suricata
detect-icode.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Gerardo Iglesias <iglesiasg@gmail.com>
22  *
23  * Implements icode keyword support
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 
29 #include "detect.h"
30 #include "detect-parse.h"
32 #include "detect-engine-uint.h"
33 #include "detect-engine-build.h"
34 
35 #include "detect-icode.h"
36 
37 #include "util-byte.h"
38 #include "util-unittest.h"
39 #include "util-unittest-helper.h"
40 #include "util-debug.h"
41 
42 /**
43  *\brief Regex for parsing our icode options
44  */
45 
46 static int DetectICodeMatch(DetectEngineThreadCtx *, Packet *,
47  const Signature *, const SigMatchCtx *);
48 static int DetectICodeSetup(DetectEngineCtx *, Signature *, const char *);
49 #ifdef UNITTESTS
50 static void DetectICodeRegisterTests(void);
51 #endif
52 void DetectICodeFree(DetectEngineCtx *, void *);
53 
54 static int PrefilterSetupICode(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
55 static bool PrefilterICodeIsPrefilterable(const Signature *s);
56 
57 /**
58  * \brief Registration function for icode: keyword
59  */
61 {
62  sigmatch_table[DETECT_ICODE].name = "icode";
63  sigmatch_table[DETECT_ICODE].desc = "match on specific ICMP id-value";
64  sigmatch_table[DETECT_ICODE].url = "/rules/header-keywords.html#icode";
65  sigmatch_table[DETECT_ICODE].Match = DetectICodeMatch;
66  sigmatch_table[DETECT_ICODE].Setup = DetectICodeSetup;
68 #ifdef UNITTESTS
69  sigmatch_table[DETECT_ICODE].RegisterTests = DetectICodeRegisterTests;
70 #endif
71  sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable;
72  sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode;
73 }
74 
75 /**
76  * \brief This function is used to match icode rule option set on a packet with those passed via
77  * icode:
78  *
79  * \param t pointer to thread vars
80  * \param det_ctx pointer to the pattern matcher thread
81  * \param p pointer to the current packet
82  * \param ctx pointer to the sigmatch that we will cast into DetectU8Data
83  *
84  * \retval 0 no match
85  * \retval 1 match
86  */
87 static int DetectICodeMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
88  const Signature *s, const SigMatchCtx *ctx)
89 {
90  if (PKT_IS_PSEUDOPKT(p))
91  return 0;
92 
93  uint8_t picode;
94  if (PKT_IS_ICMPV4(p)) {
95  picode = ICMPV4_GET_CODE(p);
96  } else if (PKT_IS_ICMPV6(p)) {
97  picode = ICMPV6_GET_CODE(p);
98  } else {
99  /* Packet not ICMPv4 nor ICMPv6 */
100  return 0;
101  }
102 
103  const DetectU8Data *icd = (const DetectU8Data *)ctx;
104  return DetectU8Match(picode, icd);
105 }
106 
107 /**
108  * \brief this function is used to add the parsed icode data into the current signature
109  *
110  * \param de_ctx pointer to the Detection Engine Context
111  * \param s pointer to the Current Signature
112  * \param icodestr pointer to the user provided icode options
113  *
114  * \retval 0 on Success
115  * \retval -1 on Failure
116  */
117 static int DetectICodeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *icodestr)
118 {
119 
120  DetectU8Data *icd = NULL;
121  SigMatch *sm = NULL;
122 
123  icd = DetectU8Parse(icodestr);
124  if (icd == NULL) goto error;
125 
126  sm = SigMatchAlloc();
127  if (sm == NULL) goto error;
128 
129  sm->type = DETECT_ICODE;
130  sm->ctx = (SigMatchCtx *)icd;
131 
134 
135  return 0;
136 
137 error:
138  if (icd != NULL)
139  rs_detect_u8_free(icd);
140  if (sm != NULL) SCFree(sm);
141  return -1;
142 }
143 
144 /**
145  * \brief this function will free memory associated with DetectU8Data
146  *
147  * \param ptr pointer to DetectU8Data
148  */
150 {
151  rs_detect_u8_free(ptr);
152 }
153 
154 /* prefilter code */
155 
156 static void PrefilterPacketICodeMatch(DetectEngineThreadCtx *det_ctx,
157  Packet *p, const void *pectx)
158 {
159  if (PKT_IS_PSEUDOPKT(p)) {
160  SCReturn;
161  }
162 
163  uint8_t picode;
164  if (PKT_IS_ICMPV4(p)) {
165  picode = ICMPV4_GET_CODE(p);
166  } else if (PKT_IS_ICMPV6(p)) {
167  picode = ICMPV6_GET_CODE(p);
168  } else {
169  /* Packet not ICMPv4 nor ICMPv6 */
170  return;
171  }
172 
173  const PrefilterPacketU8HashCtx *h = pectx;
174  const SigsArray *sa = h->array[picode];
175  if (sa) {
176  PrefilterAddSids(&det_ctx->pmq, sa->sigs, sa->cnt);
177  }
178 }
179 
180 static int PrefilterSetupICode(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
181 {
183  PrefilterPacketU8Compare, PrefilterPacketICodeMatch);
184 }
185 
186 static bool PrefilterICodeIsPrefilterable(const Signature *s)
187 {
188  const SigMatch *sm;
189  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
190  switch (sm->type) {
191  case DETECT_ICODE:
192  return true;
193  }
194  }
195  return false;
196 }
197 
198 #ifdef UNITTESTS
199 #include "detect-engine.h"
200 #include "detect-engine-mpm.h"
201 #include "detect-engine-alert.h"
202 
203 /**
204  * \test DetectICodeParseTest01 is a test for setting a valid icode value
205  */
206 static int DetectICodeParseTest01(void)
207 {
208  DetectU8Data *icd = DetectU8Parse("8");
209  FAIL_IF_NULL(icd);
210  FAIL_IF_NOT(icd->arg1 == 8);
211  FAIL_IF_NOT(icd->mode == DETECT_UINT_EQ);
212  DetectICodeFree(NULL, icd);
213 
214  PASS;
215 }
216 
217 /**
218  * \test DetectICodeParseTest02 is a test for setting a valid icode value
219  * with ">" operator
220  */
221 static int DetectICodeParseTest02(void)
222 {
223  DetectU8Data *icd = DetectU8Parse(">8");
224  FAIL_IF_NULL(icd);
225  FAIL_IF_NOT(icd->arg1 == 8);
226  FAIL_IF_NOT(icd->mode == DETECT_UINT_GT);
227  DetectICodeFree(NULL, icd);
228 
229  PASS;
230 }
231 
232 /**
233  * \test DetectICodeParseTest03 is a test for setting a valid icode value
234  * with "<" operator
235  */
236 static int DetectICodeParseTest03(void)
237 {
238  DetectU8Data *icd = DetectU8Parse("<8");
239  FAIL_IF_NULL(icd);
240  FAIL_IF_NOT(icd->arg1 == 8);
241  FAIL_IF_NOT(icd->mode == DETECT_UINT_LT);
242  DetectICodeFree(NULL, icd);
243 
244  PASS;
245 }
246 
247 /**
248  * \test DetectICodeParseTest04 is a test for setting a valid icode value
249  * with "<>" operator
250  */
251 static int DetectICodeParseTest04(void)
252 {
253  DetectU8Data *icd = DetectU8Parse("8<>20");
254  FAIL_IF_NULL(icd);
255  FAIL_IF_NOT(icd->arg1 == 8);
256  FAIL_IF_NOT(icd->arg2 == 20);
257  FAIL_IF_NOT(icd->mode == DETECT_UINT_RA);
258  DetectICodeFree(NULL, icd);
259 
260  PASS;
261 }
262 
263 /**
264  * \test DetectICodeParseTest05 is a test for setting a valid icode value
265  * with spaces all around
266  */
267 static int DetectICodeParseTest05(void)
268 {
269  DetectU8Data *icd = DetectU8Parse(" 8 ");
270  FAIL_IF_NULL(icd);
271  FAIL_IF_NOT(icd->arg1 == 8);
272  FAIL_IF_NOT(icd->mode == DETECT_UINT_EQ);
273  DetectICodeFree(NULL, icd);
274 
275  PASS;
276 }
277 
278 /**
279  * \test DetectICodeParseTest06 is a test for setting a valid icode value
280  * with ">" operator and spaces all around
281  */
282 static int DetectICodeParseTest06(void)
283 {
284  DetectU8Data *icd = DetectU8Parse(" > 8 ");
285  FAIL_IF_NULL(icd);
286  FAIL_IF_NOT(icd->arg1 == 8);
287  FAIL_IF_NOT(icd->mode == DETECT_UINT_GT);
288  DetectICodeFree(NULL, icd);
289 
290  PASS;
291 }
292 
293 /**
294  * \test DetectICodeParseTest07 is a test for setting a valid icode value
295  * with "<>" operator and spaces all around
296  */
297 static int DetectICodeParseTest07(void)
298 {
299  DetectU8Data *icd = DetectU8Parse(" 8 <> 20 ");
300  FAIL_IF_NULL(icd);
301  FAIL_IF_NOT(icd->arg1 == 8);
302  FAIL_IF_NOT(icd->arg2 == 20);
303  FAIL_IF_NOT(icd->mode == DETECT_UINT_RA);
304  DetectICodeFree(NULL, icd);
305 
306  PASS;
307 }
308 
309 /**
310  * \test DetectICodeParseTest08 is a test for setting an invalid icode value
311  */
312 static int DetectICodeParseTest08(void)
313 {
314  DetectU8Data *icd = DetectU8Parse("> 8 <> 20");
315  FAIL_IF_NOT_NULL(icd);
316 
317  DetectICodeFree(NULL, icd);
318  PASS;
319 }
320 
321 /**
322  * \test DetectICodeParseTest09 is a test for setting an invalid icode value
323  * with "<<" operator
324  */
325 static int DetectICodeParseTest09(void)
326 {
327  DetectU8Data *icd = DetectU8Parse("8<<20");
328  FAIL_IF_NOT_NULL(icd);
329 
330  DetectICodeFree(NULL, icd);
331  PASS;
332 }
333 
334 /**
335  * \test DetectICodeMatchTest01 is a test for checking the working of icode
336  * keyword by creating 5 rules and matching a crafted packet against
337  * them. 4 out of 5 rules shall trigger.
338  */
339 static int DetectICodeMatchTest01(void)
340 {
341 
342  Packet *p = NULL;
343  Signature *s = NULL;
344  ThreadVars th_v;
345  DetectEngineThreadCtx *det_ctx;
346 
347  memset(&th_v, 0, sizeof(th_v));
348 
349  p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP);
350 
351  p->icmpv4h->code = 10;
352 
355 
356  de_ctx->flags |= DE_QUIET;
357 
358  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:10; sid:1;)");
359  FAIL_IF_NULL(s);
360 
361  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:<15; sid:2;)");
362  FAIL_IF_NULL(s);
363 
364  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:>20; sid:3;)");
365  FAIL_IF_NULL(s);
366 
367  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:8<>20; sid:4;)");
368  FAIL_IF_NULL(s);
369 
370  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:20<>8; sid:5;)");
371  FAIL_IF_NOT_NULL(s);
372 
374  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
375 
376  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
377 
378  FAIL_IF(PacketAlertCheck(p, 1) == 0);
379  FAIL_IF(PacketAlertCheck(p, 2) == 0);
380  FAIL_IF(PacketAlertCheck(p, 3));
381  FAIL_IF(PacketAlertCheck(p, 4) == 0);
382 
383  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
385 
386  UTHFreePackets(&p, 1);
387 
388  PASS;
389 }
390 
391 /**
392  * \brief this function registers unit tests for DetectICode
393  */
394 void DetectICodeRegisterTests(void)
395 {
396  UtRegisterTest("DetectICodeParseTest01", DetectICodeParseTest01);
397  UtRegisterTest("DetectICodeParseTest02", DetectICodeParseTest02);
398  UtRegisterTest("DetectICodeParseTest03", DetectICodeParseTest03);
399  UtRegisterTest("DetectICodeParseTest04", DetectICodeParseTest04);
400  UtRegisterTest("DetectICodeParseTest05", DetectICodeParseTest05);
401  UtRegisterTest("DetectICodeParseTest06", DetectICodeParseTest06);
402  UtRegisterTest("DetectICodeParseTest07", DetectICodeParseTest07);
403  UtRegisterTest("DetectICodeParseTest08", DetectICodeParseTest08);
404  UtRegisterTest("DetectICodeParseTest09", DetectICodeParseTest09);
405  UtRegisterTest("DetectICodeMatchTest01", DetectICodeMatchTest01);
406 }
407 #endif /* UNITTESTS */
util-byte.h
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1238
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
ICMPV4_GET_CODE
#define ICMPV4_GET_CODE(p)
Definition: decode-icmpv4.h:235
SigTableElmt_::desc
const char * desc
Definition: detect.h:1237
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1225
SigTableElmt_::name
const char * name
Definition: detect.h:1235
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1052
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1393
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_UINT_LT
#define DETECT_UINT_LT
Definition: detect-engine-uint.h:37
PrefilterPacketU8HashCtx_::array
SigsArray * array[256]
Definition: detect-engine-prefilter-common.h:53
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:141
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1131
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:784
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2445
DETECT_UINT_EQ
#define DETECT_UINT_EQ
Definition: detect-engine-uint.h:35
ICMPV6_GET_CODE
#define ICMPV6_GET_CODE(p)
Definition: decode-icmpv6.h:103
DE_QUIET
#define DE_QUIET
Definition: detect.h:287
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:339
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1788
DETECT_UINT_GT
#define DETECT_UINT_GT
Definition: detect-engine-uint.h:32
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1220
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1223
DetectU8Parse
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
Definition: detect-engine-uint.c:85
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
DetectEngineThreadCtx_
Definition: detect.h:1024
DETECT_ICODE
@ DETECT_ICODE
Definition: detect-engine-register.h:48
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:317
DetectU8Data
DetectUintData_u8 DetectU8Data
Definition: detect-engine-uint.h:43
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:78
PrefilterPacketU8Set
void PrefilterPacketU8Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:90
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:316
PKT_IS_ICMPV6
#define PKT_IS_ICMPV6(p)
Definition: decode.h:247
SCReturn
#define SCReturn
Definition: util-debug.h:300
Signature_::flags
uint32_t flags
Definition: detect.h:540
Packet_
Definition: decode.h:425
detect-engine-build.h
detect-engine-alert.h
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:610
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1203
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:533
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:238
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1954
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:308
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2434
DetectU8Match
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
Definition: detect-engine-uint.c:71
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3154
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SigsArray_::sigs
SigIntId * sigs
Definition: detect-engine-prefilter-common.h:47
DetectICodeFree
void DetectICodeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
Definition: detect-icode.c:149
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3368
SigMatch_::type
uint16_t type
Definition: detect.h:314
SigsArray_
Definition: detect-engine-prefilter-common.h:46
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
SigsArray_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.h:48
Packet_::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:555
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:246
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1222
detect-parse.h
detect-icode.h
Signature_
Signature container.
Definition: detect.h:539
SigMatch_
a single match condition for a signature
Definition: detect.h:313
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2406
PrefilterPacketU8Compare
bool PrefilterPacketU8Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:98
PrefilterPacketU8HashCtx_
Definition: detect-engine-prefilter-common.h:52
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:785
detect-engine-prefilter-common.h
PrefilterSetupPacketHeaderU8Hash
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:407
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:352
DETECT_UINT_RA
#define DETECT_UINT_RA
Definition: detect-engine-uint.h:34
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1227
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:215
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:470