suricata
detect-smtp.c
Go to the documentation of this file.
1 /* Copyright (C) 2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <pantoine@oisf.net>
22  *
23  */
24 
25 #include "suricata-common.h"
26 #include "detect-smtp.h"
27 #include "detect-engine.h"
28 #include "detect-engine-buffer.h"
30 #include "detect-engine-helper.h"
31 #include "detect-engine-mpm.h"
33 #include "detect-parse.h"
34 #include "app-layer-smtp.h"
35 #include "rust.h"
36 
37 static int g_smtp_helo_buffer_id = 0;
38 static int g_smtp_mail_from_buffer_id = 0;
39 static int g_smtp_rcpt_to_buffer_id = 0;
40 
41 static int DetectSmtpHeloSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
42 {
43  if (SCDetectBufferSetActiveList(de_ctx, s, g_smtp_helo_buffer_id) < 0)
44  return -1;
45 
47  return -1;
48 
49  return 0;
50 }
51 
52 static InspectionBuffer *GetSmtpHeloData(DetectEngineThreadCtx *det_ctx,
53  const DetectEngineTransforms *transforms, Flow *f, const uint8_t _flow_flags, void *txv,
54  const int list_id)
55 {
56  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
57  if (buffer->inspect == NULL) {
58  SMTPState *smtp_state = (SMTPState *)FlowGetAppState(f);
59  if (smtp_state) {
60  if (smtp_state->helo == NULL || smtp_state->helo_len == 0)
61  return NULL;
62  InspectionBufferSetup(det_ctx, list_id, buffer, smtp_state->helo, smtp_state->helo_len);
63  InspectionBufferApplyTransforms(det_ctx, buffer, transforms);
64  }
65  }
66  return buffer;
67 }
68 
69 static int DetectSmtpMailFromSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
70 {
71  if (SCDetectBufferSetActiveList(de_ctx, s, g_smtp_mail_from_buffer_id) < 0)
72  return -1;
73 
75  return -1;
76 
77  return 0;
78 }
79 
80 static bool GetSmtpMailFromData(
81  const void *txv, const uint8_t _flow_flags, const uint8_t **data, uint32_t *data_len)
82 {
83  SMTPTransaction *tx = (SMTPTransaction *)txv;
84  if (tx->mail_from == NULL)
85  return false;
86  *data = tx->mail_from;
87  *data_len = tx->mail_from_len;
88  return true;
89 }
90 
91 static int DetectSmtpRcptToSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
92 {
93  if (SCDetectBufferSetActiveList(de_ctx, s, g_smtp_rcpt_to_buffer_id) < 0)
94  return -1;
95 
97  return -1;
98 
99  return 0;
100 }
101 
102 static bool GetSmtpRcptToData(DetectEngineThreadCtx *_det_ctx, const void *txv, uint8_t _flow_flags,
103  uint32_t idx, const uint8_t **buffer, uint32_t *buffer_len)
104 {
105  SMTPTransaction *tx = (SMTPTransaction *)txv;
106  if (TAILQ_EMPTY(&tx->rcpt_to_list)) {
107  return false;
108  }
109 
110  SMTPString *s;
111  if (idx == 0) {
112  s = TAILQ_FIRST(&tx->rcpt_to_list);
113  } else {
114  // TODO optimize ?
115  s = TAILQ_FIRST(&tx->rcpt_to_list);
116  for (uint32_t i = 0; i < idx; i++) {
117  s = TAILQ_NEXT(s, next);
118  }
119  }
120  if (s == NULL) {
121  return false;
122  }
123 
124  *buffer = s->str;
125  *buffer_len = s->len;
126  return true;
127 }
128 
130 {
131  SCSigTableAppLiteElmt kw = { 0 };
132  kw.name = "smtp.helo";
133  kw.desc = "SMTP helo buffer";
134  kw.url = "/rules/smtp-keywords.html#smtp-helo";
135  kw.Setup = DetectSmtpHeloSetup;
139  DetectEngineInspectBufferGeneric, GetSmtpHeloData);
141  GetSmtpHeloData, ALPROTO_SMTP, 0);
142  DetectBufferTypeSetDescriptionByName("smtp.helo", "SMTP helo");
143  g_smtp_helo_buffer_id = DetectBufferTypeGetByName("smtp.helo");
144 
145  kw.name = "smtp.mail_from";
146  kw.desc = "SMTP mail from buffer";
147  kw.url = "/rules/smtp-keywords.html#smtp-mail-from";
148  kw.Setup = DetectSmtpMailFromSetup;
151  g_smtp_mail_from_buffer_id = SCDetectHelperBufferMpmRegister(
152  "smtp.mail_from", "SMTP MAIL FROM", ALPROTO_SMTP, STREAM_TOSERVER, GetSmtpMailFromData);
153 
154  kw.name = "smtp.rcpt_to";
155  kw.desc = "SMTP rcpt to buffer";
156  kw.url = "/rules/smtp-keywords.html#smtp-rcpt-to";
157  kw.Setup = DetectSmtpRcptToSetup;
160  g_smtp_rcpt_to_buffer_id = SCDetectHelperMultiBufferMpmRegister(
161  "smtp.rcpt_to", "SMTP RCPT TO", ALPROTO_SMTP, STREAM_TOSERVER, GetSmtpRcptToData);
162 }
InspectionBufferApplyTransforms
void InspectionBufferApplyTransforms(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buffer, const DetectEngineTransforms *transforms)
Definition: detect-engine-inspect-buffer.c:128
SMTPState_
Definition: app-layer-smtp.h:116
detect-engine.h
SCSigTableAppLiteElmt::url
const char * url
keyword documentation url
Definition: detect-engine-helper.h:55
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1636
SCSigTableAppLiteElmt::name
const char * name
keyword name
Definition: detect-engine-helper.h:51
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2036
DetectEngineTransforms
Definition: detect.h:392
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
InspectionBuffer
Definition: detect-engine-inspect-buffer.h:34
Flow_
Flow data structure.
Definition: flow.h:356
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:919
TAILQ_EMPTY
#define TAILQ_EMPTY(head)
Definition: queue.h:248
InspectionBufferSetup
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine-inspect-buffer.c:190
rust.h
SCDetectBufferSetActiveList
int SCDetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine-buffer.c:29
SCDetectHelperBufferMpmRegister
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:47
SCSigTableAppLiteElmt::desc
const char * desc
keyword description
Definition: detect-engine-helper.h:53
SCDetectSignatureSetAppProto
int SCDetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:2212
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine-inspect-buffer.c:56
detect-engine-prefilter.h
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1256
SCSigTableAppLiteElmt
App-layer light version of SigTableElmt.
Definition: detect-engine-helper.h:49
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:271
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1211
SCDetectSMTPRegister
void SCDetectSMTPRegister(void)
Definition: detect-smtp.c:129
SMTPState_::helo
uint8_t * helo
Definition: app-layer-smtp.h:151
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:38
detect-engine-mpm.h
SMTPTransaction_::mail_from
uint8_t * mail_from
Definition: app-layer-smtp.h:88
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1584
detect-engine-helper.h
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:154
SMTPTransaction_
Definition: app-layer-smtp.h:72
SCDetectHelperKeywordRegister
uint16_t SCDetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
Definition: detect-engine-helper.c:103
SMTPTransaction_::mail_from_len
uint16_t mail_from_len
Definition: app-layer-smtp.h:89
detect-smtp.h
detect-engine-content-inspection.h
SMTPString_::len
uint16_t len
Definition: app-layer-smtp.h:67
SMTPState_::helo_len
uint16_t helo_len
Definition: app-layer-smtp.h:150
SCSigTableAppLiteElmt::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
function callback to parse and setup keyword in rule
Definition: detect-engine-helper.h:59
suricata-common.h
SCDetectHelperMultiBufferMpmRegister
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:80
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
detect-engine-buffer.h
SMTPString_
Definition: app-layer-smtp.h:65
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect-engine-inspect-buffer.h:35
detect-parse.h
Signature_
Signature container.
Definition: detect.h:657
SCSigTableAppLiteElmt::flags
uint16_t flags
flags SIGMATCH_*
Definition: detect-engine-helper.h:57
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1611
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:249
SMTPString_::str
uint8_t * str
Definition: app-layer-smtp.h:66
app-layer-smtp.h
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1353