mirror of https://github.com/OISF/suricata
detect/rfb: move keywords to rust
Ticket: 7178 On the way, convert rfb.secresult to a generic integer with enumeration cf ticket 6723pull/11616/head
Philippe Antoine
1 year ago
committed by
Victor Julien
parent
a673e1913b
commit
62a186ceef
@ -1,110 +0,0 @@
|
||||
/* Copyright (C) 2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
*
|
||||
* \author Sascha Steinbiss <sascha.steinbiss@dcso.de>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "threads.h"
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
#include "detect-urilen.h"
|
||||
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "flow-util.h"
|
||||
|
||||
#include "util-debug.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "util-spm.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
|
||||
#include "detect-rfb-name.h"
|
||||
#include "stream-tcp.h"
|
||||
|
||||
#include "rust.h"
|
||||
#include "app-layer-rfb.h"
|
||||
#include "rust-bindings.h"
|
||||
|
||||
#define KEYWORD_NAME "rfb.name"
|
||||
#define KEYWORD_DOC "rfb-keywords.html#rfb-name";
|
||||
#define BUFFER_NAME "rfb.name"
|
||||
#define BUFFER_DESC "rfb name"
|
||||
static int g_buffer_id = 0;
|
||||
|
||||
static int DetectRfbNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
|
||||
{
|
||||
if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
|
||||
return -1;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_RFB) < 0)
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms, Flow *_f,
|
||||
const uint8_t _flow_flags, void *txv, const int list_id)
|
||||
{
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
if (buffer->inspect == NULL) {
|
||||
const uint8_t *b = NULL;
|
||||
uint32_t b_len = 0;
|
||||
|
||||
if (rs_rfb_tx_get_name(txv, &b, &b_len) != 1)
|
||||
return NULL;
|
||||
if (b == NULL || b_len == 0)
|
||||
return NULL;
|
||||
|
||||
InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
void DetectRfbNameRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_RFB_NAME].name = KEYWORD_NAME;
|
||||
sigmatch_table[DETECT_AL_RFB_NAME].url = "/rules/" KEYWORD_DOC
|
||||
sigmatch_table[DETECT_AL_RFB_NAME].desc = "sticky buffer to match on the RFB desktop name";
|
||||
sigmatch_table[DETECT_AL_RFB_NAME].Setup = DetectRfbNameSetup;
|
||||
sigmatch_table[DETECT_AL_RFB_NAME].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
|
||||
|
||||
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_RFB, SIG_FLAG_TOCLIENT, 1,
|
||||
DetectEngineInspectBufferGeneric, GetData);
|
||||
|
||||
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 1, PrefilterGenericMpmRegister,
|
||||
GetData, ALPROTO_RFB, 1);
|
||||
|
||||
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
|
||||
|
||||
g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
|
||||
|
||||
SCLogDebug("registering " BUFFER_NAME " rule option");
|
||||
}
|
||||
@ -1,29 +0,0 @@
|
||||
/* Copyright (C) 2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Frank Honza
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_DETECT_RFB_NAME_H
|
||||
#define SURICATA_DETECT_RFB_NAME_H
|
||||
|
||||
void DetectRfbNameRegister(void);
|
||||
|
||||
#endif /* SURICATA_DETECT_RFB_NAME_H */
|
||||
@ -1,285 +0,0 @@
|
||||
/* Copyright (C) 2020-2021 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Sascha Steinbiss <sascha.steinbiss@dcso.de>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "conf.h"
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-content-inspection.h"
|
||||
#include "detect-rfb-secresult.h"
|
||||
#include "util-unittest.h"
|
||||
|
||||
#include "rust.h"
|
||||
|
||||
#define PARSE_REGEX "\\S[A-z]"
|
||||
static DetectParseRegex parse_regex;
|
||||
|
||||
static int rfb_secresult_id = 0;
|
||||
|
||||
static int DetectRfbSecresultMatch(DetectEngineThreadCtx *det_ctx,
|
||||
Flow *f, uint8_t flags, void *state,
|
||||
void *txv, const Signature *s,
|
||||
const SigMatchCtx *ctx);
|
||||
static int DetectRfbSecresultSetup (DetectEngineCtx *, Signature *, const char *);
|
||||
#ifdef UNITTESTS
|
||||
static void RfbSecresultRegisterTests(void);
|
||||
#endif
|
||||
void DetectRfbSecresultFree(DetectEngineCtx *, void *);
|
||||
|
||||
typedef struct DetectRfbSecresultData_ {
|
||||
uint32_t result; /** result code */
|
||||
} DetectRfbSecresultData;
|
||||
|
||||
/**
|
||||
* \brief Registration function for rfb.secresult: keyword
|
||||
*/
|
||||
void DetectRfbSecresultRegister (void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].name = "rfb.secresult";
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].desc = "match RFB security result";
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].url = "/rules/rfb-keywords.html#rfb-secresult";
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].AppLayerTxMatch = DetectRfbSecresultMatch;
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].Setup = DetectRfbSecresultSetup;
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].Free = DetectRfbSecresultFree;
|
||||
#ifdef UNITTESTS
|
||||
sigmatch_table[DETECT_AL_RFB_SECRESULT].RegisterTests = RfbSecresultRegisterTests;
|
||||
#endif
|
||||
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
|
||||
|
||||
DetectAppLayerInspectEngineRegister("rfb.secresult", ALPROTO_RFB, SIG_FLAG_TOCLIENT, 1,
|
||||
DetectEngineInspectGenericList, NULL);
|
||||
|
||||
rfb_secresult_id = DetectBufferTypeGetByName("rfb.secresult");
|
||||
}
|
||||
|
||||
enum {
|
||||
RFB_SECRESULT_OK = 0,
|
||||
RFB_SECRESULT_FAIL,
|
||||
RFB_SECRESULT_TOOMANY,
|
||||
RFB_SECRESULT_UNKNOWN
|
||||
};
|
||||
|
||||
/**
|
||||
* \struct DetectRfbSecresult_
|
||||
* DetectRfbSecresult_ is used to store values
|
||||
*/
|
||||
|
||||
struct DetectRfbSecresult_ {
|
||||
const char *result;
|
||||
uint16_t code;
|
||||
} results[] = {
|
||||
{ "ok", RFB_SECRESULT_OK, },
|
||||
{ "fail", RFB_SECRESULT_FAIL, },
|
||||
{ "toomany", RFB_SECRESULT_TOOMANY, },
|
||||
{ "unknown", RFB_SECRESULT_UNKNOWN, },
|
||||
{ NULL, 0 },
|
||||
};
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief Function to match security result of a RFB TX
|
||||
*
|
||||
* \param det_ctx Pointer to the pattern matcher thread.
|
||||
* \param f Pointer to the current flow.
|
||||
* \param flags Flags.
|
||||
* \param state App layer state.
|
||||
* \param txv Pointer to the RFBTransaction.
|
||||
* \param s Pointer to the Signature.
|
||||
* \param ctx Pointer to the sigmatch that we will cast into DetectRfbSecresultData.
|
||||
*
|
||||
* \retval 0 no match.
|
||||
* \retval 1 match.
|
||||
*/
|
||||
static int DetectRfbSecresultMatch(DetectEngineThreadCtx *det_ctx,
|
||||
Flow *f, uint8_t flags, void *state,
|
||||
void *txv, const Signature *s,
|
||||
const SigMatchCtx *ctx)
|
||||
{
|
||||
const DetectRfbSecresultData *de = (const DetectRfbSecresultData *)ctx;
|
||||
uint32_t resultcode;
|
||||
int ret = 0;
|
||||
|
||||
if (!de)
|
||||
return 0;
|
||||
|
||||
ret = rs_rfb_tx_get_secresult(txv, &resultcode);
|
||||
if (ret == 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (de->result < 3) {
|
||||
/* we are asking for a defined code... */
|
||||
if (resultcode == de->result) {
|
||||
/* ... which needs to match */
|
||||
return 1;
|
||||
}
|
||||
} else {
|
||||
/* we are asking for an unknown code */
|
||||
if (resultcode > 2) {
|
||||
/* match any unknown code */
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief This function is used to parse options passed via rfb.secresults: keyword
|
||||
*
|
||||
* \param rawstr Pointer to the user provided secresult options
|
||||
*
|
||||
* \retval de pointer to DetectRfbSecresultData on success
|
||||
* \retval NULL on failure
|
||||
*/
|
||||
static DetectRfbSecresultData *DetectRfbSecresultParse (const char *rawstr)
|
||||
{
|
||||
int i;
|
||||
DetectRfbSecresultData *de = NULL;
|
||||
int found = 0;
|
||||
|
||||
pcre2_match_data *match = NULL;
|
||||
int ret = DetectParsePcreExec(&parse_regex, &match, rawstr, 0, 0);
|
||||
if (ret < 1) {
|
||||
SCLogError("pcre_exec parse error, ret %" PRId32 ", string %s", ret, rawstr);
|
||||
goto error;
|
||||
}
|
||||
|
||||
for(i = 0; results[i].result != NULL; i++) {
|
||||
if((strcasecmp(results[i].result,rawstr)) == 0) {
|
||||
found = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if(found == 0) {
|
||||
SCLogError("unknown secresult value %s", rawstr);
|
||||
goto error;
|
||||
}
|
||||
|
||||
de = SCMalloc(sizeof(DetectRfbSecresultData));
|
||||
if (unlikely(de == NULL))
|
||||
goto error;
|
||||
|
||||
de->result = results[i].code;
|
||||
|
||||
pcre2_match_data_free(match);
|
||||
return de;
|
||||
|
||||
error:
|
||||
if (match) {
|
||||
pcre2_match_data_free(match);
|
||||
}
|
||||
if (de) SCFree(de);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief this function is used to add the parsed secresult into the current signature
|
||||
*
|
||||
* \param de_ctx pointer to the Detection Engine Context
|
||||
* \param s pointer to the Current Signature
|
||||
* \param rawstr pointer to the user provided secresult options
|
||||
*
|
||||
* \retval 0 on Success
|
||||
* \retval -1 on Failure
|
||||
*/
|
||||
static int DetectRfbSecresultSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
|
||||
{
|
||||
DetectRfbSecresultData *de = NULL;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_RFB) < 0)
|
||||
return -1;
|
||||
|
||||
de = DetectRfbSecresultParse(rawstr);
|
||||
if (de == NULL)
|
||||
goto error;
|
||||
|
||||
if (SigMatchAppendSMToList(
|
||||
de_ctx, s, DETECT_AL_RFB_SECRESULT, (SigMatchCtx *)de, rfb_secresult_id) == NULL) {
|
||||
goto error;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
error:
|
||||
if (de)
|
||||
SCFree(de);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief this function will free memory associated with DetectRfbSecresultData
|
||||
*
|
||||
* \param de pointer to DetectRfbSecresultData
|
||||
*/
|
||||
void DetectRfbSecresultFree(DetectEngineCtx *de_ctx, void *de_ptr)
|
||||
{
|
||||
DetectRfbSecresultData *de = (DetectRfbSecresultData *)de_ptr;
|
||||
if(de) SCFree(de);
|
||||
}
|
||||
|
||||
/*
|
||||
* ONLY TESTS BELOW THIS COMMENT
|
||||
*/
|
||||
|
||||
#ifdef UNITTESTS
|
||||
/**
|
||||
* \test RfbSecresultTestParse01 is a test for a valid secresult value
|
||||
*/
|
||||
static int RfbSecresultTestParse01 (void)
|
||||
{
|
||||
DetectRfbSecresultData *de = DetectRfbSecresultParse("fail");
|
||||
|
||||
FAIL_IF_NULL(de);
|
||||
|
||||
DetectRfbSecresultFree(NULL, de);
|
||||
|
||||
PASS;
|
||||
}
|
||||
|
||||
/**
|
||||
* \test RfbSecresultTestParse02 is a test for an invalid secresult value
|
||||
*/
|
||||
static int RfbSecresultTestParse02 (void)
|
||||
{
|
||||
DetectRfbSecresultData *de = DetectRfbSecresultParse("invalidopt");
|
||||
|
||||
FAIL_IF_NOT_NULL(de);
|
||||
|
||||
PASS;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function registers unit tests for RfbSecresult
|
||||
*/
|
||||
void RfbSecresultRegisterTests(void)
|
||||
{
|
||||
UtRegisterTest("RfbSecresultTestParse01", RfbSecresultTestParse01);
|
||||
UtRegisterTest("RfbSecresultTestParse02", RfbSecresultTestParse02);
|
||||
}
|
||||
#endif /* UNITTESTS */
|
||||
@ -1,29 +0,0 @@
|
||||
/* Copyright (C) 2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Sascha Steinbiss <sascha.steinbiss@dcso.de>
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_DETECT_RFB_SECRESULT_H
|
||||
#define SURICATA_DETECT_RFB_SECRESULT_H
|
||||
|
||||
void DetectRfbSecresultRegister(void);
|
||||
|
||||
#endif /*SURICATA_DETECT_RFB_SECRESULT_H */
|
||||
@ -1,137 +0,0 @@
|
||||
/* Copyright (C) 2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
*
|
||||
* \author Sascha Steinbiss <sascha.steinbiss@dcso.de>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "conf.h"
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-content-inspection.h"
|
||||
#include "detect-rfb-sectype.h"
|
||||
#include "detect-engine-uint.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "util-byte.h"
|
||||
|
||||
#include "rust-bindings.h"
|
||||
|
||||
|
||||
static int DetectRfbSectypeSetup (DetectEngineCtx *, Signature *s, const char *str);
|
||||
static void DetectRfbSectypeFree(DetectEngineCtx *, void *);
|
||||
static int g_rfb_sectype_buffer_id = 0;
|
||||
|
||||
static int DetectRfbSectypeMatch (DetectEngineThreadCtx *, Flow *,
|
||||
uint8_t, void *, void *, const Signature *,
|
||||
const SigMatchCtx *);
|
||||
|
||||
/**
|
||||
* \brief Registration function for rfb.sectype keyword.
|
||||
*/
|
||||
void DetectRfbSectypeRegister (void)
|
||||
{
|
||||
sigmatch_table[DETECT_AL_RFB_SECTYPE].name = "rfb.sectype";
|
||||
sigmatch_table[DETECT_AL_RFB_SECTYPE].desc = "match RFB security type";
|
||||
sigmatch_table[DETECT_AL_RFB_SECTYPE].url = "/rules/rfb-keywords.html#rfb-sectype";
|
||||
sigmatch_table[DETECT_AL_RFB_SECTYPE].AppLayerTxMatch = DetectRfbSectypeMatch;
|
||||
sigmatch_table[DETECT_AL_RFB_SECTYPE].Setup = DetectRfbSectypeSetup;
|
||||
sigmatch_table[DETECT_AL_RFB_SECTYPE].Free = DetectRfbSectypeFree;
|
||||
|
||||
DetectAppLayerInspectEngineRegister(
|
||||
"rfb.sectype", ALPROTO_RFB, SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL);
|
||||
|
||||
g_rfb_sectype_buffer_id = DetectBufferTypeGetByName("rfb.sectype");
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief Function to match security type of a RFB TX
|
||||
*
|
||||
* \param det_ctx Pointer to the pattern matcher thread.
|
||||
* \param f Pointer to the current flow.
|
||||
* \param flags Flags.
|
||||
* \param state App layer state.
|
||||
* \param txv Pointer to the RFBTransaction.
|
||||
* \param s Pointer to the Signature.
|
||||
* \param ctx Pointer to the sigmatch that we will cast into DetectU32Data.
|
||||
*
|
||||
* \retval 0 no match.
|
||||
* \retval 1 match.
|
||||
*/
|
||||
static int DetectRfbSectypeMatch (DetectEngineThreadCtx *det_ctx,
|
||||
Flow *f, uint8_t flags, void *state,
|
||||
void *txv, const Signature *s,
|
||||
const SigMatchCtx *ctx)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
const DetectU32Data *dd = (const DetectU32Data *)ctx;
|
||||
uint32_t version;
|
||||
rs_rfb_tx_get_sectype(txv, &version);
|
||||
if (DetectU32Match(version, dd))
|
||||
SCReturnInt(1);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Function to add the parsed RFB security type field into the current signature.
|
||||
*
|
||||
* \param de_ctx Pointer to the Detection Engine Context.
|
||||
* \param s Pointer to the Current Signature.
|
||||
* \param rawstr Pointer to the user provided flags options.
|
||||
*
|
||||
* \retval 0 on Success.
|
||||
* \retval -1 on Failure.
|
||||
*/
|
||||
static int DetectRfbSectypeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
|
||||
{
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_RFB) != 0)
|
||||
return -1;
|
||||
|
||||
DetectU32Data *dd = DetectU32Parse(rawstr);
|
||||
if (dd == NULL) {
|
||||
SCLogError("Parsing \'%s\' failed", rawstr);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* okay so far so good, lets get this into a SigMatch
|
||||
* and put it in the Signature. */
|
||||
|
||||
if (SigMatchAppendSMToList(de_ctx, s, DETECT_AL_RFB_SECTYPE, (SigMatchCtx *)dd,
|
||||
g_rfb_sectype_buffer_id) == NULL) {
|
||||
goto error;
|
||||
}
|
||||
return 0;
|
||||
|
||||
error:
|
||||
DetectRfbSectypeFree(de_ctx, dd);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \internal
|
||||
* \brief Function to free memory associated with DetectU32Data.
|
||||
*
|
||||
* \param de_ptr Pointer to DetectU32Data.
|
||||
*/
|
||||
static void DetectRfbSectypeFree(DetectEngineCtx *de_ctx, void *ptr)
|
||||
{
|
||||
rs_detect_u32_free(ptr);
|
||||
}
|
||||
@ -1,29 +0,0 @@
|
||||
/* Copyright (C) 2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Sascha Steinbiss <sascha.steinbiss@dcso.de>
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_DETECT_RFB_SECTYPE_H
|
||||
#define SURICATA_DETECT_RFB_SECTYPE_H
|
||||
|
||||
void DetectRfbSectypeRegister(void);
|
||||
|
||||
#endif /* SURICATA_DETECT_RFB_SECTYPE_H */
|
||||
Loading…
Reference in New Issue