diff --git a/doc/userguide/rules/kerberos-keywords.rst b/doc/userguide/rules/kerberos-keywords.rst index d863b161cd..4932121461 100644 --- a/doc/userguide/rules/kerberos-keywords.rst +++ b/doc/userguide/rules/kerberos-keywords.rst @@ -9,6 +9,8 @@ It is possible to specify the following values defined in RFC4120: krb5_msg_type uses :ref:`unsigned 32-bit integer `. +See ``suricata --list-keywords=json | jq '."krb5_msg_type".enum_values'`` + * 10 (AS-REQ) * 11 (AS-REP) * 12 (TGS-REQ) diff --git a/rust/src/krb/detect.rs b/rust/src/krb/detect.rs index a35d00abc7..ffb32350af 100644 --- a/rust/src/krb/detect.rs +++ b/rust/src/krb/detect.rs @@ -22,9 +22,9 @@ use suricata_sys::sys::AppProtoEnum::ALPROTO_KRB5; use suricata_sys::sys::{ AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, SCDetectHelperBufferProgressRegister, SCDetectHelperKeywordAliasRegister, - SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferProgressMpmRegister, - SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, - Signature, + SCDetectHelperKeywordJsonInfoRegister, SCDetectHelperKeywordRegister, + SCDetectHelperMultiBufferProgressMpmRegister, SCDetectSignatureSetAppProto, SCJsonBuilder, + SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature, }; use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; @@ -32,9 +32,10 @@ use crate::detect::uint::{ detect_parse_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Match, }; use crate::detect::{ - helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_ENUM_UINT, - SIGMATCH_INFO_UINT32, + helper_keyword_register_multi_buffer, EnumString, SigTableElmtStickyBuffer, + SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_UINT32, }; +use crate::jsonbuilder::JsonBuilder; use kerberos_parser::krb5::EncryptionType; use nom8::branch::alt; @@ -528,6 +529,11 @@ unsafe extern "C" fn krb5_ticket_encryption_free(_de: *mut DetectEngineCtx, ctx: std::mem::drop(Box::from_raw(ctx)); } +unsafe extern "C" fn krb5_msg_type_list_values(jsb: *mut SCJsonBuilder) { + let jsb = cast_pointer!(jsb, JsonBuilder); + let _ = Krb5MessageType::list_values(jsb); +} + #[no_mangle] pub unsafe extern "C" fn SCDetectKrb5Register() { let kw = SCSigTableAppLiteElmt { @@ -540,6 +546,8 @@ pub unsafe extern "C" fn SCDetectKrb5Register() { flags: SIGMATCH_INFO_ENUM_UINT | SIGMATCH_INFO_UINT32, }; G_KRB5_MSG_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); + SCDetectHelperKeywordJsonInfoRegister(G_KRB5_MSG_TYPE_KW_ID, Some(krb5_msg_type_list_values)); + G_KRB5_GENERIC_BUFFER_ID = SCDetectHelperBufferProgressRegister( b"krb5_generic\0".as_ptr() as *const libc::c_char, ALPROTO_KRB5 as AppProto,