suricata
util-ja3.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mats Klepsland <mats.klepsland@gmail.com>
22  *
23  * Functions used to generate JA3 fingerprint.
24  */
25 
26 #include "suricata-common.h"
27 #include "util-validate.h"
28 #include "util-ja3.h"
29 
30 #define MD5_STRING_LENGTH 33
31 
32 /**
33  * \brief Allocate new buffer.
34  *
35  * \return pointer to buffer on success.
36  * \return NULL on failure.
37  */
39 {
40  JA3Buffer *buffer = SCCalloc(1, sizeof(JA3Buffer));
41  if (buffer == NULL) {
42  return NULL;
43  }
44 
45  return buffer;
46 }
47 
48 /**
49  * \brief Free allocated buffer.
50  *
51  * \param buffer The buffer to free.
52  */
53 void Ja3BufferFree(JA3Buffer **buffer)
54 {
55  DEBUG_VALIDATE_BUG_ON(*buffer == NULL);
56 
57  if ((*buffer)->data != NULL) {
58  SCFree((*buffer)->data);
59  (*buffer)->data = NULL;
60  }
61 
62  SCFree(*buffer);
63  *buffer = NULL;
64 }
65 
66 /**
67  * \internal
68  * \brief Resize buffer if it is full.
69  *
70  * \param buffer The buffer.
71  * \param len The length of the data that should fit into the buffer.
72  *
73  * \retval 0 on success.
74  * \retval -1 on failure.
75  */
76 static int Ja3BufferResizeIfFull(JA3Buffer *buffer, uint32_t len)
77 {
78  DEBUG_VALIDATE_BUG_ON(buffer == NULL);
79 
80  while (buffer->used + len + 2 > buffer->size)
81  {
82  buffer->size *= 2;
83  char *tmp = SCRealloc(buffer->data, buffer->size * sizeof(char));
84  if (tmp == NULL) {
85  SCLogError(SC_ERR_MEM_ALLOC, "Error resizing JA3 buffer");
86  return -1;
87  }
88  buffer->data = tmp;
89  }
90 
91  return 0;
92 }
93 
94 /**
95  * \brief Append buffer to buffer.
96  *
97  * Append the second buffer to the first and then free it.
98  *
99  * \param buffer1 The first buffer.
100  * \param buffer2 The second buffer.
101  *
102  * \retval 0 on success.
103  * \retval -1 on failure.
104  */
105 int Ja3BufferAppendBuffer(JA3Buffer **buffer1, JA3Buffer **buffer2)
106 {
107  if (*buffer1 == NULL || *buffer2 == NULL) {
108  SCLogError(SC_ERR_INVALID_ARGUMENT, "Buffers should not be NULL");
109  return -1;
110  }
111 
112  /* If buffer1 contains no data, then we just copy the second buffer
113  instead of appending its data. */
114  if ((*buffer1)->data == NULL) {
115  (*buffer1)->data = (*buffer2)->data;
116  (*buffer1)->used = (*buffer2)->used;
117  (*buffer1)->size = (*buffer2)->size;
118  SCFree(*buffer2);
119  return 0;
120  }
121 
122  int rc = Ja3BufferResizeIfFull(*buffer1, (*buffer2)->used);
123  if (rc != 0) {
124  Ja3BufferFree(buffer1);
125  Ja3BufferFree(buffer2);
126  return -1;
127  }
128 
129  if ((*buffer2)->used == 0) {
130  (*buffer1)->used += snprintf((*buffer1)->data + (*buffer1)->used,
131  (*buffer1)->size - (*buffer1)->used, ",");
132  } else {
133  (*buffer1)->used += snprintf((*buffer1)->data + (*buffer1)->used,
134  (*buffer1)->size - (*buffer1)->used, ",%s",
135  (*buffer2)->data);
136  }
137 
138  Ja3BufferFree(buffer2);
139 
140  return 0;
141 }
142 
143 /**
144  * \internal
145  * \brief Return number of digits in number.
146  *
147  * \param num The number.
148  *
149  * \return digits Number of digits.
150  */
151 static uint32_t NumberOfDigits(uint32_t num)
152 {
153  if (num < 10) {
154  return 1;
155  }
156 
157  return 1 + NumberOfDigits(num / 10);
158 }
159 
160 /**
161  * \brief Add value to buffer.
162  *
163  * \param buffer The buffer.
164  * \param value The value.
165  *
166  * \retval 0 on success.
167  * \retval -1 on failure.
168  */
169 int Ja3BufferAddValue(JA3Buffer **buffer, uint32_t value)
170 {
171  if (*buffer == NULL) {
172  SCLogError(SC_ERR_INVALID_ARGUMENT, "Buffer should not be NULL");
173  return -1;
174  }
175 
176  if ((*buffer)->data == NULL) {
177  (*buffer)->data = SCMalloc(JA3_BUFFER_INITIAL_SIZE * sizeof(char));
178  if ((*buffer)->data == NULL) {
180  "Error allocating memory for JA3 data");
181  Ja3BufferFree(buffer);
182  return -1;
183  }
184  (*buffer)->size = JA3_BUFFER_INITIAL_SIZE;
185  }
186 
187  uint32_t value_len = NumberOfDigits(value);
188 
189  int rc = Ja3BufferResizeIfFull(*buffer, value_len);
190  if (rc != 0) {
191  Ja3BufferFree(buffer);
192  return -1;
193  }
194 
195  if ((*buffer)->used == 0) {
196  (*buffer)->used += snprintf((*buffer)->data, (*buffer)->size, "%d",
197  value);
198  }
199  else {
200  (*buffer)->used += snprintf((*buffer)->data + (*buffer)->used,
201  (*buffer)->size - (*buffer)->used, "-%d",
202  value);
203  }
204 
205  return 0;
206 }
207 
208 /**
209  * \brief Generate Ja3 hash string.
210  *
211  * \param buffer The Ja3 buffer.
212  *
213  * \retval pointer to hash string on success.
214  * \retval NULL on failure.
215  */
217 {
218 
219 #ifdef HAVE_NSS
220  if (buffer == NULL) {
221  SCLogError(SC_ERR_INVALID_ARGUMENT, "Buffer should not be NULL");
222  return NULL;
223  }
224 
225  if (buffer->data == NULL) {
226  SCLogError(SC_ERR_INVALID_VALUE, "Buffer data should not be NULL");
227  return NULL;
228  }
229 
230  char *ja3_hash = SCMalloc(MD5_STRING_LENGTH * sizeof(char));
231  if (ja3_hash == NULL) {
233  "Error allocating memory for JA3 hash");
234  return NULL;
235  }
236 
237  unsigned char md5[MD5_LENGTH];
238  HASH_HashBuf(HASH_AlgMD5, md5, (unsigned char *)buffer->data, buffer->used);
239 
240  int i, x;
241  for (i = 0, x = 0; x < MD5_LENGTH; x++) {
242  i += snprintf(ja3_hash + i, MD5_STRING_LENGTH - i, "%02x", md5[x]);
243  }
244 
245  return ja3_hash;
246 #else
247  return NULL;
248 #endif /* HAVE_NSS */
249 
250 }
251 
252 /**
253  * \brief Check if JA3 is disabled.
254  *
255  * Issue warning if JA3 is disabled or if we are lacking support for JA3.
256  *
257  * \param type Type to add to warning.
258  *
259  * \retval 1 if disabled.
260  * \retval 0 otherwise.
261  */
262 int Ja3IsDisabled(const char *type)
263 {
264  int is_enabled = 0;
265 
266  /* Check if JA3 is enabled */
267  ConfGetBool("app-layer.protocols.tls.ja3-fingerprints", &is_enabled);
268 
269  if (is_enabled == 0) {
270  SCLogWarning(SC_WARN_JA3_DISABLED, "JA3 is disabled, skipping %s",
271  type);
272  return 1;
273  }
274 
275 #ifndef HAVE_NSS
276  else {
278  "no MD5 calculation support build in, skipping %s",
279  type);
280  return 1;
281  }
282 #endif /* HAVE_NSS */
283 
284  return 0;
285 }
int Ja3BufferAddValue(JA3Buffer **buffer, uint32_t value)
Add value to buffer.
Definition: util-ja3.c:169
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:517
char * data
Definition: util-ja3.h:30
int Ja3IsDisabled(const char *type)
Check if JA3 is disabled.
Definition: util-ja3.c:262
int Ja3BufferAppendBuffer(JA3Buffer **buffer1, JA3Buffer **buffer2)
Append buffer to buffer.
Definition: util-ja3.c:105
JA3Buffer * Ja3BufferInit(void)
Allocate new buffer.
Definition: util-ja3.c:38
#define SCCalloc(nm, a)
Definition: util-mem.h:197
uint8_t type
#define JA3_BUFFER_INITIAL_SIZE
Definition: util-ja3.h:27
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
size_t used
Definition: util-ja3.h:32
char * Ja3GenerateHash(JA3Buffer *buffer)
Generate Ja3 hash string.
Definition: util-ja3.c:216
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define SCRealloc(x, a)
Definition: util-mem.h:182
size_t size
Definition: util-ja3.h:31
#define SCMalloc(a)
Definition: util-mem.h:166
#define SCFree(a)
Definition: util-mem.h:228
#define MD5_STRING_LENGTH
Definition: util-ja3.c:30
void Ja3BufferFree(JA3Buffer **buffer)
Free allocated buffer.
Definition: util-ja3.c:53
uint8_t len
#define DEBUG_VALIDATE_BUG_ON(exp)