suricata
detect-flow-age.c
Go to the documentation of this file.
1 /* Copyright (C) 2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "rust.h"
20 #include "detect-flow-age.h"
21 #include "detect-engine.h"
23 #include "detect-engine-uint.h"
24 #include "detect-parse.h"
25 
26 static int DetectFlowAgeMatch(
27  DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
28 {
29  if (p->flow == NULL) {
30  return 0;
31  }
32  uint32_t age = SCTIME_SECS(p->flow->lastts) - SCTIME_SECS(p->flow->startts);
33 
34  const DetectU32Data *du32 = (const DetectU32Data *)ctx;
35  return DetectU32Match(age, du32);
36 }
37 
38 static void DetectFlowAgeFree(DetectEngineCtx *de_ctx, void *ptr)
39 {
40  rs_detect_u32_free(ptr);
41 }
42 
43 static int DetectFlowAgeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
44 {
45  DetectU32Data *du32 = DetectU32Parse(rawstr);
46  if (du32 == NULL)
47  return -1;
48 
49  SigMatch *sm = SigMatchAlloc();
50  if (sm == NULL) {
51  DetectFlowAgeFree(de_ctx, du32);
52  return -1;
53  }
54 
55  sm->type = DETECT_FLOW_AGE;
56  sm->ctx = (SigMatchCtx *)du32;
57 
60 
61  return 0;
62 }
63 
64 static void PrefilterPacketFlowAgeMatch(
65  DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
66 {
67  const PrefilterPacketHeaderCtx *ctx = pectx;
68  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
69  return;
70 
71  DetectU32Data du32;
72  du32.mode = ctx->v1.u8[0];
73  du32.arg1 = ctx->v1.u32[1];
74  du32.arg2 = ctx->v1.u32[2];
75  if (DetectFlowAgeMatch(det_ctx, p, NULL, (const SigMatchCtx *)&du32)) {
76  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
77  }
78 }
79 
80 static int PrefilterSetupFlowAge(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
81 {
83  PrefilterPacketU32Compare, PrefilterPacketFlowAgeMatch);
84 }
85 
86 static bool PrefilterFlowAgeIsPrefilterable(const Signature *s)
87 {
88  return PrefilterIsPrefilterableById(s, DETECT_FLOW_AGE);
89 }
90 
92 {
93  sigmatch_table[DETECT_FLOW_AGE].name = "flow.age";
94  sigmatch_table[DETECT_FLOW_AGE].desc = "match flow age";
95  sigmatch_table[DETECT_FLOW_AGE].url = "/rules/flow-keywords.html#flow-age";
96  sigmatch_table[DETECT_FLOW_AGE].Match = DetectFlowAgeMatch;
97  sigmatch_table[DETECT_FLOW_AGE].Setup = DetectFlowAgeSetup;
98  sigmatch_table[DETECT_FLOW_AGE].Free = DetectFlowAgeFree;
99  sigmatch_table[DETECT_FLOW_AGE].SupportsPrefilter = PrefilterFlowAgeIsPrefilterable;
100  sigmatch_table[DETECT_FLOW_AGE].SetupPrefilter = PrefilterSetupFlowAge;
101 }
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1241
detect-engine.h
DetectU32Match
int DetectU32Match(const uint32_t parg, const DetectUintData_u32 *du32)
Definition: detect-engine-uint.c:31
SigTableElmt_::desc
const char * desc
Definition: detect.h:1240
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1228
Flow_::startts
SCTime_t startts
Definition: flow.h:496
SigTableElmt_::name
const char * name
Definition: detect.h:1238
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1395
DetectU32Parse
DetectUintData_u32 * DetectU32Parse(const char *u32str)
This function is used to parse u32 options passed via some u32 keyword.
Definition: detect-engine-uint.c:45
PrefilterPacketU32Set
void PrefilterPacketU32Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:51
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1134
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:43
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:24
rust.h
detect-flow-age.h
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:42
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1223
detect-engine-prefilter.h
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1226
DetectFlowAgeRegister
void DetectFlowAgeRegister(void)
Definition: detect-flow-age.c:91
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1025
DETECT_FLOW_AGE
@ DETECT_FLOW_AGE
Definition: detect-engine-register.h:112
Flow_::lastts
SCTime_t lastts
Definition: flow.h:416
PrefilterPacketHeaderValue::u32
uint32_t u32[4]
Definition: detect-engine-prefilter-common.h:26
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:78
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:316
Signature_::flags
uint32_t flags
Definition: detect.h:541
Packet_
Definition: decode.h:428
PrefilterPacketU32Compare
bool PrefilterPacketU32Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:60
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1206
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:239
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:36
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:308
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:314
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
DetectU32Data
DetectUintData_u32 DetectU32Data
Definition: detect-engine-uint.h:41
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:51
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1225
detect-parse.h
Signature_
Signature container.
Definition: detect.h:540
SigMatch_
a single match condition for a signature
Definition: detect.h:313
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:354
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:215