From: Philippe Antoine Date: Fri, 28 Feb 2020 11:03:16 +0000 (+0100) Subject: detect: adds icmpv6.hdr keyword X-Git-Tag: suricata-6.0.0-beta1~673 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83963334932e8e62ecbcb3e957f5e5a6fd2cdf0d;p=thirdparty%2Fsuricata.git detect: adds icmpv6.hdr keyword --- diff --git a/doc/userguide/rules/header-keywords.rst b/doc/userguide/rules/header-keywords.rst index 192d2f5733..a5d9fba724 100644 --- a/doc/userguide/rules/header-keywords.rst +++ b/doc/userguide/rules/header-keywords.rst @@ -621,3 +621,8 @@ Example of icmp_seq in a rule: .. container:: example-rule alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN Broadscan Smurf Scanner"; dsize:4; icmp_id:0; :example-rule-emphasis:`icmp_seq:0;` itype:8; classtype:attempted-recon; sid:2100478; rev:4;) + +icmpv6.hdr +^^^^^^^^^^ + +Sticky buffer to match on the whole ICMPv6 header. diff --git a/src/Makefile.am b/src/Makefile.am index 945323462b..b0e9cf4050 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -202,6 +202,7 @@ detect-http-ua.c detect-http-ua.h \ detect-http-uri.c detect-http-uri.h \ detect-icmp-id.c detect-icmp-id.h \ detect-icmp-seq.c detect-icmp-seq.h \ +detect-icmpv6hdr.c detect-icmpv6hdr.h \ detect-icode.c detect-icode.h \ detect-id.c detect-id.h \ detect-ipopts.c detect-ipopts.h \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 43764ef4b5..21e436d71b 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -173,6 +173,7 @@ #include "detect-tcphdr.h" #include "detect-tcpmss.h" #include "detect-udphdr.h" +#include "detect-icmpv6hdr.h" #include "detect-ipv4hdr.h" #include "detect-ipv6hdr.h" #include "detect-krb5-cname.h" @@ -545,6 +546,7 @@ void SigTableSetup(void) DetectTcphdrRegister(); DetectUdphdrRegister(); DetectTcpmssRegister(); + DetectICMPv6hdrRegister(); DetectIpv4hdrRegister(); DetectIpv6hdrRegister(); DetectKrb5CNameRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 2edfaaa94f..55e6603907 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -238,6 +238,7 @@ enum DetectKeywordId { DETECT_TEMPLATE2, DETECT_IPV4HDR, DETECT_IPV6HDR, + DETECT_ICMPV6HDR, DETECT_TCPHDR, DETECT_UDPHDR, DETECT_TCPMSS, diff --git a/src/detect-icmpv6hdr.c b/src/detect-icmpv6hdr.c new file mode 100644 index 0000000000..b169c870ce --- /dev/null +++ b/src/detect-icmpv6hdr.c @@ -0,0 +1,128 @@ +/* Copyright (C) 2020 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Philippe Antoine + * + */ + +#include "suricata-common.h" + +#include "detect.h" +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "detect-engine-prefilter.h" +#include "detect-engine-content-inspection.h" +#include "detect-fast-pattern.h" +#include "detect-icmpv6hdr.h" + +/* prototypes */ +static int DetectICMPv6hdrSetup (DetectEngineCtx *, Signature *, const char *); +#ifdef UNITTESTS +void DetectICMPv6hdrRegisterTests (void); +#endif + +static int g_icmpv6hdr_buffer_id = 0; + +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Packet *p, const int list_id); + +/** + * \brief Registration function for icmpv6.hdr: keyword + */ +void DetectICMPv6hdrRegister(void) +{ + sigmatch_table[DETECT_ICMPV6HDR].name = "icmpv6.hdr"; + sigmatch_table[DETECT_ICMPV6HDR].desc = "sticky buffer to match on the ICMP V6 header"; + sigmatch_table[DETECT_ICMPV6HDR].url = DOC_URL DOC_VERSION "/rules/header-keywords.html#icmpv6hdr"; + sigmatch_table[DETECT_ICMPV6HDR].Setup = DetectICMPv6hdrSetup; + sigmatch_table[DETECT_ICMPV6HDR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER; +#ifdef UNITTESTS + sigmatch_table[DETECT_ICMPV6HDR].RegisterTests = DetectICMPv6hdrRegisterTests; +#endif + + g_icmpv6hdr_buffer_id = DetectBufferTypeRegister("icmpv6.hdr"); + BUG_ON(g_icmpv6hdr_buffer_id < 0); + + DetectBufferTypeSupportsPacket("icmpv6.hdr"); + + DetectPktMpmRegister("icmpv6.hdr", 2, PrefilterGenericMpmPktRegister, GetData); + + DetectPktInspectEngineRegister("icmpv6.hdr", GetData, + DetectEngineInspectPktBufferGeneric); + + return; +} + +/** + * \brief setup icmpv6.hdr sticky buffer + * + * \param de_ctx pointer to the Detection Engine Context + * \param s pointer to the Current Signature + * \param _unused unused + * + * \retval 0 on Success + * \retval -1 on Failure + */ +static int DetectICMPv6hdrSetup (DetectEngineCtx *de_ctx, Signature *s, const char *_unused) +{ + // ICMPv6 comes only with IPv6 + s->proto.flags |= DETECT_PROTO_IPV6; + if (!(DetectProtoContainsProto(&s->proto, IPPROTO_ICMPV6))) + return -1; + + s->flags |= SIG_FLAG_REQUIRE_PACKET; + + if (DetectBufferSetActiveList(s, g_icmpv6hdr_buffer_id) < 0) + return -1; + + return 0; +} + +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Packet *p, const int list_id) +{ + SCEnter(); + + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + uint32_t hlen = ICMPV6_HEADER_LEN; + if (((uint8_t *)p->icmpv6h + (ptrdiff_t)hlen) > + ((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p))) + { + SCLogDebug("data out of range: %p > %p", + ((uint8_t *)p->icmpv6h + (ptrdiff_t)hlen), + ((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p))); + SCReturnPtr(NULL, "InspectionBuffer"); + } + + const uint32_t data_len = hlen; + const uint8_t *data = (const uint8_t *)p->icmpv6h; + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + SCReturnPtr(buffer, "InspectionBuffer"); +} + +#ifdef UNITTESTS +#include "tests/detect-icmpv6hdr.c" +#endif diff --git a/src/detect-icmpv6hdr.h b/src/detect-icmpv6hdr.h new file mode 100644 index 0000000000..18e91ae3c3 --- /dev/null +++ b/src/detect-icmpv6hdr.h @@ -0,0 +1,29 @@ +/* Copyright (C) 2020 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Philippe Antoine + */ + +#ifndef _DETECT_ICMPV6HDR_H +#define _DETECT_ICMPV6HDR_H + +void DetectICMPv6hdrRegister(void); + +#endif /* _DETECT_ICMPV6HDR_H */ diff --git a/src/tests/detect-icmpv6hdr.c b/src/tests/detect-icmpv6hdr.c new file mode 100644 index 0000000000..84292a45b5 --- /dev/null +++ b/src/tests/detect-icmpv6hdr.c @@ -0,0 +1,47 @@ +/* Copyright (C) 2020 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +#include "../suricata-common.h" + +#include "../detect.h" +#include "../detect-parse.h" +#include "../detect-engine-prefilter-common.h" + +#include "../detect-icmpv6hdr.h" + +#include "../util-unittest.h" + +static int DetectICMPv6hdrParseTest01 (void) +{ + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + FAIL_IF_NULL(de_ctx); + + Signature *sig = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (icmpv6.hdr; content:\"A\"; sid:1; rev:1;)"); + FAIL_IF_NULL(sig); + + DetectEngineCtxFree(de_ctx); + PASS; +} + +/** + * \brief this function registers unit tests for DetectICMPv6hdr + */ +void DetectICMPv6hdrRegisterTests(void) +{ + UtRegisterTest("DetectICMPv6hdrParseTest01", DetectICMPv6hdrParseTest01); +}