suricata
detect-icode.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Gerardo Iglesias <iglesiasg@gmail.com>
22  *
23  * Implements icode keyword support
24  */
25 
26 #include "suricata-common.h"
27 #include "debug.h"
28 #include "decode.h"
29 
30 #include "detect.h"
31 #include "detect-parse.h"
33 #include "detect-engine-uint.h"
34 
35 #include "detect-icode.h"
36 
37 #include "util-byte.h"
38 #include "util-unittest.h"
39 #include "util-unittest-helper.h"
40 #include "util-debug.h"
41 
42 /**
43  *\brief Regex for parsing our icode options
44  */
45 
46 static int DetectICodeMatch(DetectEngineThreadCtx *, Packet *,
47  const Signature *, const SigMatchCtx *);
48 static int DetectICodeSetup(DetectEngineCtx *, Signature *, const char *);
49 #ifdef UNITTESTS
50 static void DetectICodeRegisterTests(void);
51 #endif
52 void DetectICodeFree(DetectEngineCtx *, void *);
53 
54 static int PrefilterSetupICode(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
55 static bool PrefilterICodeIsPrefilterable(const Signature *s);
56 
57 /**
58  * \brief Registration function for icode: keyword
59  */
61 {
62  sigmatch_table[DETECT_ICODE].name = "icode";
63  sigmatch_table[DETECT_ICODE].desc = "match on specific ICMP id-value";
64  sigmatch_table[DETECT_ICODE].url = "/rules/header-keywords.html#icode";
65  sigmatch_table[DETECT_ICODE].Match = DetectICodeMatch;
66  sigmatch_table[DETECT_ICODE].Setup = DetectICodeSetup;
68 #ifdef UNITTESTS
69  sigmatch_table[DETECT_ICODE].RegisterTests = DetectICodeRegisterTests;
70 #endif
71  sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable;
72  sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode;
73 }
74 
75 /**
76  * \brief This function is used to match icode rule option set on a packet with those passed via
77  * icode:
78  *
79  * \param t pointer to thread vars
80  * \param det_ctx pointer to the pattern matcher thread
81  * \param p pointer to the current packet
82  * \param ctx pointer to the sigmatch that we will cast into DetectU8Data
83  *
84  * \retval 0 no match
85  * \retval 1 match
86  */
87 static int DetectICodeMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
88  const Signature *s, const SigMatchCtx *ctx)
89 {
90  if (PKT_IS_PSEUDOPKT(p))
91  return 0;
92 
93  uint8_t picode;
94  if (PKT_IS_ICMPV4(p)) {
95  picode = ICMPV4_GET_CODE(p);
96  } else if (PKT_IS_ICMPV6(p)) {
97  picode = ICMPV6_GET_CODE(p);
98  } else {
99  /* Packet not ICMPv4 nor ICMPv6 */
100  return 0;
101  }
102 
103  const DetectU8Data *icd = (const DetectU8Data *)ctx;
104  return DetectU8Match(picode, icd);
105 }
106 
107 /**
108  * \brief this function is used to add the parsed icode data into the current signature
109  *
110  * \param de_ctx pointer to the Detection Engine Context
111  * \param s pointer to the Current Signature
112  * \param icodestr pointer to the user provided icode options
113  *
114  * \retval 0 on Success
115  * \retval -1 on Failure
116  */
117 static int DetectICodeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *icodestr)
118 {
119 
120  DetectU8Data *icd = NULL;
121  SigMatch *sm = NULL;
122 
123  icd = DetectU8Parse(icodestr);
124  if (icd == NULL) goto error;
125 
126  sm = SigMatchAlloc();
127  if (sm == NULL) goto error;
128 
129  sm->type = DETECT_ICODE;
130  sm->ctx = (SigMatchCtx *)icd;
131 
134 
135  return 0;
136 
137 error:
138  if (icd != NULL)
139  SCFree(icd);
140  if (sm != NULL) SCFree(sm);
141  return -1;
142 }
143 
144 /**
145  * \brief this function will free memory associated with DetectU8Data
146  *
147  * \param ptr pointer to DetectU8Data
148  */
150 {
151  SCFree(ptr);
152 }
153 
154 /* prefilter code */
155 
156 static void PrefilterPacketICodeMatch(DetectEngineThreadCtx *det_ctx,
157  Packet *p, const void *pectx)
158 {
159  if (PKT_IS_PSEUDOPKT(p)) {
160  SCReturn;
161  }
162 
163  uint8_t picode;
164  if (PKT_IS_ICMPV4(p)) {
165  picode = ICMPV4_GET_CODE(p);
166  } else if (PKT_IS_ICMPV6(p)) {
167  picode = ICMPV6_GET_CODE(p);
168  } else {
169  /* Packet not ICMPv4 nor ICMPv6 */
170  return;
171  }
172 
173  const PrefilterPacketU8HashCtx *h = pectx;
174  const SigsArray *sa = h->array[picode];
175  if (sa) {
176  PrefilterAddSids(&det_ctx->pmq, sa->sigs, sa->cnt);
177  }
178 }
179 
180 static void
181 PrefilterPacketICodeSet(PrefilterPacketHeaderValue *v, void *smctx)
182 {
183  const DetectU8Data *a = smctx;
184  v->u8[0] = a->mode;
185  v->u8[1] = a->arg1;
186  v->u8[2] = a->arg2;
187 }
188 
189 static bool
190 PrefilterPacketICodeCompare(PrefilterPacketHeaderValue v, void *smctx)
191 {
192  const DetectU8Data *a = smctx;
193  if (v.u8[0] == a->mode && v.u8[1] == a->arg1 && v.u8[2] == a->arg2)
194  return true;
195  return false;
196 }
197 
198 static int PrefilterSetupICode(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
199 {
201  PrefilterPacketICodeSet,
202  PrefilterPacketICodeCompare,
203  PrefilterPacketICodeMatch);
204 }
205 
206 static bool PrefilterICodeIsPrefilterable(const Signature *s)
207 {
208  const SigMatch *sm;
209  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
210  switch (sm->type) {
211  case DETECT_ICODE:
212  return true;
213  }
214  }
215  return false;
216 }
217 
218 #ifdef UNITTESTS
219 #include "detect-engine.h"
220 #include "detect-engine-mpm.h"
221 
222 /**
223  * \test DetectICodeParseTest01 is a test for setting a valid icode value
224  */
225 static int DetectICodeParseTest01(void)
226 {
227  DetectU8Data *icd = DetectU8Parse("8");
228  FAIL_IF_NULL(icd);
229  FAIL_IF_NOT(icd->arg1 == 8);
231  DetectICodeFree(NULL, icd);
232 
233  PASS;
234 }
235 
236 /**
237  * \test DetectICodeParseTest02 is a test for setting a valid icode value
238  * with ">" operator
239  */
240 static int DetectICodeParseTest02(void)
241 {
242  DetectU8Data *icd = DetectU8Parse(">8");
243  FAIL_IF_NULL(icd);
244  FAIL_IF_NOT(icd->arg1 == 8);
246  DetectICodeFree(NULL, icd);
247 
248  PASS;
249 }
250 
251 /**
252  * \test DetectICodeParseTest03 is a test for setting a valid icode value
253  * with "<" operator
254  */
255 static int DetectICodeParseTest03(void)
256 {
257  DetectU8Data *icd = DetectU8Parse("<8");
258  FAIL_IF_NULL(icd);
259  FAIL_IF_NOT(icd->arg1 == 8);
261  DetectICodeFree(NULL, icd);
262 
263  PASS;
264 }
265 
266 /**
267  * \test DetectICodeParseTest04 is a test for setting a valid icode value
268  * with "<>" operator
269  */
270 static int DetectICodeParseTest04(void)
271 {
272  DetectU8Data *icd = DetectU8Parse("8<>20");
273  FAIL_IF_NULL(icd);
274  FAIL_IF_NOT(icd->arg1 == 8);
275  FAIL_IF_NOT(icd->arg2 == 20);
277  DetectICodeFree(NULL, icd);
278 
279  PASS;
280 }
281 
282 /**
283  * \test DetectICodeParseTest05 is a test for setting a valid icode value
284  * with spaces all around
285  */
286 static int DetectICodeParseTest05(void)
287 {
288  DetectU8Data *icd = DetectU8Parse(" 8 ");
289  FAIL_IF_NULL(icd);
290  FAIL_IF_NOT(icd->arg1 == 8);
292  DetectICodeFree(NULL, icd);
293 
294  PASS;
295 }
296 
297 /**
298  * \test DetectICodeParseTest06 is a test for setting a valid icode value
299  * with ">" operator and spaces all around
300  */
301 static int DetectICodeParseTest06(void)
302 {
303  DetectU8Data *icd = DetectU8Parse(" > 8 ");
304  FAIL_IF_NULL(icd);
305  FAIL_IF_NOT(icd->arg1 == 8);
307  DetectICodeFree(NULL, icd);
308 
309  PASS;
310 }
311 
312 /**
313  * \test DetectICodeParseTest07 is a test for setting a valid icode value
314  * with "<>" operator and spaces all around
315  */
316 static int DetectICodeParseTest07(void)
317 {
318  DetectU8Data *icd = DetectU8Parse(" 8 <> 20 ");
319  FAIL_IF_NULL(icd);
320  FAIL_IF_NOT(icd->arg1 == 8);
321  FAIL_IF_NOT(icd->arg2 == 20);
323  DetectICodeFree(NULL, icd);
324 
325  PASS;
326 }
327 
328 /**
329  * \test DetectICodeParseTest08 is a test for setting an invalid icode value
330  */
331 static int DetectICodeParseTest08(void)
332 {
333  DetectU8Data *icd = DetectU8Parse("> 8 <> 20");
334  FAIL_IF_NOT_NULL(icd);
335 
336  DetectICodeFree(NULL, icd);
337  PASS;
338 }
339 
340 /**
341  * \test DetectICodeParseTest09 is a test for setting an invalid icode value
342  * with "<<" operator
343  */
344 static int DetectICodeParseTest09(void)
345 {
346  DetectU8Data *icd = DetectU8Parse("8<<20");
347  FAIL_IF_NOT_NULL(icd);
348 
349  DetectICodeFree(NULL, icd);
350  PASS;
351 }
352 
353 /**
354  * \test DetectICodeMatchTest01 is a test for checking the working of icode
355  * keyword by creating 5 rules and matching a crafted packet against
356  * them. 4 out of 5 rules shall trigger.
357  */
358 static int DetectICodeMatchTest01(void)
359 {
360 
361  Packet *p = NULL;
362  Signature *s = NULL;
363  ThreadVars th_v;
364  DetectEngineThreadCtx *det_ctx;
365 
366  memset(&th_v, 0, sizeof(th_v));
367 
368  p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP);
369 
370  p->icmpv4h->code = 10;
371 
374 
375  de_ctx->flags |= DE_QUIET;
376 
377  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:10; sid:1;)");
378  FAIL_IF_NULL(s);
379 
380  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:<15; sid:2;)");
381  FAIL_IF_NULL(s);
382 
383  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:>20; sid:3;)");
384  FAIL_IF_NULL(s);
385 
386  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:8<>20; sid:4;)");
387  FAIL_IF_NULL(s);
388 
389  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:20<>8; sid:5;)");
390  FAIL_IF_NOT_NULL(s);
391 
393  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
394 
395  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
396 
397  FAIL_IF(PacketAlertCheck(p, 1) == 0);
398  FAIL_IF(PacketAlertCheck(p, 2) == 0);
399  FAIL_IF(PacketAlertCheck(p, 3));
400  FAIL_IF(PacketAlertCheck(p, 4) == 0);
401 
402  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
404 
405  UTHFreePackets(&p, 1);
406 
407  PASS;
408 }
409 
410 /**
411  * \brief this function registers unit tests for DetectICode
412  */
413 void DetectICodeRegisterTests(void)
414 {
415  UtRegisterTest("DetectICodeParseTest01", DetectICodeParseTest01);
416  UtRegisterTest("DetectICodeParseTest02", DetectICodeParseTest02);
417  UtRegisterTest("DetectICodeParseTest03", DetectICodeParseTest03);
418  UtRegisterTest("DetectICodeParseTest04", DetectICodeParseTest04);
419  UtRegisterTest("DetectICodeParseTest05", DetectICodeParseTest05);
420  UtRegisterTest("DetectICodeParseTest06", DetectICodeParseTest06);
421  UtRegisterTest("DetectICodeParseTest07", DetectICodeParseTest07);
422  UtRegisterTest("DetectICodeParseTest08", DetectICodeParseTest08);
423  UtRegisterTest("DetectICodeParseTest09", DetectICodeParseTest09);
424  UtRegisterTest("DetectICodeMatchTest01", DetectICodeMatchTest01);
425 }
426 #endif /* UNITTESTS */
util-byte.h
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1270
DetectU8Data_::arg1
uint8_t arg1
Definition: detect-engine-uint.h:53
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
ICMPV4_GET_CODE
#define ICMPV4_GET_CODE(p)
Definition: decode-icmpv4.h:237
SigTableElmt_::desc
const char * desc
Definition: detect.h:1269
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1257
SigTableElmt_::name
const char * name
Definition: detect.h:1267
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1224
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1425
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
PrefilterPacketU8HashCtx_::array
SigsArray * array[256]
Definition: detect-engine-prefilter-common.h:51
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:137
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1167
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:811
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2433
DetectU8Data_::mode
DetectUintMode mode
Definition: detect-engine-uint.h:56
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:22
ICMPV6_GET_CODE
#define ICMPV6_GET_CODE(p)
Definition: decode-icmpv6.h:104
DE_QUIET
#define DE_QUIET
Definition: detect.h:295
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:1790
DetectU8Match
int DetectU8Match(const uint8_t parg, const DetectU8Data *du8)
Definition: detect-engine-uint.c:294
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1252
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
DetectU8Data_
Definition: detect-engine-uint.h:52
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1255
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
DetectEngineThreadCtx_
Definition: detect.h:1060
DETECT_ICODE
@ DETECT_ICODE
Definition: detect-engine-register.h:46
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:325
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:89
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:324
PKT_IS_ICMPV6
#define PKT_IS_ICMPV6(p)
Definition: decode.h:267
SCReturn
#define SCReturn
Definition: util-debug.h:302
Signature_::flags
uint32_t flags
Definition: detect.h:549
Packet_
Definition: decode.h:427
DETECT_UINT_EQ
@ DETECT_UINT_EQ
Definition: detect-engine-uint.h:31
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:619
DETECT_UINT_LT
@ DETECT_UINT_LT
Definition: detect-engine-uint.h:30
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1235
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:542
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:235
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1948
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:316
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2420
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
Definition: detect-engine.c:3142
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SigsArray_::sigs
SigIntId * sigs
Definition: detect-engine-prefilter-common.h:45
DetectICodeFree
void DetectICodeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
Definition: detect-icode.c:149
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
Definition: detect-engine.c:3354
SigMatch_::type
uint16_t type
Definition: detect.h:322
SigsArray_
Definition: detect-engine-prefilter-common.h:44
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SigsArray_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.h:46
Packet_::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:555
PKT_IS_ICMPV4
#define PKT_IS_ICMPV4(p)
Definition: decode.h:266
DetectU8Data_::arg2
uint8_t arg2
Definition: detect-engine-uint.h:54
DETECT_UINT_GT
@ DETECT_UINT_GT
Definition: detect-engine-uint.h:32
DetectU8Parse
DetectU8Data * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
Definition: detect-engine-uint.c:370
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1254
detect-parse.h
detect-icode.h
Signature_
Signature container.
Definition: detect.h:548
SigMatch_
a single match condition for a signature
Definition: detect.h:321
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2394
DETECT_UINT_RA
@ DETECT_UINT_RA
Definition: detect-engine-uint.h:33
PrefilterPacketU8HashCtx_
Definition: detect-engine-prefilter-common.h:50
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:21
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:812
detect-engine-prefilter-common.h
PrefilterSetupPacketHeaderU8Hash
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:407
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:349
debug.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1259
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:223
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:468