diff --git a/rust/src/dcerpc/detect.rs b/rust/src/dcerpc/detect.rs index b06e1232ac..59518b9676 100644 --- a/rust/src/dcerpc/detect.rs +++ b/rust/src/dcerpc/detect.rs @@ -19,7 +19,7 @@ use super::dcerpc::{ DCERPCState, DCERPCTransaction, DCERPC_TYPE_REQUEST, DCERPC_TYPE_RESPONSE, DCERPC_UUID_ENTRY_FLAG_FF, }; -use crate::detect::detect::{detect_match_uint, detect_parse_uint, DetectUintData}; +use crate::detect::uint::{detect_match_uint, detect_parse_uint, DetectUintData}; use std::ffi::CStr; use std::os::raw::{c_char, c_void}; use uuid::Uuid; @@ -295,7 +295,7 @@ pub unsafe extern "C" fn rs_dcerpc_opnum_free(ptr: *mut c_void) { #[cfg(test)] mod test { use super::*; - use crate::detect::detect::DetectUintMode; + use crate::detect::uint::DetectUintMode; fn extract_op_version(i: &str) -> Result<(DetectUintMode, u16), ()> { match detect_parse_uint(i) { diff --git a/rust/src/detect/detect.rs b/rust/src/detect/detect.rs index 4d863f44e3..55b083e16a 100644 --- a/rust/src/detect/detect.rs +++ b/rust/src/detect/detect.rs @@ -18,354 +18,15 @@ use nom7::branch::alt; use nom7::bytes::complete::{is_a, tag, take_while}; use nom7::character::complete::{alpha0, char, digit1}; -use nom7::combinator::{all_consuming, map_opt, map_res, opt, value, verify}; +use nom7::combinator::{all_consuming, map_opt, map_res, opt, value}; use nom7::error::{make_error, ErrorKind}; use nom7::Err; use nom7::IResult; +use super::uint::*; use std::ffi::{CStr, CString}; use std::str::FromStr; -#[derive(PartialEq, Clone, Debug)] -#[repr(u8)] -pub enum DetectUintMode { - DetectUintModeEqual, - DetectUintModeLt, - DetectUintModeLte, - DetectUintModeGt, - DetectUintModeGte, - DetectUintModeRange, - DetectUintModeNe, -} - -#[derive(Debug)] -#[repr(C)] -pub struct DetectUintData { - pub arg1: T, - pub arg2: T, - pub mode: DetectUintMode, -} - -pub trait DetectIntType: - std::str::FromStr + std::cmp::PartialOrd + num::PrimInt + num::Bounded -{ -} -impl DetectIntType for T where - T: std::str::FromStr + std::cmp::PartialOrd + num::PrimInt + num::Bounded -{ -} - -fn detect_parse_uint_start_equal(i: &str) -> IResult<&str, DetectUintData> { - let (i, _) = opt(tag("="))(i)?; - let (i, _) = opt(is_a(" "))(i)?; - let (i, arg1) = map_opt(digit1, |s: &str| s.parse::().ok())(i)?; - Ok(( - i, - DetectUintData { - arg1, - arg2: T::min_value(), - mode: DetectUintMode::DetectUintModeEqual, - }, - )) -} - -fn detect_parse_uint_start_interval(i: &str) -> IResult<&str, DetectUintData> { - let (i, arg1) = map_opt(digit1, |s: &str| s.parse::().ok())(i)?; - let (i, _) = opt(is_a(" "))(i)?; - let (i, _) = alt((tag("-"), tag("<>")))(i)?; - let (i, _) = opt(is_a(" "))(i)?; - let (i, arg2) = verify(map_opt(digit1, |s: &str| s.parse::().ok()), |x| { - x > &arg1 && *x - arg1 > T::one() - })(i)?; - Ok(( - i, - DetectUintData { - arg1, - arg2, - mode: DetectUintMode::DetectUintModeRange, - }, - )) -} - -fn detect_parse_uint_start_interval_inclusive( - i: &str, -) -> IResult<&str, DetectUintData> { - let (i, arg1) = verify(map_opt(digit1, |s: &str| s.parse::().ok()), |x| { - *x > T::min_value() - })(i)?; - let (i, _) = opt(is_a(" "))(i)?; - let (i, _) = alt((tag("-"), tag("<>")))(i)?; - let (i, _) = opt(is_a(" "))(i)?; - let (i, arg2) = verify(map_opt(digit1, |s: &str| s.parse::().ok()), |x| { - *x > arg1 && *x < T::max_value() - })(i)?; - Ok(( - i, - DetectUintData { - arg1: arg1 - T::one(), - arg2: arg2 + T::one(), - mode: DetectUintMode::DetectUintModeRange, - }, - )) -} - -fn detect_parse_uint_mode(i: &str) -> IResult<&str, DetectUintMode> { - let (i, mode) = alt(( - value(DetectUintMode::DetectUintModeGte, tag(">=")), - value(DetectUintMode::DetectUintModeLte, tag("<=")), - value(DetectUintMode::DetectUintModeGt, tag(">")), - value(DetectUintMode::DetectUintModeLt, tag("<")), - value(DetectUintMode::DetectUintModeNe, tag("!=")), - value(DetectUintMode::DetectUintModeNe, tag("!")), - value(DetectUintMode::DetectUintModeEqual, tag("=")), - ))(i)?; - return Ok((i, mode)); -} - -fn detect_parse_uint_start_symbol(i: &str) -> IResult<&str, DetectUintData> { - let (i, mode) = detect_parse_uint_mode(i)?; - let (i, _) = opt(is_a(" "))(i)?; - let (i, arg1) = map_opt(digit1, |s: &str| s.parse::().ok())(i)?; - - match mode { - DetectUintMode::DetectUintModeNe => {} - DetectUintMode::DetectUintModeLt => { - if arg1 == T::min_value() { - return Err(Err::Error(make_error(i, ErrorKind::Verify))); - } - } - DetectUintMode::DetectUintModeLte => { - if arg1 == T::max_value() { - return Err(Err::Error(make_error(i, ErrorKind::Verify))); - } - } - DetectUintMode::DetectUintModeGt => { - if arg1 == T::max_value() { - return Err(Err::Error(make_error(i, ErrorKind::Verify))); - } - } - DetectUintMode::DetectUintModeGte => { - if arg1 == T::min_value() { - return Err(Err::Error(make_error(i, ErrorKind::Verify))); - } - } - _ => { - return Err(Err::Error(make_error(i, ErrorKind::MapOpt))); - } - } - - Ok(( - i, - DetectUintData { - arg1, - arg2: T::min_value(), - mode: mode, - }, - )) -} - -pub fn detect_match_uint(x: &DetectUintData, val: T) -> bool { - match x.mode { - DetectUintMode::DetectUintModeEqual => { - if val == x.arg1 { - return true; - } - } - DetectUintMode::DetectUintModeNe => { - if val != x.arg1 { - return true; - } - } - DetectUintMode::DetectUintModeLt => { - if val < x.arg1 { - return true; - } - } - DetectUintMode::DetectUintModeLte => { - if val <= x.arg1 { - return true; - } - } - DetectUintMode::DetectUintModeGt => { - if val > x.arg1 { - return true; - } - } - DetectUintMode::DetectUintModeGte => { - if val >= x.arg1 { - return true; - } - } - DetectUintMode::DetectUintModeRange => { - if val > x.arg1 && val < x.arg2 { - return true; - } - } - } - return false; -} - -pub fn detect_parse_uint_notending(i: &str) -> IResult<&str, DetectUintData> { - let (i, _) = opt(is_a(" "))(i)?; - let (i, uint) = alt(( - detect_parse_uint_start_interval, - detect_parse_uint_start_equal, - detect_parse_uint_start_symbol, - ))(i)?; - Ok((i, uint)) -} - -pub fn detect_parse_uint(i: &str) -> IResult<&str, DetectUintData> { - let (i, uint) = detect_parse_uint_notending(i)?; - let (i, _) = all_consuming(take_while(|c| c == ' '))(i)?; - Ok((i, uint)) -} - -pub fn detect_parse_uint_inclusive(i: &str) -> IResult<&str, DetectUintData> { - let (i, _) = opt(is_a(" "))(i)?; - let (i, uint) = alt(( - detect_parse_uint_start_interval_inclusive, - detect_parse_uint_start_equal, - detect_parse_uint_start_symbol, - ))(i)?; - let (i, _) = all_consuming(take_while(|c| c == ' '))(i)?; - Ok((i, uint)) -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u64_parse( - ustr: *const std::os::raw::c_char, -) -> *mut DetectUintData { - let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe - if let Ok(s) = ft_name.to_str() { - if let Ok((_, ctx)) = detect_parse_uint::(s) { - let boxed = Box::new(ctx); - return Box::into_raw(boxed) as *mut _; - } - } - return std::ptr::null_mut(); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u64_match( - arg: u64, ctx: &DetectUintData, -) -> std::os::raw::c_int { - if detect_match_uint(ctx, arg) { - return 1; - } - return 0; -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u64_free(ctx: *mut std::os::raw::c_void) { - // Just unbox... - std::mem::drop(Box::from_raw(ctx as *mut DetectUintData)); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u32_parse( - ustr: *const std::os::raw::c_char, -) -> *mut DetectUintData { - let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe - if let Ok(s) = ft_name.to_str() { - if let Ok((_, ctx)) = detect_parse_uint::(s) { - let boxed = Box::new(ctx); - return Box::into_raw(boxed) as *mut _; - } - } - return std::ptr::null_mut(); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u32_parse_inclusive( - ustr: *const std::os::raw::c_char, -) -> *mut DetectUintData { - let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe - if let Ok(s) = ft_name.to_str() { - if let Ok((_, ctx)) = detect_parse_uint_inclusive::(s) { - let boxed = Box::new(ctx); - return Box::into_raw(boxed) as *mut _; - } - } - return std::ptr::null_mut(); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u32_match( - arg: u32, ctx: &DetectUintData, -) -> std::os::raw::c_int { - if detect_match_uint(ctx, arg) { - return 1; - } - return 0; -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u32_free(ctx: &mut DetectUintData) { - // Just unbox... - std::mem::drop(Box::from_raw(ctx)); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u8_parse( - ustr: *const std::os::raw::c_char, -) -> *mut DetectUintData { - let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe - if let Ok(s) = ft_name.to_str() { - if let Ok((_, ctx)) = detect_parse_uint::(s) { - let boxed = Box::new(ctx); - return Box::into_raw(boxed) as *mut _; - } - } - return std::ptr::null_mut(); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u8_match( - arg: u8, ctx: &DetectUintData, -) -> std::os::raw::c_int { - if detect_match_uint(ctx, arg) { - return 1; - } - return 0; -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u8_free(ctx: &mut DetectUintData) { - // Just unbox... - std::mem::drop(Box::from_raw(ctx)); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u16_parse( - ustr: *const std::os::raw::c_char, -) -> *mut DetectUintData { - let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe - if let Ok(s) = ft_name.to_str() { - if let Ok((_, ctx)) = detect_parse_uint::(s) { - let boxed = Box::new(ctx); - return Box::into_raw(boxed) as *mut _; - } - } - return std::ptr::null_mut(); -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u16_match( - arg: u16, ctx: &DetectUintData, -) -> std::os::raw::c_int { - if detect_match_uint(ctx, arg) { - return 1; - } - return 0; -} - -#[no_mangle] -pub unsafe extern "C" fn rs_detect_u16_free(ctx: &mut DetectUintData) { - // Just unbox... - std::mem::drop(Box::from_raw(ctx)); -} - #[repr(u8)] #[derive(Clone, Copy, PartialEq, FromPrimitive, Debug)] pub enum DetectStreamSizeDataFlags { diff --git a/rust/src/detect/mod.rs b/rust/src/detect/mod.rs index 1c492a0f53..65f9c204e0 100644 --- a/rust/src/detect/mod.rs +++ b/rust/src/detect/mod.rs @@ -16,6 +16,7 @@ */ pub mod byte_math; +pub mod uint; pub mod detect; pub mod error; pub mod parser; diff --git a/rust/src/detect/uint.rs b/rust/src/detect/uint.rs new file mode 100644 index 0000000000..d5e41297f6 --- /dev/null +++ b/rust/src/detect/uint.rs @@ -0,0 +1,370 @@ +/* Copyright (C) 2022 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +use nom7::branch::alt; +use nom7::bytes::complete::{is_a, tag, take_while}; +use nom7::character::complete::digit1; +use nom7::combinator::{all_consuming, map_opt, opt, value, verify}; +use nom7::error::{make_error, ErrorKind}; +use nom7::Err; +use nom7::IResult; + +use std::ffi::CStr; + +#[derive(PartialEq, Clone, Debug)] +#[repr(u8)] +pub enum DetectUintMode { + DetectUintModeEqual, + DetectUintModeLt, + DetectUintModeLte, + DetectUintModeGt, + DetectUintModeGte, + DetectUintModeRange, + DetectUintModeNe, +} + +#[derive(Debug)] +#[repr(C)] +pub struct DetectUintData { + pub arg1: T, + pub arg2: T, + pub mode: DetectUintMode, +} + +pub trait DetectIntType: + std::str::FromStr + std::cmp::PartialOrd + num::PrimInt + num::Bounded +{ +} +impl DetectIntType for T where + T: std::str::FromStr + std::cmp::PartialOrd + num::PrimInt + num::Bounded +{ +} + +pub fn detect_parse_uint_start_equal( + i: &str, +) -> IResult<&str, DetectUintData> { + let (i, _) = opt(tag("="))(i)?; + let (i, _) = opt(is_a(" "))(i)?; + let (i, arg1) = map_opt(digit1, |s: &str| s.parse::().ok())(i)?; + Ok(( + i, + DetectUintData { + arg1, + arg2: T::min_value(), + mode: DetectUintMode::DetectUintModeEqual, + }, + )) +} + +pub fn detect_parse_uint_start_interval( + i: &str, +) -> IResult<&str, DetectUintData> { + let (i, arg1) = map_opt(digit1, |s: &str| s.parse::().ok())(i)?; + let (i, _) = opt(is_a(" "))(i)?; + let (i, _) = alt((tag("-"), tag("<>")))(i)?; + let (i, _) = opt(is_a(" "))(i)?; + let (i, arg2) = verify(map_opt(digit1, |s: &str| s.parse::().ok()), |x| { + x > &arg1 && *x - arg1 > T::one() + })(i)?; + Ok(( + i, + DetectUintData { + arg1, + arg2, + mode: DetectUintMode::DetectUintModeRange, + }, + )) +} + +fn detect_parse_uint_start_interval_inclusive( + i: &str, +) -> IResult<&str, DetectUintData> { + let (i, arg1) = verify(map_opt(digit1, |s: &str| s.parse::().ok()), |x| { + *x > T::min_value() + })(i)?; + let (i, _) = opt(is_a(" "))(i)?; + let (i, _) = alt((tag("-"), tag("<>")))(i)?; + let (i, _) = opt(is_a(" "))(i)?; + let (i, arg2) = verify(map_opt(digit1, |s: &str| s.parse::().ok()), |x| { + *x > arg1 && *x < T::max_value() + })(i)?; + Ok(( + i, + DetectUintData { + arg1: arg1 - T::one(), + arg2: arg2 + T::one(), + mode: DetectUintMode::DetectUintModeRange, + }, + )) +} + +pub fn detect_parse_uint_mode(i: &str) -> IResult<&str, DetectUintMode> { + let (i, mode) = alt(( + value(DetectUintMode::DetectUintModeGte, tag(">=")), + value(DetectUintMode::DetectUintModeLte, tag("<=")), + value(DetectUintMode::DetectUintModeGt, tag(">")), + value(DetectUintMode::DetectUintModeLt, tag("<")), + value(DetectUintMode::DetectUintModeNe, tag("!=")), + value(DetectUintMode::DetectUintModeNe, tag("!")), + value(DetectUintMode::DetectUintModeEqual, tag("=")), + ))(i)?; + return Ok((i, mode)); +} + +fn detect_parse_uint_start_symbol(i: &str) -> IResult<&str, DetectUintData> { + let (i, mode) = detect_parse_uint_mode(i)?; + let (i, _) = opt(is_a(" "))(i)?; + let (i, arg1) = map_opt(digit1, |s: &str| s.parse::().ok())(i)?; + + match mode { + DetectUintMode::DetectUintModeNe => {} + DetectUintMode::DetectUintModeLt => { + if arg1 == T::min_value() { + return Err(Err::Error(make_error(i, ErrorKind::Verify))); + } + } + DetectUintMode::DetectUintModeLte => { + if arg1 == T::max_value() { + return Err(Err::Error(make_error(i, ErrorKind::Verify))); + } + } + DetectUintMode::DetectUintModeGt => { + if arg1 == T::max_value() { + return Err(Err::Error(make_error(i, ErrorKind::Verify))); + } + } + DetectUintMode::DetectUintModeGte => { + if arg1 == T::min_value() { + return Err(Err::Error(make_error(i, ErrorKind::Verify))); + } + } + _ => { + return Err(Err::Error(make_error(i, ErrorKind::MapOpt))); + } + } + + Ok(( + i, + DetectUintData { + arg1, + arg2: T::min_value(), + mode: mode, + }, + )) +} + +pub fn detect_match_uint(x: &DetectUintData, val: T) -> bool { + match x.mode { + DetectUintMode::DetectUintModeEqual => { + if val == x.arg1 { + return true; + } + } + DetectUintMode::DetectUintModeNe => { + if val != x.arg1 { + return true; + } + } + DetectUintMode::DetectUintModeLt => { + if val < x.arg1 { + return true; + } + } + DetectUintMode::DetectUintModeLte => { + if val <= x.arg1 { + return true; + } + } + DetectUintMode::DetectUintModeGt => { + if val > x.arg1 { + return true; + } + } + DetectUintMode::DetectUintModeGte => { + if val >= x.arg1 { + return true; + } + } + DetectUintMode::DetectUintModeRange => { + if val > x.arg1 && val < x.arg2 { + return true; + } + } + } + return false; +} + +pub fn detect_parse_uint_notending(i: &str) -> IResult<&str, DetectUintData> { + let (i, _) = opt(is_a(" "))(i)?; + let (i, uint) = alt(( + detect_parse_uint_start_interval, + detect_parse_uint_start_equal, + detect_parse_uint_start_symbol, + ))(i)?; + Ok((i, uint)) +} + +pub fn detect_parse_uint(i: &str) -> IResult<&str, DetectUintData> { + let (i, uint) = detect_parse_uint_notending(i)?; + let (i, _) = all_consuming(take_while(|c| c == ' '))(i)?; + Ok((i, uint)) +} + +pub fn detect_parse_uint_inclusive(i: &str) -> IResult<&str, DetectUintData> { + let (i, _) = opt(is_a(" "))(i)?; + let (i, uint) = alt(( + detect_parse_uint_start_interval_inclusive, + detect_parse_uint_start_equal, + detect_parse_uint_start_symbol, + ))(i)?; + let (i, _) = all_consuming(take_while(|c| c == ' '))(i)?; + Ok((i, uint)) +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u64_parse( + ustr: *const std::os::raw::c_char, +) -> *mut DetectUintData { + let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe + if let Ok(s) = ft_name.to_str() { + if let Ok((_, ctx)) = detect_parse_uint::(s) { + let boxed = Box::new(ctx); + return Box::into_raw(boxed) as *mut _; + } + } + return std::ptr::null_mut(); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u64_match( + arg: u64, ctx: &DetectUintData, +) -> std::os::raw::c_int { + if detect_match_uint(ctx, arg) { + return 1; + } + return 0; +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u64_free(ctx: *mut std::os::raw::c_void) { + // Just unbox... + std::mem::drop(Box::from_raw(ctx as *mut DetectUintData)); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u32_parse( + ustr: *const std::os::raw::c_char, +) -> *mut DetectUintData { + let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe + if let Ok(s) = ft_name.to_str() { + if let Ok((_, ctx)) = detect_parse_uint::(s) { + let boxed = Box::new(ctx); + return Box::into_raw(boxed) as *mut _; + } + } + return std::ptr::null_mut(); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u32_parse_inclusive( + ustr: *const std::os::raw::c_char, +) -> *mut DetectUintData { + let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe + if let Ok(s) = ft_name.to_str() { + if let Ok((_, ctx)) = detect_parse_uint_inclusive::(s) { + let boxed = Box::new(ctx); + return Box::into_raw(boxed) as *mut _; + } + } + return std::ptr::null_mut(); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u32_match( + arg: u32, ctx: &DetectUintData, +) -> std::os::raw::c_int { + if detect_match_uint(ctx, arg) { + return 1; + } + return 0; +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u32_free(ctx: &mut DetectUintData) { + // Just unbox... + std::mem::drop(Box::from_raw(ctx)); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u8_parse( + ustr: *const std::os::raw::c_char, +) -> *mut DetectUintData { + let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe + if let Ok(s) = ft_name.to_str() { + if let Ok((_, ctx)) = detect_parse_uint::(s) { + let boxed = Box::new(ctx); + return Box::into_raw(boxed) as *mut _; + } + } + return std::ptr::null_mut(); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u8_match( + arg: u8, ctx: &DetectUintData, +) -> std::os::raw::c_int { + if detect_match_uint(ctx, arg) { + return 1; + } + return 0; +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u8_free(ctx: &mut DetectUintData) { + // Just unbox... + std::mem::drop(Box::from_raw(ctx)); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u16_parse( + ustr: *const std::os::raw::c_char, +) -> *mut DetectUintData { + let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe + if let Ok(s) = ft_name.to_str() { + if let Ok((_, ctx)) = detect_parse_uint::(s) { + let boxed = Box::new(ctx); + return Box::into_raw(boxed) as *mut _; + } + } + return std::ptr::null_mut(); +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u16_match( + arg: u16, ctx: &DetectUintData, +) -> std::os::raw::c_int { + if detect_match_uint(ctx, arg) { + return 1; + } + return 0; +} + +#[no_mangle] +pub unsafe extern "C" fn rs_detect_u16_free(ctx: &mut DetectUintData) { + // Just unbox... + std::mem::drop(Box::from_raw(ctx)); +} diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs index ce79540ef7..72554a5277 100644 --- a/rust/src/http2/detect.rs +++ b/rust/src/http2/detect.rs @@ -20,7 +20,7 @@ use super::http2::{ }; use super::parser; use crate::core::Direction; -use crate::detect::detect::{detect_match_uint, DetectUintData}; +use crate::detect::uint::{detect_match_uint, DetectUintData}; use std::ffi::CStr; use std::str::FromStr; diff --git a/rust/src/http2/parser.rs b/rust/src/http2/parser.rs index a3ad68a456..df139b57cf 100644 --- a/rust/src/http2/parser.rs +++ b/rust/src/http2/parser.rs @@ -17,7 +17,7 @@ use super::huffman; use crate::common::nom7::bits; -use crate::detect::detect::{detect_parse_uint, DetectUintData}; +use crate::detect::uint::{detect_parse_uint, DetectUintData}; use crate::http2::http2::{HTTP2DynTable, HTTP2_MAX_TABLESIZE}; use nom7::bits::streaming::take as take_bits; use nom7::branch::alt; @@ -749,7 +749,7 @@ pub fn http2_parse_frame_settings(i: &[u8]) -> IResult<&[u8], Vec