mirror of https://github.com/OISF/suricata
Philippe Antoine
2 months ago
committed by
Victor Julien
parent
e976db7261
commit
3e70a79ed2
@ -1,179 +0,0 @@
|
||||
/* Copyright (C) 2017-2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-content.h"
|
||||
#include "detect-pcre.h"
|
||||
#include "detect-nfs-version.h"
|
||||
#include "detect-engine-uint.h"
|
||||
|
||||
#include "app-layer-parser.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-util.h"
|
||||
#include "flow-var.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "util-byte.h"
|
||||
|
||||
#include "app-layer-nfs-tcp.h"
|
||||
#include "rust.h"
|
||||
|
||||
|
||||
static int DetectNfsVersionSetup (DetectEngineCtx *, Signature *s, const char *str);
|
||||
static void DetectNfsVersionFree(DetectEngineCtx *de_ctx, void *);
|
||||
static int g_nfs_request_buffer_id = 0;
|
||||
|
||||
static int DetectNfsVersionMatch (DetectEngineThreadCtx *, Flow *,
|
||||
uint8_t, void *, void *, const Signature *,
|
||||
const SigMatchCtx *);
|
||||
|
||||
/**
|
||||
* \brief Registration function for nfs_procedure keyword.
|
||||
*/
|
||||
void DetectNfsVersionRegister (void)
|
||||
{
|
||||
sigmatch_table[DETECT_NFS_VERSION].name = "nfs.version";
|
||||
sigmatch_table[DETECT_NFS_VERSION].alias = "nfs_version";
|
||||
sigmatch_table[DETECT_NFS_VERSION].desc = "match NFS version";
|
||||
// TODO write doc sigmatch_table[DETECT_NFS_VERSION].url =
|
||||
// "/rules/nfs-keywords.html#nfs-version";
|
||||
sigmatch_table[DETECT_NFS_VERSION].AppLayerTxMatch = DetectNfsVersionMatch;
|
||||
sigmatch_table[DETECT_NFS_VERSION].Setup = DetectNfsVersionSetup;
|
||||
sigmatch_table[DETECT_NFS_VERSION].Free = DetectNfsVersionFree;
|
||||
sigmatch_table[DETECT_NFS_VERSION].flags = SIGMATCH_INFO_UINT32;
|
||||
// unit tests were the same as DetectNfsProcedureRegisterTests
|
||||
|
||||
DetectAppLayerInspectEngineRegister(
|
||||
"nfs_request", ALPROTO_NFS, SIG_FLAG_TOSERVER, 0, DetectEngineInspectGenericList, NULL);
|
||||
g_nfs_request_buffer_id = DetectBufferTypeGetByName("nfs_request");
|
||||
|
||||
SCLogDebug("g_nfs_request_buffer_id %d", g_nfs_request_buffer_id);
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief Function to match version of a TX
|
||||
*
|
||||
* \param t Pointer to thread vars.
|
||||
* \param det_ctx Pointer to the pattern matcher thread.
|
||||
* \param f Pointer to the current flow.
|
||||
* \param flags Flags.
|
||||
* \param state App layer state.
|
||||
* \param s Pointer to the Signature.
|
||||
* \param m Pointer to the sigmatch that we will cast into
|
||||
* DetectU32Data.
|
||||
*
|
||||
* \retval 0 no match.
|
||||
* \retval 1 match.
|
||||
*/
|
||||
static int DetectNfsVersionMatch (DetectEngineThreadCtx *det_ctx,
|
||||
Flow *f, uint8_t flags, void *state,
|
||||
void *txv, const Signature *s,
|
||||
const SigMatchCtx *ctx)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
const DetectU32Data *dd = (const DetectU32Data *)ctx;
|
||||
uint32_t version;
|
||||
SCNfsTxGetVersion(txv, &version);
|
||||
SCLogDebug("version %u mode %u lo %u hi %u", version, dd->mode, dd->arg1, dd->arg2);
|
||||
if (DetectU32Match(version, dd))
|
||||
SCReturnInt(1);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief Function to parse options passed via tls validity keywords.
|
||||
*
|
||||
* \param rawstr Pointer to the user provided options.
|
||||
*
|
||||
* \retval dd pointer to DetectU32Data on success.
|
||||
* \retval NULL on failure.
|
||||
*/
|
||||
static DetectU32Data *DetectNfsVersionParse(const char *rawstr)
|
||||
{
|
||||
return SCDetectU32ParseInclusive(rawstr);
|
||||
}
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* \brief Function to add the parsed tls validity field into the current signature.
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context.
|
||||
* \param s Pointer to the Current Signature.
|
||||
* \param rawstr Pointer to the user provided flags options.
|
||||
* \param type Defines if this is notBefore or notAfter.
|
||||
*
|
||||
* \retval 0 on Success.
|
||||
* \retval -1 on Failure.
|
||||
*/
|
||||
static int DetectNfsVersionSetup (DetectEngineCtx *de_ctx, Signature *s,
|
||||
const char *rawstr)
|
||||
{
|
||||
SCLogDebug("\'%s\'", rawstr);
|
||||
|
||||
if (SCDetectSignatureSetAppProto(s, ALPROTO_NFS) != 0)
|
||||
return -1;
|
||||
|
||||
DetectU32Data *dd = DetectNfsVersionParse(rawstr);
|
||||
if (dd == NULL) {
|
||||
SCLogError("Parsing \'%s\' failed", rawstr);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* okay so far so good, lets get this into a SigMatch
|
||||
* and put it in the Signature. */
|
||||
|
||||
SCLogDebug("low %u hi %u", dd->arg1, dd->arg2);
|
||||
if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_NFS_VERSION, (SigMatchCtx *)dd,
|
||||
g_nfs_request_buffer_id) == NULL) {
|
||||
goto error;
|
||||
}
|
||||
return 0;
|
||||
|
||||
error:
|
||||
DetectNfsVersionFree(de_ctx, dd);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief Function to free memory associated with DetectU32Data.
|
||||
*
|
||||
* \param de_ptr Pointer to DetectU32Data.
|
||||
*/
|
||||
void DetectNfsVersionFree(DetectEngineCtx *de_ctx, void *ptr)
|
||||
{
|
||||
SCDetectU32Free(ptr);
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
/* Copyright (C) 2017 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_DETECT_NFS_VERSION_H
|
||||
#define SURICATA_DETECT_NFS_VERSION_H
|
||||
|
||||
/* prototypes */
|
||||
void DetectNfsVersionRegister (void);
|
||||
|
||||
#endif /* SURICATA_DETECT_NFS_VERSION_H */
|
||||
Loading…
Reference in New Issue