mirror of https://github.com/OISF/suricata
detect: add (mpm) hassh keywords
Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g: alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;) alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;) alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;) alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)pull/5141/head
Vadym Malakhatko
5 years ago
parent
536cee3ba9
commit
216a75c522
@ -0,0 +1,145 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-state.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
#include "stream-tcp.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-ssh.h"
|
||||
#include "detect-ssh-hassh-server-string.h"
|
||||
#include "rust.h"
|
||||
|
||||
|
||||
#define KEYWORD_NAME "ssh.hassh.server.string"
|
||||
#define KEYWORD_ALIAS "ssh-hassh-server-string"
|
||||
#define KEYWORD_DOC "ssh-keywords.html#ssh.hassh.server.string"
|
||||
#define BUFFER_NAME "ssh.hassh.server.string"
|
||||
#define BUFFER_DESC "Ssh Client Key Exchange methods For ssh Servers"
|
||||
static int g_ssh_hassh_server_string_buffer_id = 0;
|
||||
|
||||
|
||||
static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms, Flow *_f,
|
||||
const uint8_t flow_flags, void *txv, const int list_id)
|
||||
{
|
||||
|
||||
SCEnter();
|
||||
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
|
||||
if (buffer->inspect == NULL) {
|
||||
const uint8_t *hassh = NULL;
|
||||
uint32_t b_len = 0;
|
||||
|
||||
if (rs_ssh_tx_get_hassh_string(txv, &hassh, &b_len, flow_flags) != 1)
|
||||
return NULL;
|
||||
if (hassh == NULL || b_len == 0) {
|
||||
SCLogDebug("SSH hassh string is not set");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
InspectionBufferSetup(buffer, hassh, b_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function setup the ssh.hassh.server.string modifier keyword used in the rule
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context
|
||||
* \param s Pointer to the Signature to which the current keyword belongs
|
||||
* \param str Should hold an empty string always
|
||||
*
|
||||
* \retval 0 On success
|
||||
* \retval -1 On failure
|
||||
* \retval -2 on failure that should be silent after the first
|
||||
*/
|
||||
static int DetectSshHasshServerStringSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
||||
{
|
||||
if (DetectBufferSetActiveList(s, g_ssh_hassh_server_string_buffer_id) < 0)
|
||||
return -1;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_SSH) < 0)
|
||||
return -1;
|
||||
|
||||
/* try to enable Hassh */
|
||||
rs_ssh_enable_hassh();
|
||||
|
||||
/* Check if Hassh is disabled */
|
||||
if (!RunmodeIsUnittests() && !rs_ssh_hassh_is_enabled()) {
|
||||
if (!SigMatchSilentErrorEnabled(de_ctx, DETECT_AL_SSH_HASSH_SERVER_STRING)) {
|
||||
SCLogError(SC_WARN_HASSH_DISABLED, "hassh support is not enabled");
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Registration function for hasshServer.string keyword.
|
||||
*/
|
||||
void DetectSshHasshServerStringRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].name = KEYWORD_NAME;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].alias = KEYWORD_ALIAS;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].desc = BUFFER_NAME " sticky buffer";
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].RegisterTests = NULL;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].url = "/rules/" KEYWORD_DOC;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].Setup = DetectSshHasshServerStringSetup;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER_STRING].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;
|
||||
|
||||
|
||||
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2,
|
||||
PrefilterGenericMpmRegister, GetSshData,
|
||||
ALPROTO_SSH, SshStateBannerDone);
|
||||
DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SSH,
|
||||
SIG_FLAG_TOCLIENT, SshStateBannerDone,
|
||||
DetectEngineInspectBufferGeneric, GetSshData);
|
||||
|
||||
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
|
||||
|
||||
g_ssh_hassh_server_string_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
|
||||
}
|
||||
@ -0,0 +1,30 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Malakhatko Vadym <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_SSH_HASSH_SERVER_STRING_H__
|
||||
#define __DETECT_SSH_HASSH_SERVER_STRING_H__
|
||||
|
||||
/* prototypes */
|
||||
void DetectSshHasshServerStringRegister (void);
|
||||
|
||||
#endif /* __DETECT_SSH_HASSH_SERVER_STRING_H__ */
|
||||
@ -0,0 +1,213 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-state.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
#include "stream-tcp.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-ssh.h"
|
||||
#include "detect-ssh-hassh-server.h"
|
||||
#include "rust.h"
|
||||
|
||||
|
||||
#define KEYWORD_NAME "ssh.hassh.server"
|
||||
#define KEYWORD_ALIAS "ssh-hassh-server"
|
||||
#define KEYWORD_DOC "ssh-keywords.html#ssh.hassh.server"
|
||||
#define BUFFER_NAME "ssh.hassh.server"
|
||||
#define BUFFER_DESC "Ssh Client Fingerprinting For Ssh Servers"
|
||||
static int g_ssh_hassh_buffer_id = 0;
|
||||
|
||||
|
||||
static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms, Flow *_f,
|
||||
const uint8_t flow_flags, void *txv, const int list_id)
|
||||
{
|
||||
|
||||
SCEnter();
|
||||
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
|
||||
if (buffer->inspect == NULL) {
|
||||
const uint8_t *hasshServer = NULL;
|
||||
uint32_t b_len = 0;
|
||||
|
||||
if (rs_ssh_tx_get_hassh(txv, &hasshServer, &b_len, flow_flags) != 1)
|
||||
return NULL;
|
||||
if (hasshServer == NULL || b_len == 0) {
|
||||
SCLogDebug("SSH hassh not set");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
InspectionBufferSetup(buffer, hasshServer, b_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function setup the ssh.hassh.server modifier keyword used in the rule
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context
|
||||
* \param s Pointer to the Signature to which the current keyword belongs
|
||||
* \param str Should hold an empty string always
|
||||
*
|
||||
* \retval 0 On success
|
||||
* \retval -1 On failure
|
||||
* \retval -2 on failure that should be silent after the first
|
||||
*/
|
||||
static int DetectSshHasshServerSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
||||
{
|
||||
if (DetectBufferSetActiveList(s, g_ssh_hassh_buffer_id) < 0)
|
||||
return -1;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_SSH) < 0)
|
||||
return -1;
|
||||
|
||||
/* try to enable Hassh */
|
||||
rs_ssh_enable_hassh();
|
||||
|
||||
/* Check if Hassh is disabled */
|
||||
if (!RunmodeIsUnittests() && !rs_ssh_hassh_is_enabled()) {
|
||||
if (!SigMatchSilentErrorEnabled(de_ctx, DETECT_AL_SSH_HASSH_SERVER)) {
|
||||
SCLogError(SC_WARN_HASSH_DISABLED, "hassh support is not enabled");
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
|
||||
static _Bool DetectSshHasshServerHashValidateCallback(const Signature *s,
|
||||
const char **sigerror)
|
||||
{
|
||||
const SigMatch *sm = s->init_data->smlists[g_ssh_hassh_buffer_id];
|
||||
for ( ; sm != NULL; sm = sm->next)
|
||||
{
|
||||
if (sm->type != DETECT_CONTENT)
|
||||
continue;
|
||||
|
||||
const DetectContentData *cd = (DetectContentData *)sm->ctx;
|
||||
|
||||
if (cd->flags & DETECT_CONTENT_NOCASE) {
|
||||
*sigerror = "ssh.hassh.server should not be used together with "
|
||||
"nocase, since the rule is automatically "
|
||||
"lowercased anyway which makes nocase redundant.";
|
||||
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
||||
}
|
||||
|
||||
if (cd->content_len != 32)
|
||||
{
|
||||
*sigerror = "Invalid length of the specified ssh.hassh.server (should "
|
||||
"be 32 characters long). This rule will therefore "
|
||||
"never match.";
|
||||
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
||||
return FALSE;
|
||||
}
|
||||
for (size_t i = 0; i < cd->content_len; ++i)
|
||||
{
|
||||
if(!isxdigit(cd->content[i]))
|
||||
{
|
||||
*sigerror = "Invalid ssh.hassh.server string (should be string of hexademical characters)."
|
||||
"This rule will therefore never match.";
|
||||
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
static void DetectSshHasshServerHashSetupCallback(const DetectEngineCtx *de_ctx,
|
||||
Signature *s)
|
||||
{
|
||||
SigMatch *sm = s->init_data->smlists[g_ssh_hassh_buffer_id];
|
||||
for ( ; sm != NULL; sm = sm->next)
|
||||
{
|
||||
if (sm->type != DETECT_CONTENT)
|
||||
continue;
|
||||
|
||||
DetectContentData *cd = (DetectContentData *)sm->ctx;
|
||||
|
||||
uint32_t u;
|
||||
for (u = 0; u < cd->content_len; u++)
|
||||
{
|
||||
if (isupper(cd->content[u])) {
|
||||
cd->content[u] = tolower(cd->content[u]);
|
||||
}
|
||||
}
|
||||
|
||||
SpmDestroyCtx(cd->spm_ctx);
|
||||
cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
|
||||
de_ctx->spm_global_thread_ctx);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Registration function for hasshServer keyword.
|
||||
*/
|
||||
void DetectSshHasshServerRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].name = KEYWORD_NAME;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].alias = KEYWORD_ALIAS;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].desc = BUFFER_NAME " sticky buffer";
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].RegisterTests = NULL;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].url = "/rules/" KEYWORD_DOC;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].Setup = DetectSshHasshServerSetup;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_SERVER].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;
|
||||
|
||||
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2,
|
||||
PrefilterGenericMpmRegister, GetSshData,
|
||||
ALPROTO_SSH, SshStateBannerDone);
|
||||
DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SSH,
|
||||
SIG_FLAG_TOCLIENT, SshStateBannerDone,
|
||||
DetectEngineInspectBufferGeneric, GetSshData);
|
||||
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
|
||||
|
||||
g_ssh_hassh_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
|
||||
|
||||
DetectBufferTypeRegisterSetupCallback(BUFFER_NAME, DetectSshHasshServerHashSetupCallback);
|
||||
DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectSshHasshServerHashValidateCallback);
|
||||
}
|
||||
@ -0,0 +1,31 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Malakhatko Vadym <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_SSH_HASSH_SERVER_H__
|
||||
#define __DETECT_SSH_HASSH_SERVER_H__
|
||||
|
||||
/* prototypes */
|
||||
void DetectSshHasshServerRegister (void);
|
||||
|
||||
#endif /* __DETECT_SSH_HASSH_SERVER_H__ */
|
||||
|
||||
@ -0,0 +1,145 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-state.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "stream-tcp.h"
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-ssh.h"
|
||||
#include "detect-ssh-hassh-string.h"
|
||||
#include "rust.h"
|
||||
|
||||
|
||||
#define KEYWORD_NAME "ssh.hassh.string"
|
||||
#define KEYWORD_ALIAS "ssh-hassh-string"
|
||||
#define KEYWORD_DOC "ssh-keywords.html#hassh.string"
|
||||
#define BUFFER_NAME "ssh.hassh.string"
|
||||
#define BUFFER_DESC "Ssh Client Key Exchange methods For ssh Clients "
|
||||
static int g_ssh_hassh_string_buffer_id = 0;
|
||||
|
||||
|
||||
static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms, Flow *_f,
|
||||
const uint8_t flow_flags, void *txv, const int list_id)
|
||||
{
|
||||
|
||||
SCEnter();
|
||||
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
|
||||
if (buffer->inspect == NULL) {
|
||||
const uint8_t *hassh = NULL;
|
||||
uint32_t b_len = 0;
|
||||
|
||||
if (rs_ssh_tx_get_hassh_string(txv, &hassh, &b_len, flow_flags) != 1)
|
||||
return NULL;
|
||||
if (hassh == NULL || b_len == 0) {
|
||||
SCLogDebug("SSH hassh string is not set");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
InspectionBufferSetup(buffer, hassh, b_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function setup the hassh.string modifier keyword used in the rule
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context
|
||||
* \param s Pointer to the Signature to which the current keyword belongs
|
||||
* \param str Should hold an empty string always
|
||||
*
|
||||
* \retval 0 On success
|
||||
* \retval -1 On failure
|
||||
* \retval -2 on failure that should be silent after the first
|
||||
*/
|
||||
static int DetectSshHasshStringSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
||||
{
|
||||
if (DetectBufferSetActiveList(s, g_ssh_hassh_string_buffer_id) < 0)
|
||||
return -1;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_SSH) < 0)
|
||||
return -1;
|
||||
|
||||
/* try to enable Hassh */
|
||||
rs_ssh_enable_hassh();
|
||||
|
||||
/* Check if Hassh is disabled */
|
||||
if (!RunmodeIsUnittests() && !rs_ssh_hassh_is_enabled()) {
|
||||
if (!SigMatchSilentErrorEnabled(de_ctx, DETECT_AL_SSH_HASSH_STRING)) {
|
||||
SCLogError(SC_WARN_HASSH_DISABLED, "hassh support is not enabled");
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Registration function for hassh.string keyword.
|
||||
*/
|
||||
void DetectSshHasshStringRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].name = KEYWORD_NAME;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].alias = KEYWORD_ALIAS;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].desc = BUFFER_NAME " sticky buffer";
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].RegisterTests = NULL;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].url = "/rules/" KEYWORD_DOC;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].Setup = DetectSshHasshStringSetup;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH_STRING].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;
|
||||
|
||||
|
||||
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
|
||||
PrefilterGenericMpmRegister, GetSshData,
|
||||
ALPROTO_SSH, SshStateBannerDone);
|
||||
DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SSH,
|
||||
SIG_FLAG_TOSERVER, SshStateBannerDone,
|
||||
DetectEngineInspectBufferGeneric, GetSshData);
|
||||
|
||||
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
|
||||
|
||||
g_ssh_hassh_string_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
|
||||
}
|
||||
@ -0,0 +1,30 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_SSH_HASSH_STRING_H__
|
||||
#define __DETECT_SSH_HASSH_STRING_H__
|
||||
|
||||
/* prototypes */
|
||||
void DetectSshHasshStringRegister (void);
|
||||
|
||||
#endif /* __DETECT_SSH_HASSH_STRING_H__ */
|
||||
@ -0,0 +1,215 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Vadym Malakhatko <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-state.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "stream-tcp.h"
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-ssh.h"
|
||||
#include "detect-ssh-hassh.h"
|
||||
#include "rust.h"
|
||||
|
||||
|
||||
#define KEYWORD_NAME "ssh.hassh"
|
||||
#define KEYWORD_ALIAS "ssh-hassh"
|
||||
#define KEYWORD_DOC "ssh-keywords.html#hassh"
|
||||
#define BUFFER_NAME "ssh.hassh"
|
||||
#define BUFFER_DESC "Ssh Client Fingerprinting For Ssh Clients "
|
||||
static int g_ssh_hassh_buffer_id = 0;
|
||||
|
||||
|
||||
static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms, Flow *_f,
|
||||
const uint8_t flow_flags, void *txv, const int list_id)
|
||||
{
|
||||
|
||||
SCEnter();
|
||||
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
|
||||
if (buffer->inspect == NULL) {
|
||||
const uint8_t *hassh = NULL;
|
||||
uint32_t b_len = 0;
|
||||
|
||||
if (rs_ssh_tx_get_hassh(txv, &hassh, &b_len, flow_flags) != 1)
|
||||
return NULL;
|
||||
if (hassh == NULL || b_len == 0) {
|
||||
SCLogDebug("SSH hassh not set");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
InspectionBufferSetup(buffer, hassh, b_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function setup the hassh modifier keyword used in the rule
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context
|
||||
* \param s Pointer to the Signature to which the current keyword belongs
|
||||
* \param str Should hold an empty string always
|
||||
*
|
||||
* \retval 0 On success
|
||||
* \retval -1 On failure
|
||||
* \retval -2 on failure that should be silent after the first
|
||||
*/
|
||||
static int DetectSshHasshSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
||||
{
|
||||
if (DetectBufferSetActiveList(s, g_ssh_hassh_buffer_id) < 0)
|
||||
return -1;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_SSH) < 0)
|
||||
return -1;
|
||||
|
||||
/* try to enable Hassh */
|
||||
rs_ssh_enable_hassh();
|
||||
|
||||
/* Check if Hassh is disabled */
|
||||
if (!RunmodeIsUnittests() && !rs_ssh_hassh_is_enabled()) {
|
||||
if (!SigMatchSilentErrorEnabled(de_ctx, DETECT_AL_SSH_HASSH)) {
|
||||
SCLogError(SC_WARN_HASSH_DISABLED, "hassh support is not enabled");
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
|
||||
static bool DetectSshHasshHashValidateCallback(const Signature *s,
|
||||
const char **sigerror)
|
||||
{
|
||||
const SigMatch *sm = s->init_data->smlists[g_ssh_hassh_buffer_id];
|
||||
for ( ; sm != NULL; sm = sm->next)
|
||||
{
|
||||
if (sm->type != DETECT_CONTENT)
|
||||
continue;
|
||||
|
||||
const DetectContentData *cd = (DetectContentData *)sm->ctx;
|
||||
|
||||
if (cd->flags & DETECT_CONTENT_NOCASE) {
|
||||
*sigerror = "ssh.hassh should not be used together with "
|
||||
"nocase, since the rule is automatically "
|
||||
"lowercased anyway which makes nocase redundant.";
|
||||
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
||||
}
|
||||
|
||||
if (cd->content_len != 32)
|
||||
{
|
||||
*sigerror = "Invalid length of the specified ssh.hassh (should "
|
||||
"be 32 characters long). This rule will therefore "
|
||||
"never match.";
|
||||
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
||||
return FALSE;
|
||||
}
|
||||
for (size_t i = 0; i < cd->content_len; ++i)
|
||||
{
|
||||
if(!isxdigit(cd->content[i]))
|
||||
{
|
||||
*sigerror = "Invalid ssh.hassh string (should be string of hexademical characters)."
|
||||
"This rule will therefore never match.";
|
||||
SCLogWarning(SC_WARN_POOR_RULE, "rule %u: %s", s->id, *sigerror);
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
static void DetectSshHasshHashSetupCallback(const DetectEngineCtx *de_ctx,
|
||||
Signature *s)
|
||||
{
|
||||
SigMatch *sm = s->init_data->smlists[g_ssh_hassh_buffer_id];
|
||||
for ( ; sm != NULL; sm = sm->next)
|
||||
{
|
||||
if (sm->type != DETECT_CONTENT)
|
||||
continue;
|
||||
|
||||
DetectContentData *cd = (DetectContentData *)sm->ctx;
|
||||
|
||||
uint32_t u;
|
||||
for (u = 0; u < cd->content_len; u++)
|
||||
{
|
||||
if (isupper(cd->content[u])) {
|
||||
cd->content[u] = tolower(cd->content[u]);
|
||||
}
|
||||
}
|
||||
|
||||
SpmDestroyCtx(cd->spm_ctx);
|
||||
cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
|
||||
de_ctx->spm_global_thread_ctx);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Registration function for hassh keyword.
|
||||
*/
|
||||
void DetectSshHasshRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].name = KEYWORD_NAME;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].alias = KEYWORD_ALIAS;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].desc = BUFFER_NAME " sticky buffer";
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].RegisterTests = NULL;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].url = "/rules/" KEYWORD_DOC;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].Setup = DetectSshHasshSetup;
|
||||
sigmatch_table[DETECT_AL_SSH_HASSH].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;
|
||||
|
||||
|
||||
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
|
||||
PrefilterGenericMpmRegister, GetSshData,
|
||||
ALPROTO_SSH, SshStateBannerDone),
|
||||
DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SSH,
|
||||
SIG_FLAG_TOSERVER, SshStateBannerDone,
|
||||
DetectEngineInspectBufferGeneric, GetSshData);
|
||||
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
|
||||
|
||||
g_ssh_hassh_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
|
||||
|
||||
DetectBufferTypeRegisterSetupCallback(BUFFER_NAME, DetectSshHasshHashSetupCallback);
|
||||
DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectSshHasshHashValidateCallback);
|
||||
}
|
||||
|
||||
@ -0,0 +1,30 @@
|
||||
/* Copyright (C) 2007-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Malakhatko Vadym <v.malakhatko@sirinsoftware.com>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_SSH_HASSH_H__
|
||||
#define __DETECT_SSH_HASSH_H__
|
||||
|
||||
/* prototypes */
|
||||
void DetectSshHasshRegister (void);
|
||||
|
||||
#endif /* __DETECT_SSH_HASSH_H__ */
|
||||
Loading…
Reference in New Issue