diff --git a/rust/src/sip/detect.rs b/rust/src/sip/detect.rs index 6e75060c15..5751c3f8f8 100644 --- a/rust/src/sip/detect.rs +++ b/rust/src/sip/detect.rs @@ -34,6 +34,7 @@ static mut G_SIP_STAT_MSG_BUFFER_ID: c_int = 0; static mut G_SIP_REQUEST_LINE_BUFFER_ID: c_int = 0; static mut G_SIP_RESPONSE_LINE_BUFFER_ID: c_int = 0; static mut G_SIP_FROM_HDR_BUFFER_ID: c_int = 0; +static mut G_SIP_TO_HDR_BUFFER_ID: c_int = 0; #[no_mangle] pub unsafe extern "C" fn rs_sip_tx_get_method( @@ -372,6 +373,46 @@ unsafe extern "C" fn sip_from_hdr_get_data( ) } +unsafe extern "C" fn sip_to_hdr_setup( + de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char, +) -> c_int { + if DetectSignatureSetAppProto(s, ALPROTO_SIP) != 0 { + return -1; + } + if DetectBufferSetActiveList(de, s, G_SIP_TO_HDR_BUFFER_ID) < 0 { + return -1; + } + return 0; +} + +unsafe extern "C" fn sip_to_hdr_get( + de: *mut c_void, transforms: *const c_void, flow: *const c_void, flow_flags: u8, + tx: *const c_void, list_id: c_int, local_id: u32, +) -> *mut c_void { + return DetectHelperGetMultiData( + de, + transforms, + flow, + flow_flags, + tx, + list_id, + local_id, + sip_to_hdr_get_data, + ); +} + +unsafe extern "C" fn sip_to_hdr_get_data( + tx: *const c_void, flow_flags: u8, local_id: u32, buffer: *mut *const u8, buffer_len: *mut u32, +) -> bool { + sip_get_header_value( + tx, + local_id, + flow_flags, + buffer, + buffer_len, + "To\0".as_ptr() as *const c_char, + ) +} #[no_mangle] pub unsafe extern "C" fn ScDetectSipRegister() { let kw = SCSigTableElmt { @@ -482,4 +523,22 @@ pub unsafe extern "C" fn ScDetectSipRegister() { true, sip_from_hdr_get, ); + let kw = SCSigTableElmt { + name: b"sip.to\0".as_ptr() as *const libc::c_char, + desc: b"sticky buffer to match on the SIP To header\0".as_ptr() as *const libc::c_char, + url: b"/rules/sip-keywords.html#sip-to\0".as_ptr() as *const libc::c_char, + Setup: sip_to_hdr_setup, + flags: SIGMATCH_NOOPT, + AppLayerTxMatch: None, + Free: None, + }; + let _g_sip_to_hdr_kw_id = DetectHelperKeywordRegister(&kw); + G_SIP_TO_HDR_BUFFER_ID = DetectHelperMultiBufferMpmRegister( + b"sip.to\0".as_ptr() as *const libc::c_char, + b"sip.to\0".as_ptr() as *const libc::c_char, + ALPROTO_SIP, + true, + true, + sip_to_hdr_get, + ); }