diff --git a/doc/userguide/rules/nfs-keywords.rst b/doc/userguide/rules/nfs-keywords.rst index eb8a3190c8..db43af744d 100644 --- a/doc/userguide/rules/nfs-keywords.rst +++ b/doc/userguide/rules/nfs-keywords.rst @@ -29,6 +29,9 @@ It is also possible to specify the string values for NFSv3 or NFSv4 procedures. ``nfs_procedure: getattr`` will match like ``nfs_procedure: 1; nfs.version: <4;`` or ``nfs_procedure: 9; nfs.version: >=4;`` +See ``suricata --list-keywords=json | jq '."nfs_procedure".enum_values'`` +to have the list of all the string values for NFS v2, v3 and v4 procedures. + Unlike the other keywords, the usage of range is inclusive. Syntax:: diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs index 380f1e8ad8..689d2144c5 100644 --- a/rust/src/http2/detect.rs +++ b/rust/src/http2/detect.rs @@ -25,8 +25,8 @@ use crate::detect::uint::{ DetectUintArrayData, DetectUintData, DetectUintIndex, DetectUintMode, }; use crate::detect::{DetectThreadBuf, EnumString}; -use crate::jsonbuilder::JsonBuilder; use crate::direction::Direction; +use crate::jsonbuilder::JsonBuilder; use base64::{engine::general_purpose::STANDARD, Engine}; use std::ffi::CStr; use std::os::raw::c_void; @@ -1190,4 +1190,4 @@ pub unsafe extern "C" fn SCDetectHTTP2frameTypeListValues(jsb: *mut SCJsonBuilde pub unsafe extern "C" fn SCDetectHTTP2errorcodeListValues(jsb: *mut SCJsonBuilder) { let jsb = cast_pointer!(jsb, JsonBuilder); let _ = parser::HTTP2ErrorCode::list_values(jsb); -} \ No newline at end of file +} diff --git a/rust/src/nfs/detect.rs b/rust/src/nfs/detect.rs index 99f12348f7..416f102366 100644 --- a/rust/src/nfs/detect.rs +++ b/rust/src/nfs/detect.rs @@ -17,12 +17,13 @@ // written by Pierre Chifflier +use crate::jsonbuilder::JsonBuilder; use suricata_sys::sys::AppProtoEnum::ALPROTO_NFS; use suricata_sys::sys::{ AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferProgressRegister, - SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordRegister, - SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, - Signature, + SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordJsonInfoRegister, + SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCJsonBuilder, + SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature, }; use super::nfs::{NFSTransaction, NFSTransactionTypeData}; @@ -32,7 +33,7 @@ use crate::detect::uint::{ detect_match_uint, detect_parse_uint_enum, detect_parse_uint_inclusive, DetectUintData, SCDetectU32Free, SCDetectU32ParseInclusive, }; -use crate::detect::{SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_UINT32}; +use crate::detect::{EnumString, SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_UINT32}; use std::ffi::{c_int, CStr}; use std::os::raw::c_void; @@ -202,6 +203,21 @@ unsafe extern "C" fn nfs_version_free(_de: *mut DetectEngineCtx, ctx: *mut c_voi SCDetectU32Free(ctx); } +unsafe extern "C" fn nfs_procedure_list_values(jsb: *mut SCJsonBuilder) { + let jsb = cast_pointer!(jsb, JsonBuilder); + let _ = jsb.open_object("enum_values"); + let _ = jsb.open_object("v2"); + let _ = NfsProc2::list_values(jsb); + let _ = jsb.close(); + let _ = jsb.open_object("v3"); + let _ = NfsProc3::list_values(jsb); + let _ = jsb.close(); + let _ = jsb.open_object("v4"); + let _ = NfsProc4::list_values(jsb); + let _ = jsb.close(); + let _ = jsb.close(); +} + #[no_mangle] pub unsafe extern "C" fn SCDetectNfsRegister() { let kw = SCSigTableAppLiteElmt { @@ -214,6 +230,7 @@ pub unsafe extern "C" fn SCDetectNfsRegister() { flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_ENUM_UINT, }; G_NFS_PROCEDURE_KW_ID = SCDetectHelperKeywordRegister(&kw); + SCDetectHelperKeywordJsonInfoRegister(G_NFS_PROCEDURE_KW_ID, Some(nfs_procedure_list_values)); G_NFS_PROCEDURE_BUFFER_ID = SCDetectHelperBufferProgressRegister( b"nfs_procedure\0".as_ptr() as *const libc::c_char, ALPROTO_NFS as AppProto,