suricata
detect-tcpmss.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  */
24 
25 #include "suricata-common.h"
26 
27 #include "detect.h"
28 #include "detect-parse.h"
30 #include "detect-engine-uint.h"
31 #include "util-byte.h"
32 
33 #include "detect-tcpmss.h"
34 
35 
36 /* prototypes */
37 static int DetectTcpmssMatch (DetectEngineThreadCtx *, Packet *,
38  const Signature *, const SigMatchCtx *);
39 static int DetectTcpmssSetup (DetectEngineCtx *, Signature *, const char *);
40 void DetectTcpmssFree (DetectEngineCtx *, void *);
41 #ifdef UNITTESTS
43 #endif
44 static int PrefilterSetupTcpmss(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
45 static bool PrefilterTcpmssIsPrefilterable(const Signature *s);
46 
47 /**
48  * \brief Registration function for tcpmss: keyword
49  */
50 
52 {
53  sigmatch_table[DETECT_TCPMSS].name = "tcp.mss";
54  sigmatch_table[DETECT_TCPMSS].desc = "match on TCP MSS option field";
55  sigmatch_table[DETECT_TCPMSS].url = "/rules/header-keywords.html#tcpmss";
56  sigmatch_table[DETECT_TCPMSS].Match = DetectTcpmssMatch;
57  sigmatch_table[DETECT_TCPMSS].Setup = DetectTcpmssSetup;
59  sigmatch_table[DETECT_TCPMSS].SupportsPrefilter = PrefilterTcpmssIsPrefilterable;
60  sigmatch_table[DETECT_TCPMSS].SetupPrefilter = PrefilterSetupTcpmss;
61 
62  return;
63 }
64 
65 /**
66  * \brief This function is used to match TCPMSS rule option on a packet with those passed via
67  * tcpmss:
68  *
69  * \param det_ctx pointer to the pattern matcher thread
70  * \param p pointer to the current packet
71  * \param ctx pointer to the sigmatch that we will cast into DetectU16Data
72  *
73  * \retval 0 no match
74  * \retval 1 match
75  */
76 static int DetectTcpmssMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
77  const Signature *s, const SigMatchCtx *ctx)
78 {
79 
80  if (!(PKT_IS_TCP(p)) || PKT_IS_PSEUDOPKT(p))
81  return 0;
82 
83  if (!(TCP_HAS_MSS(p)))
84  return 0;
85 
86  uint16_t ptcpmss = TCP_GET_MSS(p);
87 
88  const DetectU16Data *tcpmssd = (const DetectU16Data *)ctx;
89  return DetectU16Match(ptcpmss, tcpmssd);
90 }
91 
92 /**
93  * \brief this function is used to attach the parsed tcpmss data into the current signature
94  *
95  * \param de_ctx pointer to the Detection Engine Context
96  * \param s pointer to the Current Signature
97  * \param tcpmssstr pointer to the user provided tcpmss options
98  *
99  * \retval 0 on Success
100  * \retval -1 on Failure
101  */
102 static int DetectTcpmssSetup (DetectEngineCtx *de_ctx, Signature *s, const char *tcpmssstr)
103 {
104  DetectU16Data *tcpmssd = DetectU16Parse(tcpmssstr);
105  if (tcpmssd == NULL)
106  return -1;
107 
108  SigMatch *sm = SigMatchAlloc();
109  if (sm == NULL) {
110  DetectTcpmssFree(de_ctx, tcpmssd);
111  return -1;
112  }
113 
114  sm->type = DETECT_TCPMSS;
115  sm->ctx = (SigMatchCtx *)tcpmssd;
116 
119 
120  return 0;
121 }
122 
123 /**
124  * \brief this function will free memory associated with DetectU16Data
125  *
126  * \param ptr pointer to DetectU16Data
127  */
129 {
130  rs_detect_u16_free(ptr);
131 }
132 
133 /* prefilter code */
134 
135 static void
136 PrefilterPacketTcpmssMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
137 {
138  if (!(PKT_IS_TCP(p)) || PKT_IS_PSEUDOPKT(p))
139  return;
140 
141  if (!(TCP_HAS_MSS(p)))
142  return;
143 
144  uint16_t ptcpmss = TCP_GET_MSS(p);
145 
146  /* during setup Suricata will automatically see if there is another
147  * check that can be added: alproto, sport or dport */
148  const PrefilterPacketHeaderCtx *ctx = pectx;
149  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
150  return;
151 
152  DetectU16Data du16;
153  du16.mode = ctx->v1.u8[0];
154  du16.arg1 = ctx->v1.u16[1];
155  du16.arg2 = ctx->v1.u16[2];
156  /* if we match, add all the sigs that use this prefilter. This means
157  * that these will be inspected further */
158  if (DetectU16Match(ptcpmss, &du16)) {
159  SCLogDebug("packet matches tcpmss/hl %u", ptcpmss);
160  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
161  }
162 }
163 
164 static int PrefilterSetupTcpmss(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
165 {
167  PrefilterPacketU16Compare, PrefilterPacketTcpmssMatch);
168 }
169 
170 static bool PrefilterTcpmssIsPrefilterable(const Signature *s)
171 {
172  const SigMatch *sm;
173  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
174  switch (sm->type) {
175  case DETECT_TCPMSS:
176  return true;
177  }
178  }
179  return false;
180 }
util-byte.h
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1248
PrefilterPacketU16Set
void PrefilterPacketU16Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:126
SigTableElmt_::desc
const char * desc
Definition: detect.h:1247
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1235
DetectTcpmssRegister
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:51
SigTableElmt_::name
const char * name
Definition: detect.h:1245
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1222
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1403
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1141
detect-tcpmss.h
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:43
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:24
TCP_HAS_MSS
#define TCP_HAS_MSS(p)
Definition: decode-tcp.h:96
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:42
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1230
DetectTcpmssFree
void DetectTcpmssFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU16Data
Definition: detect-tcpmss.c:128
PrefilterPacketHeaderValue::u16
uint16_t u16[8]
Definition: detect-engine-prefilter-common.h:25
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1233
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:255
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1034
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:318
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:80
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:317
Signature_::flags
uint32_t flags
Definition: detect.h:541
Packet_
Definition: decode.h:434
TCP_GET_MSS
#define TCP_GET_MSS(p)
Definition: decode-tcp.h:107
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:611
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1213
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:534
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:235
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:36
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:309
DetectTcpmssRegisterTests
void DetectTcpmssRegisterTests(void)
DetectU16Match
int DetectU16Match(const uint16_t parg, const DetectUintData_u16 *du16)
Definition: detect-engine-uint.c:107
DetectU16Parse
DetectUintData_u16 * DetectU16Parse(const char *u16str)
This function is used to parse u16 options passed via some u16 keyword.
Definition: detect-engine-uint.c:121
PrefilterPacketU16Compare
bool PrefilterPacketU16Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:134
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:315
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1232
detect-parse.h
Signature_
Signature container.
Definition: detect.h:540
SigMatch_
a single match condition for a signature
Definition: detect.h:314
detect-engine-prefilter-common.h
DetectU16Data
DetectUintData_u16 DetectU16Data
Definition: detect-engine-uint.h:42
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:349
DETECT_TCPMSS
@ DETECT_TCPMSS
Definition: detect-engine-register.h:273
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:217