diff --git a/rust/src/ssh/detect.rs b/rust/src/ssh/detect.rs index 1052b2986e..621891dff5 100644 --- a/rust/src/ssh/detect.rs +++ b/rust/src/ssh/detect.rs @@ -29,8 +29,8 @@ use suricata_sys::sys::{ #[no_mangle] pub unsafe extern "C" fn SCSshTxGetProtocol( - tx: *mut std::os::raw::c_void, buffer: *mut *const u8, buffer_len: *mut u32, direction: u8, -) -> u8 { + tx: *const c_void, direction: u8, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { let tx = cast_pointer!(tx, SSHTransaction); match direction.into() { Direction::ToServer => { @@ -38,7 +38,7 @@ pub unsafe extern "C" fn SCSshTxGetProtocol( if !m.is_empty() { *buffer = m.as_ptr(); *buffer_len = m.len() as u32; - return 1; + return true; } } Direction::ToClient => { @@ -46,14 +46,14 @@ pub unsafe extern "C" fn SCSshTxGetProtocol( if !m.is_empty() { *buffer = m.as_ptr(); *buffer_len = m.len() as u32; - return 1; + return true; } } } *buffer = ptr::null(); *buffer_len = 0; - return 0; + return false; } #[no_mangle] @@ -154,6 +154,18 @@ unsafe extern "C" fn ssh_software_setup( return 0; } +unsafe extern "C" fn ssh_proto_setup( + de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char, +) -> c_int { + if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 { + return -1; + } + if SCDetectBufferSetActiveList(de, s, G_SSH_PROTO_BUFFER_ID) < 0 { + return -1; + } + return 0; +} + unsafe extern "C" fn ssh_software_obsolete_setup( _de: *mut DetectEngineCtx, _s: *mut Signature, _raw: *const std::os::raw::c_char, ) -> c_int { @@ -169,6 +181,7 @@ unsafe extern "C" fn ssh_proto_obsolete_setup( } static mut G_SSH_SOFTWARE_BUFFER_ID: c_int = 0; +static mut G_SSH_PROTO_BUFFER_ID: c_int = 0; #[no_mangle] pub unsafe extern "C" fn SCDetectSshRegister() { @@ -213,4 +226,24 @@ pub unsafe extern "C" fn SCDetectSshRegister() { flags: 0, }; _ = SCDetectHelperKeywordRegister(&kw); + + let kw = SigTableElmtStickyBuffer { + name: String::from("ssh.proto"), + desc: String::from("ssh.proto sticky buffer"), + url: String::from("/rules/ssh-keywords.html#ssh-proto"), + setup: ssh_proto_setup, + }; + let ssh_proto_kw_id = helper_keyword_register_sticky_buffer(&kw); + G_SSH_PROTO_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister( + b"ssh.proto\0".as_ptr() as *const libc::c_char, + b"ssh protocol version field\0".as_ptr() as *const libc::c_char, + ALPROTO_SSH, + STREAM_TOSERVER | STREAM_TOCLIENT, + Some(SCSshTxGetProtocol), + SSHConnectionState::SshStateBannerDone as c_int, + ); + SCDetectHelperKeywordAliasRegister( + ssh_proto_kw_id, + b"ssh_proto\0".as_ptr() as *const libc::c_char, + ); } diff --git a/src/Makefile.am b/src/Makefile.am index abf53b866e..052d0370fb 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -287,7 +287,6 @@ noinst_HEADERS = \ detect-ssh-hassh-server.h \ detect-ssh-hassh-string.h \ detect-ssh-hassh.h \ - detect-ssh-proto.h \ detect-ssl-state.h \ detect-ssl-version.h \ detect-stream_size.h \ @@ -884,7 +883,6 @@ libsuricata_c_a_SOURCES = \ detect-ssh-hassh-server.c \ detect-ssh-hassh-string.c \ detect-ssh-hassh.c \ - detect-ssh-proto.c \ detect-ssl-state.c \ detect-ssl-version.c \ detect-stream_size.c \ diff --git a/src/app-layer-ssh.c b/src/app-layer-ssh.c index 08286b6897..8742f0ef07 100644 --- a/src/app-layer-ssh.c +++ b/src/app-layer-ssh.c @@ -144,7 +144,7 @@ static int SSHParserTestUtilCheck(const char *protoexp, const char *softexp, voi const uint8_t *software = NULL; uint32_t s_len = 0; - if (SCSshTxGetProtocol(tx, &protocol, &p_len, flags) != 1) { + if (SCSshTxGetProtocol(tx, flags, &protocol, &p_len) != 1) { printf("Version string not parsed correctly return: "); return 1; } @@ -307,7 +307,7 @@ static int SSHParserTest03(void) } const uint8_t *dummy = NULL; uint32_t dummy_len = 0; - if (SCSshTxGetProtocol(tx, &dummy, &dummy_len, STREAM_TOSERVER) != 0) + if (SCSshTxGetProtocol(tx, STREAM_TOSERVER, &dummy, &dummy_len) != 0) goto end; if (SCSshTxGetSoftware(tx, STREAM_TOSERVER, &dummy, &dummy_len) != 0) goto end; @@ -462,7 +462,7 @@ static int SSHParserTest06(void) } const uint8_t *dummy = NULL; uint32_t dummy_len = 0; - if (SCSshTxGetProtocol(tx, &dummy, &dummy_len, STREAM_TOCLIENT) != 0) + if (SCSshTxGetProtocol(tx, STREAM_TOCLIENT, &dummy, &dummy_len) != 0) goto end; if (SCSshTxGetSoftware(tx, STREAM_TOCLIENT, &dummy, &dummy_len) != 0) goto end; diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index b0577587cb..59c3ce42a3 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -234,7 +234,6 @@ #include "detect-tls.h" #include "detect-tls-cert-validity.h" #include "detect-tls-version.h" -#include "detect-ssh-proto.h" #include "detect-ssh-hassh.h" #include "detect-ssh-hassh-server.h" #include "detect-ssh-hassh-string.h" @@ -711,7 +710,6 @@ void SigTableSetup(void) DetectBsizeRegister(); DetectDetectionFilterRegister(); DetectAsn1Register(); - DetectSshProtocolRegister(); DetectSshHasshRegister(); DetectSshHasshServerRegister(); DetectSshHasshStringRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 8abc787601..d062a21bfc 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -189,7 +189,6 @@ enum DetectKeywordId { DETECT_HTTP_REQUEST_LINE, DETECT_HTTP_RESPONSE_LINE, DETECT_NFS_VERSION, - DETECT_SSH_PROTOCOL, DETECT_SSH_HASSH, DETECT_SSH_HASSH_SERVER, DETECT_SSH_HASSH_STRING, diff --git a/src/detect-ssh-proto.c b/src/detect-ssh-proto.c deleted file mode 100644 index e7f80c1dce..0000000000 --- a/src/detect-ssh-proto.c +++ /dev/null @@ -1,118 +0,0 @@ -/* Copyright (C) 2007-2016 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \ingroup sshlayer - * - * @{ - */ - - -/** - * \file - * - * \author Victor Julien - * - * Implements support ssh_proto sticky buffer - */ - -#include "suricata-common.h" -#include "threads.h" -#include "decode.h" - -#include "detect.h" -#include "detect-parse.h" -#include "detect-engine.h" -#include "detect-engine-buffer.h" -#include "detect-engine-mpm.h" -#include "detect-engine-state.h" -#include "detect-engine-prefilter.h" -#include "detect-engine-content-inspection.h" - -#include "app-layer.h" -#include "app-layer-parser.h" -#include "app-layer-ssh.h" -#include "detect-ssh-proto.h" -#include "rust.h" - -#define KEYWORD_NAME "ssh.proto" -#define KEYWORD_NAME_LEGACY "ssh_proto" -#define KEYWORD_DOC "ssh-keywords.html#ssh-proto" -#define BUFFER_NAME "ssh.proto" -#define BUFFER_DESC "ssh protocol version field" -static int g_buffer_id = 0; - -static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx, - const DetectEngineTransforms *transforms, Flow *_f, - const uint8_t flow_flags, void *txv, const int list_id) -{ - SCEnter(); - - InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); - - if (buffer->inspect == NULL) { - const uint8_t *protocol = NULL; - uint32_t b_len = 0; - - if (SCSshTxGetProtocol(txv, &protocol, &b_len, flow_flags) != 1) - return NULL; - if (protocol == NULL || b_len == 0) { - SCLogDebug("SSH protocol not set"); - return NULL; - } - - InspectionBufferSetupAndApplyTransforms( - det_ctx, list_id, buffer, protocol, b_len, transforms); - } - - return buffer; -} - -static int DetectSshProtocolSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) -{ - if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0) - return -1; - - if (SCDetectSignatureSetAppProto(s, ALPROTO_SSH) < 0) - return -1; - - return 0; -} - -void DetectSshProtocolRegister(void) -{ - sigmatch_table[DETECT_SSH_PROTOCOL].name = KEYWORD_NAME; - sigmatch_table[DETECT_SSH_PROTOCOL].alias = KEYWORD_NAME_LEGACY; - sigmatch_table[DETECT_SSH_PROTOCOL].desc = BUFFER_NAME " sticky buffer"; - sigmatch_table[DETECT_SSH_PROTOCOL].url = "/rules/" KEYWORD_DOC; - sigmatch_table[DETECT_SSH_PROTOCOL].Setup = DetectSshProtocolSetup; - sigmatch_table[DETECT_SSH_PROTOCOL].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT; - - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetSshData, ALPROTO_SSH, SshStateBannerDone), - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, - PrefilterGenericMpmRegister, GetSshData, ALPROTO_SSH, SshStateBannerDone), - - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SSH, SIG_FLAG_TOSERVER, - SshStateBannerDone, DetectEngineInspectBufferGeneric, GetSshData); - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SSH, SIG_FLAG_TOCLIENT, - SshStateBannerDone, DetectEngineInspectBufferGeneric, GetSshData); - - DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); - - g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); -} diff --git a/src/detect-ssh-proto.h b/src/detect-ssh-proto.h deleted file mode 100644 index e97b80eb29..0000000000 --- a/src/detect-ssh-proto.h +++ /dev/null @@ -1,29 +0,0 @@ -/* Copyright (C) 2007-2016 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Victor Julien - */ - -#ifndef SURICATA_DETECT_SSH_PROTOCOL_H -#define SURICATA_DETECT_SSH_PROTOCOL_H - -void DetectSshProtocolRegister(void); - -#endif /* SURICATA_DETECT_SSH_PROTOCOL_H */ diff --git a/src/util-lua-ssh.c b/src/util-lua-ssh.c index 0260b05d68..361176ec80 100644 --- a/src/util-lua-ssh.c +++ b/src/util-lua-ssh.c @@ -66,7 +66,7 @@ static int LuaSshTxGetProto(lua_State *L, uint8_t flags) lua_pushnil(L); return 1; } - if (SCSshTxGetProtocol(ltx->tx, &buf, &b_len, flags) != 1) { + if (!SCSshTxGetProtocol(ltx->tx, flags, &buf, &b_len)) { lua_pushnil(L); return 1; }