Skip to content

Commit

Permalink
Add a thread-safe Sandboxed API for YARA (VirusTotal#1087)
Browse files Browse the repository at this point in the history 
The library built by the Bazel target //sandbox:yara_sapi can be used
directly to perform sandboxed YARA scans.
The API is intentionally kept very simple, only three methods are
exposed by the YaraTransaction C++ class:
* YaraTransaction::Create() to create with the specified timeout and
  number of worker threads
* YaraTransaction::LoadRules() to load YARA rules from string, and
* YaraTransaction::ScanFd() to scan the contents of a file descriptor.

Internally, this creates a new sandboxed sub-process which maintains a
dispatch queue and multiple worker threads. The transaction class then
multiplexes scan tasks to the sandboxee where they will be executed in
parallel. This allows many scan threads to share the same set of YARA
rules, saving memory.

See sandbox/sandboxed_yara.cc and the unit test in
sandbox/yara_transaction_test.cc for examples on how to use this API.

Signed-off-by: Christian Blichmann <[email protected]>
  • Loading branch information
@cblichmann @plusvic
cblichmann authored and plusvic committed Jul 9, 2019
1 parent 9ccdf43 commit 092fc26
Show file tree
Hide file tree
Showing 10 changed files with 1,166 additions and 0 deletions.
28 changes: 28 additions & 0 deletions WORKSPACE
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

# BoringSSL, see
# https://boringssl.googlesource.com/boringssl/+/master/INCORPORATING.md#bazel
Expand All @@ -35,3 +36,30 @@ git_repository(
remote = "https://boringssl.googlesource.com/boringssl",
shallow_since = "1559759280 +0000",
)

# Sandboxed API
git_repository(
name = "com_google_sandboxed_api",
commit = "2301e05097818734f59b881d7fbe1624c17fc840", # 2019-07-08
remote = "https://github.com/google/sandboxed-api.git",
shallow_since = "1562590596 -0700",
)

load(
"@com_google_sandboxed_api//sandboxed_api/bazel:sapi_deps.bzl",
"sapi_deps",
)

sapi_deps()

load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")

protobuf_deps()

# GoogleTest/GoogleMock for testing the sandbox
http_archive(
name = "com_google_googletest",
sha256 = "baed63b97595c32667694de0a434f8f23da59609c4a44f3360ba94b0abd5c583",
strip_prefix = "googletest-8ffb7e5c88b20a297a2e786c480556467496463b",
urls = ["https://github.com/google/googletest/archive/8ffb7e5c88b20a297a2e786c480556467496463b.zip"], # 2019-05-30
)
125 changes: 125 additions & 0 deletions sandbox/BUILD.bazel
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,125 @@
# Copyright (c) 2019. The YARA Authors. All Rights Reserved.
#
# Redistribution and use in source and binary forms, with or without modification,
# are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this
# list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation and/or
# other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

load(
"@com_google_sandboxed_api//sandboxed_api/bazel:sapi.bzl",
"sapi_library",
)

# Proto message that stores YARA matches. Used to communicate matches from
# the sandboxee to the host code.
proto_library(
name = "yara_matches",
srcs = ["yara_matches.proto"],
)

cc_proto_library(
name = "yara_matches_cc_proto",
deps = [":yara_matches"],
)

# Library with a callback function to collect YARA matches into a YaraMatches
# proto
cc_library(
name = "collect_matches",
srcs = ["collect_matches.cc"],
hdrs = ["collect_matches.h"],
visibility = ["//visibility:public"],
deps = [
":yara_matches_cc_proto",
"//:yara",
],
)

# The sandboxee side of the YARA sandbox. This implements a dispatch queue
# shared by multiple worker threads. YARA rules are shared across all threads
# to keep memory usage down.
cc_library(
name = "yara_entry_points",
srcs = ["yara_entry_points.cc"],
deps = [
":collect_matches",
":yara_matches_cc_proto",
"//:libyara",
"@com_google_absl//absl/base:core_headers",
"@com_google_absl//absl/container:node_hash_map",
"@com_google_absl//absl/strings",
"@com_google_absl//absl/synchronization",
],
alwayslink = 1,
)

# Sandboxed API for YARA. This is what clients of this library should use. The
# API is intentionally minimal and may be extended in the future.
# See the "sandboxed-yara" target for an example on how to use this from code.
sapi_library(
name = "yara_sapi",
srcs = ["yara_transaction.cc"],
hdrs = ["yara_transaction.h"],
embed = True,
functions = [
"YaraAsyncScanFd",
"YaraGetScanResult",
"YaraInitWorkers",
"YaraLoadRules",
],
input_files = ["yara_entry_points.cc"],
lib = ":yara_entry_points",
lib_name = "Yara",
namespace = "yara::sandbox",
visibility = ["//visibility:public"],
deps = [
":yara_matches_cc_proto",
"//:yara_errors",
"@com_google_absl//absl/memory",
"@com_google_absl//absl/synchronization",
"@com_google_absl//absl/time",
"@com_google_sandboxed_api//sandboxed_api/sandbox2/util:bpf_helper",
"@com_google_sandboxed_api//sandboxed_api/util:status",
],
)

cc_test(
name = "yara_transaction_test",
srcs = ["yara_transaction_test.cc"],
deps = [
":yara_sapi",
"@com_google_googletest//:gtest_main",
"@com_google_sandboxed_api//sandboxed_api/util:status_matchers",
],
)

# Sandboxed command-line executable demonstrating how to use the YARA SAPI.
cc_binary(
name = "sandboxed_yara",
srcs = ["sandboxed_yara.cc"],
deps = [
":yara_sapi",
"@com_google_absl//absl/flags:parse",
"@com_google_absl//absl/strings",
],
)
68 changes: 68 additions & 0 deletions sandbox/collect_matches.cc
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
/*
Copyright (c) 2019. The YARA Authors. All Rights Reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation and/or
other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#include "sandbox/collect_matches.h"

#include "libyara/include/yara.h"
#include "sandbox/yara_matches.pb.h"

namespace yara {

int CollectMatches(int message, void* message_data, void* user_data) {
if (message != CALLBACK_MSG_RULE_MATCHING) {
return ERROR_SUCCESS; // There are no matching rules, simply return
}

auto* rule = static_cast<YR_RULE*>(message_data);
YR_META* rule_meta = rule->metas;

auto* match = reinterpret_cast<YaraMatches*>(user_data)->add_match();
if (rule->ns != nullptr && rule->ns->name != nullptr) {
match->mutable_id()->set_rule_namespace(rule->ns->name);
}
match->mutable_id()->set_rule_name(rule->identifier);
while (!META_IS_NULL(rule_meta)) {
auto* meta = match->add_meta();
meta->set_identifier(rule_meta->identifier);
switch (rule_meta->type) {
case META_TYPE_BOOLEAN:
case META_TYPE_INTEGER:
meta->set_int_value(rule_meta->integer);
break;
case META_TYPE_STRING:
meta->set_bytes_value(rule_meta->string);
break;
}
++rule_meta;
}

return ERROR_SUCCESS;
}

} // namespace yara
41 changes: 41 additions & 0 deletions sandbox/collect_matches.h
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
/*
Copyright (c) 2019. The YARA Authors. All Rights Reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation and/or
other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#ifndef SANDBOX_COLLECT_MATCHES_H_
#define SANDBOX_COLLECT_MATCHES_H_

namespace yara {

// Callback function for yr_scan_mem() that collects YARA matches in a
// YaraMatches proto given in user_data.
int CollectMatches(int message, void* message_data, void* user_data);

} // namespace yara

#endif // SANDBOX_COLLECT_MATCHES_H_
Loading

0 comments on commit 092fc26

Please sign in to comment.