configuration won't load.
  150. public: ConfigurationError(const std::string& w):runtime_error(w) {}
  151. };
  152. class FileError : public std::runtime_error { // Exception: rulebase file won't load.
  153. public: FileError(const std::string& w):runtime_error(w) {}
  154. };
  155. class AuthenticationError : public std::runtime_error { // Exception when authentication fails.
  156. public: AuthenticationError(const std::string& w):runtime_error(w) {}
  157. };
  158. class IgnoreListError : public std::runtime_error { // When the ignore list won't load.
  159. public: IgnoreListError(const std::string& w):runtime_error(w) {}
  160. };
  161. class AllocationError : public std::runtime_error { // Exception when we can't allocate something.
  162. public: AllocationError(const std::string& w):runtime_error(w) {}
  163. };
  164. class Busy : public std::runtime_error { // Exception when there is a collision.
  165. public: Busy(const std::string& w):runtime_error(w) {}
  166. };
  167. class Panic : public std::runtime_error { // Exception when something else happens.
  168. public: Panic(const std::string& w):runtime_error(w) {}
  169. };
  170. //// Plugin Components.
  171. snfCFGmgr MyCFGmgr; // Configuration manager.
  172. snfLOGmgr MyLOGmgr; // Logging manager.
  173. snfNETmgr MyNETmgr; // Communications manager.
  174. snfGBUdbmgr MyGBUdbmgr; // GBUdb manager.
  175. GBUdb MyGBUdb; // GBUdb for this rulebase.
  176. snfXCImgr MyXCImgr; // XCI manager.
  177. //// Methods.
  178. snf_RulebaseHandler(): // Initialization is straight forward.
  179. MyReloader(0),
  180. ReferenceCount(0),
  181. Rulebase(NULL),
  182. CurrentCount(0),
  183. OldRulebase(NULL),
  184. RetiringCount(0),
  185. RefreshInProgress(false),
  186. MyGeneration(0),
  187. myXCIServerCommandHandler(0){
  188. MyNETmgr.linkLOGmgr(MyLOGmgr); // Link the NET manager to the LOGmgr.
  189. MyNETmgr.linkGBUdbmgr(MyGBUdbmgr); // Link the NET manager to the GBUdbmgr.
  190. MyGBUdbmgr.linkGBUdb(MyGBUdb); // Link the GBUdb manager to it's db.
  191. MyGBUdbmgr.linkLOGmgr(MyLOGmgr); // Link the GBUdb manager to the LOGmgr.
  192. MyLOGmgr.linkNETmgr(MyNETmgr); // Link the LOG manager to the NETmgr.
  193. MyLOGmgr.linkGBUdb(MyGBUdb); // Link the LOG manager to the GBUdb.
  194. MyXCImgr.linkHome(this); // Link the XCI manager to this.
  195. }
  196. ~snf_RulebaseHandler(); // Shutdown checks for safety.
  197. bool isReady(); // Is the object is active.
  198. bool isBusy(); // Is a refresh/open in progress.
  199. int getReferenceCount(); // How many Engines using this handler.
  200. int getCurrentCount(); // How many Engines active in the current rb.
  201. int getRetiringCount(); // How many Engines active in the old rb.
  202. void open(const char* path, // Lights up this hanlder.
  203. const char* licenseid,
  204. const char* authentication);
  205. bool AutoRefresh(bool On); // Turn on/off auto refresh.
  206. bool AutoRefresh(); // True if AutoRefresh is on.
  207. void refresh(); // Reloads the rulebase and config.
  208. void close(); // Closes this handler.
  209. void use(); // Make use of this Rulebase Handler.
  210. void unuse(); // Finish with this Rulebase Handler.
  211. int Generation(); // Returns the generation number.
  212. void addRulePanic(int RuleID); // Synchronously add a RulePanic.
  213. bool testXHDRInjectOn(); // Safely look ahead at XHDRInjectOn.
  214. IPTestRecord& performIPTest(IPTestRecord& I); // Perform an IP test.
  215. void logThisIPTest(IPTestRecord& I, std::string Action); // Log an IP test result & action.
  216. void logThisError(std::string ContextName, int Code, std::string Text); // Log an error message.
  217. void logThisInfo(std::string ContextName, int Code, std::string Text); // Log an informational message.
  218. std::string PlatformVersion(std::string NewPlatformVersion); // Set platform version info.
  219. std::string PlatformVersion(); // Get platform version info.
  220. std::string PlatformConfiguration(); // Get platform configuration.
  221. std::string EngineVersion(); // Get engine version info.
  222. void XCIServerCommandHandler(snfXCIServerCommandHandler& XCH); // Registers a new XCI Srvr Cmd handler.
  223. std::string processXCIServerCommandRequest(snf_xci& X); // Handle a parsed XCI Srvr Cmd request.
  224. };
  225. // IPTestEngine w/ GBUdb interface.
  226. // This will plug into the FilterChain to evaluate IPs on the fly.
  227. class snf_IPTestEngine : public FilterChainIPTester {
  228. private:
  229. GBUdb* Lookup; // Where we find our GBUdb.
  230. snfScanData* ScanData; // Where we find our ScanData.
  231. snfCFGData* CFGData; // Where we find our CFG data.
  232. snfLOGmgr* LOGmgr; // Where we find our LOG manager.
  233. public:
  234. snf_IPTestEngine(); // Initialize internal pointers to NULL.
  235. void setGBUdb(GBUdb& G); // Setup the GBUdb lookup.
  236. void setScanData(snfScanData& D); // Setup the ScanData object.
  237. void setCFGData(snfCFGData& C); // (Re)Set the config data to use.
  238. void setLOGmgr(snfLOGmgr& L); // Setup the LOGmgr to use.
  239. std::string& test(std::string& input, std::string& output); // Our obligatory test function.
  240. };
  241. // How to spot strangers in the IP reputations.
  242. class snf_IPStrangerList {
  243. private:
  244. cd::Mutex myMutex;
  245. std::set<cd::IP4Address> listA;
  246. std::set<cd::IP4Address> listB;
  247. bool usingANotB;
  248. cd::Timeout listExpiration;
  249. std::set<cd::IP4Address>& myActiveList() {
  250. if(usingANotB) return listA;
  251. else return listB;
  252. }
  253. void swapOutOldLists() {
  254. if(listExpiration.isExpired()) {
  255. usingANotB = !usingANotB;
  256. myActiveList().clear();
  257. listExpiration.restart();
  258. }
  259. }
  260. std::set<cd::IP4Address>& myCurrentList() {
  261. swapOutOldLists();
  262. return myActiveList();
  263. }
  264. public:
  265. static const int TwoHours = (2 * (60 * (60 * 1000)));
  266. snf_IPStrangerList() : usingANotB(true), listExpiration(TwoHours) {}
  267. bool isStranger(cd::IP4Address a) {
  268. cd::ScopeMutex JustMe(myMutex);
  269. swapOutOldLists();
  270. bool foundStranger = (0 < listA.count(a)) || (0 < listB.count(a));
  271. return foundStranger;
  272. }
  273. void addStranger(cd::IP4Address a) {
  274. cd::ScopeMutex JustMe(myMutex);
  275. myCurrentList().insert(a);
  276. }
  277. };
  278. // Here's where we pull it all together.
  279. class snf_EngineHandler {
  280. private:
  281. cd::Mutex MyMutex; // This handler's mutex.
  282. cd::Mutex FileScan; // File scan entry mutex.
  283. EvaluationMatrix* volatile CurrentMatrix; // Matrix for the latest scan.
  284. snf_RulebaseHandler* volatile MyRulebase; // My RulebaseHandler.
  285. snfScanData MyScanData; // Local snfScanData record.
  286. snf_IPTestEngine MyIPTestEngine; // Local IP Test Engine.
  287. int ResultsCount; // Count of Match Records for getResults
  288. int ResultsRemaining; // Count of Match Records ahead of cursor.
  289. MatchRecord* FinalResult; // Final (winning) result of the scan.
  290. MatchRecord* ResultCursor; // Current Match Record for getResults.
  291. std::string extractMessageID(const unsigned char* Msg, const int Len); // Get log safe Message-ID or substitute.
  292. public:
  293. class FileError : public std::runtime_error { // Exception when a file won't open.
  294. public: FileError(const std::string& w):runtime_error(w) {}
  295. };
  296. class XHDRError : public std::runtime_error { // Exception when XHDR Inject/File fails.
  297. public: XHDRError(const std::string& w):runtime_error(w) {}
  298. };
  299. class BadMatrix : public std::runtime_error { // Exception out of bounds of matrix.
  300. public: BadMatrix(const std::string& w):runtime_error(w) {}
  301. };
  302. class MaxEvals : public std::runtime_error { // Exception too many evaluators.
  303. public: MaxEvals(const std::string& w):runtime_error(w) {}
  304. };
  305. class AllocationError : public std::runtime_error { // Exception when we can't allocate something.
  306. public: AllocationError(const std::string& w):runtime_error(w) {}
  307. };
  308. class Busy : public std::runtime_error { // Exception when there is a collision.
  309. public: Busy(const std::string& w):runtime_error(w) {}
  310. };
  311. class Panic : public std::runtime_error { // Exception when something else happens.
  312. public: Panic(const std::string& w):runtime_error(w) {}
  313. };
  314. snf_EngineHandler(): // Initialization is simple.
  315. CurrentMatrix(NULL),
  316. MyRulebase(NULL),
  317. MyScanData(snf_ScanHorizon),
  318. ResultsCount(0),
  319. ResultsRemaining(0),
  320. ResultCursor(NULL) {}
  321. ~snf_EngineHandler(); // Shutdown clenas up and checks for safety.
  322. void open(snf_RulebaseHandler* Handler); // Light up the engine.
  323. bool isReady(); // Is the Engine good to go? (doubles as busy)
  324. void close(); // Close down the engine.
  325. int scanMessageFile( // Scan this message file.
  326. const std::string MessageFilePath, // -- this is the file (and id)
  327. const int MessageSetupTime = 0, // -- setup time already used.
  328. const cd::IP4Address MessageSource = 0UL // -- message source IP (for injection).
  329. );
  330. int scanMessage( // Scan this message.
  331. const unsigned char* MessageBuffer, // -- this is the message buffer.
  332. const int MessageLength, // -- this is the length of the buffer.
  333. const std::string MessageName = "", // -- this is the message identifier.
  334. const int MessageSetupTime = 0, // -- setup time used (for logging).
  335. const cd::IP4Address MessageSource = 0UL // -- message source IP (for injection).
  336. );
  337. int getResults(snf_match* MatchBuffer); // Get the next match buffer.
  338. int getDepth(); // Get the scan depth.
  339. const std::string getClassicLog(); // Get classic log entries for last scan.
  340. const std::string getXMLLog(); // Get XML log entries or last scan.
  341. const std::string getXHDRs(); // Get XHDRs for last scan.
  342. };
  343. // Here's the class that pulls it all together.
  344. class snf_MultiEngineHandler {
  345. private:
  346. cd::Mutex RulebaseScan; // This handler's mutex.
  347. int RulebaseCursor; // Next Rulebase to search.
  348. snf_RulebaseHandler RulebaseHandlers[snf_MAX_RULEBASES]; // Array of Rulebase Handlers
  349. int RoundRulebaseCursor(); // Gets round robin Rulebase handle candidates.
  350. cd::Mutex EngineScan; // Serializes searching the Engine list.
  351. int EngineCursor; // Next Engine to search.
  352. snf_EngineHandler EngineHandlers[snf_MAX_SCANNERS]; // Array of Engine Handlers
  353. int RoundEngineCursor(); // Gets round robin Engine handle candidates.
  354. public:
  355. class TooMany : public std::runtime_error { // Exception when no more handle slots.
  356. public: TooMany(const std::string& w):runtime_error(w) {}
  357. };
  358. class FileError : public std::runtime_error { // Exception when a file won't open.
  359. public: FileError(const std::string& w):runtime_error(w) {}
  360. };
  361. class AuthenticationError : public std::runtime_error { // Exception when authentication fails.
  362. public: AuthenticationError(const std::string& w):runtime_error(w) {}
  363. };
  364. class AllocationError : public std::runtime_error { // Exception when we can't allocate something.
  365. public: AllocationError(const std::string& w):runtime_error(w) {}
  366. };
  367. class Busy : public std::runtime_error { // Exception when there is a collision.
  368. public: Busy(const std::string& w):runtime_error(w) {}
  369. };
  370. class Panic : public std::runtime_error { // Exception when something else happens.
  371. public: Panic(const std::string& w):runtime_error(w) {}
  372. };
  373. snf_MultiEngineHandler():
  374. RulebaseCursor(0),
  375. EngineCursor(0) {}
  376. ~snf_MultiEngineHandler(); // Clean up, safety check, shut down.
  377. // snf_OpenRulebase()
  378. // Grab the first available rulebse handler and light it up.
  379. int OpenRulebase(const char* path, const char* licenseid, const char* authentication);
  380. // snf_RefreshRulebase()
  381. // Reload the rulebase associated with the handler.
  382. void RefreshRulebase(int RulebaseHandle);
  383. // snf_CloseRulebase()
  384. // Shut down this Rulebase handler.
  385. void CloseRulebase(int RulebaseHandle);
  386. // snf_OpenEngine()
  387. // Grab the first available Engine handler and light it up
  388. int OpenEngine(int RulebaseHandle);
  389. // snf_CloseEngine()
  390. // Shut down this Engine handler.
  391. void CloseEngine(int EngineHandle);
  392. // snf_Scan()
  393. // Scan the MessageBuffer with this Engine.
  394. int Scan(int EngineHandle, const unsigned char* MessageBuffer, int MessageLength);
  395. // The Engine prvides detailed match results through this function.
  396. int getResults(int EngineHandle, snf_match* matchbfr);
  397. // The Engine provies the scan depth through this function.
  398. int getDepth(int EngineHandle);
  399. };