suricata
detect-icode.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Gerardo Iglesias <iglesiasg@gmail.com>
22  *
23  * Implements icode keyword support
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 
29 #include "detect.h"
30 #include "detect-parse.h"
32 #include "detect-engine-uint.h"
33 #include "detect-engine-build.h"
34 
35 #include "detect-icode.h"
36 
37 #include "util-byte.h"
38 #include "util-unittest.h"
39 #include "util-unittest-helper.h"
40 #include "util-debug.h"
41 
42 /**
43  *\brief Regex for parsing our icode options
44  */
45 
46 static int DetectICodeMatch(DetectEngineThreadCtx *, Packet *,
47  const Signature *, const SigMatchCtx *);
48 static int DetectICodeSetup(DetectEngineCtx *, Signature *, const char *);
49 #ifdef UNITTESTS
50 static void DetectICodeRegisterTests(void);
51 #endif
52 void DetectICodeFree(DetectEngineCtx *, void *);
53 
54 static int PrefilterSetupICode(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
55 static bool PrefilterICodeIsPrefilterable(const Signature *s);
56 
57 /**
58  * \brief Registration function for icode: keyword
59  */
61 {
62  sigmatch_table[DETECT_ICODE].name = "icode";
63  sigmatch_table[DETECT_ICODE].desc = "match on specific ICMP id-value";
64  sigmatch_table[DETECT_ICODE].url = "/rules/header-keywords.html#icode";
65  sigmatch_table[DETECT_ICODE].Match = DetectICodeMatch;
66  sigmatch_table[DETECT_ICODE].Setup = DetectICodeSetup;
68 #ifdef UNITTESTS
69  sigmatch_table[DETECT_ICODE].RegisterTests = DetectICodeRegisterTests;
70 #endif
71  sigmatch_table[DETECT_ICODE].SupportsPrefilter = PrefilterICodeIsPrefilterable;
72  sigmatch_table[DETECT_ICODE].SetupPrefilter = PrefilterSetupICode;
74 }
75 
76 /**
77  * \brief This function is used to match icode rule option set on a packet with those passed via
78  * icode:
79  *
80  * \param t pointer to thread vars
81  * \param det_ctx pointer to the pattern matcher thread
82  * \param p pointer to the current packet
83  * \param ctx pointer to the sigmatch that we will cast into DetectU8Data
84  *
85  * \retval 0 no match
86  * \retval 1 match
87  */
88 static int DetectICodeMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
89  const Signature *s, const SigMatchCtx *ctx)
90 {
92 
93  uint8_t picode;
94  if (PacketIsICMPv4(p)) {
95  picode = p->icmp_s.code;
96  } else if (PacketIsICMPv6(p)) {
97  const ICMPV6Hdr *icmpv6h = PacketGetICMPv6(p);
98  picode = ICMPV6_GET_CODE(icmpv6h);
99  } else {
100  /* Packet not ICMPv4 nor ICMPv6 */
101  return 0;
102  }
103 
104  const DetectU8Data *icd = (const DetectU8Data *)ctx;
105  return DetectU8Match(picode, icd);
106 }
107 
108 /**
109  * \brief this function is used to add the parsed icode data into the current signature
110  *
111  * \param de_ctx pointer to the Detection Engine Context
112  * \param s pointer to the Current Signature
113  * \param icodestr pointer to the user provided icode options
114  *
115  * \retval 0 on Success
116  * \retval -1 on Failure
117  */
118 static int DetectICodeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *icodestr)
119 {
120 
121  DetectU8Data *icd = NULL;
122 
123  icd = DetectU8Parse(icodestr);
124  if (icd == NULL)
125  return -1;
126 
128  de_ctx, s, DETECT_ICODE, (SigMatchCtx *)icd, DETECT_SM_LIST_MATCH) == NULL) {
129  SCDetectU8Free(icd);
130  return -1;
131  }
133 
134  return 0;
135 }
136 
137 /**
138  * \brief this function will free memory associated with DetectU8Data
139  *
140  * \param ptr pointer to DetectU8Data
141  */
143 {
144  SCDetectU8Free(ptr);
145 }
146 
147 /* prefilter code */
148 
149 static void PrefilterPacketICodeMatch(DetectEngineThreadCtx *det_ctx,
150  Packet *p, const void *pectx)
151 {
153 
154  uint8_t picode;
155  if (PacketIsICMPv4(p)) {
156  picode = p->icmp_s.code;
157  } else if (PacketIsICMPv6(p)) {
158  const ICMPV6Hdr *icmpv6h = PacketGetICMPv6(p);
159  picode = ICMPV6_GET_CODE(icmpv6h);
160  } else {
161  /* Packet not ICMPv4 nor ICMPv6 */
162  return;
163  }
164 
165  const PrefilterPacketU8HashCtx *h = pectx;
166  const SigsArray *sa = h->array[picode];
167  if (sa) {
168  PrefilterAddSids(&det_ctx->pmq, sa->sigs, sa->cnt);
169  }
170 }
171 
172 static int PrefilterSetupICode(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
173 {
175  PrefilterPacketU8Set, PrefilterPacketU8Compare, PrefilterPacketICodeMatch);
176 }
177 
178 static bool PrefilterICodeIsPrefilterable(const Signature *s)
179 {
180  const SigMatch *sm;
181  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
182  switch (sm->type) {
183  case DETECT_ICODE:
184  return true;
185  }
186  }
187  return false;
188 }
189 
190 #ifdef UNITTESTS
191 #include "detect-engine.h"
192 #include "detect-engine-mpm.h"
193 #include "detect-engine-alert.h"
194 
195 /**
196  * \test DetectICodeParseTest01 is a test for setting a valid icode value
197  */
198 static int DetectICodeParseTest01(void)
199 {
200  DetectU8Data *icd = DetectU8Parse("8");
201  FAIL_IF_NULL(icd);
202  FAIL_IF_NOT(icd->arg1 == 8);
203  FAIL_IF_NOT(icd->mode == DETECT_UINT_EQ);
204  DetectICodeFree(NULL, icd);
205 
206  PASS;
207 }
208 
209 /**
210  * \test DetectICodeParseTest02 is a test for setting a valid icode value
211  * with ">" operator
212  */
213 static int DetectICodeParseTest02(void)
214 {
215  DetectU8Data *icd = DetectU8Parse(">8");
216  FAIL_IF_NULL(icd);
217  FAIL_IF_NOT(icd->arg1 == 8);
218  FAIL_IF_NOT(icd->mode == DETECT_UINT_GT);
219  DetectICodeFree(NULL, icd);
220 
221  PASS;
222 }
223 
224 /**
225  * \test DetectICodeParseTest03 is a test for setting a valid icode value
226  * with "<" operator
227  */
228 static int DetectICodeParseTest03(void)
229 {
230  DetectU8Data *icd = DetectU8Parse("<8");
231  FAIL_IF_NULL(icd);
232  FAIL_IF_NOT(icd->arg1 == 8);
233  FAIL_IF_NOT(icd->mode == DETECT_UINT_LT);
234  DetectICodeFree(NULL, icd);
235 
236  PASS;
237 }
238 
239 /**
240  * \test DetectICodeParseTest04 is a test for setting a valid icode value
241  * with "<>" operator
242  */
243 static int DetectICodeParseTest04(void)
244 {
245  DetectU8Data *icd = DetectU8Parse("8<>20");
246  FAIL_IF_NULL(icd);
247  FAIL_IF_NOT(icd->arg1 == 8);
248  FAIL_IF_NOT(icd->arg2 == 20);
249  FAIL_IF_NOT(icd->mode == DETECT_UINT_RA);
250  DetectICodeFree(NULL, icd);
251 
252  PASS;
253 }
254 
255 /**
256  * \test DetectICodeParseTest05 is a test for setting a valid icode value
257  * with spaces all around
258  */
259 static int DetectICodeParseTest05(void)
260 {
261  DetectU8Data *icd = DetectU8Parse(" 8 ");
262  FAIL_IF_NULL(icd);
263  FAIL_IF_NOT(icd->arg1 == 8);
264  FAIL_IF_NOT(icd->mode == DETECT_UINT_EQ);
265  DetectICodeFree(NULL, icd);
266 
267  PASS;
268 }
269 
270 /**
271  * \test DetectICodeParseTest06 is a test for setting a valid icode value
272  * with ">" operator and spaces all around
273  */
274 static int DetectICodeParseTest06(void)
275 {
276  DetectU8Data *icd = DetectU8Parse(" > 8 ");
277  FAIL_IF_NULL(icd);
278  FAIL_IF_NOT(icd->arg1 == 8);
279  FAIL_IF_NOT(icd->mode == DETECT_UINT_GT);
280  DetectICodeFree(NULL, icd);
281 
282  PASS;
283 }
284 
285 /**
286  * \test DetectICodeParseTest07 is a test for setting a valid icode value
287  * with "<>" operator and spaces all around
288  */
289 static int DetectICodeParseTest07(void)
290 {
291  DetectU8Data *icd = DetectU8Parse(" 8 <> 20 ");
292  FAIL_IF_NULL(icd);
293  FAIL_IF_NOT(icd->arg1 == 8);
294  FAIL_IF_NOT(icd->arg2 == 20);
295  FAIL_IF_NOT(icd->mode == DETECT_UINT_RA);
296  DetectICodeFree(NULL, icd);
297 
298  PASS;
299 }
300 
301 /**
302  * \test DetectICodeParseTest08 is a test for setting an invalid icode value
303  */
304 static int DetectICodeParseTest08(void)
305 {
306  DetectU8Data *icd = DetectU8Parse("> 8 <> 20");
307  FAIL_IF_NOT_NULL(icd);
308 
309  PASS;
310 }
311 
312 /**
313  * \test DetectICodeParseTest09 is a test for setting an invalid icode value
314  * with "<<" operator
315  */
316 static int DetectICodeParseTest09(void)
317 {
318  DetectU8Data *icd = DetectU8Parse("8<<20");
319  FAIL_IF_NOT_NULL(icd);
320 
321  PASS;
322 }
323 
324 /**
325  * \test DetectICodeMatchTest01 is a test for checking the working of icode
326  * keyword by creating 5 rules and matching a crafted packet against
327  * them. 4 out of 5 rules shall trigger.
328  */
329 static int DetectICodeMatchTest01(void)
330 {
331  Signature *s = NULL;
332  ThreadVars th_v;
333  DetectEngineThreadCtx *det_ctx;
334 
335  memset(&th_v, 0, sizeof(th_v));
336 
337  Packet *p = UTHBuildPacket(NULL, 0, IPPROTO_ICMP);
338  FAIL_IF_NULL(p);
339  FAIL_IF_NOT(PacketIsICMPv4(p));
340  p->icmp_s.code = p->l4.hdrs.icmpv4h->code = 10;
341 
344 
345  de_ctx->flags |= DE_QUIET;
346 
347  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:10; sid:1;)");
348  FAIL_IF_NULL(s);
349 
350  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:<15; sid:2;)");
351  FAIL_IF_NULL(s);
352 
353  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:>20; sid:3;)");
354  FAIL_IF_NULL(s);
355 
356  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:8<>20; sid:4;)");
357  FAIL_IF_NULL(s);
358 
359  s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any (icode:20<>8; sid:5;)");
360  FAIL_IF_NOT_NULL(s);
361 
363  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
364 
365  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
366 
367  FAIL_IF(PacketAlertCheck(p, 1) == 0);
368  FAIL_IF(PacketAlertCheck(p, 2) == 0);
369  FAIL_IF(PacketAlertCheck(p, 3));
370  FAIL_IF(PacketAlertCheck(p, 4) == 0);
371 
372  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
374 
375  UTHFreePackets(&p, 1);
376  StatsThreadCleanup(&th_v);
377  PASS;
378 }
379 
380 /**
381  * \brief this function registers unit tests for DetectICode
382  */
383 void DetectICodeRegisterTests(void)
384 {
385  UtRegisterTest("DetectICodeParseTest01", DetectICodeParseTest01);
386  UtRegisterTest("DetectICodeParseTest02", DetectICodeParseTest02);
387  UtRegisterTest("DetectICodeParseTest03", DetectICodeParseTest03);
388  UtRegisterTest("DetectICodeParseTest04", DetectICodeParseTest04);
389  UtRegisterTest("DetectICodeParseTest05", DetectICodeParseTest05);
390  UtRegisterTest("DetectICodeParseTest06", DetectICodeParseTest06);
391  UtRegisterTest("DetectICodeParseTest07", DetectICodeParseTest07);
392  UtRegisterTest("DetectICodeParseTest08", DetectICodeParseTest08);
393  UtRegisterTest("DetectICodeParseTest09", DetectICodeParseTest09);
394  UtRegisterTest("DetectICodeMatchTest01", DetectICodeMatchTest01);
395 }
396 #endif /* UNITTESTS */
util-byte.h
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1460
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SIG_MASK_REQUIRE_REAL_PKT
#define SIG_MASK_REQUIRE_REAL_PKT
Definition: detect.h:316
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:642
SigTableElmt_::desc
const char * desc
Definition: detect.h:1459
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1444
SigTableElmt_::name
const char * name
Definition: detect.h:1457
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1323
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1627
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DETECT_UINT_LT
#define DETECT_UINT_LT
Definition: detect-engine-uint.h:37
SigTableElmt_::flags
uint32_t flags
Definition: detect.h:1448
PrefilterPacketU8HashCtx_::array
SigsArray * array[256]
Definition: detect-engine-prefilter-common.h:53
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:142
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1347
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2634
DETECT_UINT_EQ
#define DETECT_UINT_EQ
Definition: detect-engine-uint.h:35
DE_QUIET
#define DE_QUIET
Definition: detect.h:330
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:365
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:2416
Packet_::icmp_s
struct Packet_::@33::@40 icmp_s
SIGMATCH_SUPPORT_FIREWALL
#define SIGMATCH_SUPPORT_FIREWALL
Definition: detect.h:1680
DETECT_UINT_GT
#define DETECT_UINT_GT
Definition: detect-engine-uint.h:32
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3439
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1439
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1442
DetectU8Parse
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
Definition: detect-engine-uint.c:85
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PrefilterSetupPacketHeaderU8Hash
int PrefilterSetupPacketHeaderU8Hash(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, SignatureMask mask, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:462
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectICodeRegister
void DetectICodeRegister(void)
Registration function for icode: keyword.
Definition: detect-icode.c:60
DetectEngineThreadCtx_
Definition: detect.h:1244
DETECT_ICODE
@ DETECT_ICODE
Definition: detect-engine-register.h:48
detect-engine-mpm.h
SCSigMatchAppendSMToList
SigMatch * SCSigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:388
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3364
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DetectU8Data
DetectUintData_u8 DetectU8Data
Definition: detect-engine-uint.h:43
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
PrefilterPacketU8Set
void PrefilterPacketU8Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:90
PacketL4::L4Hdrs::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:471
Signature_::flags
uint32_t flags
Definition: detect.h:669
Packet_
Definition: decode.h:501
detect-engine-build.h
detect-engine-alert.h
Packet_::l4
struct PacketL4 l4
Definition: decode.h:601
ICMPV6_GET_CODE
#define ICMPV6_GET_CODE(icmp6h)
Definition: decode-icmpv6.h:103
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:747
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1419
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2194
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
ICMPV6Hdr_
Definition: decode-icmpv6.h:129
DetectU8Match
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
Definition: detect-engine-uint.c:71
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SigsArray_::sigs
SigIntId * sigs
Definition: detect-engine-prefilter-common.h:47
DetectICodeFree
void DetectICodeFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU8Data
Definition: detect-icode.c:142
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:357
SigsArray_
Definition: detect-engine-prefilter-common.h:46
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3596
SigsArray_::cnt
uint32_t cnt
Definition: detect-engine-prefilter-common.h:48
ICMPV4Hdr_::code
uint8_t code
Definition: decode-icmpv4.h:167
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1441
detect-parse.h
detect-icode.h
Signature_
Signature container.
Definition: detect.h:668
SigMatch_
a single match condition for a signature
Definition: detect.h:356
SIGMATCH_INFO_UINT8
#define SIGMATCH_INFO_UINT8
Definition: detect.h:1686
PacketL4::hdrs
union PacketL4::L4Hdrs hdrs
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2595
PrefilterPacketU8Compare
bool PrefilterPacketU8Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:98
PrefilterPacketU8HashCtx_
Definition: detect-engine-prefilter-common.h:52
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:934
detect-engine-prefilter-common.h
StatsThreadCleanup
void StatsThreadCleanup(ThreadVars *tv)
Definition: counters.c:1324
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DETECT_UINT_RA
#define DETECT_UINT_RA
Definition: detect-engine-uint.h:34
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1446
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:254
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:456