tcp: rejects FIN+SYN packets as invalid

Ticket: #4569

If a FIN+SYN packet is sent, the destination may keep the
connection alive instead of starting to close it.
In this case, a later SYN packet will be ignored by the
destination.

Previously, Suricata considered this a session reuse, and thus
used the sequence number of the last SYN packet, instead of
using the one of the live connection, leading to evasion.

This commit errors on FIN+SYN so that they do not get
processed as regular FIN packets.

(cherry picked from commit 6cb6225b28c5d8e616a420b7d05b129ba2845dc0)

diff --git a/rules/stream-events.rules b/rules/stream-events.rules
index 7ea3261862b7e12fab27c59dc065bd7c30449bef..39435819f534c7ab5005f06be57fd4853f342315 100644 (file)
--- a/rules/stream-events.rules
+++ b/rules/stream-events.rules
@@ -91,5 +91,8 @@ alert tcp any any -> any any (msg:"SURICATA STREAM excessive retransmissions"; f
 # Packet on wrong thread. Fires at most once per flow.
 alert tcp any any -> any any (msg:"SURICATA STREAM pkt seen on wrong thread"; stream-event:wrong_thread; sid:2210059; rev:1;)
 
-# next sid 2210060
+# Packet with FIN+SYN set
+alert tcp any any -> any any (msg:"SURICATA STREAM FIN SYN reuse"; stream-event:fin_syn; classtype:protocol-command-decode; sid:2210060; rev:1;)
+
+# next sid 2210061
 

diff --git a/src/decode-events.c b/src/decode-events.c
index f96c574fa84bad7977ae8c9654d0b9de65c3449d..a4ec4e697b771c5a9b3faab0cdcd82887d7f2146 100644 (file)
--- a/src/decode-events.c
+++ b/src/decode-events.c
@@ -723,6 +723,10 @@ const struct DecodeEvents_ DEvents[] = {
             "stream.fin_out_of_window",
             STREAM_FIN_OUT_OF_WINDOW,
     },
+    {
+            "stream.fin_syn",
+            STREAM_FIN_SYN,
+    },
     {
             "stream.lastack_ack_wrong_seq",
             STREAM_LASTACK_ACK_WRONG_SEQ,

diff --git a/src/decode-events.h b/src/decode-events.h
index 886cedf3a69e9e7d09d11f4c38a3b0224c24ccd2..b82fa235d88060dba46cae38a2423125b7042343 100644 (file)
--- a/src/decode-events.h
+++ b/src/decode-events.h
@@ -254,6 +254,7 @@ enum {
     STREAM_FIN2_INVALID_ACK,
     STREAM_FIN_BUT_NO_SESSION,
     STREAM_FIN_OUT_OF_WINDOW,
+    STREAM_FIN_SYN,
     STREAM_LASTACK_ACK_WRONG_SEQ,
     STREAM_LASTACK_INVALID_ACK,
     STREAM_RST_BUT_NO_SESSION,

diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index a170f90266741d1a3a64a6f215feb29fb5e6e3d7..e6ab8b2bd284f57cf140f57aec2eb7161f758ce5 100644 (file)
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -2750,6 +2750,11 @@ static int StreamTcpHandleFin(ThreadVars *tv, StreamTcpThread *stt,
             return -1;
         }
 
+        if (p->tcph->th_flags & TH_SYN) {
+            SCLogDebug("ssn %p: FIN+SYN", ssn);
+            StreamTcpSetEvent(p, STREAM_FIN_SYN);
+            return -1;
+        }
         StreamTcpPacketSetState(p, ssn, TCP_CLOSE_WAIT);
         SCLogDebug("ssn %p: state changed to TCP_CLOSE_WAIT", ssn);