diff options
Diffstat (limited to 'framework/src/suricata/src/detect-ttl.c')
| -rw-r--r-- | framework/src/suricata/src/detect-ttl.c | 638 |
1 files changed, 638 insertions, 0 deletions
diff --git a/framework/src/suricata/src/detect-ttl.c b/framework/src/suricata/src/detect-ttl.c new file mode 100644 index 00000000..80f39667 --- /dev/null +++ b/framework/src/suricata/src/detect-ttl.c @@ -0,0 +1,638 @@ +/* Copyright (C) 2007-2013 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Gurvinder Singh <gurvindersighdahiya@gmail.com> + * + * Implements the ttl keyword + */ + +#include "suricata-common.h" +#include "stream-tcp.h" +#include "util-unittest.h" + +#include "detect.h" +#include "detect-parse.h" + +#include "detect-ttl.h" +#include "util-debug.h" + +/** + * \brief Regex for parsing our flow options + */ +#define PARSE_REGEX "^\\s*([0-9]*)?\\s*([<>=-]+)?\\s*([0-9]+)?\\s*$" + +static pcre *parse_regex; +static pcre_extra *parse_regex_study; + +/*prototypes*/ +int DetectTtlMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, const SigMatchCtx *); +static int DetectTtlSetup (DetectEngineCtx *, Signature *, char *); +void DetectTtlFree (void *); +void DetectTtlRegisterTests (void); + +/** + * \brief Registration function for ttl: keyword + */ + +void DetectTtlRegister(void) +{ + sigmatch_table[DETECT_TTL].name = "ttl"; + sigmatch_table[DETECT_TTL].desc = "check for a specific IP time-to-live value"; + sigmatch_table[DETECT_TTL].url = "https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Header_keywords#ttl"; + sigmatch_table[DETECT_TTL].Match = DetectTtlMatch; + sigmatch_table[DETECT_TTL].Setup = DetectTtlSetup; + sigmatch_table[DETECT_TTL].Free = DetectTtlFree; + sigmatch_table[DETECT_TTL].RegisterTests = DetectTtlRegisterTests; + + const char *eb; + int eo; + int opts = 0; + + parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); + if (parse_regex == NULL) { + SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s", PARSE_REGEX, eo, eb); + goto error; + } + + parse_regex_study = pcre_study(parse_regex, 0, &eb); + if (eb != NULL) { + SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb); + goto error; + } + return; + +error: + if (parse_regex != NULL) SCFree(parse_regex); + if (parse_regex_study != NULL) SCFree(parse_regex_study); + return; +} + +/** + * \brief This function is used to match TTL rule option on a packet with those passed via ttl: + * + * \param t pointer to thread vars + * \param det_ctx pointer to the pattern matcher thread + * \param p pointer to the current packet + * \param m pointer to the sigmatch that we will cast into DetectTtlData + * + * \retval 0 no match + * \retval 1 match + */ +int DetectTtlMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx) +{ + + int ret = 0; + uint8_t pttl; + const DetectTtlData *ttld = (const DetectTtlData *)ctx; + + if (PKT_IS_PSEUDOPKT(p)) + return 0; + + if (PKT_IS_IPV4(p)) { + pttl = IPV4_GET_IPTTL(p); + } else if (PKT_IS_IPV6(p)) { + pttl = IPV6_GET_HLIM(p); + } else { + SCLogDebug("Packet is of not IPv4 or IPv6"); + return ret; + } + + if (ttld->mode == DETECT_TTL_EQ && pttl == ttld->ttl1) + ret = 1; + else if (ttld->mode == DETECT_TTL_LT && pttl < ttld->ttl1) + ret = 1; + else if (ttld->mode == DETECT_TTL_GT && pttl > ttld->ttl1) + ret = 1; + else if (ttld->mode == DETECT_TTL_RA && (pttl > ttld->ttl1 && pttl < ttld->ttl2)) + ret = 1; + + return ret; +} + +/** + * \brief This function is used to parse ttl options passed via ttl: keyword + * + * \param ttlstr Pointer to the user provided ttl options + * + * \retval ttld pointer to DetectTtlData on success + * \retval NULL on failure + */ + +DetectTtlData *DetectTtlParse (char *ttlstr) +{ + + DetectTtlData *ttld = NULL; + char *arg1 = NULL; + char *arg2 = NULL; + char *arg3 = NULL; +#define MAX_SUBSTRINGS 30 + int ret = 0, res = 0; + int ov[MAX_SUBSTRINGS]; + + ret = pcre_exec(parse_regex, parse_regex_study, ttlstr, strlen(ttlstr), 0, 0, ov, MAX_SUBSTRINGS); + if (ret < 2 || ret > 4) { + SCLogError(SC_ERR_PCRE_MATCH, "parse error, ret %" PRId32 "", ret); + goto error; + } + const char *str_ptr; + + res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg1 = (char *) str_ptr; + SCLogDebug("Arg1 \"%s\"", arg1); + + if (ret >= 3) { + res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 2, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg2 = (char *) str_ptr; + SCLogDebug("Arg2 \"%s\"", arg2); + + if (ret >= 4) { + res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 3, &str_ptr); + if (res < 0) { + SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); + goto error; + } + arg3 = (char *) str_ptr; + SCLogDebug("Arg3 \"%s\"", arg3); + } + } + + ttld = SCMalloc(sizeof (DetectTtlData)); + if (unlikely(ttld == NULL)) + goto error; + ttld->ttl1 = 0; + ttld->ttl2 = 0; + + if (arg2 != NULL) { + /*set the values*/ + switch(arg2[0]) { + case '<': + if (arg3 == NULL) + goto error; + + ttld->mode = DETECT_TTL_LT; + ttld->ttl1 = (uint8_t) atoi(arg3); + + SCLogDebug("ttl is %"PRIu8"",ttld->ttl1); + if (strlen(arg1) > 0) + goto error; + + break; + case '>': + if (arg3 == NULL) + goto error; + + ttld->mode = DETECT_TTL_GT; + ttld->ttl1 = (uint8_t) atoi(arg3); + + SCLogDebug("ttl is %"PRIu8"",ttld->ttl1); + if (strlen(arg1) > 0) + goto error; + + break; + case '-': + if (arg1 == NULL || strlen(arg1)== 0) + goto error; + if (arg3 == NULL || strlen(arg3)== 0) + goto error; + + ttld->mode = DETECT_TTL_RA; + ttld->ttl1 = (uint8_t) atoi(arg1); + + ttld->ttl2 = (uint8_t) atoi(arg3); + SCLogDebug("ttl is %"PRIu8" to %"PRIu8"",ttld->ttl1, ttld->ttl2); + if (ttld->ttl1 >= ttld->ttl2) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid ttl range. "); + goto error; + } + break; + default: + ttld->mode = DETECT_TTL_EQ; + + if ((arg2 != NULL && strlen(arg2) > 0) || (arg3 != NULL && strlen(arg3) > 0) || (arg1 == NULL ||strlen(arg1) == 0)) + goto error; + + ttld->ttl1 = (uint8_t) atoi(arg1); + break; + } + } else { + ttld->mode = DETECT_TTL_EQ; + + if ((arg2 != NULL && strlen(arg2) > 0) || + (arg3 != NULL && strlen(arg3) > 0) || + (arg1 == NULL ||strlen(arg1) == 0)) + goto error; + + ttld->ttl1 = (uint8_t) atoi(arg1); + } + + SCFree(arg1); + SCFree(arg2); + SCFree(arg3); + return ttld; + +error: + if (ttld) SCFree(ttld); + if (arg1) SCFree(arg1); + if (arg2) SCFree(arg2); + if (arg3) SCFree(arg3); + return NULL; +} + +/** + * \brief this function is used to attld the parsed ttl data into the current signature + * + * \param de_ctx pointer to the Detection Engine Context + * \param s pointer to the Current Signature + * \param ttlstr pointer to the user provided ttl options + * + * \retval 0 on Success + * \retval -1 on Failure + */ +static int DetectTtlSetup (DetectEngineCtx *de_ctx, Signature *s, char *ttlstr) +{ + + DetectTtlData *ttld = NULL; + SigMatch *sm = NULL; + + ttld = DetectTtlParse(ttlstr); + if (ttld == NULL) + goto error; + + sm = SigMatchAlloc(); + if (sm == NULL) + goto error; + + sm->type = DETECT_TTL; + sm->ctx = (SigMatchCtx *)ttld; + + SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH); + s->flags |= SIG_FLAG_REQUIRE_PACKET; + + return 0; + +error: + if (ttld != NULL) DetectTtlFree(ttld); + if (sm != NULL) SCFree(sm); + return -1; +} + +/** + * \brief this function will free memory associated with DetectTtlData + * + * \param ptr pointer to DetectTtlData + */ +void DetectTtlFree(void *ptr) +{ + DetectTtlData *ttld = (DetectTtlData *)ptr; + SCFree(ttld); +} + +#ifdef UNITTESTS + +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" + +/** + * \brief this function is used to initialize the detection engine context and + * setup the signature with passed values. + * + */ + +static int DetectTtlInitTest(DetectEngineCtx **de_ctx, Signature **sig, DetectTtlData **ttld, char *str) +{ + char fullstr[1024]; + int result = 0; + + *de_ctx = NULL; + *sig = NULL; + + if (snprintf(fullstr, 1024, "alert ip any any -> any any (msg:\"Ttl test\"; ttl:%s; sid:1;)", str) >= 1024) { + goto end; + } + + *de_ctx = DetectEngineCtxInit(); + if (*de_ctx == NULL) { + goto end; + } + + (*de_ctx)->flags |= DE_QUIET; + + (*de_ctx)->sig_list = SigInit(*de_ctx, fullstr); + if ((*de_ctx)->sig_list == NULL) { + goto end; + } + + *sig = (*de_ctx)->sig_list; + + *ttld = DetectTtlParse(str); + + result = 1; + +end: + return result; +} + +/** + * \test DetectTtlParseTest01 is a test for setting up an valid ttl value. + */ + +static int DetectTtlParseTest01 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + + ttld = DetectTtlParse("10"); + if (ttld != NULL) { + if (ttld->ttl1 == 10 && ttld->mode == DETECT_TTL_EQ) + res = 1; + + DetectTtlFree(ttld); + } + + return res; +} + +/** + * \test DetectTtlParseTest02 is a test for setting up an valid ttl value with + * "<" operator. + */ + +static int DetectTtlParseTest02 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + ttld = DetectTtlParse("<10"); + if (ttld != NULL) { + if (ttld->ttl1 == 10 && ttld->mode == DETECT_TTL_LT) + res = 1; + DetectTtlFree(ttld); + } + + return res; +} + +/** + * \test DetectTtlParseTest03 is a test for setting up an valid ttl values with + * "-" operator. + */ + +static int DetectTtlParseTest03 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + ttld = DetectTtlParse("1-2"); + if (ttld != NULL) { + if (ttld->ttl1 == 1 && ttld->ttl2 == 2 && ttld->mode == DETECT_TTL_RA) + res = 1; + DetectTtlFree(ttld); + } + + return res; +} + +/** + * \test DetectTtlParseTest04 is a test for setting up an valid ttl value with + * ">" operator and include spaces arround the given values. + */ + +static int DetectTtlParseTest04 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + + ttld = DetectTtlParse(" > 10 "); + if (ttld != NULL) { + if (ttld->ttl1 == 10 && ttld->mode == DETECT_TTL_GT) + res = 1; + + DetectTtlFree(ttld); + } + + return res; +} + +/** + * \test DetectTtlParseTest05 is a test for setting up an valid ttl values with + * "-" operator and include spaces arround the given values. + */ + +static int DetectTtlParseTest05 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + + ttld = DetectTtlParse(" 1 - 2 "); + if (ttld != NULL) { + if (ttld->ttl1 == 1 && ttld->ttl2 == 2 && ttld->mode == DETECT_TTL_RA) + res = 1; + DetectTtlFree(ttld); + } + + return res; +} + +/** + * \test DetectTtlParseTest06 is a test for setting up an valid ttl values with + * invalid "=" operator and include spaces arround the given values. + */ + +static int DetectTtlParseTest06 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + + ttld = DetectTtlParse(" 1 = 2 "); + if (ttld == NULL) + res = 1; + if (ttld) SCFree(ttld); + + return res; +} + +/** + * \test DetectTtlParseTest07 is a test for setting up an valid ttl values with + * invalid "<>" operator and include spaces arround the given values. + */ + +static int DetectTtlParseTest07 (void) +{ + DetectTtlData *ttld = NULL; + uint8_t res = 0; + + ttld = DetectTtlParse(" 1<>2 "); + if (ttld == NULL) + res = 1; + + if (ttld) SCFree(ttld); + + return res; +} + +/** + * \test DetectTtlSetpTest01 is a test for setting up an valid ttl values with + * valid "-" operator and include spaces arround the given values. In the + * test the values are setup with initializing the detection engine context + * setting up the signature itself. + */ + +static int DetectTtlSetpTest01(void) +{ + + DetectTtlData *ttld = NULL; + uint8_t res = 0; + Signature *sig = NULL; + DetectEngineCtx *de_ctx = NULL; + + res = DetectTtlInitTest(&de_ctx, &sig, &ttld, "1 - 2 "); + if (res == 0) { + goto end; + } + + if(ttld == NULL) + goto cleanup; + + if (ttld != NULL) { + if (ttld->ttl1 == 1 && ttld->ttl2 == 2 && ttld->mode == DETECT_TTL_RA) + res = 1; + } + +cleanup: + if (ttld) SCFree(ttld); + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + DetectEngineCtxFree(de_ctx); +end: + return res; +} + +/** + * \test DetectTtlTestSig01 is a test for checking the working of ttl keyword + * by setting up the signature and later testing its working by matching + * the received packet against the sig. + */ + +static int DetectTtlTestSig1(void) +{ + + Packet *p = PacketGetFromAlloc(); + if (unlikely(p == NULL)) + return 0; + Signature *s = NULL; + ThreadVars th_v; + DetectEngineThreadCtx *det_ctx; + int result = 0; + IPV4Hdr ip4h; + + memset(&th_v, 0, sizeof(th_v)); + memset(&ip4h, 0, sizeof(ip4h)); + + p->src.family = AF_INET; + p->dst.family = AF_INET; + p->proto = IPPROTO_TCP; + ip4h.ip_ttl = 15; + p->ip4h = &ip4h; + + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) { + goto end; + } + + de_ctx->flags |= DE_QUIET; + + s = de_ctx->sig_list = SigInit(de_ctx,"alert ip any any -> any any (msg:\"with in ttl limit\"; ttl: >16; sid:1;)"); + if (s == NULL) { + goto end; + } + + s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Less than 17\"; ttl: <17; sid:2;)"); + if (s == NULL) { + goto end; + } + + s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Greater than 5\"; ttl:15; sid:3;)"); + if (s == NULL) { + goto end; + } + + s = s->next = SigInit(de_ctx,"alert ip any any -> any any (msg:\"Equals tcp\"; ttl: 1-30; sid:4;)"); + if (s == NULL) { + goto end; + } + + SigGroupBuild(de_ctx); + DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); + + SigMatchSignatures(&th_v, de_ctx, det_ctx, p); + if (PacketAlertCheck(p, 1)) { + printf("sid 1 alerted, but should not have: "); + goto cleanup; + } else if (PacketAlertCheck(p, 2) == 0) { + printf("sid 2 did not alert, but should have: "); + goto cleanup; + } else if (PacketAlertCheck(p, 3) == 0) { + printf("sid 3 did not alert, but should have: "); + goto cleanup; + } else if (PacketAlertCheck(p, 4) == 0) { + printf("sid 4 did not alert, but should have: "); + goto cleanup; + } + + result = 1; + +cleanup: + SigGroupCleanup(de_ctx); + SigCleanSignatures(de_ctx); + + DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); + DetectEngineCtxFree(de_ctx); + +end: + SCFree(p); + return result; +} + +#endif /* UNITTESTS */ + +/** + * \brief this function registers unit tests for DetectTtl + */ +void DetectTtlRegisterTests(void) +{ +#ifdef UNITTESTS + UtRegisterTest("DetectTtlParseTest01", DetectTtlParseTest01, 1); + UtRegisterTest("DetectTtlParseTest02", DetectTtlParseTest02, 1); + UtRegisterTest("DetectTtlParseTest03", DetectTtlParseTest03, 1); + UtRegisterTest("DetectTtlParseTest04", DetectTtlParseTest04, 1); + UtRegisterTest("DetectTtlParseTest05", DetectTtlParseTest05, 1); + UtRegisterTest("DetectTtlParseTest06", DetectTtlParseTest06, 1); + UtRegisterTest("DetectTtlParseTest07", DetectTtlParseTest07, 1); + UtRegisterTest("DetectTtlSetpTest01", DetectTtlSetpTest01, 1); + UtRegisterTest("DetectTtlTestSig1", DetectTtlTestSig1, 1); +#endif /* UNITTESTS */ +} |