quic: ja3 getter function uses direction

so that future lua code can specify a direction
pull/13179/head
Philippe Antoine 3 months ago committed by Victor Julien
parent d1bca4a9b9
commit 06ad72e83e

@ -15,7 +15,7 @@
* 02110-1301, USA. * 02110-1301, USA.
*/ */
use crate::core::DetectEngineThreadCtx; use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::quic::quic::QuicTransaction; use crate::quic::quic::QuicTransaction;
use std::os::raw::c_void; use std::os::raw::c_void;
use std::ptr; use std::ptr;
@ -52,17 +52,21 @@ pub unsafe extern "C" fn SCQuicTxGetSni(
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn SCQuicTxGetJa3( pub unsafe extern "C" fn SCQuicTxGetJa3(
tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, tx: &QuicTransaction, dir: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 { ) -> bool {
if tx.client {
if dir & STREAM_TOSERVER == 0 {
return false;
}
} else if dir & STREAM_TOCLIENT == 0 {
return false;
}
if let Some(ja3) = &tx.ja3 { if let Some(ja3) = &tx.ja3 {
*buffer = ja3.as_ptr(); *buffer = ja3.as_ptr();
*buffer_len = ja3.len() as u32; *buffer_len = ja3.len() as u32;
1 return true;
} else {
*buffer = ptr::null();
*buffer_len = 0;
0
} }
return false;
} }
#[no_mangle] #[no_mangle]

@ -267,7 +267,7 @@ InspectionBuffer *Ja3DetectGetHash(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (SCQuicTxGetJa3(txv, &b, &b_len) != 1) if (!SCQuicTxGetJa3(txv, STREAM_TOSERVER | STREAM_TOCLIENT, &b, &b_len))
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;
@ -292,7 +292,7 @@ InspectionBuffer *Ja3DetectGetString(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (SCQuicTxGetJa3(txv, &b, &b_len) != 1) if (!SCQuicTxGetJa3(txv, STREAM_TOSERVER | STREAM_TOCLIENT, &b, &b_len))
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;

Loading…
Cancel
Save