mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
151 lines
3.8 KiB
ReStructuredText
151 lines
3.8 KiB
ReStructuredText
.. role:: example-rule-emphasis
|
|
|
|
SCTP Keywords
|
|
=============
|
|
|
|
Suricata supports sticky buffers and keywords for matching on SCTP
|
|
packet headers, chunks, and metadata.
|
|
|
|
Sticky buffers are expected to be followed by one or more
|
|
:doc:`payload-keywords`.
|
|
|
|
sctp.hdr
|
|
--------
|
|
|
|
Sticky buffer to match on the raw SCTP header and all chunks.
|
|
|
|
Example rule:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert sctp any any -> any any (msg:"SCTP header match"; :example-rule-emphasis:`sctp.hdr; content:"|01|"; offset:8; depth:1;` sid:1; rev:1;)
|
|
|
|
``sctp.hdr`` is a 'sticky buffer'.
|
|
|
|
``sctp.hdr`` can be used as ``fast_pattern``.
|
|
|
|
sctp.chunk_data
|
|
---------------
|
|
|
|
Sticky buffer to match on any SCTP DATA chunk user payload.
|
|
|
|
When a packet contains DATA chunks, the packet payload (``p->payload``)
|
|
is set to the user data of the first DATA chunk. A bare ``content``
|
|
match (without a sticky buffer) therefore inspects the first DATA
|
|
chunk's payload. Use ``sctp.chunk_data`` to inspect all DATA chunks
|
|
independently.
|
|
|
|
Example rule:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert sctp any any -> any any (msg:"SCTP DATA payload match"; :example-rule-emphasis:`sctp.chunk_data; content:"test";` sid:2; rev:1;)
|
|
|
|
``sctp.chunk_data`` is a 'sticky buffer'.
|
|
|
|
``sctp.chunk_data`` can be used as ``fast_pattern``.
|
|
|
|
sctp.vtag
|
|
---------
|
|
|
|
Match on the SCTP verification tag field in the common header.
|
|
|
|
sctp.vtag uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
|
|
|
|
Syntax::
|
|
|
|
sctp.vtag:[op]<number>
|
|
|
|
The verification tag can be matched exactly, or compared using the _op_ setting::
|
|
|
|
sctp.vtag:12345 # exactly 12345
|
|
sctp.vtag:>0 # greater than 0
|
|
sctp.vtag:100-200 # range 100 to 200
|
|
|
|
Example rule:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert sctp any any -> any any (msg:"SCTP vtag match"; :example-rule-emphasis:`sctp.vtag:0;` sid:3; rev:1;)
|
|
|
|
sctp.chunk_type
|
|
---------------
|
|
|
|
Match on the type of any SCTP chunk in the packet.
|
|
|
|
sctp.chunk_type uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
|
|
|
|
Syntax::
|
|
|
|
sctp.chunk_type:[!]<value>
|
|
sctp.chunk_type:[op]<number>
|
|
|
|
Values can be specified by name or by numeric value. The following
|
|
named chunk types are supported:
|
|
|
|
================= =====
|
|
Name Value
|
|
================= =====
|
|
data 0
|
|
init 1
|
|
init_ack 2
|
|
sack 3
|
|
heartbeat 4
|
|
hb_ack 5
|
|
abort 6
|
|
shutdown 7
|
|
shutdown_ack 8
|
|
error 9
|
|
cookie_echo 10
|
|
cookie_ack 11
|
|
ecne 12
|
|
cwr 13
|
|
shutdown_complete 14
|
|
forward_tsn 192
|
|
================= =====
|
|
|
|
Named values are case-insensitive and can be negated with ``!``::
|
|
|
|
sctp.chunk_type:init # INIT chunk
|
|
sctp.chunk_type:init_ack # INIT ACK chunk
|
|
sctp.chunk_type:!data # any chunk that is not DATA
|
|
|
|
Numeric values support comparison operators and ranges::
|
|
|
|
sctp.chunk_type:1 # INIT chunk (type 1)
|
|
sctp.chunk_type:0-4 # range 0 to 4
|
|
|
|
Example rules:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert sctp any any -> any any (msg:"SCTP INIT chunk detected"; :example-rule-emphasis:`sctp.chunk_type:init;` sid:4; rev:1;)
|
|
|
|
.. container:: example-rule
|
|
|
|
alert sctp any any -> any any (msg:"SCTP INIT chunk detected"; :example-rule-emphasis:`sctp.chunk_type:1;` sid:5; rev:1;)
|
|
|
|
sctp.chunk_cnt
|
|
--------------
|
|
|
|
Match on the number of SCTP chunks in the packet.
|
|
|
|
sctp.chunk_cnt uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
|
|
|
|
Syntax::
|
|
|
|
sctp.chunk_cnt:[op]<number>
|
|
|
|
The chunk count can be matched exactly, or compared using the _op_ setting::
|
|
|
|
sctp.chunk_cnt:1 # exactly 1 chunk
|
|
sctp.chunk_cnt:>3 # more than 3 chunks
|
|
sctp.chunk_cnt:2-5 # range 2 to 5
|
|
|
|
Example rule:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert sctp any any -> any any (msg:"SCTP packet with multiple chunks"; :example-rule-emphasis:`sctp.chunk_cnt:>1;` sid:5; rev:1;)
|
|
|