diff --git a/rust/src/smb/detect.rs b/rust/src/smb/detect.rs index fbfca8be7e..2b6de20aae 100644 --- a/rust/src/smb/detect.rs +++ b/rust/src/smb/detect.rs @@ -28,43 +28,43 @@ use std::os::raw::{c_char, c_int, c_void}; use std::ptr; use suricata_sys::sys::{ DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister, - SCDetectSignatureSetAppProto, Signature, + SCDetectHelperKeywordAliasRegister, SCDetectSignatureSetAppProto, Signature, }; -#[no_mangle] -pub unsafe extern "C" fn SCSmbTxGetShare( - tx: &SMBTransaction, buffer: *mut *const u8, buffer_len: *mut u32, -) -> u8 { +unsafe extern "C" fn smb_tx_get_share( + tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { + let tx = cast_pointer!(tx, SMBTransaction); if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data { SCLogDebug!("is_pipe {}", x.is_pipe); if !x.is_pipe { *buffer = x.share_name.as_ptr(); *buffer_len = x.share_name.len() as u32; - return 1; + return true; } } *buffer = ptr::null(); *buffer_len = 0; - return 0; + return false; } -#[no_mangle] -pub unsafe extern "C" fn SCSmbTxGetNamedPipe( - tx: &SMBTransaction, buffer: *mut *const u8, buffer_len: *mut u32, -) -> u8 { +unsafe extern "C" fn smb_tx_get_named_pipe( + tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { + let tx = cast_pointer!(tx, SMBTransaction); if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data { SCLogDebug!("is_pipe {}", x.is_pipe); if x.is_pipe { *buffer = x.share_name.as_ptr(); *buffer_len = x.share_name.len() as u32; - return 1; + return true; } } *buffer = ptr::null(); *buffer_len = 0; - return 0; + return false; } #[no_mangle] @@ -257,8 +257,34 @@ unsafe extern "C" fn smb_ntlmssp_domain_setup( return 0; } +unsafe extern "C" fn smb_share_setup( + de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char, +) -> c_int { + if SCDetectSignatureSetAppProto(s, ALPROTO_SMB) != 0 { + return -1; + } + if SCDetectBufferSetActiveList(de, s, G_SMB_SHARE_BUFFER_ID) < 0 { + return -1; + } + return 0; +} + +unsafe extern "C" fn smb_named_pipe_setup( + de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char, +) -> c_int { + if SCDetectSignatureSetAppProto(s, ALPROTO_SMB) != 0 { + return -1; + } + if SCDetectBufferSetActiveList(de, s, G_SMB_NAMED_PIPE_BUFFER_ID) < 0 { + return -1; + } + return 0; +} + static mut G_SMB_NTLMSSP_USER_BUFFER_ID: c_int = 0; static mut G_SMB_NTLMSSP_DOMAIN_BUFFER_ID: c_int = 0; +static mut G_SMB_SHARE_BUFFER_ID: c_int = 0; +static mut G_SMB_NAMED_PIPE_BUFFER_ID: c_int = 0; #[no_mangle] pub unsafe extern "C" fn SCDetectSmbRegister() { @@ -291,6 +317,44 @@ pub unsafe extern "C" fn SCDetectSmbRegister() { STREAM_TOSERVER, Some(smb_tx_get_ntlmssp_domain), ); + + let kw_share = SigTableElmtStickyBuffer { + name: String::from("smb.share"), + desc: String::from("sticky buffer to match on SMB share name in tree connect"), + url: String::from("/rules/smb-keywords.html#smb-share"), + setup: smb_share_setup, + }; + let share_keyword_id = helper_keyword_register_sticky_buffer(&kw_share); + G_SMB_SHARE_BUFFER_ID = SCDetectHelperBufferMpmRegister( + b"smb_share\0".as_ptr() as *const libc::c_char, + b"smb share\0".as_ptr() as *const libc::c_char, + ALPROTO_SMB, + STREAM_TOSERVER, + Some(smb_tx_get_share), + ); + SCDetectHelperKeywordAliasRegister( + share_keyword_id, + b"smb_share\0".as_ptr() as *const libc::c_char, + ); + + let kw_named_pipe = SigTableElmtStickyBuffer { + name: String::from("smb.named_pipe"), + desc: String::from("sticky buffer to match on SMB named pipe in tree connect"), + url: String::from("/rules/smb-keywords.html#smb-named-pipe"), + setup: smb_named_pipe_setup, + }; + let named_pipe_keyword_id = helper_keyword_register_sticky_buffer(&kw_named_pipe); + G_SMB_NAMED_PIPE_BUFFER_ID = SCDetectHelperBufferMpmRegister( + b"smb_named_pipe\0".as_ptr() as *const libc::c_char, + b"smb named pipe\0".as_ptr() as *const libc::c_char, + ALPROTO_SMB, + STREAM_TOSERVER, + Some(smb_tx_get_named_pipe), + ); + SCDetectHelperKeywordAliasRegister( + named_pipe_keyword_id, + b"smb_named_pipe\0".as_ptr() as *const libc::c_char, + ); } #[cfg(test)] diff --git a/src/Makefile.am b/src/Makefile.am index bb7deae3a0..306664c090 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -274,7 +274,6 @@ noinst_HEADERS = \ detect-sid.h \ detect-sip-method.h \ detect-sip-uri.h \ - detect-smb-share.h \ detect-smb-version.h \ detect-smtp.h \ detect-ssl-state.h \ @@ -860,7 +859,6 @@ libsuricata_c_a_SOURCES = \ detect-sid.c \ detect-sip-method.c \ detect-sip-uri.c \ - detect-smb-share.c \ detect-smb-version.c \ detect-smtp.c \ detect-ssl-state.c \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index 35e7dc9d7e..5cdfd18382 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -77,7 +77,6 @@ #include "detect-config.h" -#include "detect-smb-share.h" #include "detect-smb-version.h" #include "detect-smtp.h" @@ -686,8 +685,6 @@ void SigTableSetup(void) DetectDceIfaceRegister(); DetectDceOpnumRegister(); DetectDceStubDataRegister(); - DetectSmbNamedPipeRegister(); - DetectSmbShareRegister(); DetectSmbVersionRegister(); DetectTlsRegister(); DetectTlsValidityRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 9ab462a996..ac62f457cf 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -209,8 +209,6 @@ enum DetectKeywordId { DETECT_DCE_IFACE, DETECT_DCE_OPNUM, DETECT_DCE_STUB_DATA, - DETECT_SMB_NAMED_PIPE, - DETECT_SMB_SHARE, DETECT_SMB_VERSION, DETECT_ENGINE_EVENT, diff --git a/src/detect-smb-share.c b/src/detect-smb-share.c deleted file mode 100644 index 8b6c800740..0000000000 --- a/src/detect-smb-share.c +++ /dev/null @@ -1,155 +0,0 @@ -/* Copyright (C) 2017 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Victor Julien - * - */ - -#include "suricata-common.h" - -#include "detect.h" -#include "detect-parse.h" - -#include "detect-engine.h" -#include "detect-engine-buffer.h" -#include "detect-engine-mpm.h" -#include "detect-engine-state.h" -#include "detect-engine-prefilter.h" -#include "detect-engine-content-inspection.h" - -#include "detect-smb-share.h" -#include "rust.h" - -#define BUFFER_NAME "smb_named_pipe" -#define KEYWORD_NAME "smb.named_pipe" -#define KEYWORD_NAME_LEGACY BUFFER_NAME -#define KEYWORD_ID DETECT_SMB_NAMED_PIPE - -static int g_smb_named_pipe_buffer_id = 0; - -static int DetectSmbNamedPipeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) -{ - if (SCDetectBufferSetActiveList(de_ctx, s, g_smb_named_pipe_buffer_id) < 0) - return -1; - - if (SCDetectSignatureSetAppProto(s, ALPROTO_SMB) < 0) - return -1; - - return 0; -} - -static InspectionBuffer *GetNamedPipeData(DetectEngineThreadCtx *det_ctx, - const DetectEngineTransforms *transforms, - Flow *_f, const uint8_t _flow_flags, - void *txv, const int list_id) -{ - InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); - if (buffer->inspect == NULL) { - uint32_t b_len = 0; - const uint8_t *b = NULL; - - if (SCSmbTxGetNamedPipe(txv, &b, &b_len) != 1) - return NULL; - if (b == NULL || b_len == 0) - return NULL; - - InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms); - } - return buffer; -} - -void DetectSmbNamedPipeRegister(void) -{ - sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME; - sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY; - sigmatch_table[KEYWORD_ID].Setup = DetectSmbNamedPipeSetup; - sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; - sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB named pipe in tree connect"; - sigmatch_table[KEYWORD_ID].url = "/rules/smb-keywords.html#smb-named-pipe"; - - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetNamedPipeData, ALPROTO_SMB, 1); - - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0, - DetectEngineInspectBufferGeneric, GetNamedPipeData); - - g_smb_named_pipe_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); -} - -#undef BUFFER_NAME -#undef KEYWORD_NAME -#undef KEYWORD_NAME_LEGACY -#undef KEYWORD_ID - -#define BUFFER_NAME "smb_share" -#define KEYWORD_NAME "smb.share" -#define KEYWORD_NAME_LEGACY BUFFER_NAME -#define KEYWORD_ID DETECT_SMB_SHARE - -static int g_smb_share_buffer_id = 0; - -static int DetectSmbShareSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) -{ - if (SCDetectBufferSetActiveList(de_ctx, s, g_smb_share_buffer_id) < 0) - return -1; - - if (SCDetectSignatureSetAppProto(s, ALPROTO_SMB) < 0) - return -1; - - return 0; -} - -static InspectionBuffer *GetShareData(DetectEngineThreadCtx *det_ctx, - const DetectEngineTransforms *transforms, - Flow *_f, const uint8_t _flow_flags, - void *txv, const int list_id) -{ - InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); - if (buffer->inspect == NULL) { - uint32_t b_len = 0; - const uint8_t *b = NULL; - - if (SCSmbTxGetShare(txv, &b, &b_len) != 1) - return NULL; - if (b == NULL || b_len == 0) - return NULL; - - InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms); - } - return buffer; -} - -void DetectSmbShareRegister(void) -{ - sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME; - sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY; - sigmatch_table[KEYWORD_ID].Setup = DetectSmbShareSetup; - sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; - sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB share name in tree connect"; - sigmatch_table[KEYWORD_ID].url = "/rules/smb-keywords.html#smb-share"; - - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetShareData, ALPROTO_SMB, 1); - - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0, - DetectEngineInspectBufferGeneric, GetShareData); - - g_smb_share_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); -} diff --git a/src/detect-smb-share.h b/src/detect-smb-share.h deleted file mode 100644 index a80df8d39c..0000000000 --- a/src/detect-smb-share.h +++ /dev/null @@ -1,30 +0,0 @@ -/* Copyright (C) 2017 Open Information Security Foundation - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Victor Julien - */ - -#ifndef SURICATA_DETECT_SMB_NAMED_PIPE_H -#define SURICATA_DETECT_SMB_NAMED_PIPE_H - -void DetectSmbNamedPipeRegister(void); -void DetectSmbShareRegister(void); - -#endif /* SURICATA_DETECT_SMB_NAMED_PIPE_H */