detect: adds flow.age keyword

Ticket: #5536

doc/userguide/rules/flow-keywords.rst

@@ -285,3 +285,24 @@ Format
 Example of the stream-size keyword in a rule::
 
     alert tcp any any -> any any (stream_size:both, >, 5000; sid:1;)
+
+flow.age
+--------
+
+Flow age in seconds (integer)
+
+Syntax::
+
+ flow.age: [op]<number>
+
+The time can be matched exactly, or compared using the _op_ setting::
+
+ flow.age:3    # exactly 3
+ flow.age:<3   # smaller than 3 seconds
+ flow.age:>=2  # greater or equal than 2 seconds
+
+Signature example::
+
+ alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)
+
+In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.

src/Makefile.am

@@ -167,6 +167,7 @@ noinst_HEADERS = \
 	detect-filestore.h \
 	detect-flowbits.h \
 	detect-flow.h \
+	detect-flow-age.h \
 	detect-flowint.h \
 	detect-flowvar.h \
 	detect-fragbits.h \
@@ -770,6 +771,7 @@ libsuricata_c_a_SOURCES = \
 	detect-filestore.c \
 	detect-flowbits.c \
 	detect-flow.c \
+	detect-flow-age.c \
 	detect-flowint.c \
 	detect-flowvar.c \
 	detect-fragbits.c \

src/detect-engine-register.c

@@ -111,6 +111,7 @@
 #include "detect-msg.h"
 #include "detect-rev.h"
 #include "detect-flow.h"
+#include "detect-flow-age.h"
 #include "detect-tcp-window.h"
 #include "detect-ftpbounce.h"
 #include "detect-isdataat.h"
@@ -551,6 +552,7 @@ void SigTableSetup(void)
     DetectOffsetRegister();
     DetectReplaceRegister();
     DetectFlowRegister();
+    DetectFlowAgeRegister();
     DetectWindowRegister();
     DetectRpcRegister();
     DetectFtpbounceRegister();

src/detect-engine-register.h

@@ -107,6 +107,8 @@ enum DetectKeywordId {
 
     DETECT_FRAME,
 
+    DETECT_FLOW_AGE,
+
     DETECT_AL_TLS_VERSION,
     DETECT_AL_TLS_SUBJECT,
     DETECT_AL_TLS_ISSUERDN,

src/detect-flow-age.c

@@ -0,0 +1,101 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#include "suricata-common.h"
+#include "rust.h"
+#include "detect-flow-age.h"
+#include "detect-engine.h"
+#include "detect-engine-prefilter.h"
+#include "detect-engine-uint.h"
+#include "detect-parse.h"
+
+static int DetectFlowAgeMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
+{
+    if (p->flow == NULL) {
+        return 0;
+    }
+    uint32_t age = p->flow->lastts.tv_sec - p->flow->startts.tv_sec;
+
+    const DetectU32Data *du32 = (const DetectU32Data *)ctx;
+    return DetectU32Match(age, du32);
+}
+
+static void DetectFlowAgeFree(DetectEngineCtx *de_ctx, void *ptr)
+{
+    rs_detect_u32_free(ptr);
+}
+
+static int DetectFlowAgeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
+{
+    DetectU32Data *du32 = DetectU32Parse(rawstr);
+    if (du32 == NULL)
+        return -1;
+
+    SigMatch *sm = SigMatchAlloc();
+    if (sm == NULL) {
+        DetectFlowAgeFree(de_ctx, du32);
+        return -1;
+    }
+
+    sm->type = DETECT_FLOW_AGE;
+    sm->ctx = (SigMatchCtx *)du32;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+    s->flags |= SIG_FLAG_REQUIRE_PACKET;
+
+    return 0;
+}
+
+static void PrefilterPacketFlowAgeMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
+{
+    const PrefilterPacketHeaderCtx *ctx = pectx;
+    if (!PrefilterPacketHeaderExtraMatch(ctx, p))
+        return;
+
+    DetectU32Data du32;
+    du32.mode = ctx->v1.u8[0];
+    du32.arg1 = ctx->v1.u32[1];
+    du32.arg2 = ctx->v1.u32[2];
+    if (DetectFlowAgeMatch(det_ctx, p, NULL, (const SigMatchCtx *)&du32)) {
+        PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+    }
+}
+
+static int PrefilterSetupFlowAge(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
+{
+    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_FLOW_AGE, PrefilterPacketU32Set,
+            PrefilterPacketU32Compare, PrefilterPacketFlowAgeMatch);
+}
+
+static bool PrefilterFlowAgeIsPrefilterable(const Signature *s)
+{
+    return PrefilterIsPrefilterableById(s, DETECT_FLOW_AGE);
+}
+
+void DetectFlowAgeRegister(void)
+{
+    sigmatch_table[DETECT_FLOW_AGE].name = "flow.age";
+    sigmatch_table[DETECT_FLOW_AGE].desc = "match flow age";
+    sigmatch_table[DETECT_FLOW_AGE].url = "/rules/flow-keywords.html#flow-age";
+    sigmatch_table[DETECT_FLOW_AGE].Match = DetectFlowAgeMatch;
+    sigmatch_table[DETECT_FLOW_AGE].Setup = DetectFlowAgeSetup;
+    sigmatch_table[DETECT_FLOW_AGE].Free = DetectFlowAgeFree;
+    sigmatch_table[DETECT_FLOW_AGE].SupportsPrefilter = PrefilterFlowAgeIsPrefilterable;
+    sigmatch_table[DETECT_FLOW_AGE].SetupPrefilter = PrefilterSetupFlowAge;
+}

src/detect-flow-age.h

@@ -0,0 +1,23 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef __DETECT_FLOW_AGE_H__
+#define __DETECT_FLOW_AGE_H__
+
+void DetectFlowAgeRegister(void);
+
+#endif /* __DETECT_FLOW_AGE_H__ */