diff --git a/rust/src/sip/detect.rs b/rust/src/sip/detect.rs index 5751c3f8f8..28669861fe 100644 --- a/rust/src/sip/detect.rs +++ b/rust/src/sip/detect.rs @@ -35,6 +35,7 @@ static mut G_SIP_REQUEST_LINE_BUFFER_ID: c_int = 0; static mut G_SIP_RESPONSE_LINE_BUFFER_ID: c_int = 0; static mut G_SIP_FROM_HDR_BUFFER_ID: c_int = 0; static mut G_SIP_TO_HDR_BUFFER_ID: c_int = 0; +static mut G_SIP_VIA_HDR_BUFFER_ID: c_int = 0; #[no_mangle] pub unsafe extern "C" fn rs_sip_tx_get_method( @@ -413,6 +414,48 @@ unsafe extern "C" fn sip_to_hdr_get_data( "To\0".as_ptr() as *const c_char, ) } + +unsafe extern "C" fn sip_via_hdr_setup( + de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char, +) -> c_int { + if DetectSignatureSetAppProto(s, ALPROTO_SIP) != 0 { + return -1; + } + if DetectBufferSetActiveList(de, s, G_SIP_VIA_HDR_BUFFER_ID) < 0 { + return -1; + } + return 0; +} + +unsafe extern "C" fn sip_via_hdr_get( + de: *mut c_void, transforms: *const c_void, flow: *const c_void, flow_flags: u8, + tx: *const c_void, list_id: c_int, local_id: u32, +) -> *mut c_void { + return DetectHelperGetMultiData( + de, + transforms, + flow, + flow_flags, + tx, + list_id, + local_id, + sip_via_hdr_get_data, + ); +} + +unsafe extern "C" fn sip_via_hdr_get_data( + tx: *const c_void, flow_flags: u8, local_id: u32, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { + sip_get_header_value( + tx, + local_id, + flow_flags, + buffer, + buffer_len, + "Via\0".as_ptr() as *const c_char, + ) +} + #[no_mangle] pub unsafe extern "C" fn ScDetectSipRegister() { let kw = SCSigTableElmt { @@ -541,4 +584,22 @@ pub unsafe extern "C" fn ScDetectSipRegister() { true, sip_to_hdr_get, ); + let kw = SCSigTableElmt { + name: b"sip.via\0".as_ptr() as *const libc::c_char, + desc: b"sticky buffer to match on the SIP Via header\0".as_ptr() as *const libc::c_char, + url: b"/rules/sip-keywords.html#sip-via\0".as_ptr() as *const libc::c_char, + Setup: sip_via_hdr_setup, + flags: SIGMATCH_NOOPT, + AppLayerTxMatch: None, + Free: None, + }; + let _g_sip_via_hdr_kw_id = DetectHelperKeywordRegister(&kw); + G_SIP_VIA_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister( + b"sip.via\0".as_ptr() as *const libc::c_char, + b"sip.via\0".as_ptr() as *const libc::c_char, + ALPROTO_SIP, + true, + true, + sip_via_hdr_get, + ); }