src/detect-tcphdr.c

   1 /* Copyright (C) 2007-2019 Open Information Security Foundation
   2  *
   3  * You can copy, redistribute or modify this Program under the terms of
   4  * the GNU General Public License version 2 as published by the Free
   5  * Software Foundation.
   6  *
   7  * This program is distributed in the hope that it will be useful,
   8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
   9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  10  * GNU General Public License for more details.
  11  *
  12  * You should have received a copy of the GNU General Public License
  13  * version 2 along with this program; if not, write to the Free Software
  14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  15  * 02110-1301, USA.
  16  */
  17
  18 /**
  19  * \file
  20  *
  21  * \author Victor Julien <victor@inliniac.net>
  22  *
  23  */
  24
  25 #include "suricata-common.h"
  26
  27 #include "detect.h"
  28 #include "detect-parse.h"
  29 #include "detect-engine.h"
  30 #include "detect-engine-mpm.h"
  31 #include "detect-engine-prefilter.h"
  32 #include "detect-engine-content-inspection.h"
  33 #include "detect-fast-pattern.h"
  34 #include "detect-tcphdr.h"
  35
  36 /* prototypes */
  37 static int DetectTcphdrSetup (DetectEngineCtx *, Signature *, const char *);
  38 #ifdef UNITTESTS
  39 void DetectTcphdrRegisterTests (void);
  40 #endif
  41
  42 static int g_tcphdr_buffer_id = 0;
  43
  44 static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
  45         const DetectEngineTransforms *transforms, Packet *p, const int list_id);
  46
  47 /**
  48  * \brief Registration function for tcp.hdr: keyword
  49  */
  50 void DetectTcphdrRegister(void)
  51 {
  52     sigmatch_table[DETECT_TCPHDR].name = "tcp.hdr";
  53     sigmatch_table[DETECT_TCPHDR].desc = "sticky buffer to match on the TCP header";
  54     sigmatch_table[DETECT_TCPHDR].url = "/rules/header-keywords.html#tcphdr";
  55     sigmatch_table[DETECT_TCPHDR].Setup = DetectTcphdrSetup;
  56     sigmatch_table[DETECT_TCPHDR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
  57 #ifdef UNITTESTS
  58     sigmatch_table[DETECT_TCPHDR].RegisterTests = DetectTcphdrRegisterTests;
  59 #endif
  60
  61     g_tcphdr_buffer_id = DetectBufferTypeRegister("tcp.hdr");
  62     BUG_ON(g_tcphdr_buffer_id < 0);
  63
  64     DetectBufferTypeSupportsPacket("tcp.hdr");
  65
  66     DetectPktMpmRegister("tcp.hdr", 2, PrefilterGenericMpmPktRegister, GetData);
  67
  68     DetectPktInspectEngineRegister("tcp.hdr", GetData,
  69             DetectEngineInspectPktBufferGeneric);
  70
  71     return;
  72 }
  73
  74 /**
  75  * \brief setup tcp.hdr sticky buffer
  76  *
  77  * \param de_ctx pointer to the Detection Engine Context
  78  * \param s pointer to the Current Signature
  79  * \param _unused unused
  80  *
  81  * \retval 0 on Success
  82  * \retval -1 on Failure
  83  */
  84 static int DetectTcphdrSetup (DetectEngineCtx *de_ctx, Signature *s, const char *_unused)
  85 {
  86     if (!(DetectProtoContainsProto(&s->proto, IPPROTO_TCP)))
  87         return -1;
  88
  89     s->flags |= SIG_FLAG_REQUIRE_PACKET;
  90
  91     if (DetectBufferSetActiveList(s, g_tcphdr_buffer_id) < 0)
  92         return -1;
  93
  94     return 0;
  95 }
  96
  97 static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
  98         const DetectEngineTransforms *transforms, Packet *p, const int list_id)
  99 {
 100     SCEnter();
 101
 102     InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
 103     if (buffer->inspect == NULL) {
 104         if (p->tcph == NULL) {
 105             // may happen when DecodeTCPPacket fails
 106             // for instance with invalid header length
 107             return NULL;
 108         }
 109         uint32_t hlen = TCP_GET_HLEN(p);
 110         if (((uint8_t *)p->tcph + (ptrdiff_t)hlen) >
 111                 ((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p)))
 112         {
 113             SCLogDebug("data out of range: %p > %p",
 114                     ((uint8_t *)p->tcph + (ptrdiff_t)hlen),
 115                     ((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p)));
 116             return NULL;
 117         }
 118
 119         const uint32_t data_len = hlen;
 120         const uint8_t *data = (const uint8_t *)p->tcph;
 121
 122         InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
 123         InspectionBufferApplyTransforms(buffer, transforms);
 124     }
 125
 126     return buffer;
 127 }
 128
 129 #ifdef UNITTESTS
 130 #include "tests/detect-tcphdr.c"
 131 #endif