detect: adds flow integer keywords

Ticket: #6164

flow.pkts_toclient
flow.pkts_toserver
flow.bytes_toclient
flow.bytes_toserver

doc/userguide/rules/flow-keywords.rst

@@ -290,6 +290,7 @@ flow.age
 --------
 
 Flow age in seconds (integer)
+This keyword does not wait for the end of the flow, but will be checked at each packet.
 
 Syntax::
 
@@ -305,4 +306,84 @@ Signature example::
 
  alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;)
 
-In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
+In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.
+
+flow.pkts_toclient
+------------------
+
+Flow number of packets to client (integer)
+This keyword does not wait for the end of the flow, but will be checked at each packet.
+
+Syntax::
+
+ flow.pkts_toclient: [op]<number>
+
+The number of packets can be matched exactly, or compared using the _op_ setting::
+
+ flow.pkts_toclient:3    # exactly 3
+ flow.pkts_toclient:<3   # smaller than 3
+ flow.pkts_toclient:>=2  # greater than or equal to 2
+
+Signature example::
+
+ alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toclient:20; sid:1;)
+
+flow.pkts_toserver
+------------------
+
+Flow number of packets to server (integer)
+This keyword does not wait for the end of the flow, but will be checked at each packet.
+
+Syntax::
+
+ flow.pkts_toserver: [op]<number>
+
+The number of packets can be matched exactly, or compared using the _op_ setting::
+
+ flow.pkts_toserver:3    # exactly 3
+ flow.pkts_toserver:<3   # smaller than 3
+ flow.pkts_toserver:>=2  # greater than or equal to 2
+
+Signature example::
+
+ alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toserver:20; sid:1;)
+
+flow.bytes_toclient
+-------------------
+
+Flow number of bytes to client (integer)
+This keyword does not wait for the end of the flow, but will be checked at each packet.
+
+Syntax::
+
+ flow.bytes_toclient: [op]<number>
+
+The number of packets can be matched exactly, or compared using the _op_ setting::
+
+ flow.bytes_toclient:3    # exactly 3
+ flow.bytes_toclient:<3   # smaller than 3
+ flow.bytes_toclient:>=2  # greater than or equal to 2
+
+Signature example::
+
+ alert ip any any -> any any (msg:"Flow has less than 2000 bytes"; flow.bytes_toclient:<2000; sid:1;)
+
+flow.bytes_toserver
+-------------------
+
+Flow number of bytes to server (integer)
+This keyword does not wait for the end of the flow, but will be checked at each packet.
+
+Syntax::
+
+ flow.bytes_toserver: [op]<number>
+
+The number of packets can be matched exactly, or compared using the _op_ setting::
+
+ flow.bytes_toserver:3    # exactly 3
+ flow.bytes_toserver:<3   # smaller than 3
+ flow.bytes_toserver:>=2  # greater than or equal to 2
+
+Signature example::
+
+ alert ip any any -> any any (msg:"Flow has less than 2000 bytes"; flow.bytes_toserver:<2000; sid:1;)

src/Makefile.am

@@ -166,6 +166,7 @@ noinst_HEADERS = \
 	detect-flowbits.h \
 	detect-flow.h \
 	detect-flow-age.h \
+	detect-flow-pkts.h \
 	detect-flowint.h \
 	detect-flowvar.h \
 	detect-fragbits.h \
@@ -777,6 +778,7 @@ libsuricata_c_a_SOURCES = \
 	detect-flowbits.c \
 	detect-flow.c \
 	detect-flow-age.c \
+	detect-flow-pkts.c \
 	detect-flowint.c \
 	detect-flowvar.c \
 	detect-fragbits.c \

src/detect-engine-register.c

@@ -114,6 +114,7 @@
 #include "detect-rev.h"
 #include "detect-flow.h"
 #include "detect-flow-age.h"
+#include "detect-flow-pkts.h"
 #include "detect-tcp-window.h"
 #include "detect-ftpbounce.h"
 #include "detect-isdataat.h"
@@ -561,6 +562,10 @@ void SigTableSetup(void)
     DetectReplaceRegister();
     DetectFlowRegister();
     DetectFlowAgeRegister();
+    DetectFlowPktsToClientRegister();
+    DetectFlowPktsToServerRegister();
+    DetectFlowBytesToClientRegister();
+    DetectFlowBytesToServerRegister();
     DetectWindowRegister();
     DetectRpcRegister();
     DetectFtpbounceRegister();

src/detect-engine-register.h

@@ -110,6 +110,10 @@ enum DetectKeywordId {
     DETECT_FRAME,
 
     DETECT_FLOW_AGE,
+    DETECT_FLOW_PKTS_TO_CLIENT,
+    DETECT_FLOW_PKTS_TO_SERVER,
+    DETECT_FLOW_BYTES_TO_CLIENT,
+    DETECT_FLOW_BYTES_TO_SERVER,
 
     DETECT_AL_TLS_VERSION,
     DETECT_AL_TLS_SUBJECT,

src/detect-flow-pkts.c

@@ -0,0 +1,278 @@
+/* Copyright (C) 2023 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#include "suricata-common.h"
+#include "rust.h"
+#include "detect-flow-pkts.h"
+#include "detect-engine.h"
+#include "detect-engine-prefilter.h"
+#include "detect-engine-uint.h"
+#include "detect-parse.h"
+
+static int DetectFlowPktsToClientMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
+{
+    if (p->flow == NULL) {
+        return 0;
+    }
+    uint32_t nb = p->flow->tosrcpktcnt;
+
+    const DetectU32Data *du32 = (const DetectU32Data *)ctx;
+    return DetectU32Match(nb, du32);
+}
+
+static void DetectFlowPktsToClientFree(DetectEngineCtx *de_ctx, void *ptr)
+{
+    rs_detect_u32_free(ptr);
+}
+
+static int DetectFlowPktsToClientSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
+{
+    DetectU32Data *du32 = DetectU32Parse(rawstr);
+    if (du32 == NULL)
+        return -1;
+
+    SigMatch *sm = SigMatchAlloc();
+    if (sm == NULL) {
+        DetectFlowPktsToClientFree(de_ctx, du32);
+        return -1;
+    }
+
+    sm->type = DETECT_FLOW_PKTS_TO_CLIENT;
+    sm->ctx = (SigMatchCtx *)du32;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+    s->flags |= SIG_FLAG_REQUIRE_PACKET;
+
+    return 0;
+}
+
+static void PrefilterPacketFlowPktsToClientMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
+{
+    const PrefilterPacketHeaderCtx *ctx = pectx;
+    if (!PrefilterPacketHeaderExtraMatch(ctx, p))
+        return;
+
+    DetectU32Data du32;
+    du32.mode = ctx->v1.u8[0];
+    du32.arg1 = ctx->v1.u32[1];
+    du32.arg2 = ctx->v1.u32[2];
+    if (DetectFlowPktsToClientMatch(det_ctx, p, NULL, (const SigMatchCtx *)&du32)) {
+        PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+    }
+}
+
+static int PrefilterSetupFlowPktsToClient(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
+{
+    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_FLOW_PKTS_TO_CLIENT,
+            PrefilterPacketU32Set, PrefilterPacketU32Compare, PrefilterPacketFlowPktsToClientMatch);
+}
+
+static bool PrefilterFlowPktsToClientIsPrefilterable(const Signature *s)
+{
+    return PrefilterIsPrefilterableById(s, DETECT_FLOW_PKTS_TO_CLIENT);
+}
+
+void DetectFlowPktsToClientRegister(void)
+{
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].name = "flow.pkts_toclient";
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].desc = "match flow number of packets to client";
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].url = "/rules/flow-keywords.html#flow-pkts_toclient";
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Match = DetectFlowPktsToClientMatch;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Setup = DetectFlowPktsToClientSetup;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].Free = DetectFlowPktsToClientFree;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SupportsPrefilter =
+            PrefilterFlowPktsToClientIsPrefilterable;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_CLIENT].SetupPrefilter = PrefilterSetupFlowPktsToClient;
+}
+
+static int DetectFlowPktsToServerMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
+{
+    if (p->flow == NULL) {
+        return 0;
+    }
+    uint32_t nb = p->flow->todstpktcnt;
+
+    const DetectU32Data *du32 = (const DetectU32Data *)ctx;
+    return DetectU32Match(nb, du32);
+}
+
+static void DetectFlowPktsToServerFree(DetectEngineCtx *de_ctx, void *ptr)
+{
+    rs_detect_u32_free(ptr);
+}
+
+static int DetectFlowPktsToServerSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
+{
+    DetectU32Data *du32 = DetectU32Parse(rawstr);
+    if (du32 == NULL)
+        return -1;
+
+    SigMatch *sm = SigMatchAlloc();
+    if (sm == NULL) {
+        DetectFlowPktsToServerFree(de_ctx, du32);
+        return -1;
+    }
+
+    sm->type = DETECT_FLOW_PKTS_TO_SERVER;
+    sm->ctx = (SigMatchCtx *)du32;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+    s->flags |= SIG_FLAG_REQUIRE_PACKET;
+
+    return 0;
+}
+
+static void PrefilterPacketFlowPktsToServerMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
+{
+    const PrefilterPacketHeaderCtx *ctx = pectx;
+    if (!PrefilterPacketHeaderExtraMatch(ctx, p))
+        return;
+
+    DetectU32Data du32;
+    du32.mode = ctx->v1.u8[0];
+    du32.arg1 = ctx->v1.u32[1];
+    du32.arg2 = ctx->v1.u32[2];
+    if (DetectFlowPktsToServerMatch(det_ctx, p, NULL, (const SigMatchCtx *)&du32)) {
+        PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+    }
+}
+
+static int PrefilterSetupFlowPktsToServer(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
+{
+    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_FLOW_PKTS_TO_SERVER,
+            PrefilterPacketU32Set, PrefilterPacketU32Compare, PrefilterPacketFlowPktsToServerMatch);
+}
+
+static bool PrefilterFlowPktsToServerIsPrefilterable(const Signature *s)
+{
+    return PrefilterIsPrefilterableById(s, DETECT_FLOW_PKTS_TO_SERVER);
+}
+
+void DetectFlowPktsToServerRegister(void)
+{
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].name = "flow.pkts_toserver";
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].desc = "match flow number of packets to server";
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].url = "/rules/flow-keywords.html#flow-pkts_toserver";
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Match = DetectFlowPktsToServerMatch;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Setup = DetectFlowPktsToServerSetup;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].Free = DetectFlowPktsToServerFree;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SupportsPrefilter =
+            PrefilterFlowPktsToServerIsPrefilterable;
+    sigmatch_table[DETECT_FLOW_PKTS_TO_SERVER].SetupPrefilter = PrefilterSetupFlowPktsToServer;
+}
+
+static int DetectFlowBytesToClientMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
+{
+    if (p->flow == NULL) {
+        return 0;
+    }
+    uint64_t nb = p->flow->tosrcbytecnt;
+
+    const DetectU64Data *du64 = (const DetectU64Data *)ctx;
+    return DetectU64Match(nb, du64);
+}
+
+static void DetectFlowBytesToClientFree(DetectEngineCtx *de_ctx, void *ptr)
+{
+    rs_detect_u64_free(ptr);
+}
+
+static int DetectFlowBytesToClientSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
+{
+    DetectU64Data *du64 = DetectU64Parse(rawstr);
+    if (du64 == NULL)
+        return -1;
+
+    SigMatch *sm = SigMatchAlloc();
+    if (sm == NULL) {
+        DetectFlowBytesToClientFree(de_ctx, du64);
+        return -1;
+    }
+
+    sm->type = DETECT_FLOW_BYTES_TO_CLIENT;
+    sm->ctx = (SigMatchCtx *)du64;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+    s->flags |= SIG_FLAG_REQUIRE_PACKET;
+
+    return 0;
+}
+
+void DetectFlowBytesToClientRegister(void)
+{
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].name = "flow.bytes_toclient";
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].desc = "match flow number of bytes to client";
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].url =
+            "/rules/flow-keywords.html#flow-bytes_toclient";
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Match = DetectFlowBytesToClientMatch;
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Setup = DetectFlowBytesToClientSetup;
+    sigmatch_table[DETECT_FLOW_BYTES_TO_CLIENT].Free = DetectFlowBytesToClientFree;
+}
+
+static int DetectFlowBytesToServerMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
+{
+    if (p->flow == NULL) {
+        return 0;
+    }
+    uint64_t nb = p->flow->todstbytecnt;
+
+    const DetectU64Data *du64 = (const DetectU64Data *)ctx;
+    return DetectU64Match(nb, du64);
+}
+
+static void DetectFlowBytesToServerFree(DetectEngineCtx *de_ctx, void *ptr)
+{
+    rs_detect_u64_free(ptr);
+}
+
+static int DetectFlowBytesToServerSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
+{
+    DetectU64Data *du64 = DetectU64Parse(rawstr);
+    if (du64 == NULL)
+        return -1;
+
+    SigMatch *sm = SigMatchAlloc();
+    if (sm == NULL) {
+        DetectFlowBytesToServerFree(de_ctx, du64);
+        return -1;
+    }
+
+    sm->type = DETECT_FLOW_BYTES_TO_SERVER;
+    sm->ctx = (SigMatchCtx *)du64;
+
+    SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_MATCH);
+    s->flags |= SIG_FLAG_REQUIRE_PACKET;
+
+    return 0;
+}
+
+void DetectFlowBytesToServerRegister(void)
+{
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].name = "flow.bytes_toserver";
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].desc = "match flow number of bytes to server";
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].url =
+            "/rules/flow-keywords.html#flow-bytes_toserver";
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Match = DetectFlowBytesToServerMatch;
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Setup = DetectFlowBytesToServerSetup;
+    sigmatch_table[DETECT_FLOW_BYTES_TO_SERVER].Free = DetectFlowBytesToServerFree;
+}

src/detect-flow-pkts.h

@@ -0,0 +1,26 @@
+/* Copyright (C) 2023 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef __DETECT_FLOW_PKTS_H__
+#define __DETECT_FLOW_PKTS_H__
+
+void DetectFlowPktsToClientRegister(void);
+void DetectFlowPktsToServerRegister(void);
+void DetectFlowBytesToClientRegister(void);
+void DetectFlowBytesToServerRegister(void);
+
+#endif /* __DETECT_FLOW_PKTS_H__ */