1 /* Copyright (C) 2019 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18 /**
19 * \file
20 *
21 * \author Mats Klepsland <mats.klepsland@gmail.com>
22 *
23 * Implements support for tls.certs keyword.
24 */
25
26 #include "suricata-common.h"
27 #include "threads.h"
28 #include "debug.h"
29 #include "decode.h"
30 #include "detect.h"
31
32 #include "detect-parse.h"
33 #include "detect-engine.h"
34 #include "detect-engine-mpm.h"
35 #include "detect-engine-prefilter.h"
36 #include "detect-engine-content-inspection.h"
37 #include "detect-content.h"
38 #include "detect-pcre.h"
39 #include "detect-tls-certs.h"
40
41 #include "flow.h"
42 #include "flow-util.h"
43 #include "flow-var.h"
44
45 #include "util-debug.h"
46 #include "util-unittest.h"
47 #include "util-spm.h"
48 #include "util-print.h"
49
50 #include "stream-tcp.h"
51
52 #include "app-layer.h"
53 #include "app-layer-ssl.h"
54
55 #include "util-unittest.h"
56 #include "util-unittest-helper.h"
57
58 static int DetectTlsCertsSetup(DetectEngineCtx *, Signature *, const char *);
59 #ifdef UNITTESTS
60 static void DetectTlsCertsRegisterTests(void);
61 #endif
62 static int DetectEngineInspectTlsCerts(DetectEngineCtx *de_ctx,
63 DetectEngineThreadCtx *det_ctx,
64 const DetectEngineAppInspectionEngine *engine,
65 const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv,
66 uint64_t tx_id);
67 static int PrefilterMpmTlsCertsRegister(DetectEngineCtx *de_ctx,
68 SigGroupHead *sgh, MpmCtx *mpm_ctx,
69 const DetectBufferMpmRegistery *mpm_reg, int list_id);
70
71 static int g_tls_certs_buffer_id = 0;
72
73 struct TlsCertsGetDataArgs {
74 uint32_t local_id; /**< used as index into thread inspect array */
75 SSLCertsChain *cert;
76 };
77
78 typedef struct PrefilterMpmTlsCerts {
79 int list_id;
80 const MpmCtx *mpm_ctx;
81 const DetectEngineTransforms *transforms;
82 } PrefilterMpmTlsCerts;
83
84 /**
85 * \brief Registration function for keyword: tls.certs
86 */
DetectTlsCertsRegister(void)87 void DetectTlsCertsRegister(void)
88 {
89 sigmatch_table[DETECT_AL_TLS_CERTS].name = "tls.certs";
90 sigmatch_table[DETECT_AL_TLS_CERTS].desc = "content modifier to match the TLS certificate sticky buffer";
91 sigmatch_table[DETECT_AL_TLS_CERTS].url = "/rules/tls-keywords.html#tls-certs";
92 sigmatch_table[DETECT_AL_TLS_CERTS].Setup = DetectTlsCertsSetup;
93 #ifdef UNITTESTS
94 sigmatch_table[DETECT_AL_TLS_CERTS].RegisterTests = DetectTlsCertsRegisterTests;
95 #endif
96 sigmatch_table[DETECT_AL_TLS_CERTS].flags |= SIGMATCH_NOOPT;
97 sigmatch_table[DETECT_AL_TLS_CERTS].flags |= SIGMATCH_INFO_STICKY_BUFFER;
98
99 DetectAppLayerInspectEngineRegister2("tls.certs", ALPROTO_TLS,
100 SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
101 DetectEngineInspectTlsCerts, NULL);
102
103 DetectAppLayerMpmRegister2("tls.certs", SIG_FLAG_TOCLIENT, 2,
104 PrefilterMpmTlsCertsRegister, NULL, ALPROTO_TLS,
105 TLS_STATE_CERT_READY);
106
107 DetectBufferTypeSetDescriptionByName("tls.certs", "TLS certificate");
108
109 g_tls_certs_buffer_id = DetectBufferTypeGetByName("tls.certs");
110 }
111
112 /**
113 * \brief This function setup the tls.certs modifier keyword
114 *
115 * \param de_ctx Pointer to the Detect Engine Context
116 * \param s Pointer to the Signature to which the keyword belongs
117 * \param str Should hold an empty string always
118 *
119 * \retval 0 On success
120 * \retval -1 On failure
121 */
DetectTlsCertsSetup(DetectEngineCtx * de_ctx,Signature * s,const char * str)122 static int DetectTlsCertsSetup(DetectEngineCtx *de_ctx, Signature *s,
123 const char *str)
124 {
125 if (DetectBufferSetActiveList(s, g_tls_certs_buffer_id) < 0)
126 return -1;
127
128 if (DetectSignatureSetAppProto(s, ALPROTO_TLS) < 0)
129 return -1;
130
131 return 0;
132 }
133
TlsCertsGetData(DetectEngineThreadCtx * det_ctx,const DetectEngineTransforms * transforms,Flow * f,struct TlsCertsGetDataArgs * cbdata,int list_id)134 static InspectionBuffer *TlsCertsGetData(DetectEngineThreadCtx *det_ctx,
135 const DetectEngineTransforms *transforms, Flow *f,
136 struct TlsCertsGetDataArgs *cbdata, int list_id)
137 {
138 SCEnter();
139
140 InspectionBuffer *buffer =
141 InspectionBufferMultipleForListGet(det_ctx, list_id, cbdata->local_id);
142 if (buffer == NULL)
143 return NULL;
144
145 const SSLState *ssl_state = (SSLState *)f->alstate;
146
147 if (TAILQ_EMPTY(&ssl_state->server_connp.certs)) {
148 return NULL;
149 }
150
151 if (cbdata->cert == NULL) {
152 cbdata->cert = TAILQ_FIRST(&ssl_state->server_connp.certs);
153 } else {
154 cbdata->cert = TAILQ_NEXT(cbdata->cert, next);
155 }
156 if (cbdata->cert == NULL) {
157 return NULL;
158 }
159
160 InspectionBufferSetupMulti(buffer, transforms, cbdata->cert->cert_data, cbdata->cert->cert_len);
161
162 SCReturnPtr(buffer, "InspectionBuffer");
163 }
164
DetectEngineInspectTlsCerts(DetectEngineCtx * de_ctx,DetectEngineThreadCtx * det_ctx,const DetectEngineAppInspectionEngine * engine,const Signature * s,Flow * f,uint8_t flags,void * alstate,void * txv,uint64_t tx_id)165 static int DetectEngineInspectTlsCerts(DetectEngineCtx *de_ctx,
166 DetectEngineThreadCtx *det_ctx,
167 const DetectEngineAppInspectionEngine *engine,
168 const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv,
169 uint64_t tx_id)
170 {
171 const DetectEngineTransforms *transforms = NULL;
172 if (!engine->mpm) {
173 transforms = engine->v2.transforms;
174 }
175
176 struct TlsCertsGetDataArgs cbdata = { 0, NULL };
177
178 while (1)
179 {
180 InspectionBuffer *buffer = TlsCertsGetData(det_ctx, transforms, f,
181 &cbdata, engine->sm_list);
182 if (buffer == NULL || buffer->inspect == NULL)
183 break;
184
185 det_ctx->buffer_offset = 0;
186 det_ctx->discontinue_matching = 0;
187 det_ctx->inspection_recursion_counter = 0;
188
189 const int match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd,
190 NULL, f, (uint8_t *)buffer->inspect,
191 buffer->inspect_len,
192 buffer->inspect_offset, DETECT_CI_FLAGS_SINGLE,
193 DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE);
194 if (match == 1) {
195 return DETECT_ENGINE_INSPECT_SIG_MATCH;
196 }
197
198 cbdata.local_id++;
199 }
200
201 return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
202 }
203
PrefilterTxTlsCerts(DetectEngineThreadCtx * det_ctx,const void * pectx,Packet * p,Flow * f,void * txv,const uint64_t idx,const uint8_t flags)204 static void PrefilterTxTlsCerts(DetectEngineThreadCtx *det_ctx,
205 const void *pectx, Packet *p, Flow *f, void *txv,
206 const uint64_t idx, const uint8_t flags)
207 {
208 SCEnter();
209
210 const PrefilterMpmTlsCerts *ctx = (const PrefilterMpmTlsCerts *)pectx;
211 const MpmCtx *mpm_ctx = ctx->mpm_ctx;
212 const int list_id = ctx->list_id;
213
214 struct TlsCertsGetDataArgs cbdata = { 0, NULL };
215
216 while (1)
217 {
218 InspectionBuffer *buffer = TlsCertsGetData(det_ctx, ctx->transforms,
219 f, &cbdata, list_id);
220 if (buffer == NULL)
221 break;
222
223 if (buffer->inspect_len >= mpm_ctx->minlen) {
224 (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
225 &det_ctx->mtcu, &det_ctx->pmq,
226 buffer->inspect, buffer->inspect_len);
227 }
228
229 cbdata.local_id++;
230 }
231 }
232
PrefilterMpmTlsCertsFree(void * ptr)233 static void PrefilterMpmTlsCertsFree(void *ptr)
234 {
235 SCFree(ptr);
236 }
237
PrefilterMpmTlsCertsRegister(DetectEngineCtx * de_ctx,SigGroupHead * sgh,MpmCtx * mpm_ctx,const DetectBufferMpmRegistery * mpm_reg,int list_id)238 static int PrefilterMpmTlsCertsRegister(DetectEngineCtx *de_ctx,
239 SigGroupHead *sgh, MpmCtx *mpm_ctx,
240 const DetectBufferMpmRegistery *mpm_reg, int list_id)
241 {
242 PrefilterMpmTlsCerts *pectx = SCCalloc(1, sizeof(*pectx));
243 if (pectx == NULL)
244 return -1;
245
246 pectx->list_id = list_id;
247 pectx->mpm_ctx = mpm_ctx;
248 pectx->transforms = &mpm_reg->transforms;
249
250 return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxTlsCerts,
251 mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
252 pectx, PrefilterMpmTlsCertsFree, mpm_reg->name);
253 }
254
255 #ifdef UNITTESTS
256 #include "tests/detect-tls-certs.c"
257 #endif
258