snmp: adds usm keyword

as is logged

Ticker: #5416

doc/userguide/rules/snmp-keywords.rst

@@ -44,6 +44,26 @@ Signature example::
 
 ``snmp.community`` can be used as ``fast_pattern``.
 
+snmp.usm
+--------
+
+SNMP User-based Security Model (USM) is used in version 3.
+It corresponds to the user name.
+
+Comparison is case-sensitive.
+
+Syntax::
+
+ snmp.usm; content:"admin";
+
+Signature example::
+
+ alert snmp any any -> any any (msg:"SNMP usm admin"; snmp.usm; content:"admin"; sid:2; rev:1;)
+
+``snmp.usm`` is a 'sticky buffer'.
+
+``snmp.usm`` can be used as ``fast_pattern``.
+
 snmp.pdu_type
 -------------
 

rust/src/snmp/detect.rs

@@ -54,3 +54,17 @@ pub unsafe extern "C" fn rs_snmp_tx_get_pdu_type(tx: &mut SNMPTransaction,
         }
     }
 }
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_snmp_tx_get_usm(tx: &mut SNMPTransaction,
+                                           buf: *mut *const u8,
+                                           len: *mut u32)
+{
+    match tx.usm {
+        Some(ref c) => {
+            *buf = c.as_ptr();
+            *len = c.len() as u32;
+        },
+        None        => ()
+    }
+}

src/Makefile.am

@@ -295,6 +295,7 @@ noinst_HEADERS = \
 	detect-smb-share.h \
 	detect-snmp-community.h \
 	detect-snmp-pdu_type.h \
+	detect-snmp-usm.h \
 	detect-snmp-version.h \
 	detect-ssh-hassh.h \
 	detect-ssh-hassh-server.h \
@@ -890,6 +891,7 @@ libsuricata_c_a_SOURCES = \
 	detect-smb-share.c \
 	detect-snmp-community.c \
 	detect-snmp-pdu_type.c \
+	detect-snmp-usm.c \
 	detect-snmp-version.c \
 	detect-ssh-hassh.c \
 	detect-ssh-hassh-server.c \

src/detect-engine-register.c

@@ -198,6 +198,7 @@
 #include "detect-rfb-name.h"
 #include "detect-target.h"
 #include "detect-template-rust-buffer.h"
+#include "detect-snmp-usm.h"
 #include "detect-snmp-version.h"
 #include "detect-snmp-community.h"
 #include "detect-snmp-pdu_type.h"
@@ -633,6 +634,7 @@ void SigTableSetup(void)
     DetectRfbNameRegister();
     DetectTargetRegister();
     DetectTemplateRustBufferRegister();
+    DetectSNMPUsmRegister();
     DetectSNMPVersionRegister();
     DetectSNMPCommunityRegister();
     DetectSNMPPduTypeRegister();

src/detect-engine-register.h

@@ -267,6 +267,7 @@ enum DetectKeywordId {
     DETECT_FTPDATA,
     DETECT_TARGET,
     DETECT_AL_TEMPLATE_RUST_BUFFER,
+    DETECT_AL_SNMP_USM,
     DETECT_AL_SNMP_VERSION,
     DETECT_AL_SNMP_COMMUNITY,
     DETECT_AL_SNMP_PDU_TYPE,

src/detect-snmp-usm.c

@@ -0,0 +1,81 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#include "suricata-common.h"
+#include "rust.h"
+#include "detect-snmp-usm.h"
+#include "detect-engine.h"
+#include "detect-engine-mpm.h"
+#include "detect-engine-prefilter.h"
+#include "detect-parse.h"
+
+static int g_buffer_id = 0;
+
+static int DetectSNMPUsmSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
+{
+    if (DetectBufferSetActiveList(s, g_buffer_id) < 0)
+        return -1;
+
+    if (DetectSignatureSetAppProto(s, ALPROTO_SNMP) != 0)
+        return -1;
+
+    return 0;
+}
+
+static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
+        const int list_id)
+{
+    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
+    if (buffer->inspect == NULL) {
+        uint32_t data_len = 0;
+        const uint8_t *data = NULL;
+
+        rs_snmp_tx_get_usm(txv, &data, &data_len);
+        if (data == NULL || data_len == 0) {
+            return NULL;
+        }
+
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
+        InspectionBufferApplyTransforms(buffer, transforms);
+    }
+
+    return buffer;
+}
+
+void DetectSNMPUsmRegister(void)
+{
+    sigmatch_table[DETECT_AL_SNMP_USM].name = "snmp.usm";
+    sigmatch_table[DETECT_AL_SNMP_USM].desc = "SNMP content modifier to match on the SNMP usm";
+    sigmatch_table[DETECT_AL_SNMP_USM].Setup = DetectSNMPUsmSetup;
+
+    sigmatch_table[DETECT_AL_SNMP_USM].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+
+    /* register inspect engines */
+    DetectAppLayerInspectEngineRegister2("snmp.usm", ALPROTO_SNMP, SIG_FLAG_TOSERVER, 0,
+            DetectEngineInspectBufferGeneric, GetData);
+    DetectAppLayerMpmRegister2("snmp.usm", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
+            GetData, ALPROTO_SNMP, 0);
+    DetectAppLayerInspectEngineRegister2("snmp.usm", ALPROTO_SNMP, SIG_FLAG_TOCLIENT, 0,
+            DetectEngineInspectBufferGeneric, GetData);
+    DetectAppLayerMpmRegister2("snmp.usm", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
+            GetData, ALPROTO_SNMP, 0);
+
+    DetectBufferTypeSetDescriptionByName("snmp.usm", "SNMP USM");
+
+    g_buffer_id = DetectBufferTypeGetByName("snmp.usm");
+}

src/detect-snmp-usm.h

@@ -0,0 +1,23 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef __DETECT_SNMP_USM_H__
+#define __DETECT_SNMP_USM_H__
+
+void DetectSNMPUsmRegister(void);
+
+#endif /* __DETECT_SNMP_USM_H__ */