[Oisf-devel] Some questions about module development

[Jörg Vehlow]

Hi,
 
I am currently trying to develop some detection modules in order to
detect non simple signature based malware cnc traffic for my master's
thesis.
The first module I implemented can calculate the entropy of the payload.
And while doing that some questions (and possible answers) came up:

1. What is the intended purpose of Setup, Match and Free functions of a
detection module?
I think Setup is for parsing the parameters, match does the actual
calculating and matching and free is for freeing the memory allocated by
Setup.

2. When are Setup, Match and Free called?
>From what I saw, I suspect that: Setup gets called ONCE for EVERY rule
that uses the registered keyword at initialization and Free analog in
the end. Match is called on every rule? Or does suricata match the
keywords in order and if the first one fails it stops matching the other
ones?

3. Where am I supposed to store my calculated values for reuse? I.e. if
the entropy is used in more than one rule it would be cheaper to store
the value somewhere.
Do I have to add a member to the Packet structure?

4. What exactly is it I'm getting in Packet.payload?
As far as I've seen it is the payload of the tcp / udp packet. Is it
always the payload for the Application layer (app layer header and app
layer payload)?

5. Is there a way to decrypt a packet on the fly but only if certain
criteria are is matched, e.g. entropy greater x (I'd like to be able to
do other matches like content on the decrypted code afterwards)?
Can I just change Packet.payload to decrypt the packet and then go on
matching on it? Or do I have to implement another app layer?

6. This is about app layers: Are they always "executed"? What I mean is:
Are all packets checked if they are possible http or smb even if there
is no rules that needs this kind of matching?
What I would like here is to have some match like entropy greater x and
then execute an app layer decoder.

7. One last  (not so important) question: Why doesn't suricata use a
real plugin system with dynamically linked plugins or something?
Is it for performance reasons?


That's all for now. I hope someone will take the time to answer my
questions.

Jörg Vehlow

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20121127/10d96e02/attachment.html>