Content keywords

byte_extract

Syntax: byte_extract:<bytes_to_extract>, <offset>, <name> \ [, relative][, multiplier <multiplier value>][, <endian>]\ [, string][, hex][, dec][, oct][, align <align value>][, dce];

Description:

Use the byte_extract option to write rules against length-encoded protocols. This reads some of the bytes from the packet payload and saves it to a variable.

byte_jump

Syntax: –byte_jump <bytes_to_convert>, <offset>[, multiplier][, relative] [, big] [, little] [, string] [, hex] [, dec] [, oct] [, align];

Description:

Use the byte_jump option to extract a number of bytes from a packet, convert them to their numeric representation, and jump the match reference up that many bytes (for further pattern matching or byte testing). This keyword allows relative pattern matches to take into account numerical values found in network data. The available keyword options include:

• <bytes_to_convert>: The number of bytes to examine from the packet. l <offset>: The number of bytes into the payload to start processing.
• [multiplier]: multiplier is optional. It must be a numerical value when present. The converted value multiplied by the number is the result to be skipped.
• relative: Use an offset relative to last pattern match.
• big: Process the data as big endian (default). l little: Process the data as little endian. l string: The data is a string in the packet. l hex: The converted string data is represented in hexadecimal notation. l dec: The converted string data is represented in decimal notation. l oct: The converted string data is represented in octal notation. l align: Round up the number of converted bytes to the next 32-bit boundary.

byte_test

Syntax: –byte_test <bytes_to_convert>, <operator>, <value>, <offset> [multiplier][, relative] [, big] [, little] [, string] [, hex] [, dec] [, oct];

Description:

Use the byte_test keyword to compare a byte field against a specific value (with operator). This keyword is capable of testing binary values or converting representative byte strings to their binary equivalent and testing them. The available keyword options include:

• <bytes_to_convert>: The number of bytes to compare.
• <operator>: The operation to perform when comparing the value (<,>,=,!,&). l <value>: The value to compare the converted value against. l <offset>: The number of bytes into the payload to start processing.
• [multiplier]: multiplier is optional. It must be a numerical value when present. The converted value multiplied by the number is the result to be skipped.
• relative: Use an offset relative to last pattern match. l big: Process the data as big endian (default). l little: Process the data as little endian. l string: The data is a string in the packet. l hex: The converted string data is represented in hexadecimal notation. l dec: The converted string data is represented in decimal notation. l oct: The converted string data is represented in octal notation.

depth

Syntax: –depth <depth_int>;

Description:

Use the depth keyword to search for the contents within the specified number of bytes after the starting point defined by the offset keyword. If no offset is specified, the offset is assumed to be equal to 0.

If the value of the depth keyword is smaller than the length of the value of the content keyword, this signature will never be matched.

The depth must be between 0 and 65535. distance

Syntax: –distance <dist_int>;

Description:

Use the distance keyword to search for the contents within the specified number of bytes relative to the end of the previously matched contents. If the within keyword is not specified, continue looking for a match until the end of the payload.

The distance must be between 0 and 65535. content

Syntax: –content [!]”<content_str>”;

Description:

Deprecated, see pattern and context keywords. Use the content keyword to search for the content string in the packet payload. The content string must be enclosed in double quotes.

To have the FortiGate search for a packet that does not contain the specified context string, add an exclamation mark (!) before the content string.

Multiple content items can be specified in one rule. The value can contain mixed text and binary data. The binary data is generally enclosed within the pipe (|) character.

The double quote (“), pipe sign(|) and colon(:) characters must be escaped using a back slash if specified in a content string.

If the value of the content keyword is greater than the length of the value of the depth keyword, this signature will never be matched.

context

Syntax: –context {uri | header | body | host};

Description:

Specify the protocol field to look for the pattern. If context is not specified for a pattern, the FortiGate unit searches for the pattern anywhere in the packet buffer. The available context variables are:

l uri: Search for the pattern in the HTTP URI line. l header: Search for the pattern in HTTP header lines or SMTP/POP3/SMTP control messages. l body: Search for the pattern in HTTP body or SMTP/POP3/SMTP email body. l host: Search for the pattern in HTTP HOST line.

no_case

Syntax: –no_case; Description:

Use the no-case keyword to force the FortiGate unit to perform a case-insensitive pattern match.

offset

Syntax: –offset <offset_int>;

Description:

Use the offset keyword to look for the contents after the specified number of bytes into the payload. The specified number of bytes is an absolute value in the payload. Follow the offset keyword with the depth keyword to stop looking for a match after a specified number of bytes. If no depth is specified, the FortiGate unit continues looking for a match until the end of the payload.

The offset must be between 0 and 65535.

pattern

Syntax: –pattern [!]”<pattern_str>”;

Description:

The FortiGate unit will search for the specified pattern. A pattern keyword normally is followed by a context keyword to define where to look for the pattern in the packet. If a context keyword is not present, the FortiGate unit looks for the pattern anywhere in the packet buffer. To have the FortiGate search for a packet that does not contain the specified URI, add an exclamation mark (!) before the URI.

Example: –pattern “/level/” –pattern “|E8 D9FF FFFF|/bin/sh” –pattern

!”|20|RTSP/” pcre

Syntax: –pcre [!]”/<regex>/[ismxAEGRUB]”;

Description:

Similarly to the pattern keyword, use the pcre keyword to specify a pattern using Perl-compatible regular expressions (PCRE). A pcre keyword can be followed by a context keyword to define where to look for the pattern in the packet. If no context keyword is present, the FortiGate unit looks for the pattern anywhere in the packet buffer.

For more information about PCRE syntax, go to http://www.pcre.org.

The switches include:

• i: Case insensitive. l s: Include newlines in the dot metacharacter.
• m: By default, the string is treated as one big line of characters. ^ and $ match at the beginning and ending of the string. When m is set, ^ and $ match immediately following or immediately before any newline in the buffer, as well as the very start and very end of the buffer.
• x: White space data characters in the pattern are ignored except when escaped or inside a character class. l A: The pattern must match only at the start of the buffer (same as ^ ).
• E: Set $ to match only at the end of the subject string. Without E, $ also matches immediately before the final character if it is a newline (but not before any other newlines).
• G: Invert the “greediness” of the quantifiers so that they are not greedy by default, but become greedy if followed by

?.

• R: Match relative to the end of the last pattern match. (Similar to distance:0;). l U: Deprecated, see the context keyword. Match the decoded URI buffers.

uri

Syntax: –uri [!]”<uri_str>”;

Description:

Deprecated, see pattern and context keywords. Use the uri keyword to search for the URI in the packet payload. The URI must be enclosed in double quotes (“). To have the FortiGate unit search for a packet that does not contain the specified URI, add an exclamation mark (!) before the URI. Multiple content items can be specified in one rule. The value can contain mixed text and binary data. The binary data is generally enclosed within the pipe (|) character. The double quote (“), pipe sign (|) and colon (:) characters must be escaped using a back slash (\) if specified in a URI string. within

Syntax: –within <within_int>;

Description:

Use this together with the distance keyword to search for the contents within the specified number of bytes of the payload.

The within value must be between 0 and 65535.

IP header keywords

dst_addr

Syntax: –dst_addr [!]<ipv4>;

Description:

Use the dst_addr keyword to search for the destination IP address. To have the FortiGate search for a packet that does not contain the specified address, add an exclamation mark (!) before the IP address. You can define up to 28 IP addresses or CIDR blocks. Enclose the comma separated list in square brackets.

Example: dst_addr [172.20.0.0/16, 10.1.0.0/16,192.168.0.0/16] ip_dscp

Syntax:–ip_dscp Description:

Use the ip_dscp keyword to check the IP DSCP field for the specified value.

ip_id

Syntax: –ip_id <field_int>;

Description:

Check the IP ID field for the specified value.

ip_option

Syntax: –ip_option {rr | eol | nop | ts | sec | lsrr | ssrr | satid | any};

Description:

Use the ip_option keyword to check various IP option settings.

The available options include:

 

rr: Check if IP RR (record route) option is present. l eol: Check if IP EOL (end of list) option is present. l nop: Check if IP NOP (no op) option is present. l ts: Check if IP TS (time stamp) option is present. l sec: Check if IP SEC (IP security) option is present. l lsrr: Check if IP LSRR (loose source routing) option is present. l ssrr: Check if IP SSRR (strict source routing) option is present. l satid: Check if IP SATID (stream identifier) option is present. l any: Check if IP any option is present. ip_tos

Syntax: –ip_tos <field_int>;

Description:

Check the IP TOS field for the specified value. ip_ttl

Syntax: –ip_ttl [< | >] <ttl_int>;

Description:

Check the IP time-to-live value against the specified value. Optionally, you can check for an IP time-to-live greater-than (>) or less-than (<) the specified value with the appropriate symbol.

protocol

Syntax: –protocol {<protocol_int> | tcp | udp | icmp};

Description:

Check the IP protocol header. Example: –protocol tcp; src_addr

Syntax: –src_addr [!]<ipv4>;

Description:

Use the src_addr keyword to search for the source IP address. To have the FortiGate unit search for a packet that does not contain the specified address, add an exclamation mark (!) before the IP address. You can define up to 28 IP addresses or CIDR blocks. Enclose the comma separated list in square brackets.

Example: src_addr 192.168.13.0/24