Commit Graph

23 Commits (f5bf76c0ee4b19e7d51d3d89f535542c42c5010a)

Author SHA1 Message Date
Jason Ish 25c98af0e8 rust/detect: convert remaining detection rule parsers to nom 8
Ticket: #8051
12 months ago
Philippe Antoine 53d9569dfb detect: list-keywords cli shows integers with enums
Ticket: 7875
1 year ago
Philippe Antoine da486af881 detect: list-keywords cli shows integers
Ticket: 7875
1 year ago
Philippe Antoine a2b5225612 rust: bindgen SCSigMatchAppendSMToList
Ticket: 7667
1 year ago
Philippe Antoine 78034b218d rust: bindgen SCDetectSignatureSetAppProto
Ticket: 7667
1 year ago
Philippe Antoine dc20129195 rust: bindgen SCDetectHelperBufferMpmRegister
Ticket: 7667
1 year ago
Philippe Antoine e2603fa820 detect/single-buf: new simple wrapper
Introduce DetectGetSingleData which does the generic wrapping,
including the transforms, using a new callback prototype
DetectTxGetBufferPtr

The goal is to replace most InspectionBufferGetDataPtr.
For this commit, we do not change every callback to keep the
change relatively small.

Focus here is to remove DetectHelperGetData as its functionality is
provided more directly by the new DetectTxGetBufferPtr.
1 year ago
Philippe Antoine 13449344e8 rust: bindgen SCDetectHelperKeywordRegister
Ticket: 7667
1 year ago
Philippe Antoine a7448a0c16 rust: bindgen SCDetectHelperBufferRegister
Ticket: 7667
1 year ago
Philippe Antoine 033e0480cf detect/single-buf: helper with more explicit direction 2 years ago
Philippe Antoine dadf9012fc rust: bindgen detect-engine-buffer.h
Ticket: 7667

And prefix SCDetectBufferSetActiveList to be exported

Allows less use of suricata crate in plugin as we get the functions
prototypes from suricata_sys and they are more correct.
2 years ago
Philippe Antoine a6392ac5d4 rust: use pure rust helper for registering sticky buffers
Mark sdp and sip keywords with flags SIGMATCH_INFO_STICKY_BUFFER
as a side effect.
2 years ago
Philippe Antoine 96afdce283 detect: rename SCSigTableElmt to SCSigTableAppLiteElmt 2 years ago
Jason Ish bfd6c29f5a detect: SC prefix for extern pub Rust functions
Ticket: #7498
2 years ago
Jason Ish 77b94b8713 rust: fixes for breaking change on deranged crate
Deranged v0.4.1 (a dependency of the time crate) has implemented
PartialOrd for some integer types that conflict with the
implementation in the standard library creating an ambiguity as such
implementation are global. For more info see
https://github.com/jhpratt/deranged/issues/18.

To fix, use "::from" directly, instead of using .into() which is where
we run into amgibuity.
2 years ago
Alice Akaki 7b350e9933 misc: fix name prefix in detect register functions 2 years ago
Jason Ish f62be374ea rust/direction: move direction to own file (cleanup)
Move the implementation of Direction to its own file, direction.rs.
2 years ago
Philippe Antoine 8f6795d049 rust: remove unneeded mut for tx in detect
Detection does not change transactions, it reads only.
2 years ago
Philippe Antoine b5fcf16d97 enip/detect: remove double registration of enip_command keyword
As found with
./src/suricata --list-keywords | sort | uniq -c | awk '$1 > 1'
2 years ago
Philippe Antoine 5bb5b4f46f rust: remove unnecessary nested unsafe 2 years ago
Philippe Antoine 4fe3f04fa3 detect/enip: move keywords to rust
Ticket: 4863
2 years ago
Jason Ish f0dbfe863d misc: prefix functions with SC not Sc 2 years ago
Philippe Antoine 82c03f72c3 enip: convert to rust
Ticket: 3958

- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
    enip.product_name, enip.protocol_version, enip.revision,
    enip.identity_status, enip.state, enip.serial, enip.product_code,
    enip.device_type, enip.vendor_id, enip.capabilities,
    enip.cip_attribute, enip.cip_class, enip.cip_instance,
    enip.cip_status, enip.cip_extendedstatus
2 years ago