From: Giuseppe Longo Date: Tue, 19 Feb 2019 20:11:31 +0000 (+0100) Subject: detect/sip.method: add sticky buffer X-Git-Tag: suricata-5.0.0-rc1~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=424eead8c08ed2a437554bbe6e8b3f3aec5a3d26;p=thirdparty%2Fsuricata.git detect/sip.method: add sticky buffer Matches on uri field in SIP. --- diff --git a/rust/src/sip/detect.rs b/rust/src/sip/detect.rs new file mode 100644 index 0000000000..3ca496a821 --- /dev/null +++ b/rust/src/sip/detect.rs @@ -0,0 +1,43 @@ +/* Copyright (C) 2019 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +// written by Giuseppe Longo + +use std::ptr; + +use sip::sip::SIPTransaction; + +#[no_mangle] +pub unsafe extern "C" fn rs_sip_tx_get_method(tx: &mut SIPTransaction, + buffer: *mut *const u8, + buffer_len: *mut u32) + -> u8 +{ + if let Some(ref r) = tx.request { + let m = &r.method; + if m.len() > 0 { + *buffer = m.as_ptr(); + *buffer_len = m.len() as u32; + return 1; + } + } + + *buffer = ptr::null(); + *buffer_len = 0; + + return 0; +} diff --git a/rust/src/sip/mod.rs b/rust/src/sip/mod.rs index 061133de8a..2824c9e1ce 100755 --- a/rust/src/sip/mod.rs +++ b/rust/src/sip/mod.rs @@ -20,3 +20,4 @@ pub mod sip; pub mod parser; pub mod log; +pub mod detect; diff --git a/src/Makefile.am b/src/Makefile.am index 491c712413..8caeff8f6c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -245,6 +245,7 @@ detect-sid.c detect-sid.h \ detect-snmp-community.c detect-snmp-community.h \ detect-snmp-pdu_type.c detect-snmp-pdu_type.h \ detect-snmp-version.c detect-snmp-version.h \ +detect-sip-method.c detect-sip-method.h \ detect-ssh-proto.c detect-ssh-proto.h \ detect-ssh-proto-version.c detect-ssh-proto-version.h \ detect-ssh-software.c detect-ssh-software.h \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 7a2cd382ab..b52c05b2f9 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -179,6 +179,7 @@ #include "detect-krb5-errcode.h" #include "detect-krb5-msgtype.h" #include "detect-krb5-sname.h" +#include "detect-sip-method.h" #include "detect-target.h" #include "detect-template-rust-buffer.h" #include "detect-snmp-version.h" @@ -544,6 +545,7 @@ void SigTableSetup(void) DetectKrb5ErrCodeRegister(); DetectKrb5MsgTypeRegister(); DetectKrb5SNameRegister(); + DetectSipMethodRegister(); DetectTargetRegister(); DetectTemplateRustBufferRegister(); DetectSNMPVersionRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 4c3e5ff6d5..46cb6a0d52 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -226,6 +226,8 @@ enum { DETECT_AL_KRB5_CNAME, DETECT_AL_KRB5_SNAME, + DETECT_AL_SIP_METHOD, + DETECT_TEMPLATE, DETECT_TEMPLATE2, DETECT_IPV4HDR, diff --git a/src/detect-sip-method.c b/src/detect-sip-method.c new file mode 100644 index 0000000000..add868f927 --- /dev/null +++ b/src/detect-sip-method.c @@ -0,0 +1,151 @@ +/* Copyright (C) 2019 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * + * \author Giuseppe Longo + * + * Implements the sip.method sticky buffer + * + */ + +#include "suricata-common.h" +#include "threads.h" +#include "debug.h" +#include "decode.h" +#include "detect.h" + +#include "detect-parse.h" +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "detect-engine-prefilter.h" +#include "detect-content.h" +#include "detect-pcre.h" + +#include "flow.h" +#include "flow-var.h" +#include "flow-util.h" + +#include "util-debug.h" +#include "util-unittest.h" +#include "util-unittest-helper.h" +#include "util-spm.h" + +#include "app-layer.h" +#include "app-layer-parser.h" + +#include "detect-sip-method.h" +#include "stream-tcp.h" + +#include "rust.h" +#include "app-layer-sip.h" +#include "rust-sip-detect-gen.h" + +#define KEYWORD_NAME "sip.method" +#define KEYWORD_DOC "sip-keywords.html#sip-method" +#define BUFFER_NAME "sip.method" +#define BUFFER_DESC "sip request method" +static int g_buffer_id = 0; + +static int DetectSipMethodSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) +{ + if (DetectBufferSetActiveList(s, g_buffer_id) < 0) + return -1; + + if (DetectSignatureSetAppProto(s, ALPROTO_SIP) < 0) + return -1; + + return 0; +} + +static _Bool DetectSipMethodValidateCallback(const Signature *s, const char **sigerror) +{ + const SigMatch *sm = s->init_data->smlists[g_buffer_id]; + for ( ; sm != NULL; sm = sm->next) { + if (sm->type != DETECT_CONTENT) + continue; + const DetectContentData *cd = (const DetectContentData *)sm->ctx; + if (cd->content && cd->content_len) { + if (cd->content[cd->content_len-1] == 0x20) { + *sigerror = "sip.method pattern with trailing space"; + SCLogError(SC_ERR_INVALID_SIGNATURE, "%s", *sigerror); + return FALSE; + } else if (cd->content[0] == 0x20) { + *sigerror = "sip.method pattern with leading space"; + SCLogError(SC_ERR_INVALID_SIGNATURE, "%s", *sigerror); + return FALSE; + } else if (cd->content[cd->content_len-1] == 0x09) { + *sigerror = "sip.method pattern with trailing tab"; + SCLogError(SC_ERR_INVALID_SIGNATURE, "%s", *sigerror); + return FALSE; + } else if (cd->content[0] == 0x09) { + *sigerror = "sip.method pattern with leading tab"; + SCLogError(SC_ERR_INVALID_SIGNATURE, "%s", *sigerror); + return FALSE; + } + } + } + return TRUE; +} + +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + const uint8_t *b = NULL; + uint32_t b_len = 0; + + if (rs_sip_tx_get_method(txv, &b, &b_len) != 1) + return NULL; + if (b == NULL || b_len == 0) + return NULL; + + InspectionBufferSetup(buffer, b, b_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + +void DetectSipMethodRegister(void) +{ + /* sip.method sticky buffer */ + sigmatch_table[DETECT_AL_SIP_METHOD].name = KEYWORD_NAME; + sigmatch_table[DETECT_AL_SIP_METHOD].desc = "sticky buffer to match on the SIP method buffer"; + sigmatch_table[DETECT_AL_SIP_METHOD].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC; + sigmatch_table[DETECT_AL_SIP_METHOD].Setup = DetectSipMethodSetup; + sigmatch_table[DETECT_AL_SIP_METHOD].flags |= SIGMATCH_NOOPT; + + DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SIP, + SIG_FLAG_TOSERVER, 0, + DetectEngineInspectBufferGeneric, GetData); + + DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData, ALPROTO_SIP, + 1); + + DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); + + DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, + DetectSipMethodValidateCallback); + + g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); + + SCLogDebug("registering " BUFFER_NAME " rule option"); +} diff --git a/src/detect-sip-method.h b/src/detect-sip-method.h new file mode 100644 index 0000000000..512c752acf --- /dev/null +++ b/src/detect-sip-method.h @@ -0,0 +1,29 @@ +/* Copyright (C) 2019 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Giuseppe Longo + */ + +#ifndef __DETECT_SIP_METHOD_H__ +#define __DETECT_SIP_METHOD_H__ + +void DetectSipMethodRegister(void); + +#endif /* __DETECT_SIP_METHOD_H__ */