From 23032ebc65dec0c41b5ef2adf08698bc81210dc9 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 19 Feb 2026 13:17:54 +0100 Subject: [PATCH] detect/ike: move ike spi keywords to rust Ticket: 8310 --- rust/src/ike/detect.rs | 118 ++++++++++++++++++------ rust/src/ike/ike.rs | 2 +- src/Makefile.am | 2 - src/detect-engine-register.c | 3 +- src/detect-engine-register.h | 2 - src/detect-ike-spi.c | 168 ----------------------------------- src/detect-ike-spi.h | 28 ------ 7 files changed, 92 insertions(+), 231 deletions(-) delete mode 100644 src/detect-ike-spi.c delete mode 100644 src/detect-ike-spi.h diff --git a/rust/src/ike/detect.rs b/rust/src/ike/detect.rs index 40605decbd..74677d524d 100644 --- a/rust/src/ike/detect.rs +++ b/rust/src/ike/detect.rs @@ -17,12 +17,18 @@ // Author: Frank Honza +use super::ike::ALPROTO_IKE; use super::ipsec_parser::IkeV2Transform; +use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; +use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; use crate::ike::ike::*; use std::ffi::CStr; -use std::os::raw::c_void; +use std::os::raw::{c_char, c_int, c_void}; use std::ptr; -use suricata_sys::sys::DetectEngineThreadCtx; +use suricata_sys::sys::{ + DetectEngineCtx, DetectEngineThreadCtx, SCDetectBufferSetActiveList, + SCDetectHelperBufferMpmRegister, SCDetectSignatureSetAppProto, Signature, +}; #[no_mangle] pub extern "C" fn SCIkeStateGetExchType(tx: &IKETransaction, exch_type: *mut u8) -> u8 { @@ -45,32 +51,6 @@ pub extern "C" fn SCIkeStateGetExchType(tx: &IKETransaction, exch_type: *mut u8) return 0; } -#[no_mangle] -pub extern "C" fn SCIkeStateGetSpiInitiator( - tx: &IKETransaction, buffer: *mut *const u8, buffer_len: *mut u32, -) -> u8 { - debug_validate_bug_on!(buffer.is_null() || buffer_len.is_null()); - - unsafe { - *buffer = tx.hdr.spi_initiator.as_ptr(); - *buffer_len = tx.hdr.spi_initiator.len() as u32; - } - return 1; -} - -#[no_mangle] -pub extern "C" fn SCIkeStateGetSpiResponder( - tx: &IKETransaction, buffer: *mut *const u8, buffer_len: *mut u32, -) -> u8 { - debug_validate_bug_on!(buffer.is_null() || buffer_len.is_null()); - - unsafe { - *buffer = tx.hdr.spi_responder.as_ptr(); - *buffer_len = tx.hdr.spi_responder.len() as u32; - } - return 1; -} - #[no_mangle] pub extern "C" fn SCIkeStateGetNonce( tx: &IKETransaction, buffer: *mut *const u8, buffer_len: *mut u32, @@ -235,3 +215,85 @@ pub unsafe extern "C" fn SCIkeStateGetNoncePayloadLength( *value = 0; return 0; } + +unsafe extern "C" fn ike_tx_get_spi_initiator( + tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { + let tx = cast_pointer!(tx, IKETransaction); + *buffer = tx.hdr.spi_initiator.as_ptr(); + *buffer_len = tx.hdr.spi_initiator.len() as u32; + return true; +} + +unsafe extern "C" fn ike_tx_get_spi_responder( + tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { + let tx = cast_pointer!(tx, IKETransaction); + *buffer = tx.hdr.spi_responder.as_ptr(); + *buffer_len = tx.hdr.spi_responder.len() as u32; + return true; +} + +static mut G_IKE_SPI_INITIATOR_BUFFER_ID: c_int = 0; +static mut G_IKE_SPI_RESPONDER_BUFFER_ID: c_int = 0; + +#[no_mangle] +pub unsafe extern "C" fn SCDetectIkeRegister() { + let kw_initiator = SigTableElmtStickyBuffer { + name: String::from("ike.init_spi"), + desc: String::from("sticky buffer to match on the IKE spi initiator"), + url: String::from("/rules/ike-keywords.html#ike-init_spi"), + setup: ike_spi_initiator_setup, + }; + helper_keyword_register_sticky_buffer(&kw_initiator); + G_IKE_SPI_INITIATOR_BUFFER_ID = SCDetectHelperBufferMpmRegister( + b"ike_init_spi\0".as_ptr() as *const libc::c_char, + b"ike init spi\0".as_ptr() as *const libc::c_char, + ALPROTO_IKE, + STREAM_TOSERVER, + Some(ike_tx_get_spi_initiator), + ); + + let kw_responder = SigTableElmtStickyBuffer { + name: String::from("ike.resp_spi"), + desc: String::from("sticky buffer to match on the IKE spi responder"), + url: String::from("/rules/ike-keywords.html#ike-resp_spi"), + setup: ike_spi_responder_setup, + }; + helper_keyword_register_sticky_buffer(&kw_responder); + G_IKE_SPI_RESPONDER_BUFFER_ID = SCDetectHelperBufferMpmRegister( + b"ike_resp_spi\0".as_ptr() as *const libc::c_char, + b"ike resp spi\0".as_ptr() as *const libc::c_char, + ALPROTO_IKE, + STREAM_TOCLIENT, + Some(ike_tx_get_spi_responder), + ); +} + +unsafe extern "C" fn ike_spi_initiator_setup( + de_ctx: *mut DetectEngineCtx, s: *mut Signature, _str: *const c_char, +) -> c_int { + if SCDetectBufferSetActiveList(de_ctx, s, G_IKE_SPI_INITIATOR_BUFFER_ID) < 0 { + return -1; + } + + if SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0 { + return -1; + } + + return 0; +} + +unsafe extern "C" fn ike_spi_responder_setup( + de_ctx: *mut DetectEngineCtx, s: *mut Signature, _str: *const c_char, +) -> c_int { + if SCDetectBufferSetActiveList(de_ctx, s, G_IKE_SPI_RESPONDER_BUFFER_ID) < 0 { + return -1; + } + + if SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0 { + return -1; + } + + return 0; +} diff --git a/rust/src/ike/ike.rs b/rust/src/ike/ike.rs index 1d574b6b53..97d6b5e85d 100644 --- a/rust/src/ike/ike.rs +++ b/rust/src/ike/ike.rs @@ -360,7 +360,7 @@ extern "C" fn ike_tx_get_alstate_progress( return 1; } -static mut ALPROTO_IKE: AppProto = ALPROTO_UNKNOWN; +pub(super) static mut ALPROTO_IKE: AppProto = ALPROTO_UNKNOWN; // Parser name as a C style string. const PARSER_NAME: &[u8] = b"ike\0"; diff --git a/src/Makefile.am b/src/Makefile.am index 161061a2c1..1af5c3af5e 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -233,7 +233,6 @@ noinst_HEADERS = \ detect-ike-key-exchange-payload.h \ detect-ike-nonce-payload-length.h \ detect-ike-nonce-payload.h \ - detect-ike-spi.h \ detect-ike-vendor.h \ detect-ipaddr.h \ detect-ipopts.h \ @@ -818,7 +817,6 @@ libsuricata_c_a_SOURCES = \ detect-ike-key-exchange-payload.c \ detect-ike-nonce-payload-length.c \ detect-ike-nonce-payload.c \ - detect-ike-spi.c \ detect-ike-vendor.c \ detect-ipaddr.c \ detect-ipopts.c \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 477247642b..6c4bf06362 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -232,7 +232,6 @@ #include "detect-modbus.h" #include "detect-dnp3.h" #include "detect-ike-exch-type.h" -#include "detect-ike-spi.h" #include "detect-ike-vendor.h" #include "detect-ike-chosen-sa.h" #include "detect-ike-key-exchange-payload-length.h" @@ -591,7 +590,6 @@ void SigTableSetup(void) DetectDNP3Register(); DetectIkeExchTypeRegister(); - DetectIkeSpiRegister(); DetectIkeVendorRegister(); DetectIkeChosenSaRegister(); DetectIkeKeyExchangePayloadLengthRegister(); @@ -774,6 +772,7 @@ void SigTableSetup(void) SCDetectSshRegister(); SCDetectQuicRegister(); SCDetectSmbRegister(); + SCDetectIkeRegister(); for (size_t i = 0; i < preregistered_callbacks_nb; i++) { PreregisteredCallbacks[i](); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index c07a26dd97..637cbd36b3 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -282,8 +282,6 @@ enum DetectKeywordId { DETECT_TRANSFORM_LUAXFORM, DETECT_IKE_EXCH_TYPE, - DETECT_IKE_SPI_INITIATOR, - DETECT_IKE_SPI_RESPONDER, DETECT_IKE_VENDOR, DETECT_IKE_CHOSEN_SA, DETECT_IKE_KEY_EXCHANGE_PAYLOAD_LENGTH, diff --git a/src/detect-ike-spi.c b/src/detect-ike-spi.c deleted file mode 100644 index 778ef10eaa..0000000000 --- a/src/detect-ike-spi.c +++ /dev/null @@ -1,168 +0,0 @@ -/* Copyright (C) 2020 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * - * \author Frank Honza - */ - -#include "suricata-common.h" -#include "threads.h" -#include "decode.h" -#include "detect.h" - -#include "detect-parse.h" -#include "detect-engine.h" -#include "detect-engine-buffer.h" -#include "detect-engine-mpm.h" -#include "detect-engine-prefilter.h" -#include "detect-urilen.h" - -#include "flow.h" -#include "flow-var.h" -#include "flow-util.h" - -#include "util-debug.h" -#include "util-unittest.h" -#include "util-unittest-helper.h" -#include "util-spm.h" - -#include "app-layer.h" -#include "app-layer-parser.h" - -#include "detect-ike-spi.h" -#include "stream-tcp.h" - -#include "rust.h" -#include "app-layer-ike.h" -#include "rust-bindings.h" - -#define KEYWORD_NAME_INITIATOR "ike.init_spi" -#define KEYWORD_DOC_INITIATOR "ike-keywords.html#ike-init_spi"; -#define BUFFER_NAME_INITIATOR "ike.init_spi" -#define BUFFER_DESC_INITIATOR "ike init spi" - -#define KEYWORD_NAME_RESPONDER "ike.resp_spi" -#define KEYWORD_DOC_RESPONDER "ike-keywords.html#ike-resp_spi"; -#define BUFFER_NAME_RESPONDER "ike.resp_spi" -#define BUFFER_DESC_RESPONDER "ike resp spi" - -static int g_buffer_initiator_id = 0; -static int g_buffer_responder_id = 0; - -static int DetectSpiInitiatorSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) -{ - if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_initiator_id) < 0) - return -1; - - if (SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0) - return -1; - - return 0; -} - -static int DetectSpiResponderSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) -{ - if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_responder_id) < 0) - return -1; - - if (SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0) - return -1; - - return 0; -} - -static InspectionBuffer *GetInitiatorData(DetectEngineThreadCtx *det_ctx, - const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv, - const int list_id) -{ - InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); - if (buffer->inspect == NULL) { - const uint8_t *b = NULL; - uint32_t b_len = 0; - - if (SCIkeStateGetSpiInitiator(txv, &b, &b_len) != 1) - return NULL; - if (b == NULL || b_len == 0) - return NULL; - - InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms); - } - - return buffer; -} - -static InspectionBuffer *GetResponderData(DetectEngineThreadCtx *det_ctx, - const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv, - const int list_id) -{ - InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); - if (buffer->inspect == NULL) { - const uint8_t *b = NULL; - uint32_t b_len = 0; - - if (SCIkeStateGetSpiResponder(txv, &b, &b_len) != 1) - return NULL; - if (b == NULL || b_len == 0) - return NULL; - - InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms); - } - - return buffer; -} - -void DetectIkeSpiRegister(void) -{ - // register initiator - sigmatch_table[DETECT_IKE_SPI_INITIATOR].name = KEYWORD_NAME_INITIATOR; - sigmatch_table[DETECT_IKE_SPI_INITIATOR].url = - "/rules/" KEYWORD_DOC_INITIATOR sigmatch_table[DETECT_IKE_SPI_INITIATOR].desc = - "sticky buffer to match on the IKE spi initiator"; - sigmatch_table[DETECT_IKE_SPI_INITIATOR].Setup = DetectSpiInitiatorSetup; - sigmatch_table[DETECT_IKE_SPI_INITIATOR].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER; - - DetectAppLayerInspectEngineRegister(BUFFER_NAME_INITIATOR, ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, - DetectEngineInspectBufferGeneric, GetInitiatorData); - - DetectAppLayerMpmRegister(BUFFER_NAME_INITIATOR, SIG_FLAG_TOSERVER, 1, - PrefilterGenericMpmRegister, GetInitiatorData, ALPROTO_IKE, 1); - - DetectBufferTypeSetDescriptionByName(BUFFER_NAME_INITIATOR, BUFFER_DESC_INITIATOR); - - g_buffer_initiator_id = DetectBufferTypeGetByName(BUFFER_NAME_INITIATOR); - SCLogDebug("registering " BUFFER_NAME_INITIATOR " rule option"); - - // register responder - sigmatch_table[DETECT_IKE_SPI_RESPONDER].name = KEYWORD_NAME_RESPONDER; - sigmatch_table[DETECT_IKE_SPI_RESPONDER].url = - "/rules/" KEYWORD_DOC_RESPONDER sigmatch_table[DETECT_IKE_SPI_RESPONDER].desc = - "sticky buffer to match on the IKE spi responder"; - sigmatch_table[DETECT_IKE_SPI_RESPONDER].Setup = DetectSpiResponderSetup; - sigmatch_table[DETECT_IKE_SPI_RESPONDER].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER; - - DetectAppLayerInspectEngineRegister(BUFFER_NAME_RESPONDER, ALPROTO_IKE, SIG_FLAG_TOCLIENT, 1, - DetectEngineInspectBufferGeneric, GetResponderData); - - DetectAppLayerMpmRegister(BUFFER_NAME_RESPONDER, SIG_FLAG_TOCLIENT, 1, - PrefilterGenericMpmRegister, GetResponderData, ALPROTO_IKE, 1); - - DetectBufferTypeSetDescriptionByName(BUFFER_NAME_RESPONDER, BUFFER_DESC_RESPONDER); - - g_buffer_responder_id = DetectBufferTypeGetByName(BUFFER_NAME_RESPONDER); - SCLogDebug("registering " BUFFER_NAME_RESPONDER " rule option"); -} diff --git a/src/detect-ike-spi.h b/src/detect-ike-spi.h deleted file mode 100644 index 11baf8d62f..0000000000 --- a/src/detect-ike-spi.h +++ /dev/null @@ -1,28 +0,0 @@ -/* Copyright (C) 2020 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * - * \author Frank Honza - */ - -#ifndef SURICATA_DETECT_IKE_SPI_H -#define SURICATA_DETECT_IKE_SPI_H - -void DetectIkeSpiRegister(void); - -#endif /* SURICATA_DETECT_IKE_SPI_H */