suricata
detect-tcpmss.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  */
24 
25 #include "suricata-common.h"
26 
27 #include "detect.h"
28 #include "detect-parse.h"
30 #include "detect-engine-uint.h"
31 #include "util-byte.h"
32 
33 #include "detect-tcpmss.h"
34 
35 
36 /* prototypes */
37 static int DetectTcpmssMatch (DetectEngineThreadCtx *, Packet *,
38  const Signature *, const SigMatchCtx *);
39 static int DetectTcpmssSetup (DetectEngineCtx *, Signature *, const char *);
40 void DetectTcpmssFree (DetectEngineCtx *, void *);
41 #ifdef UNITTESTS
43 #endif
44 static int PrefilterSetupTcpmss(DetectEngineCtx *de_ctx, SigGroupHead *sgh);
45 static bool PrefilterTcpmssIsPrefilterable(const Signature *s);
46 
47 /**
48  * \brief Registration function for tcpmss: keyword
49  */
50 
52 {
53  sigmatch_table[DETECT_TCPMSS].name = "tcp.mss";
54  sigmatch_table[DETECT_TCPMSS].desc = "match on TCP MSS option field";
55  sigmatch_table[DETECT_TCPMSS].url = "/rules/header-keywords.html#tcpmss";
56  sigmatch_table[DETECT_TCPMSS].Match = DetectTcpmssMatch;
57  sigmatch_table[DETECT_TCPMSS].Setup = DetectTcpmssSetup;
60  sigmatch_table[DETECT_TCPMSS].SupportsPrefilter = PrefilterTcpmssIsPrefilterable;
61  sigmatch_table[DETECT_TCPMSS].SetupPrefilter = PrefilterSetupTcpmss;
62 }
63 
64 /**
65  * \brief This function is used to match TCPMSS rule option on a packet with those passed via
66  * tcpmss:
67  *
68  * \param det_ctx pointer to the pattern matcher thread
69  * \param p pointer to the current packet
70  * \param ctx pointer to the sigmatch that we will cast into DetectU16Data
71  *
72  * \retval 0 no match
73  * \retval 1 match
74  */
75 static int DetectTcpmssMatch (DetectEngineThreadCtx *det_ctx, Packet *p,
76  const Signature *s, const SigMatchCtx *ctx)
77 {
79 
80  if (!(PacketIsTCP(p)))
81  return 0;
82 
83  if (!(TCP_HAS_MSS(p)))
84  return 0;
85 
86  uint16_t ptcpmss = TCP_GET_MSS(p);
87 
88  const DetectU16Data *tcpmssd = (const DetectU16Data *)ctx;
89  return DetectU16Match(ptcpmss, tcpmssd);
90 }
91 
92 /**
93  * \brief this function is used to attach the parsed tcpmss data into the current signature
94  *
95  * \param de_ctx pointer to the Detection Engine Context
96  * \param s pointer to the Current Signature
97  * \param tcpmssstr pointer to the user provided tcpmss options
98  *
99  * \retval 0 on Success
100  * \retval -1 on Failure
101  */
102 static int DetectTcpmssSetup (DetectEngineCtx *de_ctx, Signature *s, const char *tcpmssstr)
103 {
104  DetectU16Data *tcpmssd = DetectU16Parse(tcpmssstr);
105  if (tcpmssd == NULL)
106  return -1;
107 
109  de_ctx, s, DETECT_TCPMSS, (SigMatchCtx *)tcpmssd, DETECT_SM_LIST_MATCH) == NULL) {
110  DetectTcpmssFree(de_ctx, tcpmssd);
111  return -1;
112  }
114 
115  return 0;
116 }
117 
118 /**
119  * \brief this function will free memory associated with DetectU16Data
120  *
121  * \param ptr pointer to DetectU16Data
122  */
124 {
125  SCDetectU16Free(ptr);
126 }
127 
128 /* prefilter code */
129 
130 static void
131 PrefilterPacketTcpmssMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
132 {
134  if (!(PacketIsTCP(p)))
135  return;
136 
137  if (!(TCP_HAS_MSS(p)))
138  return;
139 
140  uint16_t ptcpmss = TCP_GET_MSS(p);
141 
142  /* during setup Suricata will automatically see if there is another
143  * check that can be added: alproto, sport or dport */
144  const PrefilterPacketHeaderCtx *ctx = pectx;
145  if (!PrefilterPacketHeaderExtraMatch(ctx, p))
146  return;
147 
148  DetectU16Data du16;
149  du16.mode = ctx->v1.u8[0];
150  du16.arg1 = ctx->v1.u16[1];
151  du16.arg2 = ctx->v1.u16[2];
152  /* if we match, add all the sigs that use this prefilter. This means
153  * that these will be inspected further */
154  if (DetectU16Match(ptcpmss, &du16)) {
155  SCLogDebug("packet matches tcpmss/hl %u", ptcpmss);
156  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
157  }
158 }
159 
160 static int PrefilterSetupTcpmss(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
161 {
163  PrefilterPacketU16Set, PrefilterPacketU16Compare, PrefilterPacketTcpmssMatch);
164 }
165 
166 static bool PrefilterTcpmssIsPrefilterable(const Signature *s)
167 {
168  const SigMatch *sm;
169  for (sm = s->init_data->smlists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
170  switch (sm->type) {
171  case DETECT_TCPMSS:
172  return true;
173  }
174  }
175  return false;
176 }
util-byte.h
SIGMATCH_INFO_UINT16
#define SIGMATCH_INFO_UINT16
Definition: detect.h:1688
detect-engine-uint.h
SigTableElmt_::url
const char * url
Definition: detect.h:1460
SIG_MASK_REQUIRE_REAL_PKT
#define SIG_MASK_REQUIRE_REAL_PKT
Definition: detect.h:316
SignatureInitData_::smlists
struct SigMatch_ * smlists[DETECT_SM_LIST_MAX]
Definition: detect.h:642
PrefilterPacketU16Set
void PrefilterPacketU16Set(PrefilterPacketHeaderValue *v, void *smctx)
Definition: detect-engine-uint.c:126
SigTableElmt_::desc
const char * desc
Definition: detect.h:1459
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1444
DetectTcpmssRegister
void DetectTcpmssRegister(void)
Registration function for tcpmss: keyword.
Definition: detect-tcpmss.c:51
SigTableElmt_::name
const char * name
Definition: detect.h:1457
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1323
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1627
SigTableElmt_::flags
uint32_t flags
Definition: detect.h:1448
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1347
detect-tcpmss.h
ctx
struct Thresholds ctx
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:932
TCP_HAS_MSS
#define TCP_HAS_MSS(p)
Definition: decode-tcp.h:96
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1439
DetectTcpmssFree
void DetectTcpmssFree(DetectEngineCtx *, void *)
this function will free memory associated with DetectU16Data
Definition: detect-tcpmss.c:123
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1442
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1244
SCSigMatchAppendSMToList
SigMatch * SCSigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:388
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:117
Signature_::flags
uint32_t flags
Definition: detect.h:669
Packet_
Definition: decode.h:501
TCP_GET_MSS
#define TCP_GET_MSS(p)
Definition: decode-tcp.h:105
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:747
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, SignatureMask mask, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:470
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1419
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:351
DetectTcpmssRegisterTests
void DetectTcpmssRegisterTests(void)
DetectU16Match
int DetectU16Match(const uint16_t parg, const DetectUintData_u16 *du16)
Definition: detect-engine-uint.c:107
DetectU16Parse
DetectUintData_u16 * DetectU16Parse(const char *u16str)
This function is used to parse u16 options passed via some u16 keyword.
Definition: detect-engine-uint.c:121
PrefilterPacketU16Compare
bool PrefilterPacketU16Compare(PrefilterPacketHeaderValue v, void *smctx)
Definition: detect-engine-uint.c:134
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:357
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1441
detect-parse.h
Signature_
Signature container.
Definition: detect.h:668
SigMatch_
a single match condition for a signature
Definition: detect.h:356
detect-engine-prefilter-common.h
DetectU16Data
DetectUintData_u16 DetectU16Data
Definition: detect-engine-uint.h:42
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DETECT_TCPMSS
@ DETECT_TCPMSS
Definition: detect-engine-register.h:289
SIG_FLAG_REQUIRE_PACKET
#define SIG_FLAG_REQUIRE_PACKET
Definition: detect.h:254