suricata
detect-icmpv6-mtu.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  */
24 
25 #include "suricata-common.h"
26 
27 #include "detect.h"
28 #include "detect-parse.h"
29 
30 #include "detect-icmpv6-mtu.h"
31 #include "detect-engine-uint.h"
32 
33 /* prototypes */
34 static int DetectICMPv6mtuMatch (DetectEngineThreadCtx *, Packet *,
35  const Signature *, const SigMatchCtx *);
36 static int DetectICMPv6mtuSetup (DetectEngineCtx *, Signature *, const char *);
38 #ifdef UNITTESTS
40 #endif
41 static int PrefilterSetupIcmpv6mtu(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
42 static bool PrefilterIcmpv6mtuIsPrefilterable(const Signature *s);
43 
44 /**
45  * \brief Registration function for icmpv6.mtu: keyword
46  */
47 
49 {
50  sigmatch_table[DETECT_ICMPV6MTU].name = "icmpv6.mtu";
51  sigmatch_table[DETECT_ICMPV6MTU].desc = "match on ICMPv6 MTU field";
52  sigmatch_table[DETECT_ICMPV6MTU].url = "/rules/header-keywords.html#icmpv6mtu";
53  sigmatch_table[DETECT_ICMPV6MTU].Match = DetectICMPv6mtuMatch;
54  sigmatch_table[DETECT_ICMPV6MTU].Setup = DetectICMPv6mtuSetup;
56 #ifdef UNITTESTS
58 #endif
59  sigmatch_table[DETECT_ICMPV6MTU].SupportsPrefilter = PrefilterIcmpv6mtuIsPrefilterable;
60  sigmatch_table[DETECT_ICMPV6MTU].SetupPrefilter = PrefilterSetupIcmpv6mtu;
61  return;
62 }
63 
64 // returns 0 on no mtu, and 1 if mtu
65 static inline int DetectICMPv6mtuGetValue(Packet *p, uint32_t *picmpv6mtu)
66 {
67  if (!(PKT_IS_ICMPV6(p)) || PKT_IS_PSEUDOPKT(p))
68  return 0;
69  if (ICMPV6_GET_CODE(p) != 0)
70  return 0;
71  if (!(ICMPV6_HAS_MTU(p)))
72  return 0;
73 
74  *picmpv6mtu = ICMPV6_GET_MTU(p);
75  return 1;
76 }
77 
78 /**
79  * \brief This function is used to match ICMPV6 MTU rule option on a packet with those passed via icmpv6.mtu:
80  *
81  * \param det_ctx pointer to the pattern matcher thread
82  * \param p pointer to the current packet
83  * \param s pointer to the signature unused
84  * \param ctx pointer to the signature match context
85  *
86  * \retval 0 no match
87  * \retval 1 match
88  */
89 static int DetectICMPv6mtuMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
90  const Signature *s, const SigMatchCtx *ctx)
91 {
92  uint32_t picmpv6mtu;
93  if (DetectICMPv6mtuGetValue(p, &picmpv6mtu) == 0) {
94  return 0;
95  }
96 
97  const DetectU32Data *du32 = (const DetectU32Data *)ctx;
98  return DetectU32Match(picmpv6mtu, du32);
99 }
100 
101 /**
102  * \brief this function is used to attach the parsed icmpv6.mtu data into the current signature
103  *
104  * \param de_ctx pointer to the Detection Engine Context
105  * \param s pointer to the Current Signature
106  * \param icmpv6mtustr pointer to the user provided icmpv6.mtu options
107  *
108  * \retval 0 on Success
109  * \retval -1 on Failure
110  */
111 static int DetectICMPv6mtuSetup (DetectEngineCtx *de_ctx, Signature *s, const char *icmpv6mtustr)
112 {
113  DetectU32Data *icmpv6mtud = DetectU32Parse(icmpv6mtustr);
114  if (icmpv6mtud == NULL)
115  return -1;
116 
117  SigMatch *sm = SigMatchAlloc();
118  if (sm == NULL) {
119  DetectICMPv6mtuFree(de_ctx, icmpv6mtud);
120  return -1;
121  }
122 
123  sm->type = DETECT_ICMPV6MTU;
124  sm->ctx = (SigMatchCtx *)icmpv6mtud;
125 
129 
130  return 0;
131 }
132 
133 /**
134  * \brief this function will free memory associated with DetectU32Data
135  *
136  * \param ptr pointer to DetectU32Data
137  */
139 {
140  rs_detect_u32_free(ptr);
141 }
142 
143 /* prefilter code */
144 
145 static void
146 PrefilterPacketIcmpv6mtuMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
147 {
148  uint32_t picmpv6mtu;
149  if (DetectICMPv6mtuGetValue(p, &picmpv6mtu) == 0) {
150  return;
151  }
152 
153  /* during setup Suricata will automatically see if there is another
154  * check that can be added: alproto, sport or dport */
155  const PrefilterPacketHeaderCtx *ctx = pectx;
156  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
157  return;
158 
159  /* if we match, add all the sigs that use this prefilter. This means
160  * that these will be inspected further */
161  DetectU32Data du32;
162  du32.mode = ctx->v1.u8[0];
163  du32.arg1 = ctx->v1.u32[1];
164  du32.arg2 = ctx->v1.u32[2];
165  if (DetectU32Match(picmpv6mtu, &du32))
166  {
167  SCLogDebug("packet matches icmpv6.mtu/hl %u", picmpv6mtu);
168  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
169  }
170 }
171 
172 static int PrefilterSetupIcmpv6mtu(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
173 {
177  PrefilterPacketIcmpv6mtuMatch);
178 }
179 
180 static bool PrefilterIcmpv6mtuIsPrefilterable(const Signature *s)
181 {
182  return PrefilterIsPrefilterableById(s, DETECT_ICMPV6MTU);
183 }
184 
185 #ifdef UNITTESTS
186 #include "tests/detect-icmpv6-mtu.c"
187 #endif
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1238
DetectU32Match
int DetectU32Match(const uint32_t parg, const DetectUintData_u32 *du32)
Definition: detect-engine-uint.c:31
SigTableElmt_::desc
const char * desc
Definition: detect.h:1237
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1225
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:34
SigTableElmt_::name
const char * name
Definition: detect.h:1235
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1058
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1392
ICMPV6_HAS_MTU
#define ICMPV6_HAS_MTU(p)
Definition: decode-icmpv6.h:121
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
DetectU32Parse
DetectUintData_u32 * DetectU32Parse(const char *u32str)
This function is used to parse u32 options passed via some u32 keyword.
Definition: detect-engine-uint.c:45
PrefilterPacketU32Set
void PrefilterPacketU32Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:51
DetectICMPv6mtuRegisterTests
void DetectICMPv6mtuRegisterTests(void)
this function registers unit tests for DetectICMPv6mtu
Definition: detect-icmpv6-mtu.c:47
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1131
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:784
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:43
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:24
ICMPV6_GET_CODE
#define ICMPV6_GET_CODE(p)
Definition: decode-icmpv6.h:103
detect-icmpv6-mtu.h
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:42
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1220
detect-icmpv6-mtu.c
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1223
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
DetectICMPv6mtuRegister
void DetectICMPv6mtuRegister(void)
Registration function for icmpv6.mtu: keyword.
Definition: detect-icmpv6-mtu.c:48
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1024
PrefilterPacketHeaderValue::u32
uint32_t u32[4]
Definition: detect-engine-prefilter-common.h:26
detect.h
ICMPV6_GET_MTU
#define ICMPV6_GET_MTU(p)
Definition: decode-icmpv6.h:123
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:78
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:316
PKT_IS_ICMPV6
#define PKT_IS_ICMPV6(p)
Definition: decode.h:250
Signature_::flags
uint32_t flags
Definition: detect.h:540
Packet_
Definition: decode.h:428
DETECT_ICMPV6MTU
@ DETECT_ICMPV6MTU
Definition: detect-engine-register.h:274
DetectICMPv6mtuFree
void DetectICMPv6mtuFree(DetectEngineCtx *de_ctx, void *)
this function will free memory associated with DetectU32Data
Definition: detect-icmpv6-mtu.c:138
PrefilterPacketU32Compare
bool PrefilterPacketU32Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:60
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1203
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:238
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:36
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:308
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:38
Signature_::proto
DetectProto proto
Definition: detect.h:557
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:314
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
DetectU32Data
DetectUintData_u32 DetectU32Data
Definition: detect-engine-uint.h:41
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1222
detect-parse.h
Signature_
Signature container.
Definition: detect.h:539
SigMatch_
a single match condition for a signature
Definition: detect.h:313
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:352
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1227
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:215