template: move app-layer registration code to rust #11816
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| /* Copyright (C) 2024 Open Information Security Foundation | ||
| * | ||
| * You can copy, redistribute or modify this Program under the terms of | ||
| * the GNU General Public License version 2 as published by the Free | ||
| * Software Foundation. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU General Public License | ||
| * version 2 along with this program; if not, write to the Free Software | ||
| * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA | ||
| * 02110-1301, USA. | ||
| */ | ||
|
|
||
| use super::template::{TemplateTransaction, ALPROTO_TEMPLATE}; | ||
| /* TEMPLATE_START_REMOVE */ | ||
| use crate::conf::conf_get_node; | ||
| /* TEMPLATE_END_REMOVE */ | ||
| use crate::core::Direction; | ||
| use crate::detect::{ | ||
| DetectBufferSetActiveList, DetectHelperBufferMpmRegister, DetectHelperGetData, | ||
| DetectHelperKeywordRegister, DetectSignatureSetAppProto, SCSigTableElmt, | ||
| SIGMATCH_INFO_STICKY_BUFFER, SIGMATCH_NOOPT, | ||
| }; | ||
| use std::os::raw::{c_int, c_void}; | ||
|
|
||
| static mut G_TEMPLATE_BUFFER_BUFFER_ID: c_int = 0; | ||
|
|
||
| unsafe extern "C" fn template_buffer_setup( | ||
| de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char, | ||
| ) -> c_int { | ||
| if DetectSignatureSetAppProto(s, ALPROTO_TEMPLATE) != 0 { | ||
| return -1; | ||
| } | ||
| if DetectBufferSetActiveList(de, s, G_TEMPLATE_BUFFER_BUFFER_ID) < 0 { | ||
| return -1; | ||
| } | ||
| return 0; | ||
| } | ||
|
|
||
| /// Get the request/response buffer for a transaction from C. | ||
| unsafe extern "C" fn template_buffer_get_data( | ||
| tx: *const c_void, flags: u8, buf: *mut *const u8, len: *mut u32, | ||
| ) -> bool { | ||
| let tx = cast_pointer!(tx, TemplateTransaction); | ||
| if flags & Direction::ToClient as u8 != 0 { | ||
| if let Some(ref response) = tx.response { | ||
| if !response.is_empty() { | ||
| *len = response.len() as u32; | ||
| *buf = response.as_ptr(); | ||
| return true; | ||
| } | ||
| } | ||
| } else if let Some(ref request) = tx.request { | ||
| if !request.is_empty() { | ||
| *len = request.len() as u32; | ||
| *buf = request.as_ptr(); | ||
| return true; | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| unsafe extern "C" fn template_buffer_get( | ||
| de: *mut c_void, transforms: *const c_void, flow: *const c_void, flow_flags: u8, | ||
| tx: *const c_void, list_id: c_int, | ||
| ) -> *mut c_void { | ||
| return DetectHelperGetData( | ||
| de, | ||
| transforms, | ||
| flow, | ||
| flow_flags, | ||
| tx, | ||
| list_id, | ||
| template_buffer_get_data, | ||
| ); | ||
| } | ||
|
|
||
| #[no_mangle] | ||
| pub unsafe extern "C" fn ScDetectTemplateRegister() { | ||
| /* TEMPLATE_START_REMOVE */ | ||
| if conf_get_node("app-layer.protocols.template-rust").is_none() { | ||
| return; | ||
| } | ||
| /* TEMPLATE_END_REMOVE */ | ||
| // TODO create a suricata-verify test | ||
|
There was a problem hiding this comment. Rather for new keywords getting created But OISF/suricata-verify#2087 and thanks for finding new bugs |
||
| let kw = SCSigTableElmt { | ||
catenacyber marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| name: b"template.buffer\0".as_ptr() as *const libc::c_char, | ||
| desc: b"Template content modifier to match on the template buffer\0".as_ptr() | ||
| as *const libc::c_char, | ||
| // TODO use the right anchor for url and write doc | ||
catenacyber marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| url: b"/rules/template-keywords.html#buffer\0".as_ptr() as *const libc::c_char, | ||
| Setup: template_buffer_setup, | ||
| flags: SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER, | ||
| AppLayerTxMatch: None, | ||
| Free: None, | ||
| }; | ||
| let _g_template_buffer_kw_id = DetectHelperKeywordRegister(&kw); | ||
| G_TEMPLATE_BUFFER_BUFFER_ID = DetectHelperBufferMpmRegister( | ||
| b"template.buffer\0".as_ptr() as *const libc::c_char, | ||
| b"template.buffer intern description\0".as_ptr() as *const libc::c_char, | ||
| ALPROTO_TEMPLATE, | ||
| true, | ||
catenacyber marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| true, | ||
| template_buffer_get, | ||
| ); | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
not new in this PR, but I wonder if this is correct. Should be able to match on
bsize:0;but we won't be returning an 0 sized buffer?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
right