aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/smb: move smb share and named_pipe keywords to rust

Browse Source 
Ticket: 8267
pull/14806/head
Philippe Antoine 5 months ago committed by Victor Julien
parent 667f8b2eb7
commit 697c641400
6 changed files with 77 additions and 205 deletions
Show Stats Download Patch File Download Diff File

90
rust/src/smb/detect.rs
Unescape Escape View File

@ -28,43 +28,43 @@ use std::os::raw::{c_char, c_int, c_void};
use std::ptr;
use suricata_sys::sys::{
DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister,
SCDetectSignatureSetAppProto, Signature,
SCDetectHelperKeywordAliasRegister, SCDetectSignatureSetAppProto, Signature,
};
#[no_mangle]
pub unsafe extern "C" fn SCSmbTxGetShare(
tx: &SMBTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 {
unsafe extern "C" fn smb_tx_get_share(
tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> bool {
let tx = cast_pointer!(tx, SMBTransaction);
if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
SCLogDebug!("is_pipe {}", x.is_pipe);
if !x.is_pipe {
*buffer = x.share_name.as_ptr();
*buffer_len = x.share_name.len() as u32;
return 1;
return true;
}
}
*buffer = ptr::null();
*buffer_len = 0;
return 0;
return false;
}
#[no_mangle]
pub unsafe extern "C" fn SCSmbTxGetNamedPipe(
tx: &SMBTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 {
unsafe extern "C" fn smb_tx_get_named_pipe(
tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> bool {
let tx = cast_pointer!(tx, SMBTransaction);
if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
SCLogDebug!("is_pipe {}", x.is_pipe);
if x.is_pipe {
*buffer = x.share_name.as_ptr();
*buffer_len = x.share_name.len() as u32;
return 1;
return true;
}
}
*buffer = ptr::null();
*buffer_len = 0;
return 0;
return false;
}
#[no_mangle]
@ -257,8 +257,34 @@ unsafe extern "C" fn smb_ntlmssp_domain_setup(
return 0;
}
unsafe extern "C" fn smb_share_setup(
de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
if SCDetectSignatureSetAppProto(s, ALPROTO_SMB) != 0 {
return -1;
}
if SCDetectBufferSetActiveList(de, s, G_SMB_SHARE_BUFFER_ID) < 0 {
return -1;
}
return 0;
}
unsafe extern "C" fn smb_named_pipe_setup(
de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
if SCDetectSignatureSetAppProto(s, ALPROTO_SMB) != 0 {
return -1;
}
if SCDetectBufferSetActiveList(de, s, G_SMB_NAMED_PIPE_BUFFER_ID) < 0 {
return -1;
}
return 0;
}
static mut G_SMB_NTLMSSP_USER_BUFFER_ID: c_int = 0;
static mut G_SMB_NTLMSSP_DOMAIN_BUFFER_ID: c_int = 0;
static mut G_SMB_SHARE_BUFFER_ID: c_int = 0;
static mut G_SMB_NAMED_PIPE_BUFFER_ID: c_int = 0;
#[no_mangle]
pub unsafe extern "C" fn SCDetectSmbRegister() {
@ -291,6 +317,44 @@ pub unsafe extern "C" fn SCDetectSmbRegister() {
STREAM_TOSERVER,
Some(smb_tx_get_ntlmssp_domain),
);
let kw_share = SigTableElmtStickyBuffer {
name: String::from("smb.share"),
desc: String::from("sticky buffer to match on SMB share name in tree connect"),
url: String::from("/rules/smb-keywords.html#smb-share"),
setup: smb_share_setup,
};
let share_keyword_id = helper_keyword_register_sticky_buffer(&kw_share);
G_SMB_SHARE_BUFFER_ID = SCDetectHelperBufferMpmRegister(
b"smb_share\0".as_ptr() as *const libc::c_char,
b"smb share\0".as_ptr() as *const libc::c_char,
ALPROTO_SMB,
STREAM_TOSERVER,
Some(smb_tx_get_share),
);
SCDetectHelperKeywordAliasRegister(
share_keyword_id,
b"smb_share\0".as_ptr() as *const libc::c_char,
);
let kw_named_pipe = SigTableElmtStickyBuffer {
name: String::from("smb.named_pipe"),
desc: String::from("sticky buffer to match on SMB named pipe in tree connect"),
url: String::from("/rules/smb-keywords.html#smb-named-pipe"),
setup: smb_named_pipe_setup,
};
let named_pipe_keyword_id = helper_keyword_register_sticky_buffer(&kw_named_pipe);
G_SMB_NAMED_PIPE_BUFFER_ID = SCDetectHelperBufferMpmRegister(
b"smb_named_pipe\0".as_ptr() as *const libc::c_char,
b"smb named pipe\0".as_ptr() as *const libc::c_char,
ALPROTO_SMB,
STREAM_TOSERVER,
Some(smb_tx_get_named_pipe),
);
SCDetectHelperKeywordAliasRegister(
named_pipe_keyword_id,
b"smb_named_pipe\0".as_ptr() as *const libc::c_char,
);
}
#[cfg(test)]

2
src/Makefile.am
Unescape Escape View File

@ -274,7 +274,6 @@ noinst_HEADERS = \
detect-sid.h \
detect-sip-method.h \
detect-sip-uri.h \
detect-smb-share.h \
detect-smb-version.h \
detect-smtp.h \
detect-ssl-state.h \
@ -860,7 +859,6 @@ libsuricata_c_a_SOURCES = \
detect-sid.c \
detect-sip-method.c \
detect-sip-uri.c \
detect-smb-share.c \
detect-smb-version.c \
detect-smtp.c \
detect-ssl-state.c \

3
src/detect-engine-register.c
Unescape Escape View File

@ -77,7 +77,6 @@
#include "detect-config.h"
#include "detect-smb-share.h"
#include "detect-smb-version.h"
#include "detect-smtp.h"
@ -686,8 +685,6 @@ void SigTableSetup(void)
DetectDceIfaceRegister();
DetectDceOpnumRegister();
DetectDceStubDataRegister();
DetectSmbNamedPipeRegister();
DetectSmbShareRegister();
DetectSmbVersionRegister();
DetectTlsRegister();
DetectTlsValidityRegister();

2
src/detect-engine-register.h
Unescape Escape View File

@ -209,8 +209,6 @@ enum DetectKeywordId {
DETECT_DCE_IFACE,
DETECT_DCE_OPNUM,
DETECT_DCE_STUB_DATA,
DETECT_SMB_NAMED_PIPE,
DETECT_SMB_SHARE,
DETECT_SMB_VERSION,
DETECT_ENGINE_EVENT,

155
src/detect-smb-share.c
Unescape Escape View File

@ -1,155 +0,0 @@
/* Copyright (C) 2017 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Victor Julien <victor@inliniac.net>
*
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-smb-share.h"
#include "rust.h"
#define BUFFER_NAME "smb_named_pipe"
#define KEYWORD_NAME "smb.named_pipe"
#define KEYWORD_NAME_LEGACY BUFFER_NAME
#define KEYWORD_ID DETECT_SMB_NAMED_PIPE
static int g_smb_named_pipe_buffer_id = 0;
static int DetectSmbNamedPipeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
if (SCDetectBufferSetActiveList(de_ctx, s, g_smb_named_pipe_buffer_id) < 0)
return -1;
if (SCDetectSignatureSetAppProto(s, ALPROTO_SMB) < 0)
return -1;
return 0;
}
static InspectionBuffer *GetNamedPipeData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t _flow_flags,
void *txv, const int list_id)
{
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
if (buffer->inspect == NULL) {
uint32_t b_len = 0;
const uint8_t *b = NULL;
if (SCSmbTxGetNamedPipe(txv, &b, &b_len) != 1)
return NULL;
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
}
return buffer;
}
void DetectSmbNamedPipeRegister(void)
{
sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
sigmatch_table[KEYWORD_ID].Setup = DetectSmbNamedPipeSetup;
sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB named pipe in tree connect";
sigmatch_table[KEYWORD_ID].url = "/rules/smb-keywords.html#smb-named-pipe";
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetNamedPipeData, ALPROTO_SMB, 1);
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0,
DetectEngineInspectBufferGeneric, GetNamedPipeData);
g_smb_named_pipe_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
}
#undef BUFFER_NAME
#undef KEYWORD_NAME
#undef KEYWORD_NAME_LEGACY
#undef KEYWORD_ID
#define BUFFER_NAME "smb_share"
#define KEYWORD_NAME "smb.share"
#define KEYWORD_NAME_LEGACY BUFFER_NAME
#define KEYWORD_ID DETECT_SMB_SHARE
static int g_smb_share_buffer_id = 0;
static int DetectSmbShareSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
if (SCDetectBufferSetActiveList(de_ctx, s, g_smb_share_buffer_id) < 0)
return -1;
if (SCDetectSignatureSetAppProto(s, ALPROTO_SMB) < 0)
return -1;
return 0;
}
static InspectionBuffer *GetShareData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms,
Flow *_f, const uint8_t _flow_flags,
void *txv, const int list_id)
{
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
if (buffer->inspect == NULL) {
uint32_t b_len = 0;
const uint8_t *b = NULL;
if (SCSmbTxGetShare(txv, &b, &b_len) != 1)
return NULL;
if (b == NULL || b_len == 0)
return NULL;
InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
}
return buffer;
}
void DetectSmbShareRegister(void)
{
sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
sigmatch_table[KEYWORD_ID].Setup = DetectSmbShareSetup;
sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB share name in tree connect";
sigmatch_table[KEYWORD_ID].url = "/rules/smb-keywords.html#smb-share";
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetShareData, ALPROTO_SMB, 1);
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0,
DetectEngineInspectBufferGeneric, GetShareData);
g_smb_share_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
}

30
src/detect-smb-share.h
Unescape Escape View File

@ -1,30 +0,0 @@
/* Copyright (C) 2017 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Victor Julien <victor@inliniac.net>
*/
#ifndef SURICATA_DETECT_SMB_NAMED_PIPE_H
#define SURICATA_DETECT_SMB_NAMED_PIPE_H
void DetectSmbNamedPipeRegister(void);
void DetectSmbShareRegister(void);
#endif /* SURICATA_DETECT_SMB_NAMED_PIPE_H */
Write Preview
Loading…
Cancel
Save