tcp: rejects FIN+SYN packets as invalid

Ticket: #4569

If a FIN+SYN packet is sent, the destination may keep the
connection alive instead of starting to close it.
In this case, a later SYN packet will be ignored by the
destination.

Previously, Suricata considered this a session reuse, and thus
used the sequence number of the last SYN packet, instead of
using the one of the live connection, leading to evasion.

This commit errors on FIN+SYN so that they do not get
processed as regular FIN packets.

diff --git a/rules/stream-events.rules b/rules/stream-events.rules
index 7ea3261862b7e12fab27c59dc065bd7c30449bef..39435819f534c7ab5005f06be57fd4853f342315 100644 (file)
--- a/rules/stream-events.rules
+++ b/rules/stream-events.rules
@@ -91,5 +91,8 @@ alert tcp any any -> any any (msg:"SURICATA STREAM excessive retransmissions"; f
 # Packet on wrong thread. Fires at most once per flow.
 alert tcp any any -> any any (msg:"SURICATA STREAM pkt seen on wrong thread"; stream-event:wrong_thread; sid:2210059; rev:1;)
 
-# next sid 2210060
+# Packet with FIN+SYN set
+alert tcp any any -> any any (msg:"SURICATA STREAM FIN SYN reuse"; stream-event:fin_syn; classtype:protocol-command-decode; sid:2210060; rev:1;)
+
+# next sid 2210061
 

diff --git a/src/decode-events.c b/src/decode-events.c
index 8023d107508a995e87a5b867228cf7a35023000d..cd93e310523480e60b2da0529154ae4f018e1424 100644 (file)
--- a/src/decode-events.c
+++ b/src/decode-events.c
@@ -754,6 +754,10 @@ const struct DecodeEvents_ DEvents[] = {
             "stream.fin_out_of_window",
             STREAM_FIN_OUT_OF_WINDOW,
     },
+    {
+            "stream.fin_syn",
+            STREAM_FIN_SYN,
+    },
     {
             "stream.lastack_ack_wrong_seq",
             STREAM_LASTACK_ACK_WRONG_SEQ,

diff --git a/src/decode-events.h b/src/decode-events.h
index 6fad62e278469af29d82e93acdb99a6c504e3155..715b46e8d14a5b48afa945454ddc4e8e61f56a5f 100644 (file)
--- a/src/decode-events.h
+++ b/src/decode-events.h
@@ -265,6 +265,7 @@ enum {
     STREAM_FIN2_INVALID_ACK,
     STREAM_FIN_BUT_NO_SESSION,
     STREAM_FIN_OUT_OF_WINDOW,
+    STREAM_FIN_SYN,
     STREAM_LASTACK_ACK_WRONG_SEQ,
     STREAM_LASTACK_INVALID_ACK,
     STREAM_RST_BUT_NO_SESSION,

diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 311ce1ed67dd177b1a30cb9daf62c7e4ab49b701..1cff19fa5c136143fde9a9385e767c02af9f9768 100644 (file)
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -2813,6 +2813,11 @@ static int StreamTcpHandleFin(ThreadVars *tv, StreamTcpThread *stt,
             return -1;
         }
 
+        if (p->tcph->th_flags & TH_SYN) {
+            SCLogDebug("ssn %p: FIN+SYN", ssn);
+            StreamTcpSetEvent(p, STREAM_FIN_SYN);
+            return -1;
+        }
         StreamTcpPacketSetState(p, ssn, TCP_CLOSE_WAIT);
         SCLogDebug("ssn %p: state changed to TCP_CLOSE_WAIT", ssn);