aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/ike: move ike.vendor keyword to rust

Browse Source 
Ticket: 8310
pull/14856/head
Philippe Antoine 8 months ago committed by Victor Julien
parent 14edd66494
commit 55333a6ca0
6 changed files with 32 additions and 122 deletions
Show Stats Download Patch File Download Diff File

38
rust/src/ike/detect.rs
Unescape Escape View File

@ -25,8 +25,8 @@ use crate::detect::uint::{
SCDetectU8Parse,
};
use crate::detect::{
helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32,
SIGMATCH_INFO_UINT8,
helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
SigTableElmtStickyBuffer, SIGMATCH_INFO_UINT32, SIGMATCH_INFO_UINT8,
};
use crate::ike::ike::*;
use std::ffi::CStr;
@ -35,8 +35,8 @@ use std::ptr;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, SCDetectBufferSetActiveList,
SCDetectHelperBufferMpmRegister, SCDetectHelperBufferRegister, SCDetectHelperKeywordRegister,
SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx,
Signature,
SCDetectHelperMultiBufferMpmRegister, SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList,
SCSigTableAppLiteElmt, SigMatchCtx, Signature,
};
unsafe extern "C" fn ike_get_nonce_data(
@ -71,8 +71,7 @@ unsafe extern "C" fn ike_tx_get_key_exchange(
return false;
}
#[no_mangle]
pub unsafe extern "C" fn SCIkeTxGetVendor(
unsafe extern "C" fn ike_tx_get_vendor(
_de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buf: *mut *const u8,
len: *mut u32,
) -> bool {
@ -340,6 +339,7 @@ unsafe extern "C" fn ike_nonce_payload_setup(
static mut G_IKE_SPI_INITIATOR_BUFFER_ID: c_int = 0;
static mut G_IKE_SPI_RESPONDER_BUFFER_ID: c_int = 0;
static mut G_IKE_KEY_EXCHANGE_BUFFER_ID: c_int = 0;
static mut G_IKE_VENDOR_BUFFER_ID: c_int = 0;
static mut G_IKE_EXCHTYPE_KW_ID: u16 = 0;
static mut G_IKE_EXCHTYPE_BUFFER_ID: c_int = 0;
static mut G_IKE_PAYLOAD_LEN_KW_ID: u16 = 0;
@ -456,6 +456,20 @@ pub unsafe extern "C" fn SCDetectIkeRegister() {
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(ike_tx_get_key_exchange),
);
let kw = SigTableElmtStickyBuffer {
name: String::from("ike.vendor"),
desc: String::from("match IKE Vendor"),
url: String::from("/rules/ike-keywords.html#ike-vendor"),
setup: ike_vendor_setup,
};
helper_keyword_register_multi_buffer(&kw);
G_IKE_VENDOR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
b"ike.vendor.dn\0".as_ptr() as *const libc::c_char,
b"Like vendor\0".as_ptr() as *const libc::c_char,
ALPROTO_IKE,
STREAM_TOSERVER,
Some(ike_tx_get_vendor),
);
}
unsafe extern "C" fn ike_spi_initiator_setup(
@ -497,3 +511,15 @@ unsafe extern "C" fn ike_key_exchange_setup(
}
return 0;
}
unsafe extern "C" fn ike_vendor_setup(
de_ctx: *mut DetectEngineCtx, s: *mut Signature, _str: *const c_char,
) -> c_int {
if SCDetectBufferSetActiveList(de_ctx, s, G_IKE_VENDOR_BUFFER_ID) < 0 {
return -1;
}
if SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0 {
return -1;
}
return 0;
}

2
src/Makefile.am
Unescape Escape View File

@ -228,7 +228,6 @@ noinst_HEADERS = \
detect-icode.h \
detect-id.h \
detect-ike-chosen-sa.h \
detect-ike-vendor.h \
detect-ipaddr.h \
detect-ipopts.h \
detect-ipproto.h \
@ -807,7 +806,6 @@ libsuricata_c_a_SOURCES = \
detect-icode.c \
detect-id.c \
detect-ike-chosen-sa.c \
detect-ike-vendor.c \
detect-ipaddr.c \
detect-ipopts.c \
detect-ipproto.c \

2
src/detect-engine-register.c
Unescape Escape View File

@ -231,7 +231,6 @@
#include "detect-ssl-state.h"
#include "detect-modbus.h"
#include "detect-dnp3.h"
#include "detect-ike-vendor.h"
#include "detect-ike-chosen-sa.h"
#include "detect-vlan.h"
#include "detect-email.h"
@ -584,7 +583,6 @@ void SigTableSetup(void)
DetectModbusRegister();
DetectDNP3Register();
DetectIkeVendorRegister();
DetectIkeChosenSaRegister();
DetectTlsSniRegister();

1
src/detect-engine-register.h
Unescape Escape View File

@ -281,7 +281,6 @@ enum DetectKeywordId {
DETECT_TRANSFORM_PCREXFORM,
DETECT_TRANSFORM_LUAXFORM,
DETECT_IKE_VENDOR,
DETECT_IKE_CHOSEN_SA,
DETECT_JA4_HASH,

82
src/detect-ike-vendor.c
Unescape Escape View File

@ -1,82 +0,0 @@
/* Copyright (C) 2020-2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
*
* \author Frank Honza <frank.honza@dcso.de>
*/
#include "suricata-common.h"
#include "conf.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-mpm.h"
#include "detect-ike-vendor.h"
#include "rust.h"
#include "app-layer-parser.h"
#include "util-byte.h"
#include "util-profiling.h"
static int DetectIkeVendorSetup(DetectEngineCtx *, Signature *, const char *);
static int g_ike_vendor_buffer_id = 0;
/**
* \brief Registration function for ike.vendor keyword.
*/
void DetectIkeVendorRegister(void)
{
sigmatch_table[DETECT_IKE_VENDOR].name = "ike.vendor";
sigmatch_table[DETECT_IKE_VENDOR].desc = "match IKE Vendor";
sigmatch_table[DETECT_IKE_VENDOR].url = "/rules/ike-keywords.html#ike-vendor";
sigmatch_table[DETECT_IKE_VENDOR].Setup = DetectIkeVendorSetup;
sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_IKE_VENDOR].flags |=
SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
DetectAppLayerMultiRegister(
"ike.vendor", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, SCIkeTxGetVendor, 1);
g_ike_vendor_buffer_id = DetectBufferTypeGetByName("ike.vendor");
DetectBufferTypeSupportsMultiInstance("ike.vendor");
}
/**
* \brief setup the sticky buffer keyword used in the rule
*
* \param de_ctx Pointer to the Detection Engine Context
* \param s Pointer to the Signature to which the current keyword belongs
* \param str Should hold an empty string always
*
* \retval 0 On success
* \retval -1 On failure
*/
static int DetectIkeVendorSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
if (SCDetectBufferSetActiveList(de_ctx, s, g_ike_vendor_buffer_id) < 0)
return -1;
if (SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0)
return -1;
return 0;
}

29
src/detect-ike-vendor.h
Unescape Escape View File

@ -1,29 +0,0 @@
/* Copyright (C) 2020 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Frank Honza <frank.honza@dcso.de>
*/
#ifndef SURICATA_DETECT_IKE_VENDOR_H
#define SURICATA_DETECT_IKE_VENDOR_H
void DetectIkeVendorRegister(void);
#endif /* SURICATA_DETECT_IKE_VENDOR_H */
Write Preview
Loading…
Cancel
Save