ntp: add ntp.mode keyword

This keyword also accepts strings for known mode names.

Ticket: #8429
(cherry picked from commit 991e7f3b1d)

doc/userguide/rules/ntp-keywords.rst

@@ -3,6 +3,39 @@ NTP Keywords
 
 .. role:: example-rule-options
 
+ntp.mode
+********
+
+NTP mode. This keyword accepts either an integer or one of the known mode
+names.
+
+``ntp.mode`` uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.
+
+Syntax::
+
+  ntp.mode:[op]<number>
+  ntp.mode:[!]reserved
+  ntp.mode:[!]symmetric_active
+  ntp.mode:[!]symmetric_passive
+  ntp.mode:[!]client
+  ntp.mode:[!]server
+  ntp.mode:[!]broadcast
+  ntp.mode:[!]control
+  ntp.mode:[!]private
+
+Examples::
+
+  ntp.mode:3
+  ntp.mode:>3
+  ntp.mode:client
+  ntp.mode:!server
+
+Signature Example:
+
+.. container:: example-rule
+
+  alert ntp any any -> any any (msg:"NTP client mode"; :example-rule-options:`ntp.mode:client;` sid:1; rev:1;)
+
 ntp.stratum
 ***********
 
@@ -24,7 +57,7 @@ Signature Example:
 
 .. container:: example-rule
 
-  alert ntp any any -> any any (msg:"NTP stratum 2"; :example-rule-options:`ntp.stratum:2;` sid:1; rev:1;)
+  alert ntp any any -> any any (msg:"NTP stratum 2"; :example-rule-options:`ntp.stratum:2;` sid:2; rev:1;)
 
 ntp.version
 ***********
@@ -47,4 +80,4 @@ Signature Example:
 
 .. container:: example-rule
 
-  alert ntp any any -> any any (msg:"NTP version 4"; :example-rule-options:`ntp.version:4;` sid:2; rev:1;)
+  alert ntp any any -> any any (msg:"NTP version 4"; :example-rule-options:`ntp.version:4;` sid:3; rev:1;)

rust/src/ntp/detect.rs

@@ -17,7 +17,10 @@
 
 use super::ntp::{NTPTransaction, ALPROTO_NTP};
 use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
-use crate::detect::uint::{DetectUintData, SCDetectU8Free, SCDetectU8Match, SCDetectU8Parse};
+use crate::detect::uint::{
+    detect_parse_uint_enum, DetectUintData, SCDetectU8Free, SCDetectU8Match, SCDetectU8Parse,
+};
+use std::ffi::CStr;
 use std::os::raw::{c_int, c_void};
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferProgressRegister,
@@ -26,9 +29,23 @@ use suricata_sys::sys::{
 };
 
 static mut G_NTP_VERSION_KW_ID: u16 = 0;
+static mut G_NTP_MODE_KW_ID: u16 = 0;
 static mut G_NTP_STRATUM_KW_ID: u16 = 0;
 static mut G_NTP_GENERIC_BUFFER_ID: c_int = 0;
 
+#[derive(Clone, Debug, PartialEq, EnumStringU8)]
+#[repr(u8)]
+pub enum NTPMode {
+    Reserved = 0,
+    SymmetricActive = 1,
+    SymmetricPassive = 2,
+    Client = 3,
+    Server = 4,
+    Broadcast = 5,
+    Control = 6,
+    Private = 7,
+}
+
 unsafe extern "C" fn ntp_detect_version_setup(
     de: *mut DetectEngineCtx, s: *mut Signature, raw: *const libc::c_char,
 ) -> c_int {
@@ -68,6 +85,51 @@ unsafe extern "C" fn ntp_detect_u8_free(_de: *mut DetectEngineCtx, ctx: *mut c_v
     SCDetectU8Free(ctx);
 }
 
+unsafe extern "C" fn ntp_detect_mode_setup(
+    de: *mut DetectEngineCtx, s: *mut Signature, raw: *const libc::c_char,
+) -> c_int {
+    if SCDetectSignatureSetAppProto(s, ALPROTO_NTP) != 0 {
+        return -1;
+    }
+    let ctx = ntp_parse_mode(raw) as *mut c_void;
+    if ctx.is_null() {
+        return -1;
+    }
+    if SCSigMatchAppendSMToList(
+        de,
+        s,
+        G_NTP_MODE_KW_ID,
+        ctx as *mut SigMatchCtx,
+        G_NTP_GENERIC_BUFFER_ID,
+    )
+    .is_null()
+    {
+        ntp_detect_u8_free(std::ptr::null_mut(), ctx);
+        return -1;
+    }
+    return 0;
+}
+
+unsafe extern "C" fn ntp_parse_mode(ustr: *const std::os::raw::c_char) -> *mut DetectUintData<u8> {
+    let ft_name: &CStr = CStr::from_ptr(ustr);
+    if let Ok(s) = ft_name.to_str() {
+        if let Some(ctx) = detect_parse_uint_enum::<u8, NTPMode>(s) {
+            let boxed = Box::new(ctx);
+            return Box::into_raw(boxed);
+        }
+    }
+    return std::ptr::null_mut();
+}
+
+unsafe extern "C" fn ntp_detect_mode_match(
+    _de: *mut DetectEngineThreadCtx, _f: *mut Flow, _flags: u8, _state: *mut c_void,
+    tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
+) -> c_int {
+    let tx = cast_pointer!(tx, NTPTransaction);
+    let ctx = cast_pointer!(ctx, DetectUintData<u8>);
+    return SCDetectU8Match(tx.mode, ctx);
+}
+
 unsafe extern "C" fn ntp_detect_stratum_setup(
     de: *mut DetectEngineCtx, s: *mut Signature, raw: *const libc::c_char,
 ) -> c_int {
@@ -120,6 +182,17 @@ pub(super) unsafe extern "C" fn detect_ntp_register() {
         1,
     );
 
+    let kw = SCSigTableAppLiteElmt {
+        name: b"ntp.mode\0".as_ptr() as *const libc::c_char,
+        desc: b"match NTP mode\0".as_ptr() as *const libc::c_char,
+        url: b"/rules/ntp-keywords.html#ntp-mode\0".as_ptr() as *const libc::c_char,
+        AppLayerTxMatch: Some(ntp_detect_mode_match),
+        Setup: Some(ntp_detect_mode_setup),
+        Free: Some(ntp_detect_u8_free),
+        flags: 0,
+    };
+    G_NTP_MODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
+
     let kw = SCSigTableAppLiteElmt {
         name: b"ntp.stratum\0".as_ptr() as *const libc::c_char,
         desc: b"match NTP stratum\0".as_ptr() as *const libc::c_char,
@@ -131,3 +204,58 @@ pub(super) unsafe extern "C" fn detect_ntp_register() {
     };
     G_NTP_STRATUM_KW_ID = SCDetectHelperKeywordRegister(&kw);
 }
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use crate::detect::uint::DetectUintMode;
+
+    #[test]
+    fn test_ntp_parse_known_mode_strings() {
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("reserved").unwrap();
+        assert_eq!(ctx.arg1, 0);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("symmetric_active").unwrap();
+        assert_eq!(ctx.arg1, 1);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("symmetric_passive").unwrap();
+        assert_eq!(ctx.arg1, 2);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("client").unwrap();
+        assert_eq!(ctx.arg1, 3);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("server").unwrap();
+        assert_eq!(ctx.arg1, 4);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("broadcast").unwrap();
+        assert_eq!(ctx.arg1, 5);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("control").unwrap();
+        assert_eq!(ctx.arg1, 6);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("private").unwrap();
+        assert_eq!(ctx.arg1, 7);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+    }
+
+    #[test]
+    fn test_ntp_parse_mode_integer() {
+        let ctx = detect_parse_uint_enum::<u8, NTPMode>("255").unwrap();
+        assert_eq!(ctx.arg1, 255);
+        assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
+    }
+
+    #[test]
+    fn test_ntp_parse_mode_invalid() {
+        assert!(detect_parse_uint_enum::<u8, NTPMode>("invalid_mode").is_none());
+        assert!(detect_parse_uint_enum::<u8, NTPMode>("symmetric_private").is_none());
+        assert!(detect_parse_uint_enum::<u8, NTPMode>("256").is_none());
+    }
+}