suricata
detect-icmpv6-mtu.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  */
24 
25 #include "suricata-common.h"
26 
27 #include "detect.h"
28 #include "detect-parse.h"
29 
30 #include "detect-icmpv6-mtu.h"
31 #include "detect-engine-uint.h"
32 
33 /* prototypes */
34 static int DetectICMPv6mtuMatch (DetectEngineThreadCtx *, Packet *,
35  const Signature *, const SigMatchCtx *);
36 static int DetectICMPv6mtuSetup (DetectEngineCtx *, Signature *, const char *);
38 #ifdef UNITTESTS
40 #endif
41 static int PrefilterSetupIcmpv6mtu(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
42 static bool PrefilterIcmpv6mtuIsPrefilterable(const Signature *s);
43 
44 /**
45  * \brief Registration function for icmpv6.mtu: keyword
46  */
47 
49 {
50  sigmatch_table[DETECT_ICMPV6MTU].name = "icmpv6.mtu";
51  sigmatch_table[DETECT_ICMPV6MTU].desc = "match on ICMPv6 MTU field";
52  sigmatch_table[DETECT_ICMPV6MTU].url = "/rules/header-keywords.html#icmpv6mtu";
53  sigmatch_table[DETECT_ICMPV6MTU].Match = DetectICMPv6mtuMatch;
54  sigmatch_table[DETECT_ICMPV6MTU].Setup = DetectICMPv6mtuSetup;
56 #ifdef UNITTESTS
58 #endif
59  sigmatch_table[DETECT_ICMPV6MTU].SupportsPrefilter = PrefilterIcmpv6mtuIsPrefilterable;
60  sigmatch_table[DETECT_ICMPV6MTU].SetupPrefilter = PrefilterSetupIcmpv6mtu;
61 
63  return;
64 }
65 
66 // returns 0 on no mtu, and 1 if mtu
67 static inline int DetectICMPv6mtuGetValue(Packet *p, uint32_t *picmpv6mtu)
68 {
69  if (!(PKT_IS_ICMPV6(p)) || PKT_IS_PSEUDOPKT(p))
70  return 0;
71  if (ICMPV6_GET_CODE(p) != 0)
72  return 0;
73  if (!(ICMPV6_HAS_MTU(p)))
74  return 0;
75 
76  *picmpv6mtu = ICMPV6_GET_MTU(p);
77  return 1;
78 }
79 
80 /**
81  * \brief This function is used to match ICMPV6 MTU rule option on a packet with those passed via icmpv6.mtu:
82  *
83  * \param det_ctx pointer to the pattern matcher thread
84  * \param p pointer to the current packet
85  * \param s pointer to the signature unused
86  * \param ctx pointer to the signature match context
87  *
88  * \retval 0 no match
89  * \retval 1 match
90  */
91 static int DetectICMPv6mtuMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
92  const Signature *s, const SigMatchCtx *ctx)
93 {
94  uint32_t picmpv6mtu;
95  if (DetectICMPv6mtuGetValue(p, &picmpv6mtu) == 0) {
96  return 0;
97  }
98 
99  const DetectU32Data *du32 = (const DetectU32Data *)ctx;
100  return DetectU32Match(picmpv6mtu, du32);
101 }
102 
103 /**
104  * \brief this function is used to attach the parsed icmpv6.mtu data into the current signature
105  *
106  * \param de_ctx pointer to the Detection Engine Context
107  * \param s pointer to the Current Signature
108  * \param icmpv6mtustr pointer to the user provided icmpv6.mtu options
109  *
110  * \retval 0 on Success
111  * \retval -1 on Failure
112  */
113 static int DetectICMPv6mtuSetup (DetectEngineCtx *de_ctx, Signature *s, const char *icmpv6mtustr)
114 {
115  DetectU32Data *icmpv6mtud = DetectU32Parse(icmpv6mtustr);
116  if (icmpv6mtud == NULL)
117  return -1;
118 
119  SigMatch *sm = SigMatchAlloc();
120  if (sm == NULL) {
121  DetectICMPv6mtuFree(de_ctx, icmpv6mtud);
122  return -1;
123  }
124 
125  sm->type = DETECT_ICMPV6MTU;
126  sm->ctx = (SigMatchCtx *)icmpv6mtud;
127 
131 
132  return 0;
133 }
134 
135 /**
136  * \brief this function will free memory associated with DetectU32Data
137  *
138  * \param ptr pointer to DetectU32Data
139  */
141 {
142  SCFree(ptr);
143 }
144 
145 /* prefilter code */
146 
147 static void
148 PrefilterPacketIcmpv6mtuMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
149 {
150  uint32_t picmpv6mtu;
151  if (DetectICMPv6mtuGetValue(p, &picmpv6mtu) == 0) {
152  return;
153  }
154 
155  /* during setup Suricata will automatically see if there is another
156  * check that can be added: alproto, sport or dport */
157  const PrefilterPacketHeaderCtx *ctx = pectx;
158  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
159  return;
160 
161  /* if we match, add all the sigs that use this prefilter. This means
162  * that these will be inspected further */
163  DetectU32Data du32;
164  du32.mode = ctx->v1.u8[0];
165  du32.arg1 = ctx->v1.u32[1];
166  du32.arg2 = ctx->v1.u32[2];
167  if (DetectU32Match(picmpv6mtu, &du32))
168  {
169  SCLogDebug("packet matches icmpv6.mtu/hl %u", picmpv6mtu);
170  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
171  }
172 }
173 
174 static int PrefilterSetupIcmpv6mtu(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
175 {
179  PrefilterPacketIcmpv6mtuMatch);
180 }
181 
182 static bool PrefilterIcmpv6mtuIsPrefilterable(const Signature *s)
183 {
184  return PrefilterIsPrefilterableById(s, DETECT_ICMPV6MTU);
185 }
186 
187 #ifdef UNITTESTS
188 #include "tests/detect-icmpv6-mtu.c"
189 #endif
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1204
SigTableElmt_::desc
const char * desc
Definition: detect.h:1203
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1191
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:34
SigTableElmt_::name
const char * name
Definition: detect.h:1201
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1201
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1346
ICMPV6_HAS_MTU
#define ICMPV6_HAS_MTU(p)
Definition: decode-icmpv6.h:122
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
PrefilterPacketU32Set
void PrefilterPacketU32Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:263
DetectICMPv6mtuRegisterTests
void DetectICMPv6mtuRegisterTests(void)
this function registers unit tests for DetectICMPv6mtu
Definition: detect-icmpv6-mtu.c:47
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1101
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:758
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:41
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:22
ICMPV6_GET_CODE
#define ICMPV6_GET_CODE(p)
Definition: decode-icmpv6.h:104
DetectU32Parse
DetectU32Data * DetectU32Parse(const char *u32str)
This function is used to parse u32 options passed via some u32 keyword.
Definition: detect-engine-uint.c:115
detect-icmpv6-mtu.h
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:40
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1186
detect-icmpv6-mtu.c
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1189
DetectU32Match
int DetectU32Match(const uint32_t parg, const DetectU32Data *du32)
Definition: detect-engine-uint.c:39
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:33
DetectICMPv6mtuRegister
void DetectICMPv6mtuRegister(void)
Registration function for icmpv6.mtu: keyword.
Definition: detect-icmpv6-mtu.c:48
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1003
PrefilterPacketHeaderValue::u32
uint32_t u32[4]
Definition: detect-engine-prefilter-common.h:24
detect.h
ICMPV6_GET_MTU
#define ICMPV6_GET_MTU(p)
Definition: decode-icmpv6.h:124
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:89
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:323
PKT_IS_ICMPV6
#define PKT_IS_ICMPV6(p)
Definition: decode.h:264
Signature_::flags
uint32_t flags
Definition: detect.h:518
Packet_
Definition: decode.h:414
DETECT_ICMPV6MTU
@ DETECT_ICMPV6MTU
Definition: detect-engine-register.h:261
DetectICMPv6mtuFree
void DetectICMPv6mtuFree(DetectEngineCtx *de_ctx, void *)
this function will free memory associated with DetectU32Data
Definition: detect-icmpv6-mtu.c:140
PrefilterPacketU32Compare
bool PrefilterPacketU32Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:272
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1169
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:235
SigMatch_::type
uint8_t type
Definition: detect.h:321
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:34
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:315
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:38
DetectU32Data_::arg2
uint32_t arg2
Definition: detect-engine-uint.h:40
Signature_::proto
DetectProto proto
Definition: detect.h:535
suricata-common.h
DetectU32Data_::mode
DetectUintMode mode
Definition: detect-engine-uint.h:42
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
DetectU32Data_
Definition: detect-engine-uint.h:38
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1188
detect-parse.h
Signature_
Signature container.
Definition: detect.h:517
SigMatch_
a single match condition for a signature
Definition: detect.h:320
DetectU32Data_::arg1
uint32_t arg1
Definition: detect-engine-uint.h:39
DetectUintRegister
void DetectUintRegister(void)
Definition: detect-engine-uint.c:284
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:349
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1193
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:223