detect/krb5: move krb5.cname and krb5.sname to rust

Ticket: 8648

rust/src/krb/detect.rs

@@ -20,16 +20,21 @@
 use crate::krb::krb5::{test_weak_encryption, KRB5Transaction};
 use suricata_sys::sys::AppProtoEnum::ALPROTO_KRB5;
 use suricata_sys::sys::{
-    AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferProgressRegister,
+    AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
-    SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList,
+    SCDetectHelperBufferProgressRegister, SCDetectHelperKeywordAliasRegister,
-    SCSigTableAppLiteElmt, SigMatchCtx, Signature,
+    SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferProgressMpmRegister,
+    SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx,
+    Signature,
 };
 
 use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
 use crate::detect::uint::{
     detect_parse_uint, detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Match,
 };
-use crate::detect::{SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32};
+use crate::detect::{
+    helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer, SIGMATCH_INFO_ENUM_UINT,
+    SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32,
+};
 use kerberos_parser::krb5::EncryptionType;
 
 use nom8::branch::alt;
@@ -43,8 +48,7 @@ use nom8::Parser;
 use std::ffi::{c_int, CStr};
 use std::os::raw::c_void;
 
-#[no_mangle]
+unsafe extern "C" fn krb5_cname_get_data(
-pub unsafe extern "C" fn SCKrb5TxGetCname(
     _de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8,
     buffer_len: *mut u32,
 ) -> bool {
@@ -60,8 +64,7 @@ pub unsafe extern "C" fn SCKrb5TxGetCname(
     false
 }
 
-#[no_mangle]
+unsafe extern "C" fn krb5_sname_get_data(
-pub unsafe extern "C" fn SCKrb5TxGetSname(
     _de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8,
     buffer_len: *mut u32,
 ) -> bool {
@@ -343,6 +346,8 @@ mod tests {
 static mut G_KRB5_MSG_TYPE_KW_ID: u16 = 0;
 static mut G_KRB5_GENERIC_BUFFER_ID: c_int = 0;
 static mut G_KRB5_ERR_CODE_KW_ID: u16 = 0;
+static mut G_KRB5_CNAME_BUFFER_ID: c_int = 0;
+static mut G_KRB5_SNAME_BUFFER_ID: c_int = 0;
 
 // We should apply the derive on the kerberos_parser MessageType
 #[repr(u32)]
@@ -462,9 +467,7 @@ unsafe extern "C" fn krb5_err_code_match(
     let tx = cast_pointer!(tx, KRB5Transaction);
     let ctx = cast_pointer!(ctx, DetectUintData<u32>);
     match tx.error_code {
-        Some(ref e) => {
+        Some(ref e) => SCDetectU32Match(e.0 as u32, ctx),
-            SCDetectU32Match(e.0 as u32, ctx)
-        }
         None => 0,
     }
 }
@@ -474,6 +477,30 @@ unsafe extern "C" fn krb5_err_code_free(_de: *mut DetectEngineCtx, ctx: *mut c_v
     SCDetectU32Free(ctx);
 }
 
+unsafe extern "C" fn krb5_sname_setup(
+    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
+) -> c_int {
+    if SCDetectSignatureSetAppProto(s, ALPROTO_KRB5 as AppProto) != 0 {
+        return -1;
+    }
+    if SCDetectBufferSetActiveList(de, s, G_KRB5_SNAME_BUFFER_ID) < 0 {
+        return -1;
+    }
+    return 0;
+}
+
+unsafe extern "C" fn krb5_cname_setup(
+    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
+) -> c_int {
+    if SCDetectSignatureSetAppProto(s, ALPROTO_KRB5 as AppProto) != 0 {
+        return -1;
+    }
+    if SCDetectBufferSetActiveList(de, s, G_KRB5_CNAME_BUFFER_ID) < 0 {
+        return -1;
+    }
+    return 0;
+}
+
 #[no_mangle]
 pub unsafe extern "C" fn SCDetectKrb5Register() {
     let kw = SCSigTableAppLiteElmt {
@@ -503,4 +530,44 @@ pub unsafe extern "C" fn SCDetectKrb5Register() {
         flags: SIGMATCH_INFO_UINT32,
     };
     G_KRB5_ERR_CODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
+
+    let kw = SigTableElmtStickyBuffer {
+        name: String::from("krb5.sname"),
+        desc: String::from("sticky buffer to match on Kerberos 5 server name"),
+        url: String::from("/rules/kerberos-keywords.html#krb5-sname"),
+        setup: krb5_sname_setup,
+    };
+    let krb5_sname_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
+    G_KRB5_SNAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
+        b"krb5_sname\0".as_ptr() as *const libc::c_char,
+        b"krb5_sname\0".as_ptr() as *const libc::c_char,
+        ALPROTO_KRB5 as AppProto,
+        STREAM_TOCLIENT,
+        Some(krb5_sname_get_data),
+        1,
+    );
+    SCDetectHelperKeywordAliasRegister(
+        krb5_sname_hdr_kw_id,
+        b"krb5_sname\0".as_ptr() as *const libc::c_char,
+    );
+
+    let kw = SigTableElmtStickyBuffer {
+        name: String::from("krb5.cname"),
+        desc: String::from("sticky buffer to match on Kerberos 5 client name"),
+        url: String::from("/rules/kerberos-keywords.html#krb5-cname"),
+        setup: krb5_cname_setup,
+    };
+    let krb5_cname_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
+    G_KRB5_CNAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
+        b"krb5_cname\0".as_ptr() as *const libc::c_char,
+        b"krb5_cname\0".as_ptr() as *const libc::c_char,
+        ALPROTO_KRB5 as AppProto,
+        STREAM_TOCLIENT,
+        Some(krb5_cname_get_data),
+        1,
+    );
+    SCDetectHelperKeywordAliasRegister(
+        krb5_cname_hdr_kw_id,
+        b"krb5_cname\0".as_ptr() as *const libc::c_char,
+    );
 }

src/Makefile.am

@@ -242,8 +242,6 @@ noinst_HEADERS = \
 	detect-isdataat.h \
 	detect-itype.h \
 	detect-ja4-hash.h \
-	detect-krb5-cname.h \
-	detect-krb5-sname.h \
 	detect-krb5-ticket-encryption.h \
 	detect-l3proto.h \
 	detect-lua-extensions.h \
@@ -822,8 +820,6 @@ libsuricata_c_a_SOURCES = \
 	detect-isdataat.c \
 	detect-itype.c \
 	detect-ja4-hash.c \
-	detect-krb5-cname.c \
-	detect-krb5-sname.c \
 	detect-krb5-ticket-encryption.c \
 	detect-l3proto.c \
 	detect-lua-extensions.c \

src/detect-engine-register.c

@@ -196,8 +196,6 @@
 #include "detect-icmpv6-mtu.h"
 #include "detect-ipv4hdr.h"
 #include "detect-ipv6hdr.h"
-#include "detect-krb5-cname.h"
-#include "detect-krb5-sname.h"
 #include "detect-krb5-ticket-encryption.h"
 #include "detect-sip-method.h"
 #include "detect-sip-uri.h"
@@ -715,8 +713,6 @@ void SigTableSetup(void)
     DetectEtherhdrRegister();
     DetectIpv4hdrRegister();
     DetectIpv6hdrRegister();
-    DetectKrb5CNameRegister();
-    DetectKrb5SNameRegister();
     DetectKrb5TicketEncryptionRegister();
     DetectSipMethodRegister();
     DetectSipUriRegister();

src/detect-engine-register.h

@@ -258,8 +258,6 @@ enum DetectKeywordId {
     DETECT_DNP3IND,
     DETECT_DNP3OBJ,
 
-    DETECT_KRB5_CNAME,
-    DETECT_KRB5_SNAME,
     DETECT_KRB5_TICKET_ENCRYPTION,
 
     DETECT_SIP_METHOD,

src/detect-krb5-cname.c

@@ -1,72 +0,0 @@
-/* Copyright (C) 2018-2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Pierre Chifflier <chifflier@wzdftpd.net>
- */
-
-#include "suricata-common.h"
-#include "util-unittest.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-buffer.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-
-#include "detect-krb5-cname.h"
-
-#include "rust.h"
-#include "util-profiling.h"
-
-static int g_krb5_cname_buffer_id = 0;
-
-static int DetectKrb5CNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
-{
-    if (SCDetectBufferSetActiveList(de_ctx, s, g_krb5_cname_buffer_id) < 0)
-        return -1;
-
-    if (SCDetectSignatureSetAppProto(s, ALPROTO_KRB5) != 0)
-        return -1;
-
-    return 0;
-}
-
-void DetectKrb5CNameRegister(void)
-{
-    sigmatch_table[DETECT_KRB5_CNAME].name = "krb5.cname";
-    sigmatch_table[DETECT_KRB5_CNAME].alias = "krb5_cname";
-    sigmatch_table[DETECT_KRB5_CNAME].url = "/rules/kerberos-keywords.html#krb5-cname";
-    sigmatch_table[DETECT_KRB5_CNAME].Setup = DetectKrb5CNameSetup;
-    sigmatch_table[DETECT_KRB5_CNAME].flags =
-            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
-    sigmatch_table[DETECT_KRB5_CNAME].desc = "sticky buffer to match on Kerberos 5 client name";
-
-    DetectAppLayerMultiRegister(
-            "krb5_cname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, SCKrb5TxGetCname, 2);
-
-    DetectBufferTypeSetDescriptionByName("krb5_cname",
-            "Kerberos 5 ticket client name");
-
-    g_krb5_cname_buffer_id = DetectBufferTypeGetByName("krb5_cname");
-
-    DetectBufferTypeSupportsMultiInstance("krb5_cname");
-}

src/detect-krb5-cname.h

@@ -1,29 +0,0 @@
-/* Copyright (C) 2015-2017 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Pierre Chifflier <chifflier@wzdftpd.net>
- */
-
-#ifndef SURICATA_DETECT_KRB5_CNAME_H
-#define SURICATA_DETECT_KRB5_CNAME_H
-
-void DetectKrb5CNameRegister(void);
-
-#endif /* SURICATA_DETECT_KRB5_CNAME_H */

src/detect-krb5-sname.c

@@ -1,72 +0,0 @@
-/* Copyright (C) 2018-2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Pierre Chifflier <chifflier@wzdftpd.net>
- */
-
-#include "suricata-common.h"
-#include "util-unittest.h"
-
-#include "detect-parse.h"
-#include "detect-engine.h"
-#include "detect-engine-buffer.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-
-#include "detect-krb5-sname.h"
-
-#include "rust.h"
-#include "util-profiling.h"
-
-static int g_krb5_sname_buffer_id = 0;
-
-static int DetectKrb5SNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
-{
-    if (SCDetectBufferSetActiveList(de_ctx, s, g_krb5_sname_buffer_id) < 0)
-        return -1;
-
-    if (SCDetectSignatureSetAppProto(s, ALPROTO_KRB5) != 0)
-        return -1;
-
-    return 0;
-}
-
-void DetectKrb5SNameRegister(void)
-{
-    sigmatch_table[DETECT_KRB5_SNAME].name = "krb5.sname";
-    sigmatch_table[DETECT_KRB5_SNAME].alias = "krb5_sname";
-    sigmatch_table[DETECT_KRB5_SNAME].url = "/rules/kerberos-keywords.html#krb5-sname";
-    sigmatch_table[DETECT_KRB5_SNAME].Setup = DetectKrb5SNameSetup;
-    sigmatch_table[DETECT_KRB5_SNAME].flags =
-            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
-    sigmatch_table[DETECT_KRB5_SNAME].desc = "sticky buffer to match on Kerberos 5 server name";
-
-    DetectAppLayerMultiRegister(
-            "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, SCKrb5TxGetSname, 2);
-
-    DetectBufferTypeSetDescriptionByName("krb5_sname",
-            "Kerberos 5 ticket server name");
-
-    g_krb5_sname_buffer_id = DetectBufferTypeGetByName("krb5_sname");
-
-    DetectBufferTypeSupportsMultiInstance("krb5_sname");
-}

src/detect-krb5-sname.h

@@ -1,29 +0,0 @@
-/* Copyright (C) 2015-2017 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Pierre Chifflier <chifflier@wzdftpd.net>
- */
-
-#ifndef SURICATA_DETECT_KRB5_SNAME_H
-#define SURICATA_DETECT_KRB5_SNAME_H
-
-void DetectKrb5SNameRegister(void);
-
-#endif /* SURICATA_DETECT_KRB5_SNAME_H */