detect: add (mpm) keyword ja3_hash

Match on JA3 hash using ja3_hash keyword, e.g:

alert tls any any -> any any (msg:"JA3 hash test";
        ja3_hash;
        content:"e7eca2baf4458d095b7f45da28c16c34";
        sid:1;)

diff --git a/src/Makefile.am b/src/Makefile.am
index 1a1ecac443c3974b0095792a48445bc2b643c57a..5f92e445dc774debdd21ab0ee859abaea712765f 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -103,6 +103,7 @@ detect-detection-filter.c detect-detection-filter.h \
 detect-distance.c detect-distance.h \
 detect-dnp3.c detect-dnp3.h \
 detect-dns-query.c detect-dns-query.h \
+detect-tls-ja3-hash.c detect-tls-ja3-hash.h \
 detect-tls-sni.c detect-tls-sni.h \
 detect-tls-cert-issuer.c detect-tls-cert-issuer.h \
 detect-tls-cert-subject.c detect-tls-cert-subject.h \

diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c
index f13b560d0fc877f3e82de5653b1366311b60fb45..6aa53a69eded146e17ee1fd8b8300abafe454413 100644 (file)
--- a/src/detect-engine-register.c
+++ b/src/detect-engine-register.c
@@ -52,6 +52,7 @@
 #include "detect-tls-cert-issuer.h"
 #include "detect-tls-cert-subject.h"
 #include "detect-tls-cert-serial.h"
+#include "detect-tls-ja3-hash.h"
 #include "detect-engine-state.h"
 #include "detect-engine-analyzer.h"
 #include "detect-engine-filedata.h"
@@ -408,6 +409,8 @@ void SigTableSetup(void)
     DetectTlsSerialRegister();
     DetectTlsFingerprintRegister();
 
+    DetectTlsJa3HashRegister();
+
     DetectAppLayerEventRegister();
     /* end of order dependent regs */
 

diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h
index a780fbc9bf7645ce58538475868f075df01f8f3a..25725ebb188e00e521873023f71203bab12cd2a8 100644 (file)
--- a/src/detect-engine-register.h
+++ b/src/detect-engine-register.h
@@ -181,6 +181,8 @@ enum {
     DETECT_AL_TLS_CERT_SERIAL,
     DETECT_AL_TLS_CERT_FINGERPRINT,
 
+    DETECT_AL_TLS_JA3_HASH,
+
     DETECT_AL_MODBUS,
     DETECT_CIPSERVICE,
     DETECT_ENIPCOMMAND,

diff --git a/src/detect-tls-ja3-hash.c b/src/detect-tls-ja3-hash.c
new file mode 100644 (file)
index 0000000..4f35062
--- /dev/null
+++ b/src/detect-tls-ja3-hash.c
@@ -0,0 +1,258 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Mats Klepsland <mats.klepsland@gmail.com>
+ *
+ * Implements support for ja3_hash keyword.
+ */
+
+#include "suricata-common.h"
+#include "threads.h"
+#include "debug.h"
+#include "decode.h"
+#include "detect.h"
+
+#include "detect-parse.h"
+#include "detect-engine.h"
+#include "detect-engine-mpm.h"
+#include "detect-engine-prefilter.h"
+#include "detect-content.h"
+#include "detect-pcre.h"
+#include "detect-tls-ja3-hash.h"
+
+#include "flow.h"
+#include "flow-util.h"
+#include "flow-var.h"
+
+#include "conf.h"
+#include "conf-yaml-loader.h"
+
+#include "util-debug.h"
+#include "util-unittest.h"
+#include "util-spm.h"
+#include "util-print.h"
+#include "util-ja3.h"
+
+#include "stream-tcp.h"
+
+#include "app-layer.h"
+#include "app-layer-ssl.h"
+
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+
+static int DetectTlsJa3HashSetup(DetectEngineCtx *, Signature *, const char *);
+static void DetectTlsJa3HashRegisterTests(void);
+static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
+       const DetectEngineTransforms *transforms,
+       Flow *_f, const uint8_t _flow_flags,
+       void *txv, const int list_id);
+static int g_tls_ja3_hash_buffer_id = 0;
+
+/**
+ * \brief Registration function for keyword: ja3_hash
+ */
+void DetectTlsJa3HashRegister(void)
+{
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].name = "ja3_hash";
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].desc = "content modifier to match the JA3 hash buffer";
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].url = DOC_URL DOC_VERSION "/rules/ja3-keywords.html#ja3_hash";
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].Match = NULL;
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].Setup = DetectTlsJa3HashSetup;
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].Free = NULL;
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].RegisterTests = DetectTlsJa3HashRegisterTests;
+
+    sigmatch_table[DETECT_AL_TLS_JA3_HASH].flags |= SIGMATCH_NOOPT;
+
+    DetectAppLayerInspectEngineRegister2("ja3_hash", ALPROTO_TLS, SIG_FLAG_TOSERVER, 0,
+            DetectEngineInspectBufferGeneric, GetData);
+
+    DetectAppLayerMpmRegister2("ja3_hash", SIG_FLAG_TOSERVER, 2,
+            PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, 0);
+
+    DetectBufferTypeSetDescriptionByName("ja3_hash", "TLS JA3 hash");
+
+    g_tls_ja3_hash_buffer_id = DetectBufferTypeGetByName("ja3_hash");
+}
+
+/**
+ * \brief this function setup the ja3_hash modifier keyword used in the rule
+ *
+ * \param de_ctx Pointer to the Detection Engine Context
+ * \param s      Pointer to the Signature to which the current keyword belongs
+ * \param str    Should hold an empty string always
+ *
+ * \retval 0 On success
+ */
+static int DetectTlsJa3HashSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
+{
+    DetectBufferSetActiveList(s, g_tls_ja3_hash_buffer_id);
+    s->alproto = ALPROTO_TLS;
+
+    if (RunmodeIsUnittests())
+        return 0;
+
+    /* Check if JA3 is disabled */
+    if (Ja3IsDisabled("rule"))
+        return -1;
+
+    return 0;
+}
+
+static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f,
+        const uint8_t _flow_flags, void *txv, const int list_id)
+{
+    BUG_ON(det_ctx->inspect_buffers == NULL);
+    InspectionBuffer *buffer = &det_ctx->inspect_buffers[list_id];
+
+    if (buffer->inspect == NULL) {
+        SSLState *ssl_state = (SSLState *)_f->alstate;
+
+        if (ssl_state->ja3_hash == NULL) {
+            return NULL;
+        }
+
+        const uint32_t data_len = strlen(ssl_state->ja3_hash);
+        const uint8_t *data = (uint8_t *)ssl_state->ja3_hash;
+
+        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferApplyTransforms(buffer, transforms);
+    }
+
+    return buffer;
+}
+
+#ifndef HAVE_NSS
+
+static void DetectTlsJa3HashRegisterTests(void)
+{
+    /* Don't register any tests */
+}
+
+#else /* HAVE_NSS */
+
+#ifdef UNITTESTS
+
+/**
+ * \test Test matching on a simple client hello packet
+ */
+static int DetectTlsJa3HashTest01(void)
+{
+    /* Client hello */
+    uint8_t buf[] = { 0x16, 0x03, 0x03, 0x00, 0x82, 0x01, 0x00, 0x00, 0x7E,
+                      0x03, 0x03, 0x57, 0x04, 0x9F, 0x5D, 0xC9, 0x5C, 0x87,
+                      0xAE, 0xF2, 0xA7, 0x4A, 0xFC, 0x59, 0x78, 0x23, 0x31,
+                      0x61, 0x2D, 0x29, 0x92, 0xB6, 0x70, 0xA5, 0xA1, 0xFC,
+                      0x0E, 0x79, 0xFE, 0xC3, 0x97, 0x37, 0xC0, 0x00, 0x00,
+                      0x44, 0x00, 0x04, 0x00, 0x05, 0x00, 0x0A, 0x00, 0x0D,
+                      0x00, 0x10, 0x00, 0x13, 0x00, 0x16, 0x00, 0x2F, 0x00,
+                      0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x35,
+                      0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00,
+                      0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40,
+                      0x00, 0x41, 0x00, 0x44, 0x00, 0x45, 0x00, 0x66, 0x00,
+                      0x67, 0x00, 0x68, 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B,
+                      0x00, 0x84, 0x00, 0x87, 0x00, 0xFF, 0x01, 0x00, 0x00,
+                      0x13, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x0D, 0x00, 0x00,
+                      0x0A, 0x67, 0x6F, 0x6F, 0x67, 0x6C, 0x65, 0x2E, 0x63,
+                      0x6F, 0x6D, };
+
+
+    Flow f;
+    SSLState *ssl_state = NULL;
+    Packet *p = NULL;
+    Signature *s = NULL;
+    ThreadVars tv;
+    DetectEngineThreadCtx *det_ctx = NULL;
+    TcpSession ssn;
+    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
+
+    memset(&tv, 0, sizeof(ThreadVars));
+    memset(&f, 0, sizeof(Flow));
+    memset(&ssn, 0, sizeof(TcpSession));
+
+    p = UTHBuildPacketReal(buf, sizeof(buf), IPPROTO_TCP,
+                           "192.168.1.5", "192.168.1.1",
+                           41424, 443);
+
+    FLOW_INITIALIZE(&f);
+    f.protoctx = (void *)&ssn;
+    f.flags |= FLOW_IPV4;
+    f.proto = IPPROTO_TCP;
+    f.protomap = FlowGetProtoMapping(f.proto);
+
+    p->flow = &f;
+    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
+    p->flowflags |= FLOW_PKT_TOSERVER|FLOW_PKT_ESTABLISHED;
+    f.alproto = ALPROTO_TLS;
+
+    StreamTcpInitConfig(TRUE);
+
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
+
+    de_ctx->mpm_matcher = mpm_default_matcher;
+    de_ctx->flags |= DE_QUIET;
+
+    s = DetectEngineAppendSig(de_ctx, "alert tls any any -> any any "
+                              "(msg:\"Test ja3_hash\"; ja3_hash; "
+                              "content:\"e7eca2baf4458d095b7f45da28c16c34\"; "
+                              "sid:1;)");
+    FAIL_IF_NULL(s);
+
+    SigGroupBuild(de_ctx);
+    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
+
+    FLOWLOCK_WRLOCK(&f);
+    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TLS,
+                                STREAM_TOSERVER, buf, sizeof(buf));
+    FLOWLOCK_UNLOCK(&f);
+    FAIL_IF(r != 0);
+
+    ssl_state = f.alstate;
+    FAIL_IF_NULL(ssl_state);
+
+    FAIL_IF_NULL(ssl_state->ja3_hash);
+
+    SigMatchSignatures(&tv, de_ctx, det_ctx, p);
+
+    FAIL_IF_NOT(PacketAlertCheck(p, 1));
+
+    AppLayerParserThreadCtxFree(alp_tctx);
+    DetectEngineThreadCtxDeinit(&tv, det_ctx);
+    DetectEngineCtxFree(de_ctx);
+
+    StreamTcpFreeConfig(TRUE);
+    FLOW_DESTROY(&f);
+    UTHFreePacket(p);
+
+    PASS;
+}
+
+#endif /* UNITTESTS */
+
+static void DetectTlsJa3HashRegisterTests(void)
+{
+#ifdef UNITTESTS
+    UtRegisterTest("DetectTlsJa3HashTest01", DetectTlsJa3HashTest01);
+#endif /* UNITTESTS */
+}
+
+#endif /* HAVE_NSS */

diff --git a/src/detect-tls-ja3-hash.h b/src/detect-tls-ja3-hash.h
new file mode 100644 (file)
index 0000000..556896d
--- /dev/null
+++ b/src/detect-tls-ja3-hash.h
@@ -0,0 +1,30 @@
+/* Copyright (C) 2017 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Mats Klepsland <mats.klepsland@gmail.com>
+ */
+
+#ifndef __DETECT_TLS_JA3_HASH_H__
+#define __DETECT_TLS_JA3_HASH_H__
+
+/* Prototypes */
+void DetectTlsJa3HashRegister(void);
+
+#endif /* __DETECT_TLS_JA3_HASH_H__ */

diff --git a/src/util-error.c b/src/util-error.c
index c40bef0e521837a6d880d4decf78806864b3e76f..639a6cf3cb3e76dde157341cdcb043a88fd891ef 100644 (file)
--- a/src/util-error.c
+++ b/src/util-error.c
@@ -349,6 +349,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_WARN_FLOWBIT);
         CASE_CODE (SC_ERR_SMB_CONFIG);
         CASE_CODE (SC_WARN_NO_JA3_SUPPORT);
+        CASE_CODE (SC_WARN_JA3_DISABLED);
         CASE_CODE (SC_ERR_MAX);
     }
 

diff --git a/src/util-error.h b/src/util-error.h
index 4cd33fd727ea4f87b9fa786be396f9684e10d075..399e96f2299d8d0c245c53faf02be8d6b82e8c30 100644 (file)
--- a/src/util-error.h
+++ b/src/util-error.h
@@ -339,6 +339,7 @@ typedef enum {
     SC_WARN_FLOWBIT,
     SC_ERR_SMB_CONFIG,
     SC_WARN_NO_JA3_SUPPORT,
+    SC_WARN_JA3_DISABLED,
     SC_ERR_MAX
 } SCError;