From 77abcde9ee0470c31b4f2c42e595fa9d015c3967 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Tue, 2 Dec 2025 13:41:23 +0530 Subject: [PATCH] rust/flow: add public wrapper for dir in order to be able to use it on the C side for elephant flow detection. --- rust/src/detect/flow.rs | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/rust/src/detect/flow.rs b/rust/src/detect/flow.rs index e1dba1dfba..53e01af06e 100644 --- a/rust/src/detect/flow.rs +++ b/rust/src/detect/flow.rs @@ -25,7 +25,6 @@ use std::ffi::CStr; #[allow(non_camel_case_types)] #[derive(PartialEq, Eq, Clone, Debug)] #[repr(u8)] -/// This data structure is also used in detect-flow-pkts.c pub enum DetectFlowDir { DETECT_FLOW_TOSERVER = 1, DETECT_FLOW_TOCLIENT = 2, @@ -53,7 +52,8 @@ fn detect_parse_flow_direction(i: &str) -> IResult<&str, DetectFlowDir> { value(DetectFlowDir::DETECT_FLOW_TOSERVER, tag("toserver")), value(DetectFlowDir::DETECT_FLOW_TOCLIENT, tag("toclient")), value(DetectFlowDir::DETECT_FLOW_TOEITHER, tag("either")), - )).parse(i)?; + )) + .parse(i)?; return Ok((i, fd)); } @@ -130,6 +130,26 @@ fn detect_parse_flow_bytes_dir(i: &str, dir: DetectFlowDir) -> IResult<&str, Det )); } +// Just a public wrapper around the direction parsing +#[no_mangle] +pub unsafe extern "C" fn SCDetectFlowDir( + dir_str: *const std::os::raw::c_char, +) -> *mut DetectFlowDir { + let dir = CStr::from_ptr(dir_str); + if let Ok(d) = dir.to_str() { + if let Ok((_, parsed)) = detect_parse_flow_direction(d) { + let boxed = Box::new(parsed); + return Box::into_raw(boxed) as *mut _; + } + } + return std::ptr::null_mut(); +} + +#[no_mangle] +pub unsafe extern "C" fn SCDetectFlowDirFree(ctx: &mut DetectFlowDir) { + std::mem::drop(Box::from_raw(ctx)); +} + #[no_mangle] pub unsafe extern "C" fn SCDetectFlowBytesParseDir( ustr: *const std::os::raw::c_char, dir: DetectFlowDir,