Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

improve TCP/UDP socket creation matching #964

Closed
mike-hunhoff opened this issue Nov 20, 2024 · 0 comments · Fixed by #993
Closed

improve TCP/UDP socket creation matching #964

mike-hunhoff opened this issue Nov 20, 2024 · 0 comments · Fixed by #993
Labels
good first issue Good for newcomers rule idea

Comments

@mike-hunhoff
Copy link
Collaborator

Add additional check for parameter argument of 0.

https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket

If a value of 0 is specified, the caller does not wish to specify a protocol and the service provider will choose the protocol to use.

https://man7.org/linux/man-pages/man2/socket.2.html

The protocol specifies a particular protocol to be used with the
socket. Normally only a single protocol exists to support a
particular socket type within a given protocol family, in which
case protocol can be specified as 0.

https://github.com/mandiant/capa-rules/blob/e50d824553ae8d7168ac2d1f7b5540a93f944e28/communication/socket/udp/send/create-udp-socket.yml
https://github.com/mandiant/capa-rules/blob/e50d824553ae8d7168ac2d1f7b5540a93f944e28/communication/socket/tcp/create-tcp-socket.yml
dhruvak001 added a commit to dhruvak001/capa-rules that referenced this issue Feb 4, 2025
@dhruvak001
improve TCP/UDP socket creation matching mandiant#964
537fc82
@dhruvak001 dhruvak001 mentioned this issue Feb 4, 2025
Merged
dhruvak001 added a commit to dhruvak001/capa-rules that referenced this issue Mar 13, 2025
@dhruvak001
improve TCP/UDP socket creation matching mandiant#964
b37dc7e
mike-hunhoff pushed a commit that referenced this issue Mar 14, 2025
@dhruvak001
improve TCP/UDP socket creation matching #964 (#993)

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode
Loading
Loading status checks…
6697513 
* improve TCP/UDP socket creation matching #964

* Adding references

* adding IPPROTO_UDP

* relax rule

* function -> basic block

* adding bytes for indirect(0)

* adding bytes for indirect(0)

* back to default changes

* moved to nursery

* final change

* resolving comment

* indentation error
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue Good for newcomers rule idea
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

improve TCP/UDP socket creation matching #964 dhruvak001/capa-rules
1 participant
@mike-hunhoff