rust/detect: generic detect_parse_array_uint_enum

And make ldap use it

Ticket: 7480

No behavior change, just code restyling
pull/13878/head
Philippe Antoine 1 year ago committed by Victor Julien
parent c6d3857793
commit f555f02ed4

@ -26,6 +26,7 @@ use nom7::IResult;
use super::EnumString;
use std::ffi::CStr;
use std::str::FromStr;
#[derive(PartialEq, Eq, Clone, Debug)]
#[repr(u8)]
@ -63,6 +64,36 @@ pub(crate) struct DetectUintArrayData<T> {
pub index: DetectUintIndex,
}
fn parse_uint_index(parts: &[&str]) -> Option<DetectUintIndex> {
let index = if parts.len() == 2 {
match parts[1] {
"all" => DetectUintIndex::All,
"any" => DetectUintIndex::Any,
_ => {
let i32_index = i32::from_str(parts[1]).ok()?;
DetectUintIndex::Index(i32_index)
}
}
} else {
DetectUintIndex::Any
};
return Some(index);
}
pub(crate) fn detect_parse_array_uint_enum<T1: DetectIntType, T2: EnumString<T1>>(
s: &str,
) -> Option<DetectUintArrayData<T1>> {
let parts: Vec<&str> = s.split(',').collect();
if parts.len() > 2 {
return None;
}
let index = parse_uint_index(&parts)?;
let du = detect_parse_uint_enum::<T1, T2>(parts[0])?;
Some(DetectUintArrayData { du, index })
}
/// Parses a string for detection with integers, using enumeration strings
///
/// Needs to specify T1 the integer type (like u8)

@ -18,8 +18,8 @@
use super::ldap::{LdapTransaction, ALPROTO_LDAP};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, DetectUintData, DetectUintIndex, SCDetectU32Free,
SCDetectU32Parse, SCDetectU8Free, DetectUintArrayData,
detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint_enum, DetectUintArrayData,
DetectUintData, DetectUintIndex, SCDetectU32Free, SCDetectU32Parse, SCDetectU8Free,
};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::ldap::types::*;
@ -34,7 +34,6 @@ use suricata_sys::sys::{
use std::collections::VecDeque;
use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
use std::str::FromStr;
static mut G_LDAP_REQUEST_OPERATION_KW_ID: u16 = 0;
static mut G_LDAP_REQUEST_OPERATION_BUFFER_ID: c_int = 0;
@ -107,40 +106,12 @@ unsafe extern "C" fn ldap_detect_request_free(_de: *mut DetectEngineCtx, ctx: *m
SCDetectU8Free(ctx);
}
fn parse_ldap_index(parts: &[&str]) -> Option<DetectUintIndex> {
let index = if parts.len() == 2 {
match parts[1] {
"all" => DetectUintIndex::All,
"any" => DetectUintIndex::Any,
_ => {
let i32_index = i32::from_str(parts[1]).ok()?;
DetectUintIndex::Index(i32_index)
}
}
} else {
DetectUintIndex::Any
};
return Some(index);
}
fn aux_ldap_parse_protocol_resp_op(s: &str) -> Option<DetectUintArrayData<u8>> {
let parts: Vec<&str> = s.split(',').collect();
if parts.len() > 2 {
return None;
}
let index = parse_ldap_index(&parts)?;
let du = detect_parse_uint_enum::<u8, ProtocolOpCode>(parts[0])?;
Some(DetectUintArrayData{ du, index })
}
unsafe extern "C" fn ldap_parse_protocol_resp_op(
ustr: *const std::os::raw::c_char,
) -> *mut DetectUintData<u8> {
let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
if let Ok(s) = ft_name.to_str() {
if let Some(ctx) = aux_ldap_parse_protocol_resp_op(s) {
if let Some(ctx) = detect_parse_array_uint_enum::<u8, ProtocolOpCode>(s) {
let boxed = Box::new(ctx);
return Box::into_raw(boxed) as *mut _;
}
@ -363,24 +334,12 @@ unsafe extern "C" fn ldap_tx_get_responses_dn(
return true;
}
fn aux_ldap_parse_resp_result_code(s: &str) -> Option<DetectUintArrayData<u32>> {
let parts: Vec<&str> = s.split(',').collect();
if parts.len() > 2 {
return None;
}
let index = parse_ldap_index(&parts)?;
let du = detect_parse_uint_enum::<u32, LdapResultCode>(parts[0])?;
Some(DetectUintArrayData { du, index })
}
unsafe extern "C" fn ldap_parse_responses_result_code(
ustr: *const std::os::raw::c_char,
) -> *mut DetectUintData<u32> {
let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
if let Ok(s) = ft_name.to_str() {
if let Some(ctx) = aux_ldap_parse_resp_result_code(s) {
if let Some(ctx) = detect_parse_array_uint_enum::<u32, LdapResultCode>(s) {
let boxed = Box::new(ctx);
return Box::into_raw(boxed) as *mut _;
}

Loading…
Cancel
Save