suricata
detect-ssh-hassh.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "threads.h"
26 #include "decode.h"
27 
28 #include "detect.h"
29 #include "detect-parse.h"
30 #include "detect-content.h"
31 
32 #include "detect-engine.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-engine-state.h"
36 
37 #include "flow.h"
38 #include "flow-var.h"
39 #include "flow-util.h"
40 
41 #include "util-debug.h"
42 #include "util-unittest.h"
43 #include "util-unittest-helper.h"
44 #include "stream-tcp.h"
45 #include "app-layer.h"
46 #include "app-layer-parser.h"
47 #include "app-layer-ssh.h"
48 #include "detect-ssh-hassh.h"
49 #include "rust.h"
50 
51 
52 #define KEYWORD_NAME "ssh.hassh"
53 #define KEYWORD_ALIAS "ssh-hassh"
54 #define KEYWORD_DOC "ssh-keywords.html#hassh"
55 #define BUFFER_NAME "ssh.hassh"
56 #define BUFFER_DESC "Ssh Client Fingerprinting For Ssh Clients "
57 static int g_ssh_hassh_buffer_id = 0;
58 
59 
60 static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
61  const DetectEngineTransforms *transforms, Flow *_f,
62  const uint8_t flow_flags, void *txv, const int list_id)
63 {
64 
65  SCEnter();
66 
67  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
68 
69  if (buffer->inspect == NULL) {
70  const uint8_t *hassh = NULL;
71  uint32_t b_len = 0;
72 
73  if (SCSshTxGetHassh(txv, &hassh, &b_len, flow_flags) != 1)
74  return NULL;
75  if (hassh == NULL || b_len == 0) {
76  SCLogDebug("SSH hassh not set");
77  return NULL;
78  }
79 
80  InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, hassh, b_len, transforms);
81  }
82 
83  return buffer;
84 }
85 
86 /**
87  * \brief this function setup the hassh modifier keyword used in the rule
88  *
89  * \param de_ctx Pointer to the Detection Engine Context
90  * \param s Pointer to the Signature to which the current keyword belongs
91  * \param str Should hold an empty string always
92  *
93  * \retval 0 On success
94  * \retval -1 On failure
95  * \retval -2 on failure that should be silent after the first
96  */
97 static int DetectSshHasshSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
98 {
99  if (DetectBufferSetActiveList(de_ctx, s, g_ssh_hassh_buffer_id) < 0)
100  return -1;
101 
103  return -1;
104 
105  /* try to enable Hassh */
106  SCSshEnableHassh();
107 
108  /* Check if Hassh is disabled */
109  if (!RunmodeIsUnittests() && !SCSshHasshIsEnabled()) {
111  SCLogError("hassh support is not enabled");
112  }
113  return -2;
114  }
115 
116  return 0;
117 
118 }
119 
120 
121 static bool DetectSshHasshHashValidateCallback(const Signature *s,
122  const char **sigerror)
123 {
124  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
125  if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id)
126  continue;
127  const SigMatch *sm = s->init_data->buffers[x].head;
128  for (; sm != NULL; sm = sm->next) {
129  if (sm->type != DETECT_CONTENT)
130  continue;
131 
132  const DetectContentData *cd = (DetectContentData *)sm->ctx;
133 
134  if (cd->flags & DETECT_CONTENT_NOCASE) {
135  *sigerror = "ssh.hassh should not be used together with "
136  "nocase, since the rule is automatically "
137  "lowercased anyway which makes nocase redundant.";
138  SCLogWarning("rule %u: %s", s->id, *sigerror);
139  }
140 
141  if (cd->content_len != 32) {
142  *sigerror = "Invalid length of the specified ssh.hassh (should "
143  "be 32 characters long). This rule will therefore "
144  "never match.";
145  SCLogWarning("rule %u: %s", s->id, *sigerror);
146  return false;
147  }
148  for (size_t i = 0; i < cd->content_len; ++i) {
149  if (!isxdigit(cd->content[i])) {
150  *sigerror =
151  "Invalid ssh.hassh string (should be string of hexadecimal characters)."
152  "This rule will therefore never match.";
153  SCLogWarning("rule %u: %s", s->id, *sigerror);
154  return false;
155  }
156  }
157  }
158  }
159  return true;
160 }
161 
162 static void DetectSshHasshHashSetupCallback(const DetectEngineCtx *de_ctx,
163  Signature *s)
164 {
165  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
166  if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id)
167  continue;
168  SigMatch *sm = s->init_data->buffers[x].head;
169  for (; sm != NULL; sm = sm->next) {
170  if (sm->type != DETECT_CONTENT)
171  continue;
172 
174 
175  uint32_t u;
176  for (u = 0; u < cd->content_len; u++) {
177  if (isupper(cd->content[u])) {
178  cd->content[u] = u8_tolower(cd->content[u]);
179  }
180  }
181 
182  SpmDestroyCtx(cd->spm_ctx);
183  cd->spm_ctx =
185  }
186  }
187 }
188 
189 /**
190  * \brief Registration function for hassh keyword.
191  */
193 {
196  sigmatch_table[DETECT_SSH_HASSH].desc = BUFFER_NAME " sticky buffer";
198  sigmatch_table[DETECT_SSH_HASSH].Setup = DetectSshHasshSetup;
200 
202  GetSshData, ALPROTO_SSH, SshStateBannerDone),
204  SshStateBannerDone, DetectEngineInspectBufferGeneric, GetSshData);
206 
207  g_ssh_hassh_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
208 
209  DetectBufferTypeRegisterSetupCallback(BUFFER_NAME, DetectSshHasshHashSetupCallback);
210  DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectSshHasshHashValidateCallback);
211 }
212 
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SigTableElmt_::url
const char * url
Definition: detect.h:1329
DetectSignatureSetAppProto
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:1870
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:538
detect-content.h
detect-engine.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1534
BUFFER_NAME
#define BUFFER_NAME
Definition: detect-ssh-hassh.c:55
app-layer-ssh.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1328
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:153
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2195
flow-util.h
SigTableElmt_::name
const char * name
Definition: detect.h:1326
InspectionBufferSetupAndApplyTransforms
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
Definition: detect-engine.c:1662
stream-tcp.h
DetectEngineTransforms
Definition: detect.h:409
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:71
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
DetectBufferSetActiveList
int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine.c:1377
DetectSshHasshRegister
void DetectSshHasshRegister(void)
Registration function for hassh keyword.
Definition: detect-ssh-hassh.c:192
InspectionBuffer
Definition: detect.h:374
threads.h
Flow_
Flow data structure.
Definition: flow.h:354
DetectBufferTypeRegisterSetupCallback
void DetectBufferTypeRegisterSetupCallback(const char *name, void(*SetupCallback)(const DetectEngineCtx *, Signature *))
Definition: detect-engine.c:1308
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1320
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:860
BUFFER_DESC
#define BUFFER_DESC
Definition: detect-ssh-hassh.c:56
rust.h
u8_tolower
#define u8_tolower(c)
Definition: suricata-common.h:445
DetectContentData_
Definition: detect-content.h:93
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:40
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1311
detect-engine-prefilter.h
util-unittest.h
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine.c:1521
util-unittest-helper.h
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1114
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:269
decode.h
detect-ssh-hassh.h
util-debug.h
DetectBufferTypeRegisterValidateCallback
void DetectBufferTypeRegisterValidateCallback(const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror))
Definition: detect-engine.c:1326
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
KEYWORD_ALIAS
#define KEYWORD_ALIAS
Definition: detect-ssh-hassh.c:53
DetectEngineThreadCtx_
Definition: detect.h:1116
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:354
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:761
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:151
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:353
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:688
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
KEYWORD_DOC
#define KEYWORD_DOC
Definition: detect-ssh-hassh.c:54
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:255
SigMatchSilentErrorEnabled
bool SigMatchSilentErrorEnabled(const DetectEngineCtx *de_ctx, const enum DetectKeywordId id)
Definition: detect-parse.c:404
SigTableElmt_::alias
const char * alias
Definition: detect.h:1327
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:351
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectContentData_::spm_ctx
SpmCtx * spm_ctx
Definition: detect-content.h:111
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:600
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:375
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
Signature_::id
uint32_t id
Definition: detect.h:654
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:531
Signature_
Signature container.
Definition: detect.h:618
SigMatch_
a single match condition for a signature
Definition: detect.h:350
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1510
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:245
DetectEngineCtx_::spm_global_thread_ctx
SpmGlobalThreadCtx * spm_global_thread_ctx
Definition: detect.h:918
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1211
flow.h
SpmDestroyCtx
void SpmDestroyCtx(SpmCtx *ctx)
Definition: util-spm.c:183
DETECT_SSH_HASSH
@ DETECT_SSH_HASSH
Definition: detect-engine-register.h:196
KEYWORD_NAME
#define KEYWORD_NAME
Definition: detect-ssh-hassh.c:52
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:601
flow-var.h
SpmInitCtx
SpmCtx * SpmInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *global_thread_ctx)
Definition: util-spm.c:173
app-layer.h