From c53b9df5a2a0413b1ad7e3def5db6a47174af338 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Sun, 29 Mar 2026 21:51:19 +0200 Subject: [PATCH] rust/ffi: move detection helpers to ffi crate Ticket: 7666 --- examples/plugins/altemplate/src/detect.rs | 2 +- rust/ffi/src/detect.rs | 72 +++++++++++++++++++++++ rust/ffi/src/lib.rs | 1 + rust/src/detect/mod.rs | 56 ++---------------- 4 files changed, 78 insertions(+), 53 deletions(-) create mode 100644 rust/ffi/src/detect.rs diff --git a/examples/plugins/altemplate/src/detect.rs b/examples/plugins/altemplate/src/detect.rs index e7cd550152..3cfd34f10c 100644 --- a/examples/plugins/altemplate/src/detect.rs +++ b/examples/plugins/altemplate/src/detect.rs @@ -22,7 +22,7 @@ use super::template::{TemplateTransaction, ALPROTO_TEMPLATE}; use std::os::raw::{c_int, c_void}; -use suricata::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; +use suricata_ffi::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer}; use suricata_ffi::{cast_pointer, STREAM_TOCLIENT, STREAM_TOSERVER}; use suricata_sys::sys::{ DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister, diff --git a/rust/ffi/src/detect.rs b/rust/ffi/src/detect.rs new file mode 100644 index 0000000000..97d2ce517f --- /dev/null +++ b/rust/ffi/src/detect.rs @@ -0,0 +1,72 @@ +/* Copyright (C) 2026 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +//! Detection utils. + +use std::ffi::{c_int, CString}; +use suricata_sys::sys::{ + DetectEngineCtx, SCDetectHelperKeywordRegister, SCDetectHelperKeywordSetCleanCString, + SCSigTableAppLiteElmt, Signature, SIGMATCH_INFO_MULTI_BUFFER, SIGMATCH_INFO_STICKY_BUFFER, + SIGMATCH_NOOPT, +}; + +/// Rust app-layer light version of SigTableElmt for simple sticky buffer +pub struct SigTableElmtStickyBuffer { + /// keyword name + pub name: String, + /// keyword description + pub desc: String, + /// keyword documentation url + pub url: String, + /// function callback to parse and setup keyword in rule + pub setup: unsafe extern "C" fn( + de: *mut DetectEngineCtx, + s: *mut Signature, + raw: *const std::os::raw::c_char, + ) -> c_int, +} + +fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u32) -> u16 { + let name = CString::new(kw.name.as_bytes()).unwrap().into_raw(); + let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw(); + let url = CString::new(kw.url.as_bytes()).unwrap().into_raw(); + let st = SCSigTableAppLiteElmt { + name, + desc, + url, + Setup: Some(kw.setup), + flags, + AppLayerTxMatch: None, + Free: None, + }; + unsafe { + let r = SCDetectHelperKeywordRegister(&st); + SCDetectHelperKeywordSetCleanCString(r); + return r; + } +} + +pub fn helper_keyword_register_multi_buffer(kw: &SigTableElmtStickyBuffer) -> u16 { + return helper_keyword_register_buffer_flags( + kw, + SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER, + ); +} + +pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 { + return helper_keyword_register_buffer_flags(kw, SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER); +} diff --git a/rust/ffi/src/lib.rs b/rust/ffi/src/lib.rs index 7ca18b0246..7d19fa24da 100644 --- a/rust/ffi/src/lib.rs +++ b/rust/ffi/src/lib.rs @@ -16,6 +16,7 @@ */ pub mod debug; +pub mod detect; pub mod eve; pub mod jsonbuilder; pub mod plugin; diff --git a/rust/src/detect/mod.rs b/rust/src/detect/mod.rs index 069c19487c..6335c0fcf8 100644 --- a/rust/src/detect/mod.rs +++ b/rust/src/detect/mod.rs @@ -37,12 +37,6 @@ pub mod uri; pub mod vlan; use std::ffi::CString; -use std::os::raw::c_int; - -use suricata_sys::sys::{ - DetectEngineCtx, SCDetectHelperKeywordRegister, SCDetectHelperKeywordSetCleanCString, - SCSigTableAppLiteElmt, Signature, -}; /// EnumString trait that will be implemented on enums that /// derive StringEnum. @@ -64,52 +58,10 @@ pub trait EnumString { Self: Sized; } -/// Rust app-layer light version of SigTableElmt for simple sticky buffer -pub struct SigTableElmtStickyBuffer { - /// keyword name - pub name: String, - /// keyword description - pub desc: String, - /// keyword documentation url - pub url: String, - /// function callback to parse and setup keyword in rule - pub setup: unsafe extern "C" fn( - de: *mut DetectEngineCtx, - s: *mut Signature, - raw: *const std::os::raw::c_char, - ) -> c_int, -} - -fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u32) -> u16 { - let name = CString::new(kw.name.as_bytes()).unwrap().into_raw(); - let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw(); - let url = CString::new(kw.url.as_bytes()).unwrap().into_raw(); - let st = SCSigTableAppLiteElmt { - name, - desc, - url, - Setup: Some(kw.setup), - flags, - AppLayerTxMatch: None, - Free: None, - }; - unsafe { - let r = SCDetectHelperKeywordRegister(&st); - SCDetectHelperKeywordSetCleanCString(r); - return r; - } -} - -pub fn helper_keyword_register_multi_buffer(kw: &SigTableElmtStickyBuffer) -> u16 { - return helper_keyword_register_buffer_flags( - kw, - SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER, - ); -} - -pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 { - return helper_keyword_register_buffer_flags(kw, SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER); -} +pub use suricata_ffi::detect::{ + helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer, + SigTableElmtStickyBuffer, +}; #[repr(C)] #[allow(non_snake_case)]