suricata
detect-ssh-hassh.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "threads.h"
26 #include "decode.h"
27 
28 #include "detect.h"
29 #include "detect-parse.h"
30 #include "detect-content.h"
31 
32 #include "detect-engine.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-engine-state.h"
36 
37 #include "flow.h"
38 #include "flow-var.h"
39 #include "flow-util.h"
40 
41 #include "util-debug.h"
42 #include "util-unittest.h"
43 #include "util-unittest-helper.h"
44 #include "stream-tcp.h"
45 #include "app-layer.h"
46 #include "app-layer-parser.h"
47 #include "app-layer-ssh.h"
48 #include "detect-ssh-hassh.h"
49 #include "rust.h"
50 
51 
52 #define KEYWORD_NAME "ssh.hassh"
53 #define KEYWORD_ALIAS "ssh-hassh"
54 #define KEYWORD_DOC "ssh-keywords.html#hassh"
55 #define BUFFER_NAME "ssh.hassh"
56 #define BUFFER_DESC "Ssh Client Fingerprinting For Ssh Clients "
57 static int g_ssh_hassh_buffer_id = 0;
58 
59 
60 static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
61  const DetectEngineTransforms *transforms, Flow *_f,
62  const uint8_t flow_flags, void *txv, const int list_id)
63 {
64 
65  SCEnter();
66 
67  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
68 
69  if (buffer->inspect == NULL) {
70  const uint8_t *hassh = NULL;
71  uint32_t b_len = 0;
72 
73  if (rs_ssh_tx_get_hassh(txv, &hassh, &b_len, flow_flags) != 1)
74  return NULL;
75  if (hassh == NULL || b_len == 0) {
76  SCLogDebug("SSH hassh not set");
77  return NULL;
78  }
79 
80  InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
81  InspectionBufferApplyTransforms(buffer, transforms);
82  }
83 
84  return buffer;
85 }
86 
87 /**
88  * \brief this function setup the hassh modifier keyword used in the rule
89  *
90  * \param de_ctx Pointer to the Detection Engine Context
91  * \param s Pointer to the Signature to which the current keyword belongs
92  * \param str Should hold an empty string always
93  *
94  * \retval 0 On success
95  * \retval -1 On failure
96  * \retval -2 on failure that should be silent after the first
97  */
98 static int DetectSshHasshSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
99 {
100  if (DetectBufferSetActiveList(de_ctx, s, g_ssh_hassh_buffer_id) < 0)
101  return -1;
102 
104  return -1;
105 
106  /* try to enable Hassh */
107  rs_ssh_enable_hassh();
108 
109  /* Check if Hassh is disabled */
110  if (!RunmodeIsUnittests() && !rs_ssh_hassh_is_enabled()) {
112  SCLogError("hassh support is not enabled");
113  }
114  return -2;
115  }
116 
117  return 0;
118 
119 }
120 
121 
122 static bool DetectSshHasshHashValidateCallback(const Signature *s,
123  const char **sigerror)
124 {
125  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
126  if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id)
127  continue;
128  const SigMatch *sm = s->init_data->buffers[x].head;
129  for (; sm != NULL; sm = sm->next) {
130  if (sm->type != DETECT_CONTENT)
131  continue;
132 
133  const DetectContentData *cd = (DetectContentData *)sm->ctx;
134 
135  if (cd->flags & DETECT_CONTENT_NOCASE) {
136  *sigerror = "ssh.hassh should not be used together with "
137  "nocase, since the rule is automatically "
138  "lowercased anyway which makes nocase redundant.";
139  SCLogWarning("rule %u: %s", s->id, *sigerror);
140  }
141 
142  if (cd->content_len != 32) {
143  *sigerror = "Invalid length of the specified ssh.hassh (should "
144  "be 32 characters long). This rule will therefore "
145  "never match.";
146  SCLogWarning("rule %u: %s", s->id, *sigerror);
147  return false;
148  }
149  for (size_t i = 0; i < cd->content_len; ++i) {
150  if (!isxdigit(cd->content[i])) {
151  *sigerror =
152  "Invalid ssh.hassh string (should be string of hexadecimal characters)."
153  "This rule will therefore never match.";
154  SCLogWarning("rule %u: %s", s->id, *sigerror);
155  return false;
156  }
157  }
158  }
159  }
160  return true;
161 }
162 
163 static void DetectSshHasshHashSetupCallback(const DetectEngineCtx *de_ctx,
164  Signature *s)
165 {
166  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
167  if (s->init_data->buffers[x].id != (uint32_t)g_ssh_hassh_buffer_id)
168  continue;
169  SigMatch *sm = s->init_data->buffers[x].head;
170  for (; sm != NULL; sm = sm->next) {
171  if (sm->type != DETECT_CONTENT)
172  continue;
173 
175 
176  uint32_t u;
177  for (u = 0; u < cd->content_len; u++) {
178  if (isupper(cd->content[u])) {
179  cd->content[u] = u8_tolower(cd->content[u]);
180  }
181  }
182 
183  SpmDestroyCtx(cd->spm_ctx);
184  cd->spm_ctx =
186  }
187  }
188 }
189 
190 /**
191  * \brief Registration function for hassh keyword.
192  */
194 {
199  sigmatch_table[DETECT_AL_SSH_HASSH].Setup = DetectSshHasshSetup;
201 
203  GetSshData, ALPROTO_SSH, SshStateBannerDone),
205  SshStateBannerDone, DetectEngineInspectBufferGeneric, GetSshData);
207 
208  g_ssh_hassh_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
209 
210  DetectBufferTypeRegisterSetupCallback(BUFFER_NAME, DetectSshHasshHashSetupCallback);
211  DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectSshHasshHashValidateCallback);
212 }
213 
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
SigTableElmt_::url
const char * url
Definition: detect.h:1309
DetectSignatureSetAppProto
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:1738
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:537
detect-content.h
detect-engine.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1514
BUFFER_NAME
#define BUFFER_NAME
Definition: detect-ssh-hassh.c:55
app-layer-ssh.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1308
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:128
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2155
flow-util.h
SigTableElmt_::name
const char * name
Definition: detect.h:1306
stream-tcp.h
DetectEngineTransforms
Definition: detect.h:408
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:70
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
DetectBufferSetActiveList
int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine.c:1357
DetectSshHasshRegister
void DetectSshHasshRegister(void)
Registration function for hassh keyword.
Definition: detect-ssh-hassh.c:193
InspectionBuffer
Definition: detect.h:373
threads.h
Flow_
Flow data structure.
Definition: flow.h:356
DetectBufferTypeRegisterSetupCallback
void DetectBufferTypeRegisterSetupCallback(const char *name, void(*SetupCallback)(const DetectEngineCtx *, Signature *))
Definition: detect-engine.c:1288
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1300
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:843
BUFFER_DESC
#define BUFFER_DESC
Definition: detect-ssh-hassh.c:56
rust.h
u8_tolower
#define u8_tolower(c)
Definition: suricata-common.h:436
DetectContentData_
Definition: detect-content.h:93
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:34
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1291
detect-engine-prefilter.h
util-unittest.h
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine.c:1501
util-unittest-helper.h
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1094
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:267
decode.h
detect-ssh-hassh.h
util-debug.h
DetectBufferTypeRegisterValidateCallback
void DetectBufferTypeRegisterValidateCallback(const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror))
Definition: detect-engine.c:1306
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
KEYWORD_ALIAS
#define KEYWORD_ALIAS
Definition: detect-ssh-hassh.c:53
DetectEngineThreadCtx_
Definition: detect.h:1095
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:353
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:750
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:151
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:352
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:672
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
KEYWORD_DOC
#define KEYWORD_DOC
Definition: detect-ssh-hassh.c:54
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:251
SigMatchSilentErrorEnabled
bool SigMatchSilentErrorEnabled(const DetectEngineCtx *de_ctx, const enum DetectKeywordId id)
Definition: detect-parse.c:379
SigTableElmt_::alias
const char * alias
Definition: detect.h:1307
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:350
InspectionBufferApplyTransforms
void InspectionBufferApplyTransforms(InspectionBuffer *buffer, const DetectEngineTransforms *transforms)
Definition: detect-engine.c:1712
DETECT_AL_SSH_HASSH
@ DETECT_AL_SSH_HASSH
Definition: detect-engine-register.h:193
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
DetectContentData_::spm_ctx
SpmCtx * spm_ctx
Definition: detect-content.h:111
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:593
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:374
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
InspectionBufferSetup
void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine.c:1596
Signature_::id
uint32_t id
Definition: detect.h:638
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:530
Signature_
Signature container.
Definition: detect.h:603
SigMatch_
a single match condition for a signature
Definition: detect.h:349
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1490
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:240
DetectEngineCtx_::spm_global_thread_ctx
SpmGlobalThreadCtx * spm_global_thread_ctx
Definition: detect.h:897
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1191
flow.h
SpmDestroyCtx
void SpmDestroyCtx(SpmCtx *ctx)
Definition: util-spm.c:183
KEYWORD_NAME
#define KEYWORD_NAME
Definition: detect-ssh-hassh.c:52
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:594
flow-var.h
SpmInitCtx
SpmCtx * SpmInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase, SpmGlobalThreadCtx *global_thread_ctx)
Definition: util-spm.c:173
app-layer.h