aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/krb5: move krb5.cname and krb5.sname to rust

Browse Source 
Ticket: 8648
pull/15726/head
Philippe Antoine 1 month ago committed by Victor Julien
parent 3327cf42f0
commit 8f0dbc0b63
8 changed files with 78 additions and 223 deletions
Show Stats Download Patch File Download Diff File

89
rust/src/krb/detect.rs
Unescape Escape View File

@ -20,16 +20,21 @@
use crate::krb::krb5::{test_weak_encryption, KRB5Transaction};
use suricata_sys::sys::AppProtoEnum::ALPROTO_KRB5;
use suricata_sys::sys::{
AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferProgressRegister,
SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList,
SCSigTableAppLiteElmt, SigMatchCtx, Signature,
AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
SCDetectHelperBufferProgressRegister, SCDetectHelperKeywordAliasRegister,
SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferProgressMpmRegister,
SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx,
Signature,
};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_parse_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Match,
};
use crate::detect::{SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32};
use crate::detect::{
helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_ENUM_UINT,
SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32,
};
use kerberos_parser::krb5::EncryptionType;
use nom8::branch::alt;
@ -43,8 +48,7 @@ use nom8::Parser;
use std::ffi::{c_int, CStr};
use std::os::raw::c_void;
#[no_mangle]
pub unsafe extern "C" fn SCKrb5TxGetCname(
unsafe extern "C" fn krb5_cname_get_data(
_de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8,
buffer_len: *mut u32,
) -> bool {
@ -60,8 +64,7 @@ pub unsafe extern "C" fn SCKrb5TxGetCname(
false
}
#[no_mangle]
pub unsafe extern "C" fn SCKrb5TxGetSname(
unsafe extern "C" fn krb5_sname_get_data(
_de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8,
buffer_len: *mut u32,
) -> bool {
@ -343,6 +346,8 @@ mod tests {
static mut G_KRB5_MSG_TYPE_KW_ID: u16 = 0;
static mut G_KRB5_GENERIC_BUFFER_ID: c_int = 0;
static mut G_KRB5_ERR_CODE_KW_ID: u16 = 0;
static mut G_KRB5_CNAME_BUFFER_ID: c_int = 0;
static mut G_KRB5_SNAME_BUFFER_ID: c_int = 0;
// We should apply the derive on the kerberos_parser MessageType
#[repr(u32)]
@ -462,9 +467,7 @@ unsafe extern "C" fn krb5_err_code_match(
let tx = cast_pointer!(tx, KRB5Transaction);
let ctx = cast_pointer!(ctx, DetectUintData<u32>);
match tx.error_code {
Some(ref e) => {
SCDetectU32Match(e.0 as u32, ctx)
}
Some(ref e) => SCDetectU32Match(e.0 as u32, ctx),
None => 0,
}
}
@ -474,6 +477,30 @@ unsafe extern "C" fn krb5_err_code_free(_de: *mut DetectEngineCtx, ctx: *mut c_v
SCDetectU32Free(ctx);
}
unsafe extern "C" fn krb5_sname_setup(
de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
if SCDetectSignatureSetAppProto(s, ALPROTO_KRB5 as AppProto) != 0 {
return -1;
}
if SCDetectBufferSetActiveList(de, s, G_KRB5_SNAME_BUFFER_ID) < 0 {
return -1;
}
return 0;
}
unsafe extern "C" fn krb5_cname_setup(
de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
if SCDetectSignatureSetAppProto(s, ALPROTO_KRB5 as AppProto) != 0 {
return -1;
}
if SCDetectBufferSetActiveList(de, s, G_KRB5_CNAME_BUFFER_ID) < 0 {
return -1;
}
return 0;
}
#[no_mangle]
pub unsafe extern "C" fn SCDetectKrb5Register() {
let kw = SCSigTableAppLiteElmt {
@ -503,4 +530,44 @@ pub unsafe extern "C" fn SCDetectKrb5Register() {
flags: SIGMATCH_INFO_UINT32,
};
G_KRB5_ERR_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
let kw = SigTableElmtStickyBuffer {
name: String::from("krb5.sname"),
desc: String::from("sticky buffer to match on Kerberos 5 server name"),
url: String::from("/rules/kerberos-keywords.html#krb5-sname"),
setup: krb5_sname_setup,
};
let krb5_sname_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_KRB5_SNAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
b"krb5_sname\0".as_ptr() as *const libc::c_char,
b"krb5_sname\0".as_ptr() as *const libc::c_char,
ALPROTO_KRB5 as AppProto,
STREAM_TOCLIENT,
Some(krb5_sname_get_data),
1,
);
SCDetectHelperKeywordAliasRegister(
krb5_sname_hdr_kw_id,
b"krb5_sname\0".as_ptr() as *const libc::c_char,
);
let kw = SigTableElmtStickyBuffer {
name: String::from("krb5.cname"),
desc: String::from("sticky buffer to match on Kerberos 5 client name"),
url: String::from("/rules/kerberos-keywords.html#krb5-cname"),
setup: krb5_cname_setup,
};
let krb5_cname_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
G_KRB5_CNAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
b"krb5_cname\0".as_ptr() as *const libc::c_char,
b"krb5_cname\0".as_ptr() as *const libc::c_char,
ALPROTO_KRB5 as AppProto,
STREAM_TOCLIENT,
Some(krb5_cname_get_data),
1,
);
SCDetectHelperKeywordAliasRegister(
krb5_cname_hdr_kw_id,
b"krb5_cname\0".as_ptr() as *const libc::c_char,
);
}

4
src/Makefile.am
Unescape Escape View File

@ -242,8 +242,6 @@ noinst_HEADERS = \
detect-isdataat.h \
detect-itype.h \
detect-ja4-hash.h \
detect-krb5-cname.h \
detect-krb5-sname.h \
detect-krb5-ticket-encryption.h \
detect-l3proto.h \
detect-lua-extensions.h \
@ -822,8 +820,6 @@ libsuricata_c_a_SOURCES = \
detect-isdataat.c \
detect-itype.c \
detect-ja4-hash.c \
detect-krb5-cname.c \
detect-krb5-sname.c \
detect-krb5-ticket-encryption.c \
detect-l3proto.c \
detect-lua-extensions.c \

4
src/detect-engine-register.c
Unescape Escape View File

@ -196,8 +196,6 @@
#include "detect-icmpv6-mtu.h"
#include "detect-ipv4hdr.h"
#include "detect-ipv6hdr.h"
#include "detect-krb5-cname.h"
#include "detect-krb5-sname.h"
#include "detect-krb5-ticket-encryption.h"
#include "detect-sip-method.h"
#include "detect-sip-uri.h"
@ -715,8 +713,6 @@ void SigTableSetup(void)
DetectEtherhdrRegister();
DetectIpv4hdrRegister();
DetectIpv6hdrRegister();
DetectKrb5CNameRegister();
DetectKrb5SNameRegister();
DetectKrb5TicketEncryptionRegister();
DetectSipMethodRegister();
DetectSipUriRegister();

2
src/detect-engine-register.h
Unescape Escape View File

@ -258,8 +258,6 @@ enum DetectKeywordId {
DETECT_DNP3IND,
DETECT_DNP3OBJ,
DETECT_KRB5_CNAME,
DETECT_KRB5_SNAME,
DETECT_KRB5_TICKET_ENCRYPTION,
DETECT_SIP_METHOD,

72
src/detect-krb5-cname.c
Unescape Escape View File

@ -1,72 +0,0 @@
/* Copyright (C) 2018-2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*/
#include "suricata-common.h"
#include "util-unittest.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-krb5-cname.h"
#include "rust.h"
#include "util-profiling.h"
static int g_krb5_cname_buffer_id = 0;
static int DetectKrb5CNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
if (SCDetectBufferSetActiveList(de_ctx, s, g_krb5_cname_buffer_id) < 0)
return -1;
if (SCDetectSignatureSetAppProto(s, ALPROTO_KRB5) != 0)
return -1;
return 0;
}
void DetectKrb5CNameRegister(void)
{
sigmatch_table[DETECT_KRB5_CNAME].name = "krb5.cname";
sigmatch_table[DETECT_KRB5_CNAME].alias = "krb5_cname";
sigmatch_table[DETECT_KRB5_CNAME].url = "/rules/kerberos-keywords.html#krb5-cname";
sigmatch_table[DETECT_KRB5_CNAME].Setup = DetectKrb5CNameSetup;
sigmatch_table[DETECT_KRB5_CNAME].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
sigmatch_table[DETECT_KRB5_CNAME].desc = "sticky buffer to match on Kerberos 5 client name";
DetectAppLayerMultiRegister(
"krb5_cname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, SCKrb5TxGetCname, 2);
DetectBufferTypeSetDescriptionByName("krb5_cname",
"Kerberos 5 ticket client name");
g_krb5_cname_buffer_id = DetectBufferTypeGetByName("krb5_cname");
DetectBufferTypeSupportsMultiInstance("krb5_cname");
}

29
src/detect-krb5-cname.h
Unescape Escape View File

@ -1,29 +0,0 @@
/* Copyright (C) 2015-2017 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*/
#ifndef SURICATA_DETECT_KRB5_CNAME_H
#define SURICATA_DETECT_KRB5_CNAME_H
void DetectKrb5CNameRegister(void);
#endif /* SURICATA_DETECT_KRB5_CNAME_H */

72
src/detect-krb5-sname.c
Unescape Escape View File

@ -1,72 +0,0 @@
/* Copyright (C) 2018-2022 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*/
#include "suricata-common.h"
#include "util-unittest.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-krb5-sname.h"
#include "rust.h"
#include "util-profiling.h"
static int g_krb5_sname_buffer_id = 0;
static int DetectKrb5SNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
if (SCDetectBufferSetActiveList(de_ctx, s, g_krb5_sname_buffer_id) < 0)
return -1;
if (SCDetectSignatureSetAppProto(s, ALPROTO_KRB5) != 0)
return -1;
return 0;
}
void DetectKrb5SNameRegister(void)
{
sigmatch_table[DETECT_KRB5_SNAME].name = "krb5.sname";
sigmatch_table[DETECT_KRB5_SNAME].alias = "krb5_sname";
sigmatch_table[DETECT_KRB5_SNAME].url = "/rules/kerberos-keywords.html#krb5-sname";
sigmatch_table[DETECT_KRB5_SNAME].Setup = DetectKrb5SNameSetup;
sigmatch_table[DETECT_KRB5_SNAME].flags =
SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
sigmatch_table[DETECT_KRB5_SNAME].desc = "sticky buffer to match on Kerberos 5 server name";
DetectAppLayerMultiRegister(
"krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, SCKrb5TxGetSname, 2);
DetectBufferTypeSetDescriptionByName("krb5_sname",
"Kerberos 5 ticket server name");
g_krb5_sname_buffer_id = DetectBufferTypeGetByName("krb5_sname");
DetectBufferTypeSupportsMultiInstance("krb5_sname");
}

29
src/detect-krb5-sname.h
Unescape Escape View File

@ -1,29 +0,0 @@
/* Copyright (C) 2015-2017 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*/
#ifndef SURICATA_DETECT_KRB5_SNAME_H
#define SURICATA_DETECT_KRB5_SNAME_H
void DetectKrb5SNameRegister(void);
#endif /* SURICATA_DETECT_KRB5_SNAME_H */
Write Preview
Loading…
Cancel
Save