suricata
util-ja3.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mats Klepsland <mats.klepsland@gmail.com>
22  *
23  * Functions used to generate JA3 fingerprint.
24  */
25 
26 #include "suricata-common.h"
27 #include "app-layer-ssl.h"
28 #include "util-validate.h"
29 #include "util-ja3.h"
30 
31 #define MD5_STRING_LENGTH 33
32 
33 /**
34  * \brief Allocate new buffer.
35  *
36  * \return pointer to buffer on success.
37  * \return NULL on failure.
38  */
40 {
41  JA3Buffer *buffer = SCCalloc(1, sizeof(JA3Buffer));
42  if (buffer == NULL) {
43  return NULL;
44  }
45 
46  return buffer;
47 }
48 
49 /**
50  * \brief Free allocated buffer.
51  *
52  * \param buffer The buffer to free.
53  */
54 void Ja3BufferFree(JA3Buffer **buffer)
55 {
56  DEBUG_VALIDATE_BUG_ON(*buffer == NULL);
57 
58  if ((*buffer)->data != NULL) {
59  SCFree((*buffer)->data);
60  (*buffer)->data = NULL;
61  }
62 
63  SCFree(*buffer);
64  *buffer = NULL;
65 }
66 
67 /**
68  * \internal
69  * \brief Resize buffer if it is full.
70  *
71  * \param buffer The buffer.
72  * \param len The length of the data that should fit into the buffer.
73  *
74  * \retval 0 on success.
75  * \retval -1 on failure.
76  */
77 static int Ja3BufferResizeIfFull(JA3Buffer *buffer, uint32_t len)
78 {
79  DEBUG_VALIDATE_BUG_ON(buffer == NULL);
80 
81  while (buffer->used + len + 2 > buffer->size)
82  {
83  buffer->size *= 2;
84  char *tmp = SCRealloc(buffer->data, buffer->size * sizeof(char));
85  if (tmp == NULL) {
86  SCLogError(SC_ERR_MEM_ALLOC, "Error resizing JA3 buffer");
87  return -1;
88  }
89  buffer->data = tmp;
90  }
91 
92  return 0;
93 }
94 
95 /**
96  * \brief Append buffer to buffer.
97  *
98  * Append the second buffer to the first and then free it.
99  *
100  * \param buffer1 The first buffer.
101  * \param buffer2 The second buffer.
102  *
103  * \retval 0 on success.
104  * \retval -1 on failure.
105  */
106 int Ja3BufferAppendBuffer(JA3Buffer **buffer1, JA3Buffer **buffer2)
107 {
108  if (*buffer1 == NULL || *buffer2 == NULL) {
109  SCLogError(SC_ERR_INVALID_ARGUMENT, "Buffers should not be NULL");
110  return -1;
111  }
112 
113  /* If buffer1 contains no data, then we just copy the second buffer
114  instead of appending its data. */
115  if ((*buffer1)->data == NULL) {
116  (*buffer1)->data = (*buffer2)->data;
117  (*buffer1)->used = (*buffer2)->used;
118  (*buffer1)->size = (*buffer2)->size;
119  SCFree(*buffer2);
120  return 0;
121  }
122 
123  int rc = Ja3BufferResizeIfFull(*buffer1, (*buffer2)->used);
124  if (rc != 0) {
125  Ja3BufferFree(buffer1);
126  Ja3BufferFree(buffer2);
127  return -1;
128  }
129 
130  if ((*buffer2)->used == 0) {
131  (*buffer1)->used += snprintf((*buffer1)->data + (*buffer1)->used,
132  (*buffer1)->size - (*buffer1)->used, ",");
133  } else {
134  (*buffer1)->used += snprintf((*buffer1)->data + (*buffer1)->used,
135  (*buffer1)->size - (*buffer1)->used, ",%s",
136  (*buffer2)->data);
137  }
138 
139  Ja3BufferFree(buffer2);
140 
141  return 0;
142 }
143 
144 /**
145  * \internal
146  * \brief Return number of digits in number.
147  *
148  * \param num The number.
149  *
150  * \return digits Number of digits.
151  */
152 static uint32_t NumberOfDigits(uint32_t num)
153 {
154  if (num < 10) {
155  return 1;
156  }
157 
158  return 1 + NumberOfDigits(num / 10);
159 }
160 
161 /**
162  * \brief Add value to buffer.
163  *
164  * \param buffer The buffer.
165  * \param value The value.
166  *
167  * \retval 0 on success.
168  * \retval -1 on failure.
169  */
170 int Ja3BufferAddValue(JA3Buffer **buffer, uint32_t value)
171 {
172  if (*buffer == NULL) {
173  SCLogError(SC_ERR_INVALID_ARGUMENT, "Buffer should not be NULL");
174  return -1;
175  }
176 
177  if ((*buffer)->data == NULL) {
178  (*buffer)->data = SCMalloc(JA3_BUFFER_INITIAL_SIZE * sizeof(char));
179  if ((*buffer)->data == NULL) {
181  "Error allocating memory for JA3 data");
182  Ja3BufferFree(buffer);
183  return -1;
184  }
185  (*buffer)->size = JA3_BUFFER_INITIAL_SIZE;
186  }
187 
188  uint32_t value_len = NumberOfDigits(value);
189 
190  int rc = Ja3BufferResizeIfFull(*buffer, value_len);
191  if (rc != 0) {
192  Ja3BufferFree(buffer);
193  return -1;
194  }
195 
196  if ((*buffer)->used == 0) {
197  (*buffer)->used += snprintf((*buffer)->data, (*buffer)->size, "%d",
198  value);
199  }
200  else {
201  (*buffer)->used += snprintf((*buffer)->data + (*buffer)->used,
202  (*buffer)->size - (*buffer)->used, "-%d",
203  value);
204  }
205 
206  return 0;
207 }
208 
209 /**
210  * \brief Generate Ja3 hash string.
211  *
212  * \param buffer The Ja3 buffer.
213  *
214  * \retval pointer to hash string on success.
215  * \retval NULL on failure.
216  */
218 {
219 
220 #ifdef HAVE_NSS
221  if (buffer == NULL) {
222  SCLogError(SC_ERR_INVALID_ARGUMENT, "Buffer should not be NULL");
223  return NULL;
224  }
225 
226  if (buffer->data == NULL) {
227  SCLogError(SC_ERR_INVALID_VALUE, "Buffer data should not be NULL");
228  return NULL;
229  }
230 
231  char *ja3_hash = SCMalloc(MD5_STRING_LENGTH * sizeof(char));
232  if (ja3_hash == NULL) {
234  "Error allocating memory for JA3 hash");
235  return NULL;
236  }
237 
238  unsigned char md5[MD5_LENGTH];
239  HASH_HashBuf(HASH_AlgMD5, md5, (unsigned char *)buffer->data, buffer->used);
240 
241  int i, x;
242  for (i = 0, x = 0; x < MD5_LENGTH; x++) {
243  i += snprintf(ja3_hash + i, MD5_STRING_LENGTH - i, "%02x", md5[x]);
244  }
245 
246  return ja3_hash;
247 #else
248  return NULL;
249 #endif /* HAVE_NSS */
250 
251 }
252 
253 /**
254  * \brief Check if JA3 is disabled.
255  *
256  * Issue warning if JA3 is disabled or if we are lacking support for JA3.
257  *
258  * \param type Type to add to warning.
259  *
260  * \retval 1 if disabled.
261  * \retval 0 otherwise.
262  */
263 int Ja3IsDisabled(const char *type)
264 {
265  bool is_enabled = SSLJA3IsEnabled();
266  if (is_enabled == 0) {
267  if (strcmp(type, "rule") != 0) {
268  SCLogWarning(SC_WARN_JA3_DISABLED, "JA3 is disabled, skipping %s",
269  type);
270  }
271  return 1;
272  }
273 
274 #ifndef HAVE_NSS
275  else {
276  if (strcmp(type, "rule") != 0) {
278  "no MD5 calculation support built in (LibNSS), skipping %s",
279  type);
280  }
281  return 1;
282  }
283 #endif /* HAVE_NSS */
284 
285  return 0;
286 }
int Ja3BufferAddValue(JA3Buffer **buffer, uint32_t value)
Add value to buffer.
Definition: util-ja3.c:170
char * data
Definition: util-ja3.h:30
int Ja3IsDisabled(const char *type)
Check if JA3 is disabled.
Definition: util-ja3.c:263
int Ja3BufferAppendBuffer(JA3Buffer **buffer1, JA3Buffer **buffer2)
Append buffer to buffer.
Definition: util-ja3.c:106
JA3Buffer * Ja3BufferInit(void)
Allocate new buffer.
Definition: util-ja3.c:39
#define SCCalloc(nm, a)
Definition: util-mem.h:253
uint8_t type
#define JA3_BUFFER_INITIAL_SIZE
Definition: util-ja3.h:27
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
size_t used
Definition: util-ja3.h:32
char * Ja3GenerateHash(JA3Buffer *buffer)
Generate Ja3 hash string.
Definition: util-ja3.c:217
bool SSLJA3IsEnabled(void)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define SCRealloc(x, a)
Definition: util-mem.h:238
size_t size
Definition: util-ja3.h:31
#define SCMalloc(a)
Definition: util-mem.h:222
#define SCFree(a)
Definition: util-mem.h:322
#define MD5_STRING_LENGTH
Definition: util-ja3.c:31
void Ja3BufferFree(JA3Buffer **buffer)
Free allocated buffer.
Definition: util-ja3.c:54
uint8_t len
#define DEBUG_VALIDATE_BUG_ON(exp)