suricata/rust/src/nfs/detect.rs

/* Copyright (C) 2018 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

// written by Pierre Chifflier  <chifflier@wzdftpd.net>

use crate::jsonbuilder::JsonBuilder;
use suricata_sys::sys::AppProtoEnum::ALPROTO_NFS;
use suricata_sys::sys::{
    AppProto, DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectHelperBufferProgressRegister,
    SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordJsonInfoRegister,
    SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCJsonBuilder,
    SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, Signature,
};

use super::nfs::{NFSTransaction, NFSTransactionTypeData};
use super::types::{NfsProc2, NfsProc3, NfsProc4};
use crate::core::STREAM_TOSERVER;
use crate::detect::uint::{
    detect_match_uint, detect_parse_uint_enum, detect_parse_uint_inclusive, DetectUintData,
    SCDetectU32Free, SCDetectU32ParseInclusive,
};
use crate::detect::{EnumString, SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_UINT32};

use std::ffi::{c_int, CStr};
use std::os::raw::c_void;

static mut G_NFS_PROCEDURE_KW_ID: u16 = 0;
static mut G_NFS_PROCEDURE_BUFFER_ID: c_int = 0;
static mut G_NFS_VERSION_KW_ID: u16 = 0;
static mut G_NFS_VERSION_BUFFER_ID: c_int = 0;

struct DetectNfsProcedureDataVersion {
    v2: Option<DetectUintData<u32>>,
    v3: Option<DetectUintData<u32>>,
    v4: Option<DetectUintData<u32>>,
}

enum DetectNfsProcedureData {
    VersionLiteral(DetectNfsProcedureDataVersion),
    Num(DetectUintData<u32>),
}

fn nfs_procedure_parse_aux(s: &str) -> Option<DetectNfsProcedureData> {
    if let Ok((_, ctx)) = detect_parse_uint_inclusive::<u32>(s) {
        return Some(DetectNfsProcedureData::Num(ctx));
    }
    let v2 = detect_parse_uint_enum::<u32, NfsProc2>(s);
    let v3 = detect_parse_uint_enum::<u32, NfsProc3>(s);
    let v4 = detect_parse_uint_enum::<u32, NfsProc4>(s);
    if v2.is_none() && v3.is_none() && v4.is_none() {
        return None;
    }
    return Some(DetectNfsProcedureData::VersionLiteral(
        DetectNfsProcedureDataVersion { v2, v3, v4 },
    ));
}

unsafe extern "C" fn nfs_procedure_parse(
    ustr: *const std::os::raw::c_char,
) -> *mut DetectNfsProcedureData {
    let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
    if let Ok(s) = ft_name.to_str() {
        if let Some(ctx) = nfs_procedure_parse_aux(s) {
            let boxed = Box::new(ctx);
            return Box::into_raw(boxed) as *mut _;
        }
    }
    return std::ptr::null_mut();
}

unsafe extern "C" fn nfs_procedure_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, raw: *const libc::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_NFS as AppProto) != 0 {
        return -1;
    }
    let ctx = nfs_procedure_parse(raw) as *mut c_void;
    if ctx.is_null() {
        return -1;
    }
    if SCSigMatchAppendSMToList(
        de,
        s,
        G_NFS_PROCEDURE_KW_ID,
        ctx as *mut SigMatchCtx,
        G_NFS_PROCEDURE_BUFFER_ID,
    )
    .is_null()
    {
        nfs_procedure_free(std::ptr::null_mut(), ctx);
        return -1;
    }
    return 0;
}

fn nfs_procedure_match_val(proc: u32, nfs_version: u16, ctx: &DetectNfsProcedureData) -> bool {
    match ctx {
        DetectNfsProcedureData::VersionLiteral(ver) => {
            if nfs_version < 3 {
                if let Some(du32v2) = &ver.v2 {
                    return detect_match_uint(du32v2, proc);
                }
            } else if nfs_version == 3 {
                if let Some(du32v3) = &ver.v3 {
                    return detect_match_uint(du32v3, proc);
                }
            } else if let Some(du32v4) = &ver.v4 {
                return detect_match_uint(du32v4, proc);
            }
            return false;
        }
        DetectNfsProcedureData::Num(du32) => {
            return detect_match_uint(du32, proc);
        }
    }
}

fn nfs_procedure_match_aux(tx: &NFSTransaction, ctx: &DetectNfsProcedureData) -> c_int {
    // first try tx.procedure
    if nfs_procedure_match_val(tx.procedure, tx.nfs_version, ctx) {
        return 1;
    }

    if !tx.is_file_tx {
        return 0;
    }

    /* file tx handling follows */
    if let Some(NFSTransactionTypeData::FILE(ref tdf)) = tx.type_data {
        for proc in &tdf.file_additional_procs {
            if nfs_procedure_match_val(*proc, tx.nfs_version, ctx) {
                return 1;
            }
        }
    }
    return 0;
}

unsafe extern "C" fn nfs_procedure_match(
    _de: *mut DetectEngineThreadCtx, _f: *mut Flow, _flags: u8, _state: *mut c_void,
    tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
) -> c_int {
    let tx = cast_pointer!(tx, NFSTransaction);
    let ctx = cast_pointer!(ctx, DetectNfsProcedureData);
    return nfs_procedure_match_aux(tx, ctx);
}

unsafe extern "C" fn nfs_procedure_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) {
    let ctx = cast_pointer!(ctx, DetectNfsProcedureData);
    std::mem::drop(Box::from_raw(ctx));
}

unsafe extern "C" fn nfs_version_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, raw: *const libc::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_NFS as AppProto) != 0 {
        return -1;
    }
    let ctx = SCDetectU32ParseInclusive(raw) as *mut c_void;
    if ctx.is_null() {
        return -1;
    }
    if SCSigMatchAppendSMToList(
        de,
        s,
        G_NFS_VERSION_KW_ID,
        ctx as *mut SigMatchCtx,
        G_NFS_VERSION_BUFFER_ID,
    )
    .is_null()
    {
        nfs_version_free(std::ptr::null_mut(), ctx);
        return -1;
    }
    return 0;
}

unsafe extern "C" fn nfs_version_match(
    _de: *mut DetectEngineThreadCtx, _f: *mut Flow, _flags: u8, _state: *mut c_void,
    tx: *mut c_void, _sig: *const Signature, ctx: *const SigMatchCtx,
) -> c_int {
    let tx = cast_pointer!(tx, NFSTransaction);
    let ctx = cast_pointer!(ctx, DetectUintData<u32>);
    return detect_match_uint(ctx, tx.nfs_version as u32) as c_int;
}

unsafe extern "C" fn nfs_version_free(_de: *mut DetectEngineCtx, ctx: *mut c_void) {
    let ctx = cast_pointer!(ctx, DetectUintData<u32>);
    SCDetectU32Free(ctx);
}

unsafe extern "C" fn nfs_procedure_list_values(jsb: *mut SCJsonBuilder) {
    let jsb = cast_pointer!(jsb, JsonBuilder);
    let _ = jsb.open_object("enum_values");
    let _ = jsb.open_object("v2");
    let _ = NfsProc2::list_values(jsb);
    let _ = jsb.close();
    let _ = jsb.open_object("v3");
    let _ = NfsProc3::list_values(jsb);
    let _ = jsb.close();
    let _ = jsb.open_object("v4");
    let _ = NfsProc4::list_values(jsb);
    let _ = jsb.close();
    let _ = jsb.close();
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectNfsRegister() {
    let kw = SCSigTableAppLiteElmt {
        name: b"nfs_procedure\0".as_ptr() as *const libc::c_char,
        desc: b"match NFS procedure\0".as_ptr() as *const libc::c_char,
        url: b"/rules/nfs-keywords.html#nfs-procedure\0".as_ptr() as *const libc::c_char,
        AppLayerTxMatch: Some(nfs_procedure_match),
        Setup: Some(nfs_procedure_setup),
        Free: Some(nfs_procedure_free),
        flags: SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_ENUM_UINT,
    };
    G_NFS_PROCEDURE_KW_ID = SCDetectHelperKeywordRegister(&kw);
    SCDetectHelperKeywordJsonInfoRegister(G_NFS_PROCEDURE_KW_ID, Some(nfs_procedure_list_values));
    G_NFS_PROCEDURE_BUFFER_ID = SCDetectHelperBufferProgressRegister(
        b"nfs_procedure\0".as_ptr() as *const libc::c_char,
        ALPROTO_NFS as AppProto,
        STREAM_TOSERVER,
        0,
    );

    let kw = SCSigTableAppLiteElmt {
        name: b"nfs.version\0".as_ptr() as *const libc::c_char,
        desc: b"match NFS version\0".as_ptr() as *const libc::c_char,
        // TODO write doc /rules/nfs-keywords.html#nfs-version\0
        url: std::ptr::null(),
        AppLayerTxMatch: Some(nfs_version_match),
        Setup: Some(nfs_version_setup),
        Free: Some(nfs_version_free),
        flags: SIGMATCH_INFO_UINT32,
    };
    G_NFS_VERSION_KW_ID = SCDetectHelperKeywordRegister(&kw);
    G_NFS_VERSION_BUFFER_ID = SCDetectHelperBufferProgressRegister(
        b"nfs.version\0".as_ptr() as *const libc::c_char,
        ALPROTO_NFS as AppProto,
        STREAM_TOSERVER,
        0,
    );
    SCDetectHelperKeywordAliasRegister(
        G_NFS_VERSION_KW_ID,
        b"nfs_version\0".as_ptr() as *const libc::c_char,
    );
}

#[cfg(test)]
mod test {
    use super::*;
    use crate::detect::uint::DetectUintMode;

    #[test]
    fn nfs_procedure_parse_test() {
        let ctx = nfs_procedure_parse_aux("1430000000").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1430000000);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
        } else {
            panic!("not right enum");
        }

        let ctx = nfs_procedure_parse_aux(">1430000000").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1430000000);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeGt);
        } else {
            panic!("not right enum");
        }

        let ctx = nfs_procedure_parse_aux("<1430000000").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1430000000);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeLt);
        } else {
            panic!("not right enum");
        }

        let ctx = nfs_procedure_parse_aux("1430000001<>1470000000").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1430000000);
            assert_eq!(ctx.arg2, 1470000001);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeRange);
        } else {
            panic!("not right enum");
        }

        assert!(nfs_procedure_parse_aux("A").is_none());
        assert!(nfs_procedure_parse_aux(">1430000000<>1470000000").is_none());
        assert!(nfs_procedure_parse_aux("1430000000<>").is_none());
        assert!(nfs_procedure_parse_aux("<>1430000000").is_none());
        assert!(nfs_procedure_parse_aux("").is_none());
        assert!(nfs_procedure_parse_aux(" ").is_none());
        assert!(nfs_procedure_parse_aux("1490000000<>1430000000").is_none());

        let ctx = nfs_procedure_parse_aux("1430000001 <> 1490000000").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1430000000);
            assert_eq!(ctx.arg2, 1490000001);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeRange);
        } else {
            panic!("not right enum");
        }

        let ctx = nfs_procedure_parse_aux("> 1430000000 ").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1430000000);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeGt);
        } else {
            panic!("not right enum");
        }

        let ctx = nfs_procedure_parse_aux("<   1490000000 ").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1490000000);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeLt);
        } else {
            panic!("not right enum");
        }

        let ctx = nfs_procedure_parse_aux("   1490000000 ").unwrap();
        if let DetectNfsProcedureData::Num(ctx) = ctx {
            assert_eq!(ctx.arg1, 1490000000);
            assert_eq!(ctx.mode, DetectUintMode::DetectUintModeEqual);
        } else {
            panic!("not right enum");
        }
    }
}