From fc36553629c4a86500b03c8048d6910dd10ea9f0 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 7 Jul 2026 16:16:12 +0200 Subject: [PATCH] mqtt/doc: list possible values for enum keywords Ticket: 8675 --- doc/userguide/rules/mqtt-keywords.rst | 2 ++ rust/src/mqtt/detect.rs | 16 ++++++++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/doc/userguide/rules/mqtt-keywords.rst b/doc/userguide/rules/mqtt-keywords.rst index 2e784f97d5..e37a6dc5cf 100644 --- a/doc/userguide/rules/mqtt-keywords.rst +++ b/doc/userguide/rules/mqtt-keywords.rst @@ -46,6 +46,8 @@ Valid values are : where ``UNASSIGNED`` refers to message type code 0. +See ``suricata --list-keywords=json | jq '."mqtt.type".enum_values'`` + mqtt.type uses an :ref:`unsigned 8-bits integer `. mqtt.type is also a :ref:`multi-integer `. diff --git a/rust/src/mqtt/detect.rs b/rust/src/mqtt/detect.rs index 8007173311..4e87410ada 100644 --- a/rust/src/mqtt/detect.rs +++ b/rust/src/mqtt/detect.rs @@ -24,16 +24,17 @@ use crate::detect::uint::{ DetectUintIndex, SCDetectU8ArrayFree, SCDetectU8ArrayParse, SCDetectU8Free, SCDetectU8Parse, }; use crate::detect::{ - helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer, + helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer, EnumString, SigTableElmtStickyBuffer, SIGMATCH_INFO_BITFLAGS_UINT, SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT8, }; +use crate::jsonbuilder::JsonBuilder; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister, SCDetectHelperBufferProgressRegister, - SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferMpmRegister, - SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, - Signature, + SCDetectHelperKeywordJsonInfoRegister, SCDetectHelperKeywordRegister, + SCDetectHelperMultiBufferMpmRegister, SCDetectSignatureSetAppProto, SCJsonBuilder, + SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature, }; use super::mqtt::{MQTTState, MQTTTransaction, ALPROTO_MQTT}; @@ -906,6 +907,11 @@ unsafe extern "C" fn mqtt_conn_clientid_setup( return 0; } +unsafe extern "C" fn mqtt_type_list_values(jsb: *mut SCJsonBuilder) { + let jsb = cast_pointer!(jsb, JsonBuilder); + let _ = MQTTTypeCode::list_values(jsb); +} + #[no_mangle] pub unsafe extern "C" fn SCDetectMqttRegister() { let keyword_name = b"mqtt.unsubscribe.topic\0".as_ptr() as *const libc::c_char; @@ -941,6 +947,8 @@ pub unsafe extern "C" fn SCDetectMqttRegister() { flags: SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT, }; G_MQTT_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw); + SCDetectHelperKeywordJsonInfoRegister(G_MQTT_TYPE_KW_ID, Some(mqtt_type_list_values)); + G_MQTT_TYPE_BUFFER_ID = SCDetectHelperBufferProgressRegister( b"mqtt.type\0".as_ptr() as *const libc::c_char, ALPROTO_MQTT,