detect/smb: move smb share and named_pipe keywords to rust

Ticket: 8267

rust/src/smb/detect.rs

@@ -28,43 +28,43 @@ use std::os::raw::{c_char, c_int, c_void};
 use std::ptr;
 use suricata_sys::sys::{
     DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister,
-    SCDetectSignatureSetAppProto, Signature,
+    SCDetectHelperKeywordAliasRegister, SCDetectSignatureSetAppProto, Signature,
 };
 
-#[no_mangle]
+unsafe extern "C" fn smb_tx_get_share(
-pub unsafe extern "C" fn SCSmbTxGetShare(
+    tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32,
-    tx: &SMBTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
+) -> bool {
-) -> u8 {
+    let tx = cast_pointer!(tx, SMBTransaction);
     if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
         SCLogDebug!("is_pipe {}", x.is_pipe);
         if !x.is_pipe {
             *buffer = x.share_name.as_ptr();
             *buffer_len = x.share_name.len() as u32;
-            return 1;
+            return true;
         }
     }
 
     *buffer = ptr::null();
     *buffer_len = 0;
-    return 0;
+    return false;
 }
 
-#[no_mangle]
+unsafe extern "C" fn smb_tx_get_named_pipe(
-pub unsafe extern "C" fn SCSmbTxGetNamedPipe(
+    tx: *const c_void, _flags: u8, buffer: *mut *const u8, buffer_len: *mut u32,
-    tx: &SMBTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
+) -> bool {
-) -> u8 {
+    let tx = cast_pointer!(tx, SMBTransaction);
     if let Some(SMBTransactionTypeData::TREECONNECT(ref x)) = tx.type_data {
         SCLogDebug!("is_pipe {}", x.is_pipe);
         if x.is_pipe {
             *buffer = x.share_name.as_ptr();
             *buffer_len = x.share_name.len() as u32;
-            return 1;
+            return true;
         }
     }
 
     *buffer = ptr::null();
     *buffer_len = 0;
-    return 0;
+    return false;
 }
 
 #[no_mangle]
@@ -257,8 +257,34 @@ unsafe extern "C" fn smb_ntlmssp_domain_setup(
     return 0;
 }
 
+unsafe extern "C" fn smb_share_setup(
+    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
+) -> c_int {
+    if SCDetectSignatureSetAppProto(s, ALPROTO_SMB) != 0 {
+        return -1;
+    }
+    if SCDetectBufferSetActiveList(de, s, G_SMB_SHARE_BUFFER_ID) < 0 {
+        return -1;
+    }
+    return 0;
+}
+
+unsafe extern "C" fn smb_named_pipe_setup(
+    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
+) -> c_int {
+    if SCDetectSignatureSetAppProto(s, ALPROTO_SMB) != 0 {
+        return -1;
+    }
+    if SCDetectBufferSetActiveList(de, s, G_SMB_NAMED_PIPE_BUFFER_ID) < 0 {
+        return -1;
+    }
+    return 0;
+}
+
 static mut G_SMB_NTLMSSP_USER_BUFFER_ID: c_int = 0;
 static mut G_SMB_NTLMSSP_DOMAIN_BUFFER_ID: c_int = 0;
+static mut G_SMB_SHARE_BUFFER_ID: c_int = 0;
+static mut G_SMB_NAMED_PIPE_BUFFER_ID: c_int = 0;
 
 #[no_mangle]
 pub unsafe extern "C" fn SCDetectSmbRegister() {
@@ -291,6 +317,44 @@ pub unsafe extern "C" fn SCDetectSmbRegister() {
         STREAM_TOSERVER,
         Some(smb_tx_get_ntlmssp_domain),
     );
+
+    let kw_share = SigTableElmtStickyBuffer {
+        name: String::from("smb.share"),
+        desc: String::from("sticky buffer to match on SMB share name in tree connect"),
+        url: String::from("/rules/smb-keywords.html#smb-share"),
+        setup: smb_share_setup,
+    };
+    let share_keyword_id = helper_keyword_register_sticky_buffer(&kw_share);
+    G_SMB_SHARE_BUFFER_ID = SCDetectHelperBufferMpmRegister(
+        b"smb_share\0".as_ptr() as *const libc::c_char,
+        b"smb share\0".as_ptr() as *const libc::c_char,
+        ALPROTO_SMB,
+        STREAM_TOSERVER,
+        Some(smb_tx_get_share),
+    );
+    SCDetectHelperKeywordAliasRegister(
+        share_keyword_id,
+        b"smb_share\0".as_ptr() as *const libc::c_char,
+    );
+
+    let kw_named_pipe = SigTableElmtStickyBuffer {
+        name: String::from("smb.named_pipe"),
+        desc: String::from("sticky buffer to match on SMB named pipe in tree connect"),
+        url: String::from("/rules/smb-keywords.html#smb-named-pipe"),
+        setup: smb_named_pipe_setup,
+    };
+    let named_pipe_keyword_id = helper_keyword_register_sticky_buffer(&kw_named_pipe);
+    G_SMB_NAMED_PIPE_BUFFER_ID = SCDetectHelperBufferMpmRegister(
+        b"smb_named_pipe\0".as_ptr() as *const libc::c_char,
+        b"smb named pipe\0".as_ptr() as *const libc::c_char,
+        ALPROTO_SMB,
+        STREAM_TOSERVER,
+        Some(smb_tx_get_named_pipe),
+    );
+    SCDetectHelperKeywordAliasRegister(
+        named_pipe_keyword_id,
+        b"smb_named_pipe\0".as_ptr() as *const libc::c_char,
+    );
 }
 
 #[cfg(test)]

src/Makefile.am

@@ -274,7 +274,6 @@ noinst_HEADERS = \
 	detect-sid.h \
 	detect-sip-method.h \
 	detect-sip-uri.h \
-	detect-smb-share.h \
 	detect-smb-version.h \
 	detect-smtp.h \
 	detect-ssl-state.h \
@@ -860,7 +859,6 @@ libsuricata_c_a_SOURCES = \
 	detect-sid.c \
 	detect-sip-method.c \
 	detect-sip-uri.c \
-	detect-smb-share.c \
 	detect-smb-version.c \
 	detect-smtp.c \
 	detect-ssl-state.c \

src/detect-engine-register.c

@@ -77,7 +77,6 @@
 
 #include "detect-config.h"
 
-#include "detect-smb-share.h"
 #include "detect-smb-version.h"
 #include "detect-smtp.h"
 
@@ -686,8 +685,6 @@ void SigTableSetup(void)
     DetectDceIfaceRegister();
     DetectDceOpnumRegister();
     DetectDceStubDataRegister();
-    DetectSmbNamedPipeRegister();
-    DetectSmbShareRegister();
     DetectSmbVersionRegister();
     DetectTlsRegister();
     DetectTlsValidityRegister();

src/detect-engine-register.h

@@ -209,8 +209,6 @@ enum DetectKeywordId {
     DETECT_DCE_IFACE,
     DETECT_DCE_OPNUM,
     DETECT_DCE_STUB_DATA,
-    DETECT_SMB_NAMED_PIPE,
-    DETECT_SMB_SHARE,
     DETECT_SMB_VERSION,
 
     DETECT_ENGINE_EVENT,

src/detect-smb-share.c

@@ -1,155 +0,0 @@
-/* Copyright (C) 2017 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Victor Julien <victor@inliniac.net>
- *
- */
-
-#include "suricata-common.h"
-
-#include "detect.h"
-#include "detect-parse.h"
-
-#include "detect-engine.h"
-#include "detect-engine-buffer.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-state.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-content-inspection.h"
-
-#include "detect-smb-share.h"
-#include "rust.h"
-
-#define BUFFER_NAME "smb_named_pipe"
-#define KEYWORD_NAME "smb.named_pipe"
-#define KEYWORD_NAME_LEGACY BUFFER_NAME
-#define KEYWORD_ID DETECT_SMB_NAMED_PIPE
-
-static int g_smb_named_pipe_buffer_id = 0;
-
-static int DetectSmbNamedPipeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
-{
-    if (SCDetectBufferSetActiveList(de_ctx, s, g_smb_named_pipe_buffer_id) < 0)
-        return -1;
-
-    if (SCDetectSignatureSetAppProto(s, ALPROTO_SMB) < 0)
-        return -1;
-
-    return 0;
-}
-
-static InspectionBuffer *GetNamedPipeData(DetectEngineThreadCtx *det_ctx,
-        const DetectEngineTransforms *transforms,
-        Flow *_f, const uint8_t _flow_flags,
-        void *txv, const int list_id)
-{
-    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
-    if (buffer->inspect == NULL) {
-        uint32_t b_len = 0;
-        const uint8_t *b = NULL;
-
-        if (SCSmbTxGetNamedPipe(txv, &b, &b_len) != 1)
-            return NULL;
-        if (b == NULL || b_len == 0)
-            return NULL;
-
-        InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
-    }
-    return buffer;
-}
-
-void DetectSmbNamedPipeRegister(void)
-{
-    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
-    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
-    sigmatch_table[KEYWORD_ID].Setup = DetectSmbNamedPipeSetup;
-    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
-    sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB named pipe in tree connect";
-    sigmatch_table[KEYWORD_ID].url = "/rules/smb-keywords.html#smb-named-pipe";
-
-    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
-            GetNamedPipeData, ALPROTO_SMB, 1);
-
-    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0,
-            DetectEngineInspectBufferGeneric, GetNamedPipeData);
-
-    g_smb_named_pipe_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
-}
-
-#undef BUFFER_NAME
-#undef KEYWORD_NAME
-#undef KEYWORD_NAME_LEGACY
-#undef KEYWORD_ID
-
-#define BUFFER_NAME "smb_share"
-#define KEYWORD_NAME "smb.share"
-#define KEYWORD_NAME_LEGACY BUFFER_NAME
-#define KEYWORD_ID DETECT_SMB_SHARE
-
-static int g_smb_share_buffer_id = 0;
-
-static int DetectSmbShareSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
-{
-    if (SCDetectBufferSetActiveList(de_ctx, s, g_smb_share_buffer_id) < 0)
-        return -1;
-
-    if (SCDetectSignatureSetAppProto(s, ALPROTO_SMB) < 0)
-        return -1;
-
-    return 0;
-}
-
-static InspectionBuffer *GetShareData(DetectEngineThreadCtx *det_ctx,
-        const DetectEngineTransforms *transforms,
-        Flow *_f, const uint8_t _flow_flags,
-        void *txv, const int list_id)
-{
-    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
-    if (buffer->inspect == NULL) {
-        uint32_t b_len = 0;
-        const uint8_t *b = NULL;
-
-        if (SCSmbTxGetShare(txv, &b, &b_len) != 1)
-            return NULL;
-        if (b == NULL || b_len == 0)
-            return NULL;
-
-        InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
-    }
-    return buffer;
-}
-
-void DetectSmbShareRegister(void)
-{
-    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
-    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
-    sigmatch_table[KEYWORD_ID].Setup = DetectSmbShareSetup;
-    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
-    sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB share name in tree connect";
-    sigmatch_table[KEYWORD_ID].url = "/rules/smb-keywords.html#smb-share";
-
-    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
-            GetShareData, ALPROTO_SMB, 1);
-
-    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0,
-            DetectEngineInspectBufferGeneric, GetShareData);
-
-    g_smb_share_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
-}

src/detect-smb-share.h

@@ -1,30 +0,0 @@
-/* Copyright (C) 2017 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Victor Julien <victor@inliniac.net>
- */
-
-#ifndef SURICATA_DETECT_SMB_NAMED_PIPE_H
-#define SURICATA_DETECT_SMB_NAMED_PIPE_H
-
-void DetectSmbNamedPipeRegister(void);
-void DetectSmbShareRegister(void);
-
-#endif /* SURICATA_DETECT_SMB_NAMED_PIPE_H */