aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/ssh: move obsolete keywords to rust

Browse Source
pull/14639/head
Philippe Antoine 6 months ago committed by Victor Julien
parent ea8ac2a02a
commit 9cfc1cc557
8 changed files with 38 additions and 159 deletions
Show Stats Download Patch File Download Diff File

39
rust/src/ssh/detect.rs
Unescape Escape View File

@ -23,7 +23,8 @@ use std::os::raw::{c_int, c_void};
use std::ptr;
use suricata_sys::sys::{
DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferProgressMpmRegister,
SCDetectHelperKeywordAliasRegister, SCDetectSignatureSetAppProto, Signature,
SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordRegister,
SCDetectSignatureSetAppProto, SCSigTableAppLiteElmt, Signature,
};
#[no_mangle]
@ -153,6 +154,20 @@ unsafe extern "C" fn ssh_software_setup(
return 0;
}
unsafe extern "C" fn ssh_software_obsolete_setup(
_de: *mut DetectEngineCtx, _s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
SCLogError!("ssh.softwareversion is obsolete, use now ssh.software");
return -1;
}
unsafe extern "C" fn ssh_proto_obsolete_setup(
_de: *mut DetectEngineCtx, _s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
SCLogError!("ssh.softwareversion is obsolete, use now ssh.software");
return -1;
}
static mut G_SSH_SOFTWARE_BUFFER_ID: c_int = 0;
#[no_mangle]
@ -176,4 +191,26 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ssh_software_kw_id,
b"ssh_software\0".as_ptr() as *const libc::c_char,
);
let kw = SCSigTableAppLiteElmt {
name: b"ssh.softwareversion\0".as_ptr() as *const libc::c_char,
desc: b"obsolete keyword, use now ssh.software\0".as_ptr() as *const libc::c_char,
url: std::ptr::null(),
AppLayerTxMatch: None,
Setup: Some(ssh_software_obsolete_setup),
Free: None,
flags: 0,
};
_ = SCDetectHelperKeywordRegister(&kw);
let kw = SCSigTableAppLiteElmt {
name: b"ssh.protoversion\0".as_ptr() as *const libc::c_char,
desc: b"obsolete keyword, use now ssh.proto\0".as_ptr() as *const libc::c_char,
url: std::ptr::null(),
AppLayerTxMatch: None,
Setup: Some(ssh_proto_obsolete_setup),
Free: None,
flags: 0,
};
_ = SCDetectHelperKeywordRegister(&kw);
}

4
src/Makefile.am
Unescape Escape View File

@ -287,9 +287,7 @@ noinst_HEADERS = \
detect-ssh-hassh-server.h \
detect-ssh-hassh-string.h \
detect-ssh-hassh.h \
detect-ssh-proto-version.h \
detect-ssh-proto.h \
detect-ssh-software-version.h \
detect-ssl-state.h \
detect-ssl-version.h \
detect-stream_size.h \
@ -886,9 +884,7 @@ libsuricata_c_a_SOURCES = \
detect-ssh-hassh-server.c \
detect-ssh-hassh-string.c \
detect-ssh-hassh.c \
detect-ssh-proto-version.c \
detect-ssh-proto.c \
detect-ssh-software-version.c \
detect-ssl-state.c \
detect-ssl-version.c \
detect-stream_size.c \

4
src/detect-engine-register.c
Unescape Escape View File

@ -235,8 +235,6 @@
#include "detect-tls-cert-validity.h"
#include "detect-tls-version.h"
#include "detect-ssh-proto.h"
#include "detect-ssh-proto-version.h"
#include "detect-ssh-software-version.h"
#include "detect-ssh-hassh.h"
#include "detect-ssh-hassh-server.h"
#include "detect-ssh-hassh-string.h"
@ -714,8 +712,6 @@ void SigTableSetup(void)
DetectDetectionFilterRegister();
DetectAsn1Register();
DetectSshProtocolRegister();
DetectSshVersionRegister();
DetectSshSoftwareVersionRegister();
DetectSshHasshRegister();
DetectSshHasshServerRegister();
DetectSshHasshStringRegister();

2
src/detect-engine-register.h
Unescape Escape View File

@ -190,8 +190,6 @@ enum DetectKeywordId {
DETECT_HTTP_RESPONSE_LINE,
DETECT_NFS_VERSION,
DETECT_SSH_PROTOCOL,
DETECT_SSH_PROTOVERSION,
DETECT_SSH_SOFTWAREVERSION,
DETECT_SSH_HASSH,
DETECT_SSH_HASSH_SERVER,
DETECT_SSH_HASSH_STRING,

44
src/detect-ssh-proto-version.c
Unescape Escape View File

@ -1,44 +0,0 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
*
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-engine-register.h"
#include "detect-ssh-proto-version.h"
static int DetectSshVersionSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
SCLogError("ssh.protoversion is obsolete, use now ssh.proto");
return -1;
}
/**
* \brief Registration function for keyword: ssh.protoversion
*/
void DetectSshVersionRegister(void)
{
sigmatch_table[DETECT_SSH_PROTOVERSION].name = "ssh.protoversion";
sigmatch_table[DETECT_SSH_PROTOVERSION].desc = "obsolete keyword, use now ssh.proto";
sigmatch_table[DETECT_SSH_PROTOVERSION].Setup = DetectSshVersionSetup;
}

30
src/detect-ssh-proto-version.h
Unescape Escape View File

@ -1,30 +0,0 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
*/
#ifndef SURICATA_DETECT_SSH_VERSION_H
#define SURICATA_DETECT_SSH_VERSION_H
/* prototypes */
void DetectSshVersionRegister (void);
#endif /* SURICATA_DETECT_SSH_VERSION_H */

44
src/detect-ssh-software-version.c
Unescape Escape View File

@ -1,44 +0,0 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
*
*/
#include "suricata-common.h"
#include "detect.h"
#include "detect-engine-register.h"
#include "detect-ssh-software-version.h"
static int DetectSshSoftwareVersionSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
SCLogError("ssh.softwareversion is obsolete, use now ssh.software");
return -1;
}
/**
* \brief Registration function for keyword: ssh.softwareversion
*/
void DetectSshSoftwareVersionRegister(void)
{
sigmatch_table[DETECT_SSH_SOFTWAREVERSION].name = "ssh.softwareversion";
sigmatch_table[DETECT_SSH_SOFTWAREVERSION].desc = "obsolete keyword, use now ssh.software";
sigmatch_table[DETECT_SSH_SOFTWAREVERSION].Setup = DetectSshSoftwareVersionSetup;
}

30
src/detect-ssh-software-version.h
Unescape Escape View File

@ -1,30 +0,0 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
*/
#ifndef SURICATA_DETECT_SSH_SOFTWARE_VERSION_H
#define SURICATA_DETECT_SSH_SOFTWARE_VERSION_H
/* prototypes */
void DetectSshSoftwareVersionRegister(void);
#endif /* SURICATA_DETECT_SSH_SOFTWARE_VERSION_H */
Write Preview
Loading…
Cancel
Save