aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: add igmp.hdr keyword

Browse Source
pull/14921/head
Victor Julien 9 months ago
parent d652b7ef62
commit 6a1389acff
6 changed files with 201 additions and 0 deletions
Show Stats Download Patch File Download Diff File

3
src/Makefile.am
Unescape Escape View File

@ -228,6 +228,7 @@ noinst_HEADERS = \
detect-icmpv6hdr.h \
detect-icode.h \
detect-id.h \
detect-igmphdr.h \
detect-ipaddr.h \
detect-ipopts.h \
detect-ipproto.h \
@ -806,6 +807,7 @@ libsuricata_c_a_SOURCES = \
detect-icmpv6hdr.c \
detect-icode.c \
detect-id.c \
detect-igmphdr.c \
detect-ipaddr.c \
detect-ipopts.c \
detect-ipproto.c \
@ -1174,6 +1176,7 @@ EXTRA_DIST = \
tests/detect-http2.c \
tests/detect-icmpv6-mtu.c \
tests/detect-icmpv6hdr.c \
tests/detect-igmphdr.c \
tests/detect-template.c \
tests/detect-transform-pcrexform.c \
tests/detect-ttl.c \

2
src/detect-engine-register.c
Unescape Escape View File

@ -154,6 +154,7 @@
#include "detect-icmp-id.h"
#include "detect-icmp-seq.h"
#include "detect-icmpv4hdr.h"
#include "detect-igmphdr.h"
#include "detect-dce-iface.h"
#include "detect-dce-opnum.h"
#include "detect-dce-stub-data.h"
@ -664,6 +665,7 @@ void SigTableSetup(void)
DetectIcmpIdRegister();
DetectIcmpSeqRegister();
DetectIcmpv4HdrRegister();
DetectIGMPHdrRegister();
DetectDceIfaceRegister();
DetectDceOpnumRegister();
DetectDceStubDataRegister();

1
src/detect-engine-register.h
Unescape Escape View File

@ -49,6 +49,7 @@ enum DetectKeywordId {
DETECT_ICMP_ID,
DETECT_ICMP_SEQ,
DETECT_ICMPV4HDR,
DETECT_IGMPHDR,
DETECT_DSIZE,
DETECT_FLOW,

123
src/detect-igmphdr.c
Unescape Escape View File

@ -0,0 +1,123 @@
/* Copyright (C) 2026 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-igmphdr.h"
#include "detect-engine-prefilter.h"
/* prototypes */
static int DetectIGMPHdrSetup(DetectEngineCtx *, Signature *, const char *);
#ifdef UNITTESTS
void DetectIGMPHdrRegisterTests(void);
#endif
static int g_igmphdr_buffer_id = 0;
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Packet *p, const int list_id);
/**
* \brief Registration function for igmp.hdr: keyword
*/
void DetectIGMPHdrRegister(void)
{
sigmatch_table[DETECT_IGMPHDR].name = "igmp.hdr";
sigmatch_table[DETECT_IGMPHDR].desc = "sticky buffer to match on the IGMP header";
sigmatch_table[DETECT_IGMPHDR].url = "/rules/header-keywords.html#igmp-hdr";
sigmatch_table[DETECT_IGMPHDR].Setup = DetectIGMPHdrSetup;
sigmatch_table[DETECT_IGMPHDR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
#ifdef UNITTESTS
sigmatch_table[DETECT_IGMPHDR].RegisterTests = DetectIGMPHdrRegisterTests;
#endif
g_igmphdr_buffer_id = DetectBufferTypeRegister("igmp.hdr");
BUG_ON(g_igmphdr_buffer_id < 0);
DetectBufferTypeSupportsPacket("igmp.hdr");
DetectPktMpmRegister("igmp.hdr", 2, PrefilterGenericMpmPktRegister, GetData);
DetectPktInspectEngineRegister("igmp.hdr", GetData, DetectEngineInspectPktBufferGeneric);
}
/**
* \brief setup igmp.hdr sticky buffer
*
* \param de_ctx pointer to the Detection Engine Context
* \param s pointer to the Current Signature
* \param _unused unused
*
* \retval 0 on Success
* \retval -1 on Failure
*/
static int DetectIGMPHdrSetup(DetectEngineCtx *de_ctx, Signature *s, const char *_unused)
{
if (!(DetectProtoContainsProto(&s->proto, IPPROTO_IGMP)))
return -1;
s->proto.flags |= DETECT_PROTO_IPV4;
s->flags |= SIG_FLAG_REQUIRE_PACKET;
if (SCDetectBufferSetActiveList(de_ctx, s, g_igmphdr_buffer_id) < 0)
return -1;
return 0;
}
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Packet *p, const int list_id)
{
SCEnter();
if (!PacketIsIGMP(p)) {
SCReturnPtr(NULL, "InspectionBuffer");
}
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
if (buffer->inspect == NULL) {
const IGMPHdr *igmph = PacketGetIGMP(p);
const uint16_t hlen = p->l4.vars.igmp.hlen;
if (((uint8_t *)igmph + (ptrdiff_t)hlen) >
((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p))) {
SCLogDebug("data out of range: %p > %p", ((uint8_t *)igmph + (ptrdiff_t)hlen),
((uint8_t *)GET_PKT_DATA(p) + (ptrdiff_t)GET_PKT_LEN(p)));
SCReturnPtr(NULL, "InspectionBuffer");
}
const uint32_t data_len = hlen;
const uint8_t *data = (const uint8_t *)igmph;
InspectionBufferSetupAndApplyTransforms(
det_ctx, list_id, buffer, data, data_len, transforms);
}
SCReturnPtr(buffer, "InspectionBuffer");
}
#ifdef UNITTESTS
#include "tests/detect-igmphdr.c"
#endif

27
src/detect-igmphdr.h
Unescape Escape View File

@ -0,0 +1,27 @@
/* Copyright (C) 2026 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*/
#ifndef _DETECT_IGMPHDR_H
#define _DETECT_IGMPHDR_H
void DetectIGMPHdrRegister(void);
#endif /* _DETECT_IGMPHDR_H */

45
src/tests/detect-igmphdr.c
Unescape Escape View File

@ -0,0 +1,45 @@
/* Copyright (C) 2026 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
#include "../suricata-common.h"
#include "../detect.h"
#include "../detect-parse.h"
#include "../detect-igmphdr.h"
#include "../util-unittest.h"
static int DetectIGMPHdrParseTest01(void)
{
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
FAIL_IF_NULL(de_ctx);
FAIL_IF_NULL(DetectEngineAppendSig(
de_ctx, "alert igmp any any -> any any (igmp.hdr; content:\"A\"; sid:1; rev:1;)"));
DetectEngineCtxFree(de_ctx);
PASS;
}
/**
* \brief register tests
*/
void DetectIGMPHdrRegisterTests(void)
{
UtRegisterTest("DetectIGMPHdrParseTest01", DetectIGMPHdrParseTest01);
}
Write Preview
Loading…
Cancel
Save