aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust: bindgen DetectHelperMultiBufferMpmRegister

Browse Source 
Ticket: 7667
pull/13230/head
Philippe Antoine 1 year ago committed by Victor Julien
parent dfa4df9f54
commit 0d82e905bc
17 changed files with 87 additions and 85 deletions
Show Stats Download Patch File Download Diff File

1
rust/src/core.rs
Unescape Escape View File

@ -28,7 +28,6 @@ use crate::flow::Flow;
pub enum DetectEngineState {}
pub enum AppLayerDecoderEvents {}
pub enum GenericVar {}
pub(crate) use suricata_sys::sys::DetectEngineThreadCtx;
#[repr(C)]
#[derive(Debug, PartialEq, Eq, Clone, Copy)]

13
rust/src/detect/mod.rs
Unescape Escape View File

@ -38,7 +38,6 @@ pub mod datasets;
use std::os::raw::{c_char, c_int, c_void};
use std::ffi::CString;
use crate::core::DetectEngineThreadCtx;
use suricata_sys::sys::{AppProto, DetectEngineCtx, Signature};
/// EnumString trait that will be implemented on enums that
@ -178,18 +177,6 @@ extern "C" {
pub fn SigMatchAppendSMToList(
de: *mut DetectEngineCtx, s: *mut Signature, kwid: c_int, ctx: *const c_void, bufid: c_int,
) -> *mut c_void;
// in detect-engine-helper.h
pub fn DetectHelperMultiBufferMpmRegister(
name: *const libc::c_char, desc: *const libc::c_char, alproto: AppProto, dir: u8,
get_multi_data: unsafe extern "C" fn(
*mut DetectEngineThreadCtx,
*const c_void,
u8,
u32,
*mut *const u8,
*mut u32,
) -> bool,
) -> c_int;
}
#[repr(u8)]
#[derive(Copy, Clone, Debug, PartialEq, Eq)]

6
rust/src/dns/detect.rs
Unescape Escape View File

@ -16,7 +16,7 @@
*/
use super::dns::{DNSRcode, DNSRecordType, DNSTransaction, ALPROTO_DNS};
use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU16Free, SCDetectU8Free,
SCDetectU8Parse,
@ -30,8 +30,8 @@ use crate::direction::Direction;
use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
use suricata_sys::sys::{
DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperMultiBufferProgressMpmRegister,
Signature,
DetectEngineCtx, DetectEngineThreadCtx, SCDetectBufferSetActiveList,
SCDetectHelperMultiBufferProgressMpmRegister, Signature,
};
/// Perform the DNS opcode match.

2
rust/src/dns/dns.rs
Unescape Escape View File

@ -31,7 +31,7 @@ use crate::frames::Frame;
use nom7::number::streaming::be_u16;
use nom7::{Err, IResult};
use suricata_sys::sys::AppProto;
use suricata_sys::sys::{AppProto, DetectEngineThreadCtx};
/// DNS record types.
/// DNS error codes.

2
rust/src/http2/detect.rs
Unescape Escape View File

@ -19,7 +19,6 @@ use super::http2::{
HTTP2Event, HTTP2Frame, HTTP2FrameTypeData, HTTP2State, HTTP2Transaction, HTTP2TransactionState,
};
use super::parser;
use crate::core::DetectEngineThreadCtx;
use crate::detect::uint::{detect_match_uint, DetectUintData};
use crate::direction::Direction;
use base64::{engine::general_purpose::STANDARD, Engine};
@ -27,6 +26,7 @@ use std::ffi::CStr;
use std::os::raw::c_void;
use std::rc::Rc;
use std::str::FromStr;
use suricata_sys::sys::DetectEngineThreadCtx;
fn http2_tx_has_frametype(
tx: &HTTP2Transaction, direction: Direction, value: u8,

2
rust/src/ike/detect.rs
Unescape Escape View File

@ -18,11 +18,11 @@
// Author: Frank Honza <frank.honza@dcso.de>
use super::ipsec_parser::IkeV2Transform;
use crate::core::DetectEngineThreadCtx;
use crate::ike::ike::*;
use std::ffi::CStr;
use std::os::raw::c_void;
use std::ptr;
use suricata_sys::sys::DetectEngineThreadCtx;
#[no_mangle]
pub extern "C" fn SCIkeStateGetExchType(tx: &IKETransaction, exch_type: *mut u8) -> u8 {

2
rust/src/krb/detect.rs
Unescape Escape View File

@ -17,8 +17,8 @@
// written by Pierre Chifflier <chifflier@wzdftpd.net>
use crate::core::DetectEngineThreadCtx;
use crate::krb::krb5::{test_weak_encryption, KRB5Transaction};
use suricata_sys::sys::DetectEngineThreadCtx;
use kerberos_parser::krb5::EncryptionType;

27
rust/src/ldap/detect.rs
Unescape Escape View File

@ -16,7 +16,7 @@
*/
use super::ldap::{LdapTransaction, ALPROTO_LDAP};
use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Parse,
SCDetectU8Free,
@ -24,11 +24,14 @@ use crate::detect::uint::{
use crate::detect::{
helper_keyword_register_sticky_buffer, DetectHelperBufferMpmRegister,
DetectHelperBufferRegister, DetectHelperGetData, DetectHelperKeywordRegister,
DetectHelperMultiBufferMpmRegister, DetectSignatureSetAppProto, SCSigTableAppLiteElmt,
SigMatchAppendSMToList, SigTableElmtStickyBuffer,
DetectSignatureSetAppProto, SCSigTableAppLiteElmt, SigMatchAppendSMToList,
SigTableElmtStickyBuffer,
};
use crate::ldap::types::{LdapMessage, LdapResultCode, ProtocolOp, ProtocolOpCode};
use suricata_sys::sys::{DetectEngineCtx, SCDetectBufferSetActiveList, Signature};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, SCDetectBufferSetActiveList,
SCDetectHelperMultiBufferMpmRegister, Signature,
};
use std::collections::VecDeque;
use std::ffi::CStr;
@ -700,12 +703,12 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
setup: ldap_detect_responses_dn_setup,
};
let _g_ldap_responses_dn_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_LDAP_RESPONSES_DN_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_LDAP_RESPONSES_DN_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.responses.dn\0".as_ptr() as *const libc::c_char,
b"LDAP RESPONSES DISTINGUISHED_NAME\0".as_ptr() as *const libc::c_char,
ALPROTO_LDAP,
STREAM_TOCLIENT,
ldap_tx_get_responses_dn,
Some(ldap_tx_get_responses_dn),
);
let kw = SCSigTableAppLiteElmt {
name: b"ldap.responses.result_code\0".as_ptr() as *const libc::c_char,
@ -730,12 +733,12 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
setup: ldap_detect_responses_msg_setup,
};
let _g_ldap_responses_dn_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_LDAP_RESPONSES_MSG_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_LDAP_RESPONSES_MSG_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.responses.message\0".as_ptr() as *const libc::c_char,
b"LDAP RESPONSES DISTINGUISHED_NAME\0".as_ptr() as *const libc::c_char,
ALPROTO_LDAP,
STREAM_TOCLIENT,
ldap_tx_get_responses_msg,
Some(ldap_tx_get_responses_msg),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("ldap.request.attribute_type"),
@ -744,12 +747,12 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
setup: ldap_detect_request_attibute_type_setup,
};
let _g_ldap_request_attribute_type_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_LDAP_REQUEST_ATTRIBUTE_TYPE_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_LDAP_REQUEST_ATTRIBUTE_TYPE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.request.attribute_type\0".as_ptr() as *const libc::c_char,
b"LDAP REQUEST ATTRIBUTE TYPE\0".as_ptr() as *const libc::c_char,
ALPROTO_LDAP,
STREAM_TOSERVER,
ldap_tx_get_req_attribute_type,
Some(ldap_tx_get_req_attribute_type),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("ldap.responses.attribute_type"),
@ -758,11 +761,11 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
setup: ldap_detect_responses_attibute_type_setup,
};
let _g_ldap_responses_attribute_type_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_LDAP_RESPONSES_ATTRIBUTE_TYPE_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_LDAP_RESPONSES_ATTRIBUTE_TYPE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ldap.responses.attribute_type\0".as_ptr() as *const libc::c_char,
b"LDAP RESPONSES ATTRIBUTE TYPE\0".as_ptr() as *const libc::c_char,
ALPROTO_LDAP,
STREAM_TOCLIENT,
ldap_tx_get_resp_attribute_type,
Some(ldap_tx_get_resp_attribute_type),
);
}

19
rust/src/mqtt/detect.rs
Unescape Escape View File

@ -17,7 +17,7 @@
// written by Sascha Steinbiss <sascha@steinbiss.name>
use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_match_uint, detect_parse_uint, detect_parse_uint_enum, DetectUintData, DetectUintMode,
SCDetectU8Free, SCDetectU8Parse,
@ -25,10 +25,13 @@ use crate::detect::uint::{
use crate::detect::{
helper_keyword_register_sticky_buffer, DetectHelperBufferMpmRegister,
DetectHelperBufferRegister, DetectHelperGetData, DetectHelperKeywordRegister,
DetectHelperMultiBufferMpmRegister, DetectSignatureSetAppProto, SCSigTableAppLiteElmt,
SigMatchAppendSMToList, SigTableElmtStickyBuffer,
DetectSignatureSetAppProto, SCSigTableAppLiteElmt, SigMatchAppendSMToList,
SigTableElmtStickyBuffer,
};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, SCDetectBufferSetActiveList,
SCDetectHelperMultiBufferMpmRegister, Signature,
};
use suricata_sys::sys::{DetectEngineCtx, SCDetectBufferSetActiveList, Signature};
use nom7::branch::alt;
use nom7::bytes::complete::{is_a, tag};
@ -1087,12 +1090,12 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
}
}
let _g_mqtt_unsub_topic_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_MQTT_UNSUB_TOPIC_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_MQTT_UNSUB_TOPIC_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
keyword_name,
b"unsubscribe topic query\0".as_ptr() as *const libc::c_char,
ALPROTO_MQTT,
STREAM_TOSERVER,
unsub_topic_get_data,
Some(unsub_topic_get_data),
);
let kw = SCSigTableAppLiteElmt {
@ -1126,12 +1129,12 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
}
}
let _g_mqtt_sub_topic_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_MQTT_SUB_TOPIC_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_MQTT_SUB_TOPIC_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
keyword_name,
b"subscribe topic query\0".as_ptr() as *const libc::c_char,
ALPROTO_MQTT,
STREAM_TOSERVER,
sub_topic_get_data,
Some(sub_topic_get_data),
);
let kw = SCSigTableAppLiteElmt {

3
rust/src/quic/detect.rs
Unescape Escape View File

@ -15,10 +15,11 @@
* 02110-1301, USA.
*/
use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::quic::quic::QuicTransaction;
use std::os::raw::c_void;
use std::ptr;
use suricata_sys::sys::DetectEngineThreadCtx;
#[no_mangle]
pub unsafe extern "C" fn SCQuicTxGetUa(

41
rust/src/sdp/detect.rs
Unescape Escape View File

@ -17,16 +17,19 @@
// written by Giuseppe Longo <giuseppe@glongo.it>
use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::{
helper_keyword_register_sticky_buffer, DetectHelperBufferMpmRegister, DetectHelperGetData,
DetectHelperMultiBufferMpmRegister, DetectSignatureSetAppProto, SigTableElmtStickyBuffer,
DetectSignatureSetAppProto, SigTableElmtStickyBuffer,
};
use crate::direction::Direction;
use crate::sip::sip::{SIPTransaction, ALPROTO_SIP};
use std::os::raw::{c_int, c_void};
use std::ptr;
use suricata_sys::sys::{DetectEngineCtx, SCDetectBufferSetActiveList, Signature};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, SCDetectBufferSetActiveList,
SCDetectHelperMultiBufferMpmRegister, Signature,
};
static mut G_SDP_ORIGIN_BUFFER_ID: c_int = 0;
static mut G_SDP_SESSION_NAME_BUFFER_ID: c_int = 0;
@ -875,12 +878,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_bandwidth_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_BANDWIDTH_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_BANDWIDTH_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.bandwidth\0".as_ptr() as *const libc::c_char,
b"sdp.bandwidth\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_bandwidth_get_data,
Some(sip_bandwidth_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.time"),
@ -889,12 +892,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_time_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_TIME_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_TIME_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.time\0".as_ptr() as *const libc::c_char,
b"sdp.time\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sdp_time_get_data,
Some(sdp_time_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.repeat_time"),
@ -903,12 +906,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_repeat_time_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_REPEAT_TIME_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_REPEAT_TIME_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.repeat_time\0".as_ptr() as *const libc::c_char,
b"sdp.repeat_time\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sdp_repeat_time_get_data,
Some(sdp_repeat_time_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.timezone"),
@ -945,12 +948,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_attribute_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_ATTRIBUTE_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_ATTRIBUTE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.attribute\0".as_ptr() as *const libc::c_char,
b"sdp.attribute\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_attribute_get_data,
Some(sip_attribute_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.media.media"),
@ -961,12 +964,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_media_desc_media_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_MEDIA_DESC_MEDIA_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_MEDIA_DESC_MEDIA_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.media\0".as_ptr() as *const libc::c_char,
b"sdp.media.media\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_media_desc_media_get_data,
Some(sip_media_desc_media_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.media.media_info"),
@ -975,12 +978,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_media_desc_session_info_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_MEDIA_DESC_SESSION_INFO_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_MEDIA_DESC_SESSION_INFO_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.media_info\0".as_ptr() as *const libc::c_char,
b"sdp.media.media_info\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_media_desc_session_info_get_data,
Some(sip_media_desc_session_info_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.media.connection_data"),
@ -989,12 +992,12 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_media_desc_connection_data_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_MEDIA_DESC_CONNECTION_DATA_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_MEDIA_DESC_CONNECTION_DATA_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.connection_data\0".as_ptr() as *const libc::c_char,
b"sdp.media.connection_data\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_media_desc_connection_data_get_data,
Some(sip_media_desc_connection_data_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sdp.media.encryption_key"),
@ -1003,11 +1006,11 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
setup: sdp_media_desc_encryption_key_setup,
};
let _ = helper_keyword_register_sticky_buffer(&kw);
G_SDP_MEDIA_DESC_ENCRYPTION_KEY_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SDP_MEDIA_DESC_ENCRYPTION_KEY_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sdp.media.encryption_key\0".as_ptr() as *const libc::c_char,
b"sdp.media.encryption_key\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_media_desc_encryption_key_get_data,
Some(sip_media_desc_encryption_key_get_data),
);
}

30
rust/src/sip/detect.rs
Unescape Escape View File

@ -17,16 +17,16 @@
// written by Giuseppe Longo <giuseppe@glongo.it>
use crate::core::{DetectEngineThreadCtx, STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::{
helper_keyword_register_sticky_buffer, DetectHelperBufferMpmRegister, DetectHelperGetData,
DetectHelperMultiBufferMpmRegister, DetectSignatureSetAppProto, SigTableElmtStickyBuffer,
DetectSignatureSetAppProto, SigTableElmtStickyBuffer,
};
use crate::direction::Direction;
use crate::sip::sip::{SIPTransaction, ALPROTO_SIP};
use std::os::raw::{c_int, c_void};
use std::ptr;
use suricata_sys::sys::{DetectEngineCtx, SCDetectBufferSetActiveList, Signature};
use suricata_sys::sys::{DetectEngineCtx, SCDetectBufferSetActiveList, Signature, SCDetectHelperMultiBufferMpmRegister, DetectEngineThreadCtx};
static mut G_SIP_PROTOCOL_BUFFER_ID: c_int = 0;
static mut G_SIP_STAT_CODE_BUFFER_ID: c_int = 0;
@ -567,12 +567,12 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
setup: sip_from_hdr_setup,
};
let _g_sip_from_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SIP_FROM_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SIP_FROM_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.from\0".as_ptr() as *const libc::c_char,
b"sip.from\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_from_hdr_get_data,
Some(sip_from_hdr_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sip.to"),
@ -581,12 +581,12 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
setup: sip_to_hdr_setup,
};
let _g_sip_to_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SIP_TO_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SIP_TO_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.to\0".as_ptr() as *const libc::c_char,
b"sip.to\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_to_hdr_get_data,
Some(sip_to_hdr_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sip.via"),
@ -595,12 +595,12 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
setup: sip_via_hdr_setup,
};
let _g_sip_via_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SIP_VIA_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SIP_VIA_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.via\0".as_ptr() as *const libc::c_char,
b"sip.via\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_via_hdr_get_data,
Some(sip_via_hdr_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sip.user_agent"),
@ -609,12 +609,12 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
setup: sip_ua_hdr_setup,
};
let _g_sip_ua_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SIP_UA_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SIP_UA_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.ua\0".as_ptr() as *const libc::c_char,
b"sip.ua\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_ua_hdr_get_data,
Some(sip_ua_hdr_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sip.content_type"),
@ -623,12 +623,12 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
setup: sip_content_type_hdr_setup,
};
let _g_sip_content_type_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SIP_CONTENT_TYPE_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SIP_CONTENT_TYPE_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.content_type\0".as_ptr() as *const libc::c_char,
b"sip.content_type\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_content_type_hdr_get_data,
Some(sip_content_type_hdr_get_data),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("sip.content_length"),
@ -637,11 +637,11 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
setup: sip_content_length_hdr_setup,
};
let _g_sip_content_length_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SIP_CONTENT_LENGTH_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister(
G_SIP_CONTENT_LENGTH_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"sip.content_length\0".as_ptr() as *const libc::c_char,
b"sip.content_length\0".as_ptr() as *const libc::c_char,
ALPROTO_SIP,
STREAM_TOSERVER | STREAM_TOCLIENT,
sip_content_length_hdr_get_data,
Some(sip_content_length_hdr_get_data),
);
}

6
rust/sys/src/sys.rs
Unescape Escape View File

@ -326,6 +326,12 @@ pub struct SCTransformTableElmt {
extern "C" {
pub fn SCDetectHelperNewKeywordId() -> ::std::os::raw::c_int;
}
extern "C" {
pub fn SCDetectHelperMultiBufferMpmRegister(
name: *const ::std::os::raw::c_char, desc: *const ::std::os::raw::c_char,
alproto: AppProto, direction: u8, GetData: InspectionMultiBufferGetDataPtr,
) -> ::std::os::raw::c_int;
}
extern "C" {
pub fn SCDetectHelperMultiBufferProgressMpmRegister(
name: *const ::std::os::raw::c_char, desc: *const ::std::os::raw::c_char,

4
src/detect-email.c
Unescape Escape View File

@ -401,7 +401,7 @@ void DetectEmailRegister(void)
kw.Setup = DetectMimeEmailUrlSetup;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
DetectHelperKeywordRegister(&kw);
g_mime_email_url_buffer_id = DetectHelperMultiBufferMpmRegister(
g_mime_email_url_buffer_id = SCDetectHelperMultiBufferMpmRegister(
"email.url", "MIME EMAIL URL", ALPROTO_SMTP, STREAM_TOSERVER, GetMimeEmailUrlData);
kw.name = "email.received";
@ -410,6 +410,6 @@ void DetectEmailRegister(void)
kw.Setup = DetectMimeEmailReceivedSetup;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
DetectHelperKeywordRegister(&kw);
g_mime_email_received_buffer_id = DetectHelperMultiBufferMpmRegister("email.received",
g_mime_email_received_buffer_id = SCDetectHelperMultiBufferMpmRegister("email.received",
"MIME EMAIL RECEIVED", ALPROTO_SMTP, STREAM_TOSERVER, GetMimeEmailReceivedData);
}

6
src/detect-engine-helper.c
Unescape Escape View File

@ -81,8 +81,8 @@ int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto a
return DetectBufferTypeGetByName(name);
}
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
{
if (direction & STREAM_TOSERVER) {
DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);
@ -95,7 +95,7 @@ int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *d
return DetectBufferTypeGetByName(name);
}
int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
{
return SCDetectHelperMultiBufferProgressMpmRegister(name, desc, alproto, direction, GetData, 0);

6
src/detect-engine-helper.h
Unescape Escape View File

@ -86,10 +86,10 @@ InspectionBuffer *DetectHelperGetData(struct DetectEngineThreadCtx_ *det_ctx,
const int list_id, SimpleGetTxBuffer GetBuf);
int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionBufferGetDataPtr GetData);
int DetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionMultiBufferGetDataPtr GetData);
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress);
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress);
int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw);

2
src/detect-smtp.c
Unescape Escape View File

@ -155,6 +155,6 @@ void SCDetectSMTPRegister(void)
kw.Setup = DetectSmtpRcptToSetup;
kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
DetectHelperKeywordRegister(&kw);
g_smtp_rcpt_to_buffer_id = DetectHelperMultiBufferMpmRegister(
g_smtp_rcpt_to_buffer_id = SCDetectHelperMultiBufferMpmRegister(
"smtp.rcpt_to", "SMTP RCPT TO", ALPROTO_SMTP, STREAM_TOSERVER, GetSmtpRcptToData);
}

Write Preview
Loading…
Cancel
Save