mirror of https://github.com/OISF/suricata
template: move detect keywords to pure rust
Ticket: 3195
Also remove unused src/tests/detect-template-buffer.c
Completes commit 4a7567b3f0
to remove references to template-rust
pull/11948/head
Philippe Antoine
1 year ago
committed by
Victor Julien
parent
87e6e9374f
commit
96c8470cdd
@ -0,0 +1,111 @@
|
||||
/* Copyright (C) 2024 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
use super::template::{TemplateTransaction, ALPROTO_TEMPLATE};
|
||||
/* TEMPLATE_START_REMOVE */
|
||||
use crate::conf::conf_get_node;
|
||||
/* TEMPLATE_END_REMOVE */
|
||||
use crate::core::Direction;
|
||||
use crate::detect::{
|
||||
DetectBufferSetActiveList, DetectHelperBufferMpmRegister, DetectHelperGetData,
|
||||
DetectHelperKeywordRegister, DetectSignatureSetAppProto, SCSigTableElmt,
|
||||
SIGMATCH_INFO_STICKY_BUFFER, SIGMATCH_NOOPT,
|
||||
};
|
||||
use std::os::raw::{c_int, c_void};
|
||||
|
||||
static mut G_TEMPLATE_BUFFER_BUFFER_ID: c_int = 0;
|
||||
|
||||
unsafe extern "C" fn template_buffer_setup(
|
||||
de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||
) -> c_int {
|
||||
if DetectSignatureSetAppProto(s, ALPROTO_TEMPLATE) != 0 {
|
||||
return -1;
|
||||
}
|
||||
if DetectBufferSetActiveList(de, s, G_TEMPLATE_BUFFER_BUFFER_ID) < 0 {
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/// Get the request/response buffer for a transaction from C.
|
||||
unsafe extern "C" fn template_buffer_get_data(
|
||||
tx: *const c_void, flags: u8, buf: *mut *const u8, len: *mut u32,
|
||||
) -> bool {
|
||||
let tx = cast_pointer!(tx, TemplateTransaction);
|
||||
if flags & Direction::ToClient as u8 != 0 {
|
||||
if let Some(ref response) = tx.response {
|
||||
if !response.is_empty() {
|
||||
*len = response.len() as u32;
|
||||
*buf = response.as_ptr();
|
||||
return true;
|
||||
}
|
||||
}
|
||||
} else if let Some(ref request) = tx.request {
|
||||
if !request.is_empty() {
|
||||
*len = request.len() as u32;
|
||||
*buf = request.as_ptr();
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
unsafe extern "C" fn template_buffer_get(
|
||||
de: *mut c_void, transforms: *const c_void, flow: *const c_void, flow_flags: u8,
|
||||
tx: *const c_void, list_id: c_int,
|
||||
) -> *mut c_void {
|
||||
return DetectHelperGetData(
|
||||
de,
|
||||
transforms,
|
||||
flow,
|
||||
flow_flags,
|
||||
tx,
|
||||
list_id,
|
||||
template_buffer_get_data,
|
||||
);
|
||||
}
|
||||
|
||||
#[no_mangle]
|
||||
pub unsafe extern "C" fn ScDetectTemplateRegister() {
|
||||
/* TEMPLATE_START_REMOVE */
|
||||
if conf_get_node("app-layer.protocols.template").is_none() {
|
||||
return;
|
||||
}
|
||||
/* TEMPLATE_END_REMOVE */
|
||||
// TODO create a suricata-verify test
|
||||
// Setup a keyword structure and register it
|
||||
let kw = SCSigTableElmt {
|
||||
name: b"template.buffer\0".as_ptr() as *const libc::c_char,
|
||||
desc: b"Template content modifier to match on the template buffer\0".as_ptr()
|
||||
as *const libc::c_char,
|
||||
// TODO use the right anchor for url and write doc
|
||||
url: b"/rules/template-keywords.html#buffer\0".as_ptr() as *const libc::c_char,
|
||||
Setup: template_buffer_setup,
|
||||
flags: SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER,
|
||||
AppLayerTxMatch: None,
|
||||
Free: None,
|
||||
};
|
||||
let _g_template_buffer_kw_id = DetectHelperKeywordRegister(&kw);
|
||||
G_TEMPLATE_BUFFER_BUFFER_ID = DetectHelperBufferMpmRegister(
|
||||
b"template.buffer\0".as_ptr() as *const libc::c_char,
|
||||
b"template.buffer intern description\0".as_ptr() as *const libc::c_char,
|
||||
ALPROTO_TEMPLATE,
|
||||
true, //toclient
|
||||
true, //toserver
|
||||
template_buffer_get,
|
||||
);
|
||||
}
|
||||
@ -1,192 +0,0 @@
|
||||
/* Copyright (C) 2015-2022 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/*
|
||||
* TODO: Update the \author in this file and detect-template.h.
|
||||
* TODO: Update description in the \file section below.
|
||||
* TODO: Remove SCLogNotice statements or convert to debug.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <yourname@domain>
|
||||
*
|
||||
* Set up of the "template_rust" keyword to allow content
|
||||
* inspections on the decoded template application layer buffers.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "conf.h"
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-content-inspection.h"
|
||||
#include "detect-template-rust-buffer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "detect-engine-build.h"
|
||||
#include "rust.h"
|
||||
|
||||
#ifdef UNITTESTS
|
||||
static void DetectTemplateRustBufferRegisterTests(void);
|
||||
#endif
|
||||
static int g_template_rust_id = 0;
|
||||
|
||||
static int DetectTemplateRustBufferSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
|
||||
{
|
||||
s->init_data->list = g_template_rust_id;
|
||||
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_TEMPLATE) != 0)
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms, Flow *_f, const uint8_t flags, void *txv,
|
||||
const int list_id)
|
||||
{
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
if (!buffer->initialized) {
|
||||
uint32_t data_len = 0;
|
||||
const uint8_t *data = NULL;
|
||||
if (flags & STREAM_TOSERVER) {
|
||||
rs_template_get_request_buffer(txv, &data, &data_len);
|
||||
} else {
|
||||
rs_template_get_response_buffer(txv, &data, &data_len);
|
||||
}
|
||||
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
return buffer;
|
||||
}
|
||||
|
||||
void DetectTemplateRustBufferRegister(void)
|
||||
{
|
||||
/* TEMPLATE_START_REMOVE */
|
||||
if (ConfGetNode("app-layer.protocols.template") == NULL) {
|
||||
return;
|
||||
}
|
||||
/* TEMPLATE_END_REMOVE */
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].name = "template.buffer";
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].desc =
|
||||
"Template content modifier to match on the template buffers";
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].Setup = DetectTemplateRustBufferSetup;
|
||||
#ifdef UNITTESTS
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].RegisterTests = DetectTemplateRustBufferRegisterTests;
|
||||
#endif
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_NOOPT;
|
||||
|
||||
/* register inspect engines */
|
||||
DetectAppLayerInspectEngineRegister("template_buffer", ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER, 0,
|
||||
DetectEngineInspectBufferGeneric, GetData);
|
||||
DetectAppLayerInspectEngineRegister("template_buffer", ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT, 0,
|
||||
DetectEngineInspectBufferGeneric, GetData);
|
||||
|
||||
g_template_rust_id = DetectBufferTypeGetByName("template_buffer");
|
||||
|
||||
SCLogNotice("Template application layer detect registered.");
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-unittest-helper.h"
|
||||
#include "flow-util.h"
|
||||
#include "stream-tcp.h"
|
||||
#include "detect-engine-alert.h"
|
||||
|
||||
static int DetectTemplateRustBufferTest(void)
|
||||
{
|
||||
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
||||
DetectEngineThreadCtx *det_ctx = NULL;
|
||||
DetectEngineCtx *de_ctx = NULL;
|
||||
Flow f;
|
||||
Packet *p;
|
||||
TcpSession tcp;
|
||||
ThreadVars tv;
|
||||
Signature *s;
|
||||
|
||||
uint8_t request[] = "12:Hello World!";
|
||||
|
||||
/* Setup flow. */
|
||||
memset(&f, 0, sizeof(Flow));
|
||||
memset(&tcp, 0, sizeof(TcpSession));
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
p = UTHBuildPacket(request, sizeof(request), IPPROTO_TCP);
|
||||
FLOW_INITIALIZE(&f);
|
||||
f.alproto = ALPROTO_TEMPLATE;
|
||||
f.protoctx = (void *)&tcp;
|
||||
f.proto = IPPROTO_TCP;
|
||||
f.flags |= FLOW_IPV4;
|
||||
p->flow = &f;
|
||||
p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
|
||||
p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;
|
||||
StreamTcpInitConfig(true);
|
||||
|
||||
de_ctx = DetectEngineCtxInit();
|
||||
FAIL_IF_NULL(de_ctx);
|
||||
|
||||
/* This rule should match. */
|
||||
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any ("
|
||||
"msg:\"TEMPLATE Test Rule\"; "
|
||||
"template.buffer; content:\"World!\"; "
|
||||
"sid:1; rev:1;)");
|
||||
FAIL_IF_NULL(s);
|
||||
|
||||
/* This rule should not match. */
|
||||
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any ("
|
||||
"msg:\"TEMPLATE Test Rule\"; "
|
||||
"template.buffer; content:\"W0rld!\"; "
|
||||
"sid:2; rev:1;)");
|
||||
FAIL_IF_NULL(s);
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
||||
|
||||
AppLayerParserParse(
|
||||
NULL, alp_tctx, &f, ALPROTO_TEMPLATE, STREAM_TOSERVER, request, sizeof(request));
|
||||
|
||||
/* Check that we have app-layer state. */
|
||||
FAIL_IF_NULL(f.alstate);
|
||||
|
||||
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
||||
FAIL_IF(!PacketAlertCheck(p, 1));
|
||||
FAIL_IF(PacketAlertCheck(p, 2));
|
||||
|
||||
/* Cleanup. */
|
||||
if (alp_tctx != NULL)
|
||||
AppLayerParserThreadCtxFree(alp_tctx);
|
||||
if (det_ctx != NULL)
|
||||
DetectEngineThreadCtxDeinit(&tv, det_ctx);
|
||||
if (de_ctx != NULL)
|
||||
SigGroupCleanup(de_ctx);
|
||||
if (de_ctx != NULL)
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
StreamTcpFreeConfig(true);
|
||||
FLOW_DESTROY(&f);
|
||||
UTHFreePacket(p);
|
||||
|
||||
PASS;
|
||||
}
|
||||
|
||||
static void DetectTemplateRustBufferRegisterTests(void)
|
||||
{
|
||||
UtRegisterTest("DetectTemplateRustBufferTest",
|
||||
DetectTemplateRustBufferTest);
|
||||
}
|
||||
#endif /* UNITTESTS */
|
||||
@ -1,29 +0,0 @@
|
||||
/* Copyright (C) 2015-2017 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <yourname@domain>
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_DETECT_TEMPLATE_RUST_BUFFER_H
|
||||
#define SURICATA_DETECT_TEMPLATE_RUST_BUFFER_H
|
||||
|
||||
void DetectTemplateRustBufferRegister(void);
|
||||
|
||||
#endif /* SURICATA_DETECT_TEMPLATE_RUST_BUFFER_H */
|
||||
@ -1,104 +0,0 @@
|
||||
/* Copyright (C) 2015-2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
#include "../util-unittest.h"
|
||||
#include "../util-unittest-helper.h"
|
||||
#include "../app-layer-parser.h"
|
||||
#include "../detect-engine.h"
|
||||
#include "../detect-parse.h"
|
||||
#include "../flow-util.h"
|
||||
#include "../stream-tcp.h"
|
||||
#include "../detect-engine-build.h"
|
||||
|
||||
static int DetectTemplateBufferTest(void)
|
||||
{
|
||||
AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
|
||||
FAIL_IF_NULL(alp_tctx);
|
||||
|
||||
Flow f;
|
||||
Packet *p;
|
||||
TcpSession tcp;
|
||||
ThreadVars tv;
|
||||
Signature *s;
|
||||
|
||||
uint8_t request[] = "Hello World!";
|
||||
|
||||
/* Setup flow. */
|
||||
memset(&f, 0, sizeof(Flow));
|
||||
memset(&tcp, 0, sizeof(TcpSession));
|
||||
memset(&tv, 0, sizeof(ThreadVars));
|
||||
p = UTHBuildPacket(request, sizeof(request), IPPROTO_TCP);
|
||||
FLOW_INITIALIZE(&f);
|
||||
f.alproto = ALPROTO_TEMPLATE;
|
||||
f.protoctx = (void *)&tcp;
|
||||
f.proto = IPPROTO_TCP;
|
||||
f.flags |= FLOW_IPV4;
|
||||
p->flow = &f;
|
||||
p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
|
||||
p->flowflags |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;
|
||||
StreamTcpInitConfig(true);
|
||||
|
||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
||||
FAIL_IF_NULL(de_ctx);
|
||||
|
||||
/* This rule should match. */
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert tcp any any -> any any ("
|
||||
"msg:\"TEMPLATE Test Rule\"; "
|
||||
"template_buffer; content:\"World!\"; "
|
||||
"sid:1; rev:1;)");
|
||||
FAIL_IF_NULL(s);
|
||||
|
||||
/* This rule should not match. */
|
||||
s = DetectEngineAppendSig(de_ctx,
|
||||
"alert tcp any any -> any any ("
|
||||
"msg:\"TEMPLATE Test Rule\"; "
|
||||
"template_buffer; content:\"W0rld!\"; "
|
||||
"sid:2; rev:1;)");
|
||||
FAIL_IF_NULL(s);
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
|
||||
DetectEngineThreadCtx *det_ctx = NULL;
|
||||
DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);
|
||||
FAIL_IF_NULL(det_ctx);
|
||||
|
||||
AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_TEMPLATE,
|
||||
STREAM_TOSERVER, request, sizeof(request));
|
||||
|
||||
/* Check that we have app-layer state. */
|
||||
FAIL_IF_NULL(f.alstate);
|
||||
|
||||
SigMatchSignatures(&tv, de_ctx, det_ctx, p);
|
||||
FAIL_IF(!PacketAlertCheck(p, 1));
|
||||
FAIL_IF(PacketAlertCheck(p, 2));
|
||||
|
||||
/* Cleanup. */
|
||||
AppLayerParserThreadCtxFree(alp_tctx);
|
||||
DetectEngineThreadCtxDeinit(&tv, det_ctx);
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
StreamTcpFreeConfig(true);
|
||||
FLOW_DESTROY(&f);
|
||||
UTHFreePacket(p);
|
||||
|
||||
PASS;
|
||||
}
|
||||
|
||||
static void DetectTemplateBufferRegisterTests(void)
|
||||
{
|
||||
UtRegisterTest("DetectTemplateBufferTest", DetectTemplateBufferTest);
|
||||
}
|
||||
Loading…
Reference in New Issue