suricata
detect-smb-version.c
Go to the documentation of this file.
1 /* Copyright (C) 2022-2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Eloy PĂ©rez
22  * \author Jason Taylor
23  *
24  * Implements the smb.version keyword
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "detect.h"
30 #include "detect-parse.h"
31 
32 #include "detect-engine.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-engine-state.h"
37 
38 #include "detect-smb-version.h"
39 #include "rust.h"
40 
41 #define BUFFER_NAME "smb_version"
42 #define KEYWORD_NAME "smb.version"
43 #define KEYWORD_ID DETECT_SMB_VERSION
44 
45 static int g_smb_version_list_id = 0;
46 
47 static void DetectSmbVersionFree(DetectEngineCtx *de_ctx, void *ptr)
48 {
49 
50  SCLogDebug("smb_version: DetectSmbVersionFree");
51  rs_smb_version_free(ptr);
52 }
53 
54 /**
55  * \brief Creates a SigMatch for the "smb.version" keyword being sent as argument,
56  * and appends it to the rs_smb_version_match Signature(s).
57  *
58  * \param de_ctx Pointer to the detection engine context.
59  * \param s Pointer to signature for the current Signature being parsed
60  * from the rules.
61  * \param arg Pointer to the string holding the keyword value.
62  *
63  * \retval 0 on success, -1 on failure
64  */
65 
66 static int DetectSmbVersionSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
67 {
68  SCLogDebug("smb_version: DetectSmbVersionSetup");
69 
71  return -1;
72 
73  if (arg == NULL) {
74  SCLogError("Error parsing smb.version option in signature, it needs a value");
75  return -1;
76  }
77 
79  SCLogError("Can't use 2 or more smb.version declarations in "
80  "the same sig. Invalidating signature.");
81  return -1;
82  }
83 
84  void *dod = rs_smb_version_parse(arg);
85 
86  if (dod == NULL) {
87  SCLogError("Error parsing smb.version option in signature");
88  return -1;
89  }
90 
92  de_ctx, s, DETECT_SMB_VERSION, (SigMatchCtx *)dod, g_smb_version_list_id) == NULL) {
93  DetectSmbVersionFree(de_ctx, dod);
94  return -1;
95  }
96 
97  return 0;
98 }
99 
100 /**
101  * \brief App layer match function for the "smb.version" keyword.
102  *
103  * \param t Pointer to the ThreadVars instance.
104  * \param det_ctx Pointer to the DetectEngineThreadCtx.
105  * \param f Pointer to the flow.
106  * \param flags Pointer to the flags indicating the flow direction.
107  * \param state Pointer to the app layer state data.
108  * \param s Pointer to the Signature instance.
109  * \param m Pointer to the SigMatch.
110  *
111  * \retval 1 On Match.
112  * \retval 0 On no match.
113  */
114 
115 static int DetectSmbVersionMatchRust(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags,
116  void *state, void *txv, const Signature *s, const SigMatchCtx *m)
117 {
118 
119  SCLogDebug("smb_version: DetectSmbVersionMatchRust");
120 
121  int matchvalue = rs_smb_version_match(txv, (void *)m);
122 
123  if (matchvalue != 1) {
124  SCLogDebug("rs_smb_version_match: didn't match");
125  SCReturnInt(0);
126  } else {
127  SCLogDebug("rs_smb_version_match: matched!");
128  return matchvalue;
129  }
130 }
131 
132 /**
133  * \brief Registers the keyword handlers for the "smb_version" keyword.
134  */
135 
137 {
139  sigmatch_table[DETECT_SMB_VERSION].Setup = DetectSmbVersionSetup;
141  sigmatch_table[DETECT_SMB_VERSION].AppLayerTxMatch = DetectSmbVersionMatchRust;
142  sigmatch_table[DETECT_SMB_VERSION].Free = DetectSmbVersionFree;
143  sigmatch_table[DETECT_SMB_VERSION].desc = "smb keyword to match on SMB version";
144  sigmatch_table[DETECT_FLOW_AGE].url = "/rules/smb-keywords.html#smb-version";
145 
148 
151 
152  g_smb_version_list_id = DetectBufferTypeRegister(BUFFER_NAME);
153 
154  SCLogDebug("registering " BUFFER_NAME " rule option");
155 }
SigTableElmt_::url
const char * url
Definition: detect.h:1296
DetectSignatureSetAppProto
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:1753
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1295
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1283
SigTableElmt_::name
const char * name
Definition: detect.h:1293
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Flow_
Flow data structure.
Definition: flow.h:351
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:836
DetectSmbVersionRegister
void DetectSmbVersionRegister(void)
Registers the keyword handlers for the "smb_version" keyword.
Definition: detect-smb-version.c:136
SigTableElmt_::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
Definition: detect.h:1264
rust.h
m
SCMutex m
Definition: flow-hash.h:6
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:264
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1278
detect-engine-prefilter.h
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:263
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1092
DETECT_FLOW_AGE
@ DETECT_FLOW_AGE
Definition: detect-engine-register.h:112
detect-engine-mpm.h
detect.h
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1261
BUFFER_NAME
#define BUFFER_NAME
Definition: detect-smb-version.c:41
detect-engine-content-inspection.h
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:342
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1008
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
detect-smb-version.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2079
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
detect-parse.h
Signature_
Signature container.
Definition: detect.h:593
DETECT_SMB_VERSION
@ DETECT_SMB_VERSION
Definition: detect-engine-register.h:206
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
register inspect engine at start up time
Definition: detect-engine.c:169
DetectGetLastSMFromLists
SigMatch * DetectGetLastSMFromLists(const Signature *s,...)
Returns the sm with the largest index (added latest) from the lists passed to us.
Definition: detect-parse.c:619
SigMatchAppendSMToList
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:447
KEYWORD_NAME
#define KEYWORD_NAME
Definition: detect-smb-version.c:42
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275