suricata
detect-l3proto.c
Go to the documentation of this file.
1 /* Copyright (C) 2012-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eric Leblond <eric@regit.org>
22  *
23  *
24  * Implements the l3_proto keyword
25  */
26 
27 #include "suricata-common.h"
28 #include "decode.h"
29 #include "detect.h"
30 
31 #include "detect-ipproto.h"
32 
33 #include "detect-parse.h"
34 #include "detect-engine.h"
35 #include "detect-engine-mpm.h"
36 #include "detect-engine-build.h"
37 
38 #include "detect-engine-siggroup.h"
39 #include "detect-engine-address.h"
40 
41 #include "detect-l3proto.h"
42 
43 #include "util-byte.h"
44 #include "util-unittest-helper.h"
45 
46 #include "util-debug.h"
47 
48 static int DetectL3ProtoSetup(DetectEngineCtx *, Signature *, const char *);
49 #ifdef UNITTESTS
50 static void DetectL3protoRegisterTests(void);
51 #endif
52 
53 void DetectL3ProtoRegister(void)
54 {
55  sigmatch_table[DETECT_L3PROTO].name = "l3_proto";
56  sigmatch_table[DETECT_L3PROTO].Match = NULL;
57  sigmatch_table[DETECT_L3PROTO].Setup = DetectL3ProtoSetup;
58  sigmatch_table[DETECT_L3PROTO].Free = NULL;
59 #ifdef UNITTESTS
60  sigmatch_table[DETECT_L3PROTO].RegisterTests = DetectL3protoRegisterTests;
61 #endif
62 }
63 /**
64  * \internal
65  * \brief Setup l3_proto keyword.
66  *
67  * \param de_ctx Detection engine context
68  * \param s Signature
69  * \param optstr Options string
70  *
71  * \return Non-zero on error
72  */
73 static int DetectL3ProtoSetup(DetectEngineCtx *de_ctx, Signature *s, const char *optstr)
74 {
75  const char *str = optstr;
76 
77  /* reset possible any value */
78  if (s->init_data->proto.flags & DETECT_PROTO_ANY) {
79  s->init_data->proto.flags &= ~DETECT_PROTO_ANY;
80  }
81 
82  /* authorized value, ip, any, ip4, ipv4, ip6, ipv6 */
83  if (strcasecmp(str,"ipv4") == 0 ||
84  strcasecmp(str,"ip4") == 0 ) {
85  if (s->init_data->proto.flags & DETECT_PROTO_IPV6) {
86  SCLogError("Conflicting l3 proto specified");
87  goto error;
88  }
89  s->init_data->proto.flags |= DETECT_PROTO_IPV4;
90  SCLogDebug("IPv4 protocol detected");
91  } else if (strcasecmp(str,"ipv6") == 0 ||
92  strcasecmp(str,"ip6") == 0 ) {
93  if (s->init_data->proto.flags & DETECT_PROTO_IPV6) {
94  SCLogError("Conflicting l3 proto specified");
95  goto error;
96  }
97  s->init_data->proto.flags |= DETECT_PROTO_IPV6;
98  SCLogDebug("IPv6 protocol detected");
99  } else {
100  SCLogError("Invalid l3 proto: \"%s\"", str);
101  goto error;
102  }
103 
104  return 0;
105 error:
106  return -1;
107 }
108 
109 #ifdef UNITTESTS
110 #include "detect-engine-alert.h"
111 
112 /**
113  * \test DetectL3protoTestSig01 is a test for checking the working of ttl keyword
114  * by setting up the signature and later testing its working by matching
115  * the received packet against the sig.
116  */
117 
118 static int DetectL3protoTestSig1(void)
119 {
120  Packet *p = PacketGetFromAlloc();
121  FAIL_IF_NULL(p);
122  Signature *s = NULL;
123  ThreadVars th_v;
124  DetectEngineThreadCtx *det_ctx;
125  IPV4Hdr ip4h;
126 
127  memset(&th_v, 0, sizeof(th_v));
128  StatsThreadInit(&th_v.stats);
129 
130  p->src.family = AF_INET;
131  p->dst.family = AF_INET;
132  p->proto = IPPROTO_TCP;
133  UTHSetIPV4Hdr(p, &ip4h);
134 
135  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
136  FAIL_IF_NULL(de_ctx);
137 
138  de_ctx->flags |= DE_QUIET;
139 
140  s = DetectEngineAppendSig(
141  de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv4\"; l3_proto:ipv4; sid:1;)");
142  FAIL_IF_NULL(s);
143 
144  s = DetectEngineAppendSig(
145  de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv6\"; l3_proto:ipv6; sid:2;)");
146  FAIL_IF_NULL(s);
147 
148  s = DetectEngineAppendSig(
149  de_ctx, "alert ip any any -> any any (msg:\"l3proto ip4\"; l3_proto:ip4; sid:3;)");
150  FAIL_IF_NULL(s);
151 
152  s = DetectEngineAppendSig(
153  de_ctx, "alert ip any any -> any any (msg:\"l3proto ip6\"; l3_proto:ip6; sid:4;)");
154  FAIL_IF_NULL(s);
155 
156  SigGroupBuild(de_ctx);
157  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
158 
159  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
160  FAIL_IF_NOT(PacketAlertCheck(p, 1));
161  FAIL_IF(PacketAlertCheck(p, 2));
162  FAIL_IF_NOT(PacketAlertCheck(p, 3));
163  FAIL_IF(PacketAlertCheck(p, 4));
164 
165  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
166  DetectEngineCtxFree(de_ctx);
167 
168  PacketFree(p);
169  StatsThreadCleanup(&th_v.stats);
170  PASS;
171 }
172 
173 /**
174  * \test DetectL3protoTestSig02 is a test for checking the working of l3proto keyword
175  * by setting up the signature and later testing its working by matching
176  * the received IPv6 packet against the sig.
177  */
178 
179 static int DetectL3protoTestSig2(void)
180 {
181  Packet *p = PacketGetFromAlloc();
182  FAIL_IF_NULL(p);
183  Signature *s = NULL;
184  ThreadVars th_v;
185  DetectEngineThreadCtx *det_ctx;
186  IPV6Hdr ip6h;
187 
188  memset(&th_v, 0, sizeof(th_v));
189  StatsThreadInit(&th_v.stats);
190 
191  p->src.family = AF_INET6;
192  p->dst.family = AF_INET6;
193  p->proto = IPPROTO_TCP;
194  UTHSetIPV6Hdr(p, &ip6h);
195 
196  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
197  FAIL_IF_NULL(de_ctx);
198 
199  de_ctx->flags |= DE_QUIET;
200 
201  s = DetectEngineAppendSig(
202  de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv4\"; l3_proto:ipv4; sid:1;)");
203  FAIL_IF_NULL(s);
204 
205  s = DetectEngineAppendSig(
206  de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv6\"; l3_proto:ipv6; sid:2;)");
207  FAIL_IF_NULL(s);
208 
209  s = DetectEngineAppendSig(
210  de_ctx, "alert ip any any -> any any (msg:\"l3proto ip4\"; l3_proto:ip4; sid:3;)");
211  FAIL_IF_NULL(s);
212 
213  s = DetectEngineAppendSig(
214  de_ctx, "alert ip any any -> any any (msg:\"l3proto ip6\"; l3_proto:ip6; sid:4;)");
215  FAIL_IF_NULL(s);
216 
217  SigGroupBuild(de_ctx);
218  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
219 
220  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
221  FAIL_IF(PacketAlertCheck(p, 1));
222  FAIL_IF_NOT(PacketAlertCheck(p, 2));
223  FAIL_IF(PacketAlertCheck(p, 3));
224  FAIL_IF_NOT(PacketAlertCheck(p, 4));
225 
226  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
227  DetectEngineCtxFree(de_ctx);
228 
229  PacketFree(p);
230  StatsThreadCleanup(&th_v.stats);
231 
232  PASS;
233 }
234 
235 /**
236  * \test DetectL3protoTestSig03 is a test for checking the working of l3proto keyword
237  * in conjunction with ip_proto keyword.
238  */
239 
240 static int DetectL3protoTestSig3(void)
241 {
242  Packet *p = PacketGetFromAlloc();
243  FAIL_IF_NULL(p);
244  Signature *s = NULL;
245  ThreadVars th_v;
246  DetectEngineThreadCtx *det_ctx;
247  IPV6Hdr ip6h;
248 
249  memset(&th_v, 0, sizeof(th_v));
250  StatsThreadInit(&th_v.stats);
251 
252  p->src.family = AF_INET6;
253  p->dst.family = AF_INET6;
254  p->proto = IPPROTO_TCP;
255  UTHSetIPV6Hdr(p, &ip6h);
256 
257  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
258  FAIL_IF_NULL(de_ctx);
259 
260  de_ctx->flags |= DE_QUIET;
261 
262  s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv4 and "
263  "ip_proto udp\"; l3_proto:ipv4; ip_proto:17; sid:1;)");
264  FAIL_IF_NULL(s);
265 
266  s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv6 and "
267  "ip_proto udp\"; l3_proto:ipv6; ip_proto:17; sid:2;)");
268  FAIL_IF_NULL(s);
269 
270  s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (msg:\"l3proto ip4 and ip_proto "
271  "tcp\"; l3_proto:ipv4; ip_proto:6; sid:3;)");
272  FAIL_IF_NULL(s);
273 
274  s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (msg:\"l3proto ipv6 and "
275  "ip_proto tcp\"; l3_proto:ipv6; ip_proto:6; sid:4;)");
276  FAIL_IF_NULL(s);
277 
278  SigGroupBuild(de_ctx);
279  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
280 
281  SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
282  FAIL_IF(PacketAlertCheck(p, 1));
283  FAIL_IF(PacketAlertCheck(p, 2));
284  FAIL_IF(PacketAlertCheck(p, 3));
285  FAIL_IF_NOT(PacketAlertCheck(p, 4));
286 
287  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
288  DetectEngineCtxFree(de_ctx);
289 
290  PacketFree(p);
291  StatsThreadCleanup(&th_v.stats);
292 
293  PASS;
294 }
295 
296 /**
297  * \brief this function registers unit tests for DetectL3proto
298  */
299 static void DetectL3protoRegisterTests(void)
300 {
301  UtRegisterTest("DetectL3protoTestSig1", DetectL3protoTestSig1);
302  UtRegisterTest("DetectL3protoTestSig2", DetectL3protoTestSig2);
303  UtRegisterTest("DetectL3protoTestSig3", DetectL3protoTestSig3);
304 }
305 #endif /* UNITTESTS */
util-byte.h
Packet_::proto
uint8_t proto
Definition: decode.h:538
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:78
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1529
DETECT_PROTO_IPV6
#define DETECT_PROTO_IPV6
Definition: detect-engine-proto.h:32
detect-engine-siggroup.h
SigTableElmt_::name
const char * name
Definition: detect.h:1542
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:101
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:144
UTHSetIPV4Hdr
void UTHSetIPV4Hdr(Packet *p, IPV4Hdr *ip4h)
Definition: util-unittest-helper.c:251
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:995
DETECT_PROTO_ANY
#define DETECT_PROTO_ANY
Definition: detect-engine-proto.h:28
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2912
DE_QUIET
#define DE_QUIET
Definition: detect.h:334
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:3305
p
Packet * p
Definition: fuzz_dataset.c:30
UTHSetIPV6Hdr
void UTHSetIPV6Hdr(Packet *p, IPV6Hdr *ip6h)
Definition: util-unittest-helper.c:256
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3965
detect-l3proto.h
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1524
DETECT_L3PROTO
@ DETECT_L3PROTO
Definition: detect-engine-register.h:236
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
DetectL3ProtoRegister
void DetectL3ProtoRegister(void)
Registration function for ip_proto keyword.
Definition: detect-l3proto.c:53
DetectEngineThreadCtx_
Definition: detect.h:1316
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3660
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:221
SignatureInitData_::proto
DetectProto proto
Definition: detect.h:655
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:516
detect-engine-build.h
detect-engine-alert.h
detect-ipproto.h
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:775
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1504
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2300
StatsThreadInit
void StatsThreadInit(StatsThreadContext *stats)
Definition: counters.c:1332
IPV4Hdr_
Definition: decode-ipv4.h:72
DetectProto_::flags
uint8_t flags
Definition: detect-engine-proto.h:40
th_v
ThreadVars * th_v
Definition: fuzz_dataset.c:29
DETECT_PROTO_IPV4
#define DETECT_PROTO_IPV4
Definition: detect-engine-proto.h:31
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3905
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:260
str
#define str(s)
Definition: suricata-common.h:313
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:274
detect-parse.h
Signature_
Signature container.
Definition: detect.h:692
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2873
Address_::family
char family
Definition: decode.h:114
Packet_::dst
Address dst
Definition: decode.h:521
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:997
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:120
StatsThreadCleanup
void StatsThreadCleanup(StatsThreadContext *stats)
Definition: counters.c:1428
detect-engine-address.h
Packet_::src
Address src
Definition: decode.h:520
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1531