ThreatFactor NSIA

package net.lukeMurphey.nsia.scanRules;

import java.util.regex.*;

import java.util.*;

/**

 * This class provides the ability to parse Snort rules and evaluate content to determine if the Snort rules match. 

 * @author luke

 *

 */

public class SnortSignature implements ContentSignature{

        private String snortSignatureName;

        private int sid;

        private int revision;

        private String classtype;

        private Vector<Option> options = new Vector<Option>();

        private Vector<Reference> references = new Vector<Reference>();

        private static final Pattern SNORT_RULE_REGEX = Pattern.compile("([a-zA-Z]+) ([a-zA-Z]+) ([0-9a-zA-Z$_]+) ([0-9a-zA-Z$_]+) (\\->|<>|<\\-) ([0-9a-zA-Z$_]+) ([0-9a-zA-Z$_]+) (\\()([ /()a-zA-Z%0-9=!?._;:,\\-$\\\"\\']*)(\\))");

        private static final Pattern SNORT_OPTIONS_REGEX = Pattern.compile("([ ]*([()a-zA-Z0-9._,\\-$']+)(:[ ]*(([ /()a-zA-Z%0-9=!?._,\\-$']+)|\"([ /()a-zA-Z%0-9!?=._,\\-$']+)\"))?)+");

        /**

         * This class represents a snort rule option.

         * @author luke

         *

         */

        public class Option{

                private String name;

                private String value = null;

                public Option( String name ){

                        this.name = name;

                }

                public Option( String name, String value ){

                        this.name = name;

                        this.value = value;

                }

                public String getName(){

                        return name;

                }

                public String getValue(){

                        return value;

                }

                public boolean hasValue(){

                        if( value == null )

                                return false;

                        else

                                return true;

                }

        }

        /**

         * This class represents a Snort signature reference (URL, CVE entry, etc.).

         * @author luke

         *

         */

        public static class Reference{

                public final static Type BUGTRAQ = new Type(1, "http://www.securityfocus.com/bid/");

                public final static Type CVE = new Type(2, "http://cve.mitre.org/cgi-bin/cvename.cgi?name=");

                public final static Type NESSUS = new Type(3, "http://cgi.nessus.org/plugins/dump.php3?id=");

                public final static Type ARACHNIDS = new Type(4, "http://www.whitehats.com/info/IDS");

                public final static Type MCAFEE = new Type(5, "http://vil.nai.com/vil/dispVirus.asp?virus_k=");

                public final static Type URL = new Type(6, "http://");

                /**

                 * This class represents the possible Snort reference types.

                 * See http://www.snort.org/docs/snort_htmanuals/htmanual_2.4/node18.html#SECTION00442000000000000000

                 * @author luke

                 *

                 */

                public static class Type{

                        private int id;

                        private String urlPrefix;

                        protected Type( int id, String urlPrefix ){

                                this.id = id;

                                this.urlPrefix = urlPrefix;

                        }

                        public String getUrlPrefix(){

                                return urlPrefix; 

                        }

                        public boolean equals(Type type){

                                // 0 -- Precondition check

                                if( type == null ){

                                        throw new IllegalArgumentException("Type cannot be null");

                                }

                                // 1 -- Compare the types

                                return type.id == id;

                        }

                }

                private Type type;

                private String value;

                public Reference(Type type, String value){

                        this.type = type;

                        this.value = value;

                }

                public static Reference parse(String value) throws SignatureParseException{

                        int firstComma = value.indexOf(',');

                        String type = value.substring(0, firstComma).trim();

                        String argument = value.substring(firstComma+1).trim();

                        if( type.equalsIgnoreCase("bugtraq") ){

                                return new Reference(Reference.BUGTRAQ, argument);

                        }

                        else if( type.equalsIgnoreCase("cve") ){

                                return new Reference(Reference.CVE, argument);

                        }

                        else if( type.equalsIgnoreCase("nessus") ){

                                return new Reference(Reference.NESSUS, argument);

                        }

                        else if( type.equalsIgnoreCase("arachnids") ){

                                return new Reference(Reference.ARACHNIDS, argument);

                        }

                        else if( type.equalsIgnoreCase("mcafee") ){

                                return new Reference(Reference.MCAFEE, argument);

                        }

                        else if( type.equalsIgnoreCase("url") ){

                                return new Reference(Reference.URL, argument);

                        }

                        else{

                                throw new SignatureParseException("Reference name (\"" + type + "\" is invalid");

                        }

                }

                public String toString(){

                        return type.getUrlPrefix() + value;

                }

        }

        /**

         * Takes a Snort rule string and creates an SnortSignature object that is capable of evaluting content for exploits. 

         * @param snortRule

         * @return

         * @throws SignatureParseException 

         */

        public static SnortSignature parse(String snortRule) throws SignatureParseException{

                // 0 -- Precondition check

                //         0.1 --Rule must not be null

                if( snortRule == null ){

                        throw new IllegalArgumentException("Snort rule must not be null");

                }

                //         0.2 --Rule must not be empty

                if( snortRule.isEmpty() ){

                        throw new IllegalArgumentException("Snort rule must not be empty");

                }

                // 1 -- Identify the section with the options

                String options;

                Matcher ruleMatcher = SNORT_RULE_REGEX.matcher(snortRule);

                if( !ruleMatcher.matches() || ruleMatcher.groupCount() < 10 ){

                        throw new SignatureParseException("The snort rule given does not match a known rule format");

                }

                else{

                        options = ruleMatcher.group(9);

                }

                // 2 -- Parse out the rule options

                SnortSignature snortSig = new SnortSignature();

                Matcher optionsMatcher = SNORT_OPTIONS_REGEX.matcher(options);

                while (optionsMatcher.find()){

                        //         2.1 --Get the option name

                        String optionName = optionsMatcher.group(2).trim();

                        //         2.2 -- Get the option value (if exists)

                        String optionValue = null;

                        if( optionsMatcher.group(6) != null ){

                                optionValue = optionsMatcher.group(6);

                        }

                        else{

                                optionValue = optionsMatcher.group(5);

                        }

                        //         2.3 -- Save the option to the list

                        if(optionValue == null){

                                snortSig.options.add( snortSig.new Option( optionName ) );

                        }

                        else{

                                snortSig.options.add( snortSig.new Option( optionName, optionValue) );

                        }

                }

                // 3 -- Populate the signature from the options

                for( int c = 0; c < snortSig.options.size(); c++){

                        Option option = snortSig.options.get(c);

                        if( option.getName().equalsIgnoreCase("msg") ){

                                snortSig.snortSignatureName = option.getValue();

                        }

                        if( option.getName().equalsIgnoreCase("sid") ){

                                snortSig.sid = Integer.parseInt( option.getValue() );

                        }

                        if( option.getName().equalsIgnoreCase("rev") ){

                                snortSig.revision = Integer.parseInt( option.getValue() );

                        }

                        if( option.getName().equalsIgnoreCase("classtype") ){

                                snortSig.classtype = option.getValue();

                        }

                        if( option.getName().equalsIgnoreCase("reference") ){

                                snortSig.references.add( Reference.parse( option.getValue() ) );

                        }

                }

                return snortSig;

        }

        public String getName() {

                String description = "This signature detects attacks originating from monitored resource. Details are below:\n\nSignature: " + snortSignatureName;

                if( references != null && references.size() > 0 ){

                        return description + "\nReferences:\n" + getNotes();

                }

                else

                        return description;

        }

        public String getNotes() {

                StringBuffer notes = new StringBuffer("");

                if( references != null ){

                        for( int c = 0; c < references.size(); c++){

                                if( c > 0 ){

                                        notes.append("\n" + references.get(c).toString());

                                }

                                else{

                                        notes.append(references.get(c).toString());

                                }

                        }

                }

                return notes.toString();

        }

        public String getCategoryName(){

                return "Exploit Signature";

        }

        public String getClassType() {

                return classtype;

        }

        public Reference[] getReferences() {

                return (Reference[])references.toArray();

        }

        public String getSubCategoryName() {

                return snortSignatureName;

        }

        public int getID() {

                return sid;

        } 

        public int getRevision() {

                return revision;

        }

        public Option[] getOptions(){

                Option[] optionsArray = new Option[options.size()];

                options.toArray(optionsArray);

                return optionsArray;

        }

}