aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: add dcerpc.flags keyword

Browse Source 
This is a u16 keyword that matches on flags field derived from the
header of a DCERPC packet per transaction per direction.

Flags are stored in the tx to allow matches with dcerpc.flags keyword
later on. DCERPC/TCP exposes a u8 as PFC flags in its header however,
DCERPC/UDP stores two sets of flags flags1 and flags2 in its header.
Hence, the field is kept u16 to accommodate for both.

Feature 8734
pull/16045/head
Shivani Bhardwaj 3 months ago
parent 4481f27657
commit 6436d8f28b
4 changed files with 112 additions and 3 deletions
Show Stats Download Patch File Download Diff File

16
doc/userguide/rules/dcerpc-keywords.rst
Unescape Escape View File

@ -59,6 +59,22 @@ Examples::
dcerpc.opnum can since suricata 9 use an :ref:`unsigned 16-bits integer <rules-integer-keywords>`.
dcerpc.flags
------------
Match on the flags in a DCERPC header. The value is an
:ref:`unsigned 16-bit integer <rules-integer-keywords>`.
The 16-bit value carries the PFC flags of the transaction. Over TCP the low
byte holds ``pfc_flags``; over UDP the low byte holds ``flags1`` and the high
byte holds ``flags2``.
Examples::
dcerpc.flags:0x03;
dcerpc.flags:&0x03=0x03;
dcerpc.stub_data
----------------

11
rust/src/dcerpc/dcerpc.rs
Unescape Escape View File

@ -205,6 +205,8 @@ pub struct DCERPCTransaction {
pub resp_lost: bool,
pub req_cmd: u8,
pub resp_cmd: u8,
pub req_flags: u16,
pub resp_flags: u16,
pub activityuuid: Vec<u8>,
pub seqnum: u32,
pub tx_data: AppLayerTxData,
@ -539,8 +541,6 @@ impl DCERPCState {
uuidentry.version = ctxitem.version;
uuidentry.versionminor = ctxitem.versionminor;
let pfcflags = hdr.pfc_flags;
// Store the first frag flag in the uuid as pfc_flags will
// be overwritten by new packets
if pfcflags & PFC_FIRST_FRAG > 0 {
uuidentry.flags |= DCERPC_UUID_ENTRY_FLAG_FF;
}
@ -585,6 +585,7 @@ impl DCERPCState {
}
let mut tx = self.create_tx(hdr);
tx.req_cmd = hdr.hdrtype;
tx.req_flags |= hdr.pfc_flags as u16;
tx.req_done = true;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_inspection(
@ -762,6 +763,7 @@ impl DCERPCState {
match transaction {
Some(ref mut tx) => {
tx.req_cmd = hdr_type;
tx.req_flags |= hdr.pfc_flags as u16;
tx.ctxid = request.ctxid;
tx.opnum = request.opnum;
tx.first_request_seen = request.first_request_seen;
@ -769,6 +771,7 @@ impl DCERPCState {
None => {
let mut tx = self.create_tx(hdr);
tx.req_cmd = hdr_type;
tx.req_flags |= hdr.pfc_flags as u16;
tx.ctxid = request.ctxid;
tx.opnum = request.opnum;
tx.first_request_seen = request.first_request_seen;
@ -949,10 +952,12 @@ impl DCERPCState {
self.get_tx_by_call_id(current_call_id, Direction::ToClient, hdrtype)
{
tx.resp_cmd = hdrtype;
tx.resp_flags |= hdr.pfc_flags as u16;
tx
} else {
let mut tx = self.create_tx(&hdr);
tx.resp_cmd = hdrtype;
tx.resp_flags |= hdr.pfc_flags as u16;
self.transactions.push_back(tx);
self.transactions.back_mut().unwrap()
};
@ -980,10 +985,12 @@ impl DCERPCState {
match transaction {
Some(tx) => {
tx.resp_cmd = hdrtype;
tx.resp_flags |= hdr.pfc_flags as u16;
}
None => {
let mut tx = self.create_tx(&hdr);
tx.resp_cmd = hdrtype;
tx.resp_flags |= hdr.pfc_flags as u16;
self.transactions.push_back(tx);
}
};

2
rust/src/dcerpc/dcerpc_udp.rs
Unescape Escape View File

@ -190,6 +190,7 @@ impl DCERPCUDPState {
let max_size = cfg_max_stub_size() as usize;
match hdr.pkt_type {
DCERPC_TYPE_REQUEST => {
tx.req_flags |= (hdr.flags1 as u16) | ((hdr.flags2 as u16) << 8);
tx.frag_cnt_ts = tx.frag_cnt_ts.saturating_add(1);
if input.len() + tx.stub_data_buffer_ts.len() < max_size {
tx.stub_data_buffer_ts.extend_from_slice(input);
@ -203,6 +204,7 @@ impl DCERPCUDPState {
return true;
}
DCERPC_TYPE_RESPONSE => {
tx.resp_flags |= (hdr.flags1 as u16) | ((hdr.flags2 as u16) << 8);
tx.frag_cnt_tc = tx.frag_cnt_tc.saturating_add(1);
if input.len() + tx.stub_data_buffer_tc.len() < max_size {
tx.stub_data_buffer_tc.extend_from_slice(input);

86
rust/src/dcerpc/detect.rs
Unescape Escape View File

@ -22,7 +22,9 @@ use super::dcerpc::{
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{detect_match_uint, detect_parse_uint, DetectUintData};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::smb::detect::{smb_tx_get_stub_data, smb_tx_match_dce_iface, smb_tx_match_dce_opnum};
use crate::smb::detect::{
smb_tx_get_stub_data, smb_tx_match_dce_iface, smb_tx_match_dce_opnum,
};
use crate::smb::smb::ALPROTO_SMB;
use std::ffi::CStr;
use std::os::raw::{c_char, c_int, c_void};
@ -393,6 +395,75 @@ unsafe extern "C" fn dcerpc_opnum_free(_de: *mut DetectEngineCtx, ptr: *mut c_vo
}
}
unsafe extern "C" fn dcerpc_tx_match_dce_flags(
tx: *mut c_void, ctx: *const SigMatchCtx, flags: u8,
) -> c_int {
let tx = cast_pointer!(tx, DCERPCTransaction);
let ctx = cast_pointer!(ctx, DetectUintData<u16>);
let value = if flags & STREAM_TOSERVER != 0 {
tx.req_flags
} else {
tx.resp_flags
};
return detect_match_uint(ctx, value) as i32;
}
unsafe fn dcerpc_flags_parse(carg: *const c_char) -> *mut c_void {
let arg = match CStr::from_ptr(carg).to_str() {
Ok(arg) => arg,
Err(_) => {
return std::ptr::null_mut();
}
};
match detect_parse_uint::<u16>(arg) {
Ok((_, ctx)) => Box::into_raw(Box::new(ctx)) as *mut c_void,
Err(_) => std::ptr::null_mut(),
}
}
unsafe extern "C" fn dcerpc_flags_match(
_de: *mut DetectEngineThreadCtx, f: *mut crate::flow::Flow, flags: u8, _state: *mut c_void,
tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
) -> c_int {
if SCFlowGetAppProtocol(f) == ALPROTO_DCERPC {
return dcerpc_tx_match_dce_flags(tx, ctx, flags);
}
return 0;
}
unsafe extern "C" fn dcerpc_flags_setup(
de: *mut DetectEngineCtx, s: *mut Signature, raw: *const libc::c_char,
) -> c_int {
if SCDetectSignatureSetAppProto(s, ALPROTO_DCERPC) != 0 {
return -1;
}
let ctx = dcerpc_flags_parse(raw);
if ctx.is_null() {
return -1;
}
if SCSigMatchAppendSMToList(
de,
s,
G_DCERPC_FLAGS_KW_ID,
ctx as *mut SigMatchCtx,
G_DCERPC_GENERIC_BUFFER_ID,
)
.is_null()
{
dcerpc_flags_free(std::ptr::null_mut(), ctx);
return -1;
}
return 0;
}
unsafe extern "C" fn dcerpc_flags_free(_de: *mut DetectEngineCtx, ptr: *mut c_void) {
if !ptr.is_null() {
std::mem::drop(Box::from_raw(ptr as *mut DetectUintData<u16>));
}
}
unsafe extern "C" fn dcerpc_stub_data_setup(
de_ctx: *mut DetectEngineCtx, s: *mut Signature, _str: *const c_char,
) -> c_int {
@ -440,6 +511,7 @@ unsafe extern "C" fn dcerpc_tx_get_stub_data(
}
static mut G_DCERPC_OPNUM_KW_ID: u16 = 0;
static mut G_DCERPC_FLAGS_KW_ID: u16 = 0;
static mut G_DCERPC_GENERIC_BUFFER_ID: c_int = 0;
static mut G_DCERPC_IFACE_KW_ID: u16 = 0;
static mut G_DCERPC_STUB_BUFFER_ID: c_int = 0;
@ -457,6 +529,18 @@ pub unsafe extern "C" fn SCDetectDcerpcRegister() {
flags: 0,
};
G_DCERPC_OPNUM_KW_ID = SCDetectHelperKeywordRegister(&kw);
let kw = SCSigTableAppLiteElmt {
name: b"dcerpc.flags\0".as_ptr() as *const libc::c_char,
desc: b"match on the PFC flags in a DCERPC header\0".as_ptr() as *const libc::c_char,
url: b"/rules/dcerpc-keywords.html#dcerpc-flags\0".as_ptr() as *const libc::c_char,
AppLayerTxMatch: Some(dcerpc_flags_match),
Setup: Some(dcerpc_flags_setup),
Free: Some(dcerpc_flags_free),
flags: 0,
};
G_DCERPC_FLAGS_KW_ID = SCDetectHelperKeywordRegister(&kw);
G_DCERPC_GENERIC_BUFFER_ID = SCDetectHelperBufferProgressRegister(
b"dce_generic\0".as_ptr() as *const libc::c_char,
ALPROTO_DCERPC,

Write Preview
Loading…
Cancel
Save