suricata
detect-tcp-ack.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Brian Rectanus <brectanu@gmail.com>
22  * \author Victor Julien <victor@inliniac.net>
23  *
24  * Implements the "ack" keyword.
25  */
26 
27 #include "suricata-common.h"
28 #include "decode.h"
29 #include "detect.h"
30 
31 #include "detect-parse.h"
32 #include "detect-engine.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-engine-prefilter.h"
35 #include "detect-engine-prefilter-common.h"
36 #include "detect-engine-build.h"
37 #include "detect-engine-uint.h"
38 
39 #include "detect-tcp-ack.h"
40 
41 #include "util-byte.h"
42 #include "util-unittest-helper.h"
43 #include "util-debug.h"
44 
45 /* prototypes */
46 static int DetectAckSetup(DetectEngineCtx *, Signature *, const char *);
47 static int DetectAckMatch(DetectEngineThreadCtx *,
48  Packet *, const Signature *, const SigMatchCtx *);
49 #ifdef UNITTESTS
50 static void DetectAckRegisterTests(void);
51 #endif
52 static void DetectAckFree(DetectEngineCtx *, void *);
53 static int PrefilterSetupTcpAck(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
54 static bool PrefilterTcpAckIsPrefilterable(const Signature *s);
55 
56 void DetectAckRegister(void)
57 {
58  sigmatch_table[DETECT_ACK].name = "tcp.ack";
59  sigmatch_table[DETECT_ACK].alias = "ack";
60  sigmatch_table[DETECT_ACK].desc = "check for a specific TCP acknowledgement number";
61  sigmatch_table[DETECT_ACK].url = "/rules/header-keywords.html#ack";
62  sigmatch_table[DETECT_ACK].Match = DetectAckMatch;
63  sigmatch_table[DETECT_ACK].Setup = DetectAckSetup;
64  sigmatch_table[DETECT_ACK].Free = DetectAckFree;
65  sigmatch_table[DETECT_ACK].flags = SIGMATCH_INFO_UINT32;
66 
67  sigmatch_table[DETECT_ACK].SupportsPrefilter = PrefilterTcpAckIsPrefilterable;
68  sigmatch_table[DETECT_ACK].SetupPrefilter = PrefilterSetupTcpAck;
69 #ifdef UNITTESTS
70  sigmatch_table[DETECT_ACK].RegisterTests = DetectAckRegisterTests;
71 #endif
72 }
73 
74 /**
75  * \internal
76  * \brief This function is used to match packets with a given Ack number
77  *
78  * \param t pointer to thread vars
79  * \param det_ctx pointer to the pattern matcher thread
80  * \param p pointer to the current packet
81  * \param m pointer to the sigmatch that we will cast into DetectAckData
82  *
83  * \retval 0 no match
84  * \retval 1 match
85  */
86 static int DetectAckMatch(DetectEngineThreadCtx *det_ctx,
87  Packet *p, const Signature *s, const SigMatchCtx *ctx)
88 {
89  DEBUG_VALIDATE_BUG_ON(PKT_IS_PSEUDOPKT(p));
90  const DetectU32Data *data = (const DetectU32Data *)ctx;
91 
92  /* This is only needed on TCP packets */
93  if (!(PacketIsTCP(p))) {
94  return 0;
95  }
96 
97  return DetectU32Match(TCP_GET_RAW_ACK(PacketGetTCP(p)), data);
98 }
99 
100 /**
101  * \internal
102  * \brief this function is used to add the ack option into the signature
103  *
104  * \param de_ctx pointer to the Detection Engine Context
105  * \param s pointer to the Current Signature
106  * \param m pointer to the Current SigMatch
107  * \param optstr pointer to the user provided options
108  *
109  * \retval 0 on Success
110  * \retval -1 on Failure
111  */
112 static int DetectAckSetup(DetectEngineCtx *de_ctx, Signature *s, const char *optstr)
113 {
114  DetectU32Data *data = SCDetectU32Parse(optstr);
115  if (data == NULL)
116  return -1;
117 
118  if (SCSigMatchAppendSMToList(
119  de_ctx, s, DETECT_ACK, (SigMatchCtx *)data, DETECT_SM_LIST_MATCH) == NULL) {
120  DetectAckFree(de_ctx, data);
121  return -1;
122  }
123  s->flags |= SIG_FLAG_REQUIRE_PACKET;
124  return 0;
125 }
126 
127 /**
128  * \internal
129  * \brief this function will free memory associated with ack option
130  *
131  * \param data pointer to ack configuration data
132  */
133 static void DetectAckFree(DetectEngineCtx *de_ctx, void *ptr)
134 {
135  SCDetectU32Free(ptr);
136 }
137 
138 /* prefilter code */
139 
140 static void
141 PrefilterPacketAckMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
142 {
143  DEBUG_VALIDATE_BUG_ON(PKT_IS_PSEUDOPKT(p));
144  const PrefilterPacketHeaderCtx *ctx = pectx;
145 
146  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
147  return;
148 
149  if (p->proto == IPPROTO_TCP && PacketIsTCP(p)) {
150  DetectU32Data du32;
151  du32.mode = ctx->v1.u8[0];
152  du32.arg1 = ctx->v1.u32[1];
153  du32.arg2 = ctx->v1.u32[2];
154  if (DetectU32Match(TCP_GET_RAW_ACK(PacketGetTCP(p)), &du32)) {
155  SCLogDebug("packet matches TCP ack %u", ctx->v1.u32[0]);
156  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
157  }
158  }
159 }
160 
161 static int PrefilterSetupTcpAck(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
162 {
163  return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_ACK, SIG_MASK_REQUIRE_REAL_PKT,
164  PrefilterPacketU32Set, PrefilterPacketU32Compare, PrefilterPacketAckMatch);
165 }
166 
167 static bool PrefilterTcpAckIsPrefilterable(const Signature *s)
168 {
169  return PrefilterIsPrefilterableById(s, DETECT_ACK);
170 }
171 
172 #ifdef UNITTESTS
173 #include "detect-engine-alert.h"
174 /**
175  * \internal
176  * \brief This test tests sameip success and failure.
177  */
178 static int DetectAckSigTest01(void)
179 {
180  ThreadVars th_v;
181  memset(&th_v, 0, sizeof(th_v));
182  StatsThreadInit(&th_v.stats);
183  DetectEngineThreadCtx *det_ctx = NULL;
184 
185  /* TCP w/ack=42 */
186  Packet *p1 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
187  p1->l4.hdrs.tcph->th_ack = htonl(42);
188 
189  /* TCP w/ack=100 */
190  Packet *p2 = UTHBuildPacket(NULL, 0, IPPROTO_TCP);
191  p2->l4.hdrs.tcph->th_ack = htonl(100);
192 
193  /* ICMP */
194  Packet *p3 = UTHBuildPacket(NULL, 0, IPPROTO_ICMP);
195 
196  DetectEngineCtx *de_ctx = DetectEngineCtxInit();
197  FAIL_IF_NULL(de_ctx);
198  de_ctx->flags |= DE_QUIET;
199 
200  /* These three are crammed in here as there is no Parse */
201  Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
202  "(msg:\"Testing ack\";ack:foo;sid:1;)");
203  FAIL_IF_NOT_NULL(s);
204  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
205  "(msg:\"Testing ack\";ack:9999999999;sid:1;)");
206  FAIL_IF_NOT_NULL(s);
207  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
208  "(msg:\"Testing ack\";ack:-100;sid:1;)");
209  FAIL_IF_NOT_NULL(s);
210 
211  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
212  "(msg:\"Testing ack\";ack:41;sid:1;)");
213  FAIL_IF_NULL(s);
214  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
215  "(msg:\"Testing ack\";ack:42;sid:2;)");
216  FAIL_IF_NULL(s);
217 
218  SigGroupBuild(de_ctx);
219  DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
220 
221  SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
222  FAIL_IF(PacketAlertCheck(p1, 1));
223  FAIL_IF_NOT(PacketAlertCheck(p1, 2));
224 
225  SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
226  FAIL_IF(PacketAlertCheck(p2, 1));
227  FAIL_IF(PacketAlertCheck(p2, 2));
228 
229  SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
230  FAIL_IF(PacketAlertCheck(p3, 1));
231  FAIL_IF(PacketAlertCheck(p3, 2));
232 
233  UTHFreePacket(p1);
234  UTHFreePacket(p2);
235  UTHFreePacket(p3);
236 
237  DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
238  DetectEngineCtxFree(de_ctx);
239  StatsThreadCleanup(&th_v.stats);
240  PASS;
241 }
242 
243 /**
244  * \internal
245  * \brief This function registers unit tests for DetectAck
246  */
247 static void DetectAckRegisterTests(void)
248 {
249  UtRegisterTest("DetectAckSigTest01", DetectAckSigTest01);
250 }
251 #endif /* UNITTESTS */
util-byte.h
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1545
Packet_::proto
uint8_t proto
Definition: decode.h:538
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SIG_MASK_REQUIRE_REAL_PKT
#define SIG_MASK_REQUIRE_REAL_PKT
Definition: detect.h:320
DetectU32Match
int DetectU32Match(const uint32_t parg, const DetectUintData_u32 *du32)
Definition: detect-engine-uint.c:31
SigTableElmt_::desc
const char * desc
Definition: detect.h:1544
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:78
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1529
SigTableElmt_::name
const char * name
Definition: detect.h:1542
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1364
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1730
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:101
SigTableElmt_::flags
uint32_t flags
Definition: detect.h:1533
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
PrefilterPacketU32Set
void PrefilterPacketU32Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:51
PacketAlertCheck
int PacketAlertCheck(Packet *p, uint32_t sid)
Check if a certain sid alerted, this is used in the test functions.
Definition: detect-engine-alert.c:144
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1429
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:995
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2912
DE_QUIET
#define DE_QUIET
Definition: detect.h:334
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:241
SigMatchSignatures
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
Definition: detect.c:3305
p
Packet * p
Definition: fuzz_dataset.c:30
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:3965
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1524
detect-engine-prefilter.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TCPHdr_::th_ack
uint32_t th_ack
Definition: decode-tcp.h:153
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1527
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
DetectEngineThreadCtx_
Definition: detect.h:1316
detect-engine-mpm.h
SCSigMatchAppendSMToList
SigMatch * SCSigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:424
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DetectEngineThreadCtxInit
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Definition: detect-engine.c:3660
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:118
DETECT_ACK
@ DETECT_ACK
Definition: detect-engine-register.h:36
Signature_::flags
uint32_t flags
Definition: detect.h:693
Packet_
Definition: decode.h:516
detect-engine-build.h
detect-engine-alert.h
Packet_::l4
struct PacketL4 l4
Definition: decode.h:616
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, SignatureMask mask, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:470
PrefilterPacketU32Compare
bool PrefilterPacketU32Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:60
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1504
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:2300
StatsThreadInit
void StatsThreadInit(StatsThreadContext *stats)
Definition: counters.c:1332
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:355
DetectAckRegister
void DetectAckRegister(void)
Registration function for ack: keyword.
Definition: detect-tcp-ack.c:56
th_v
ThreadVars * th_v
Definition: fuzz_dataset.c:29
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SigTableElmt_::alias
const char * alias
Definition: detect.h:1543
suricata-common.h
DetectU32Data
DetectUintData_u32 DetectU32Data
Definition: detect-engine-uint.h:41
DetectEngineThreadCtxDeinit
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
Definition: detect-engine.c:3905
PacketL4::L4Hdrs::tcph
TCPHdr * tcph
Definition: decode.h:481
detect-tcp-ack.h
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1526
UTHFreePacket
void UTHFreePacket(Packet *p)
UTHFreePacket: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:470
SIGMATCH_INFO_UINT32
#define SIGMATCH_INFO_UINT32
Definition: detect-engine-register.h:346
detect-parse.h
Signature_
Signature container.
Definition: detect.h:692
PacketL4::hdrs
union PacketL4::L4Hdrs hdrs
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2873
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:997
detect-engine-prefilter-common.h
TCP_GET_RAW_ACK
#define TCP_GET_RAW_ACK(tcph)
Definition: decode-tcp.h:81
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:120
StatsThreadCleanup
void StatsThreadCleanup(StatsThreadContext *stats)
Definition: counters.c:1428
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1531
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:257