suricata
detect-tcp-window.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  *
23  * Implements the window keyword.
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 
29 #include "detect.h"
30 #include "detect-parse.h"
31 
32 #include "detect-tcp-window.h"
33 #include "flow.h"
34 #include "flow-var.h"
35 
36 #include "util-debug.h"
37 #include "util-unittest.h"
38 #include "util-unittest-helper.h"
39 #include "util-byte.h"
40 
41 /**
42  * \brief Regex for parsing our window option
43  */
44 #define PARSE_REGEX "^\\s*([!])?\\s*([0-9]{1,9}+)\\s*$"
45 
46 static DetectParseRegex parse_regex;
47 
48 static int DetectWindowMatch(DetectEngineThreadCtx *, Packet *,
49  const Signature *, const SigMatchCtx *);
50 static int DetectWindowSetup(DetectEngineCtx *, Signature *, const char *);
51 #ifdef UNITTESTS
52 static void DetectWindowRegisterTests(void);
53 #endif
54 void DetectWindowFree(DetectEngineCtx *, void *);
55 
56 /**
57  * \brief Registration function for window: keyword
58  */
60 {
61  sigmatch_table[DETECT_WINDOW].name = "tcp.window";
63  sigmatch_table[DETECT_WINDOW].desc = "check for a specific TCP window size";
64  sigmatch_table[DETECT_WINDOW].url = "/rules/header-keywords.html#window";
65  sigmatch_table[DETECT_WINDOW].Match = DetectWindowMatch;
66  sigmatch_table[DETECT_WINDOW].Setup = DetectWindowSetup;
68 #ifdef UNITTESTS
69  sigmatch_table[DETECT_WINDOW].RegisterTests = DetectWindowRegisterTests;
70 #endif
71  DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
72 }
73 
74 /**
75  * \brief This function is used to match the window size on a packet
76  *
77  * \param t pointer to thread vars
78  * \param det_ctx pointer to the pattern matcher thread
79  * \param p pointer to the current packet
80  * \param m pointer to the sigmatch that we will cast into DetectWindowData
81  *
82  * \retval 0 no match
83  * \retval 1 match
84  */
85 static int DetectWindowMatch(DetectEngineThreadCtx *det_ctx, Packet *p,
86  const Signature *s, const SigMatchCtx *ctx)
87 {
88  const DetectWindowData *wd = (const DetectWindowData *)ctx;
89 
90  if ( !(PKT_IS_TCP(p)) || wd == NULL || PKT_IS_PSEUDOPKT(p)) {
91  return 0;
92  }
93 
94  if ( (!wd->negated && wd->size == TCP_GET_WINDOW(p)) || (wd->negated && wd->size != TCP_GET_WINDOW(p))) {
95  return 1;
96  }
97 
98  return 0;
99 }
100 
101 /**
102  * \brief This function is used to parse window options passed via window: keyword
103  *
104  * \param de_ctx Pointer to the detection engine context
105  * \param windowstr Pointer to the user provided window options (negation! and size)
106  *
107  * \retval wd pointer to DetectWindowData on success
108  * \retval NULL on failure
109  */
110 static DetectWindowData *DetectWindowParse(DetectEngineCtx *de_ctx, const char *windowstr)
111 {
112  DetectWindowData *wd = NULL;
113  int ret = 0, res = 0;
114  size_t pcre2len;
115 
116  ret = DetectParsePcreExec(&parse_regex, windowstr, 0, 0);
117  if (ret < 1 || ret > 3) {
118  SCLogError("pcre_exec parse error, ret %" PRId32 ", string %s", ret, windowstr);
119  goto error;
120  }
121 
122  wd = SCMalloc(sizeof(DetectWindowData));
123  if (unlikely(wd == NULL))
124  goto error;
125 
126  if (ret > 1) {
127  char copy_str[128] = "";
128  pcre2len = sizeof(copy_str);
129  res = SC_Pcre2SubstringCopy(parse_regex.match, 1, (PCRE2_UCHAR8 *)copy_str, &pcre2len);
130  if (res < 0) {
131  SCLogError("pcre2_substring_copy_bynumber failed");
132  goto error;
133  }
134 
135  /* Detect if it's negated */
136  if (copy_str[0] == '!')
137  wd->negated = 1;
138  else
139  wd->negated = 0;
140 
141  if (ret > 2) {
142  pcre2len = sizeof(copy_str);
143  res = pcre2_substring_copy_bynumber(
144  parse_regex.match, 2, (PCRE2_UCHAR8 *)copy_str, &pcre2len);
145  if (res < 0) {
146  SCLogError("pcre2_substring_copy_bynumber failed");
147  goto error;
148  }
149 
150  /* Get the window size if it's a valid value (in packets, we
151  * should alert if this doesn't happend from decode) */
152  if (StringParseUint16(&wd->size, 10, 0, copy_str) < 0) {
153  goto error;
154  }
155  }
156  }
157 
158  return wd;
159 
160 error:
161  if (wd != NULL)
163  return NULL;
164 
165 }
166 
167 /**
168  * \brief this function is used to add the parsed window sizedata into the current signature
169  *
170  * \param de_ctx pointer to the Detection Engine Context
171  * \param s pointer to the Current Signature
172  * \param windowstr pointer to the user provided window options
173  *
174  * \retval 0 on Success
175  * \retval -1 on Failure
176  */
177 static int DetectWindowSetup (DetectEngineCtx *de_ctx, Signature *s, const char *windowstr)
178 {
179  DetectWindowData *wd = NULL;
180  SigMatch *sm = NULL;
181 
182  wd = DetectWindowParse(de_ctx, windowstr);
183  if (wd == NULL) goto error;
184 
185  /* Okay so far so good, lets get this into a SigMatch
186  * and put it in the Signature. */
187  sm = SigMatchAlloc();
188  if (sm == NULL)
189  goto error;
190 
191  sm->type = DETECT_WINDOW;
192  sm->ctx = (SigMatchCtx *)wd;
193 
196 
197  return 0;
198 
199 error:
200  if (wd != NULL) DetectWindowFree(de_ctx, wd);
201  if (sm != NULL) SCFree(sm);
202  return -1;
203 
204 }
205 
206 /**
207  * \brief this function will free memory associated with DetectWindowData
208  *
209  * \param wd pointer to DetectWindowData
210  */
212 {
213  DetectWindowData *wd = (DetectWindowData *)ptr;
214  SCFree(wd);
215 }
216 
217 #ifdef UNITTESTS /* UNITTESTS */
218 
219 /**
220  * \test DetectWindowTestParse01 is a test to make sure that we set the size correctly
221  * when given valid window opt
222  */
223 static int DetectWindowTestParse01 (void)
224 {
225  int result = 0;
226  DetectWindowData *wd = NULL;
227  wd = DetectWindowParse(NULL, "35402");
228  if (wd != NULL &&wd->size==35402) {
229  DetectWindowFree(NULL, wd);
230  result = 1;
231  }
232 
233  return result;
234 }
235 
236 /**
237  * \test DetectWindowTestParse02 is a test for setting the window opt negated
238  */
239 static int DetectWindowTestParse02 (void)
240 {
241  int result = 0;
242  DetectWindowData *wd = NULL;
243  wd = DetectWindowParse(NULL, "!35402");
244  if (wd != NULL) {
245  if (wd->negated == 1 && wd->size==35402) {
246  result = 1;
247  } else {
248  printf("expected wd->negated=1 and wd->size=35402\n");
249  }
250  DetectWindowFree(NULL, wd);
251  }
252 
253  return result;
254 }
255 
256 /**
257  * \test DetectWindowTestParse03 is a test to check for an empty value
258  */
259 static int DetectWindowTestParse03 (void)
260 {
261  int result = 0;
262  DetectWindowData *wd = NULL;
263  wd = DetectWindowParse(NULL, "");
264  if (wd == NULL) {
265  result = 1;
266  } else {
267  printf("expected a NULL pointer (It was an empty string)\n");
268  }
269  DetectWindowFree(NULL, wd);
270 
271  return result;
272 }
273 
274 /**
275  * \test DetectWindowTestParse03 is a test to check for a big value
276  */
277 static int DetectWindowTestParse04 (void)
278 {
279  int result = 0;
280  DetectWindowData *wd = NULL;
281  wd = DetectWindowParse(NULL, "1235402");
282  if (wd != NULL) {
283  printf("expected a NULL pointer (It was exceeding the MAX window size)\n");
284  DetectWindowFree(NULL, wd);
285  }else
286  result=1;
287 
288  return result;
289 }
290 
291 /**
292  * \test DetectWindowTestPacket01 is a test to check window with constructed packets
293  */
294 static int DetectWindowTestPacket01 (void)
295 {
296  int result = 0;
297  uint8_t *buf = (uint8_t *)"Hi all!";
298  uint16_t buflen = strlen((char *)buf);
299  Packet *p[3];
300  p[0] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
301  p[1] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_TCP);
302  p[2] = UTHBuildPacket((uint8_t *)buf, buflen, IPPROTO_ICMP);
303 
304  if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
305  goto end;
306 
307  /* TCP wwindow = 40 */
308  p[0]->tcph->th_win = htons(40);
309 
310  /* TCP window = 41 */
311  p[1]->tcph->th_win = htons(41);
312 
313  const char *sigs[2];
314  sigs[0]= "alert tcp any any -> any any (msg:\"Testing window 1\"; window:40; sid:1;)";
315  sigs[1]= "alert tcp any any -> any any (msg:\"Testing window 2\"; window:41; sid:2;)";
316 
317  uint32_t sid[2] = {1, 2};
318 
319  uint32_t results[3][2] = {
320  /* packet 0 match sid 1 but should not match sid 2 */
321  {1, 0},
322  /* packet 1 should not match */
323  {0, 1},
324  /* packet 2 should not match */
325  {0, 0} };
326  result = UTHGenericTest(p, 3, sigs, sid, (uint32_t *) results, 2);
327 
328  UTHFreePackets(p, 3);
329 end:
330  return result;
331 }
332 
333 /**
334  * \brief this function registers unit tests for DetectWindow
335  */
336 void DetectWindowRegisterTests(void)
337 {
338  UtRegisterTest("DetectWindowTestParse01", DetectWindowTestParse01);
339  UtRegisterTest("DetectWindowTestParse02", DetectWindowTestParse02);
340  UtRegisterTest("DetectWindowTestParse03", DetectWindowTestParse03);
341  UtRegisterTest("DetectWindowTestParse04", DetectWindowTestParse04);
342  UtRegisterTest("DetectWindowTestPacket01", DetectWindowTestPacket01);
343 }
344 #endif /* UNITTESTS */
util-byte.h
DetectParseRegex::match
pcre2_match_data * match
Definition: detect-parse.h:47
SigTableElmt_::url
const char * url
Definition: detect.h:1243
SigTableElmt_::desc
const char * desc
Definition: detect.h:1242
DetectParsePcreExec
int DetectParsePcreExec(DetectParseRegex *parse_regex, const char *str, int start_offset, int options)
Definition: detect-parse.c:2477
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1230
DetectParseRegex
Definition: detect-parse.h:44
SigTableElmt_::name
const char * name
Definition: detect.h:1240
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1059
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
results
struct DetectRfbSecresult_ results[]
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:787
StringParseUint16
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:337
DetectWindowFree
void DetectWindowFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectWindowData
Definition: detect-tcp-window.c:211
UTHBuildPacket
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
Definition: util-unittest-helper.c:337
DetectWindowData_
Definition: detect-tcp-window.h:24
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1225
util-unittest.h
util-unittest-helper.h
TCP_GET_WINDOW
#define TCP_GET_WINDOW(p)
Definition: decode-tcp.h:116
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:247
decode.h
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectWindowRegister
void DetectWindowRegister(void)
Registration function for window: keyword.
Definition: detect-tcp-window.c:59
DetectEngineThreadCtx_
Definition: detect.h:1027
DetectSetupParseRegexes
void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
Definition: detect-parse.c:2598
DetectWindowData_::negated
uint8_t negated
Definition: detect-tcp-window.h:25
detect.h
detect-tcp-window.h
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:79
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:318
Signature_::flags
uint32_t flags
Definition: detect.h:543
Packet_
Definition: decode.h:428
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1208
PARSE_REGEX
#define PARSE_REGEX
Regex for parsing our window option.
Definition: detect-tcp-window.c:44
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:241
DetectWindowData_::size
uint16_t size
Definition: detect-tcp-window.h:26
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:310
SigTableElmt_::alias
const char * alias
Definition: detect.h:1241
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:316
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:553
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
UTHGenericTest
int UTHGenericTest(Packet **pkt, int numpkts, const char *sigs[], uint32_t sids[], uint32_t *results, int numsigs)
UTHGenericTest: function that perfom a generic check taking care of as maximum common unittest elemen...
Definition: util-unittest-helper.c:604
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
detect-parse.h
Signature_
Signature container.
Definition: detect.h:542
SigMatch_
a single match condition for a signature
Definition: detect.h:315
SC_Pcre2SubstringCopy
int SC_Pcre2SubstringCopy(pcre2_match_data *match_data, uint32_t number, PCRE2_UCHAR *buffer, PCRE2_SIZE *bufflen)
Definition: detect-parse.c:2574
DETECT_WINDOW
@ DETECT_WINDOW
Definition: detect-engine-register.h:38
flow.h
flow-var.h
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:356
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1232
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:217
UTHFreePackets
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.
Definition: util-unittest-helper.c:468