aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust: bindgen SCDetectGetLastSMFromLists

Browse Source 
to use it from rust keywords
pull/14806/head
Philippe Antoine 5 months ago committed by Victor Julien
parent 697c641400
commit df495d7e22
23 changed files with 67 additions and 81 deletions
Show Stats Download Patch File Download Diff File

3
rust/sys/src/sys.rs
Unescape Escape View File

@ -554,6 +554,9 @@ extern "C" {
extern "C" {
pub fn SCSigMatchSilentErrorEnabled(de_ctx: *const DetectEngineCtx, id: u16) -> bool;
}
extern "C" {
pub fn SCDetectGetLastSMFromLists(s: *const Signature, ...) -> *mut SigMatch;
}
extern "C" {
pub fn SCDetectSignatureSetAppProto(
s: *mut Signature, alproto: AppProto,

2
src/detect-base64-data.c
Unescape Escape View File

@ -51,7 +51,7 @@ static int DetectBase64DataSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *pm = NULL;
/* Check for a preceding base64_decode. */
pm = DetectGetLastSMFromLists(s, DETECT_BASE64_DECODE, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_BASE64_DECODE, -1);
if (pm == NULL) {
SCLogError("\"base64_data\" keyword seen without preceding base64_decode.");
return -1;

6
src/detect-base64-decode.c
Unescape Escape View File

@ -209,10 +209,8 @@ static int DetectBase64DecodeSetup(DetectEngineCtx *de_ctx, Signature *s,
sm_list = s->init_data->list;
}
else {
pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, -1);
if (pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
}

13
src/detect-byte-extract.c
Unescape Escape View File

@ -268,13 +268,12 @@ static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const c
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (data->endian == EndianDCE) {
if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -290,10 +289,8 @@ static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const c
goto error;
} else if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

14
src/detect-bytejump.c
Unescape Escape View File

@ -526,14 +526,12 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (data->flags & DETECT_BYTEJUMP_DCE) {
if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -549,10 +547,8 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
goto error;
} else if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

15
src/detect-bytemath.c
Unescape Escape View File

@ -301,7 +301,7 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
if (!prev_pm) {
SCLogError("relative specified without "
"previous pattern match");
@ -310,11 +310,8 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
} else if (data->endian == EndianDCE) {
if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP,
DETECT_BYTE_EXTRACT,
DETECT_BYTEMATH,
DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -330,10 +327,8 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
goto error;
} else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP,
DETECT_BYTE_EXTRACT, DETECT_BYTEMATH,
DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

14
src/detect-bytetest.c
Unescape Escape View File

@ -585,15 +585,13 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTETEST_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (data->flags & DETECT_BYTETEST_DCE) {
if (data->flags & DETECT_BYTETEST_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -609,10 +607,8 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
goto error;
} else if (data->flags & DETECT_BYTETEST_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

37
src/detect-csum.c
Unescape Escape View File

@ -872,23 +872,26 @@ static int DetectCsumInvalidArgsTestParse02(void)
}
#undef TEST2
#define TEST3(kwstr, kwtype) { \
DetectEngineCtx *de_ctx = DetectEngineCtxInit();\
FAIL_IF_NULL(de_ctx);\
Signature *s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any ("mystr(kwstr)"-csum:valid; sid:1;)");\
FAIL_IF_NULL(s);\
SigMatch *sm = DetectGetLastSMFromLists(s, (kwtype), -1);\
FAIL_IF_NULL(sm);\
FAIL_IF_NULL(sm->ctx);\
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 1);\
s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any ("mystr(kwstr)"-csum:INVALID; sid:2;)");\
FAIL_IF_NULL(s);\
sm = DetectGetLastSMFromLists(s, (kwtype), -1);\
FAIL_IF_NULL(sm);\
FAIL_IF_NULL(sm->ctx);\
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 0);\
DetectEngineCtxFree(de_ctx);\
}
#define TEST3(kwstr, kwtype) \
{ \
DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
FAIL_IF_NULL(de_ctx); \
Signature *s = DetectEngineAppendSig( \
de_ctx, "alert ip any any -> any any (" mystr(kwstr) "-csum:valid; sid:1;)"); \
FAIL_IF_NULL(s); \
SigMatch *sm = SCDetectGetLastSMFromLists(s, (kwtype), -1); \
FAIL_IF_NULL(sm); \
FAIL_IF_NULL(sm->ctx); \
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 1); \
s = DetectEngineAppendSig( \
de_ctx, "alert ip any any -> any any (" mystr(kwstr) "-csum:INVALID; sid:2;)"); \
FAIL_IF_NULL(s); \
sm = SCDetectGetLastSMFromLists(s, (kwtype), -1); \
FAIL_IF_NULL(sm); \
FAIL_IF_NULL(sm->ctx); \
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 0); \
DetectEngineCtxFree(de_ctx); \
}
static int DetectCsumValidArgsTestParse03(void)
{

4
src/detect-depth.c
Unescape Escape View File

@ -68,7 +68,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, const char *
int ret = -1;
/* retrieve the sm to apply the depth against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("depth needs "
"preceding content, uricontent option, http_client_body, "
@ -143,7 +143,7 @@ static int DetectStartsWithSetup (DetectEngineCtx *de_ctx, Signature *s, const c
int ret = -1;
/* retrieve the sm to apply the depth against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("startswith needs a "
"preceding content option.");

4
src/detect-detection-filter.c
Unescape Escape View File

@ -236,13 +236,13 @@ static int DetectDetectionFilterSetup(DetectEngineCtx *de_ctx, Signature *s, con
SigMatch *tmpm = NULL;
/* checks if there's a previous instance of threshold */
tmpm = DetectGetLastSMFromLists(s, DETECT_THRESHOLD, -1);
tmpm = SCDetectGetLastSMFromLists(s, DETECT_THRESHOLD, -1);
if (tmpm != NULL) {
SCLogError("\"detection_filter\" and \"threshold\" are not allowed in the same rule");
SCReturnInt(-1);
}
/* checks there's no previous instance of detection_filter */
tmpm = DetectGetLastSMFromLists(s, DETECT_DETECTION_FILTER, -1);
tmpm = SCDetectGetLastSMFromLists(s, DETECT_DETECTION_FILTER, -1);
if (tmpm != NULL) {
SCLogError("At most one \"detection_filter\" is allowed per rule");
SCReturnInt(-1);

2
src/detect-distance.c
Unescape Escape View File

@ -72,7 +72,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
const char *str = distancestr;
/* retrieve the sm to apply the distance against */
SigMatch *pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("distance needs "
"preceding content, uricontent option, http_client_body, "

2
src/detect-dsize.c
Unescape Escape View File

@ -119,7 +119,7 @@ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *
{
DetectU16Data *dd = NULL;
if (DetectGetLastSMFromLists(s, DETECT_DSIZE, -1)) {
if (SCDetectGetLastSMFromLists(s, DETECT_DSIZE, -1)) {
SCLogError("Can't use 2 or more dsizes in "
"the same sig. Invalidating signature.");
return -1;

2
src/detect-fast-pattern.c
Unescape Escape View File

@ -217,7 +217,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, const c
pcre2_match_data *match = NULL;
SigMatch *pm1 = DetectGetLastSMFromMpmLists(de_ctx, s);
SigMatch *pm2 = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm2 = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm1 == NULL && pm2 == NULL) {
SCLogError("fast_pattern found inside "
"the rule, without a content context. Please use a "

2
src/detect-filemagic.c
Unescape Escape View File

@ -218,7 +218,7 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
return -1;
}
SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *sm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (sm == NULL)
return -1;

4
src/detect-filename.c
Unescape Escape View File

@ -144,7 +144,7 @@ static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
SCFree(dotstr);
SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *sm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (sm == NULL)
return -1;
@ -182,7 +182,7 @@ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
return -1;
}
SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *sm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (sm == NULL)
return -1;

10
src/detect-isdataat.c
Unescape Escape View File

@ -327,13 +327,11 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isda
sm_list = s->init_data->list;
if (idad->flags & ISDATAAT_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (idad->flags & ISDATAAT_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL)
sm_list = DETECT_SM_LIST_PMATCH;
else {
@ -422,7 +420,7 @@ static int DetectEndsWithSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
int ret = -1;
/* retrieve the sm to apply the depth against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("endswith needs a "
"preceding content option");

2
src/detect-nocase.c
Unescape Escape View File

@ -67,7 +67,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, const char
}
/* retrieve the sm to apply the nocase against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("nocase needs "
"preceding content option");

2
src/detect-offset.c
Unescape Escape View File

@ -56,7 +56,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *offset
const char *str = offsetstr;
/* retrieve the sm to apply the offset against */
SigMatch *pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("offset needs preceding content option.");
return -1;

2
src/detect-parse.c
Unescape Escape View File

@ -560,7 +560,7 @@ SigMatch *DetectGetLastSMFromMpmLists(const DetectEngineCtx *de_ctx, const Signa
*
* \retval Pointer to Last sm.
*/
SigMatch *DetectGetLastSMFromLists(const Signature *s, ...)
SigMatch *SCDetectGetLastSMFromLists(const Signature *s, ...)
{
SigMatch *sm_last = NULL;
SigMatch *sm_new;

2
src/detect-parse.h
Unescape Escape View File

@ -79,7 +79,7 @@ void SigTableApplyStrictCommandLineOption(const char *str);
SigMatch *DetectGetLastSM(const Signature *);
SigMatch *DetectGetLastSMFromMpmLists(const DetectEngineCtx *de_ctx, const Signature *s);
SigMatch *DetectGetLastSMFromLists(const Signature *s, ...);
SigMatch *SCDetectGetLastSMFromLists(const Signature *s, ...);
SigMatch *DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list, ...);
SigMatch *DetectGetLastSMByListId(const Signature *s, int list_id, ...);

2
src/detect-smb-version.c
Unescape Escape View File

@ -74,7 +74,7 @@ static int DetectSmbVersionSetup(DetectEngineCtx *de_ctx, Signature *s, const ch
return -1;
}
if (DetectGetLastSMFromLists(s, DETECT_SMB_VERSION, -1)) {
if (SCDetectGetLastSMFromLists(s, DETECT_SMB_VERSION, -1)) {
SCLogError("Can't use 2 or more smb.version declarations in "
"the same sig. Invalidating signature.");
return -1;

2
src/detect-threshold.c
Unescape Escape View File

@ -291,7 +291,7 @@ static int DetectThresholdSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
SigMatch *tmpm = NULL;
/* checks if there is a previous instance of detection_filter */
tmpm = DetectGetLastSMFromLists(s, DETECT_THRESHOLD, DETECT_DETECTION_FILTER, -1);
tmpm = SCDetectGetLastSMFromLists(s, DETECT_THRESHOLD, DETECT_DETECTION_FILTER, -1);
if (tmpm != NULL) {
if (tmpm->type == DETECT_DETECTION_FILTER) {
SCLogError("\"detection_filter\" and "

2
src/detect-within.c
Unescape Escape View File

@ -73,7 +73,7 @@ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *
const char *str = withinstr;
/* retrieve the sm to apply the within against */
SigMatch *pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("within needs preceding content option");
return -1;

Write Preview
Loading…
Cancel
Save