}
#[no_mangle]
-pub unsafe extern "C" fn rs_detect_u64_free(ctx: *mut std::os::raw::c_void) {
+pub unsafe extern "C" fn rs_detect_u64_free(ctx: &mut DetectUintData<u64>) {
// Just unbox...
- std::mem::drop(Box::from_raw(ctx as *mut DetectUintData<u64>));
+ std::mem::drop(Box::from_raw(ctx));
}
#[no_mangle]
*/
use super::dhcp::{
- DHCPTransaction, DHCP_OPT_ADDRESS_TIME, DHCP_OPT_REBINDING_TIME, DHCP_OPT_RENEWAL_TIME,
+ DHCPTransaction, ALPROTO_DHCP, DHCP_OPT_ADDRESS_TIME, DHCP_OPT_REBINDING_TIME,
+ DHCP_OPT_RENEWAL_TIME,
};
use super::parser::DHCPOptionWrapper;
+use crate::detect::uint::{
+ rs_detect_u64_free, rs_detect_u64_match, rs_detect_u64_parse, DetectUintData,
+};
+use crate::detect::{
+ DetectHelperBufferRegister, DetectHelperKeywordRegister, DetectSignatureSetAppProto,
+ SCSigTableElmt, SigMatchAppendSMToList,
+};
+use std::os::raw::{c_int, c_void};
-#[no_mangle]
-pub unsafe extern "C" fn rs_dhcp_tx_get_leasetime(
- tx: &mut DHCPTransaction, leasetime: *mut u64,
-) -> u8 {
+fn rs_dhcp_tx_get_time(tx: &DHCPTransaction, code: u8) -> Option<u64> {
for option in &tx.message.options {
- if option.code == DHCP_OPT_ADDRESS_TIME {
+ if option.code == code {
if let DHCPOptionWrapper::TimeValue(ref time_value) = option.option {
- *leasetime = time_value.seconds as u64;
- return 1;
+ return Some(time_value.seconds as u64);
}
}
}
+ return None;
+}
+
+static mut G_DHCP_LEASE_TIME_KW_ID: c_int = 0;
+static mut G_DHCP_LEASE_TIME_BUFFER_ID: c_int = 0;
+static mut G_DHCP_REBINDING_TIME_KW_ID: c_int = 0;
+static mut G_DHCP_REBINDING_TIME_BUFFER_ID: c_int = 0;
+static mut G_DHCP_RENEWAL_TIME_KW_ID: c_int = 0;
+static mut G_DHCP_RENEWAL_TIME_BUFFER_ID: c_int = 0;
+
+unsafe extern "C" fn dhcp_detect_leasetime_setup(
+ de: *mut c_void, s: *mut c_void, raw: *const libc::c_char,
+) -> c_int {
+ if DetectSignatureSetAppProto(s, ALPROTO_DHCP) != 0 {
+ return -1;
+ }
+ let ctx = rs_detect_u64_parse(raw) as *mut c_void;
+ if ctx.is_null() {
+ return -1;
+ }
+ if SigMatchAppendSMToList(
+ de,
+ s,
+ G_DHCP_LEASE_TIME_KW_ID,
+ ctx,
+ G_DHCP_LEASE_TIME_BUFFER_ID,
+ )
+ .is_null()
+ {
+ dhcp_detect_time_free(std::ptr::null_mut(), ctx);
+ return -1;
+ }
return 0;
}
-#[no_mangle]
-pub unsafe extern "C" fn rs_dhcp_tx_get_rebinding_time(
- tx: &mut DHCPTransaction, res: *mut u64,
-) -> u8 {
- for option in &tx.message.options {
- if option.code == DHCP_OPT_REBINDING_TIME {
- if let DHCPOptionWrapper::TimeValue(ref time_value) = option.option {
- *res = time_value.seconds as u64;
- return 1;
- }
- }
+unsafe extern "C" fn dhcp_detect_leasetime_match(
+ _de: *mut c_void, _f: *mut c_void, _flags: u8, _state: *mut c_void, tx: *mut c_void,
+ _sig: *const c_void, ctx: *const c_void,
+) -> c_int {
+ let tx = cast_pointer!(tx, DHCPTransaction);
+ let ctx = cast_pointer!(ctx, DetectUintData<u64>);
+ if let Some(val) = rs_dhcp_tx_get_time(tx, DHCP_OPT_ADDRESS_TIME) {
+ return rs_detect_u64_match(val, ctx);
}
return 0;
}
-#[no_mangle]
-pub unsafe extern "C" fn rs_dhcp_tx_get_renewal_time(
- tx: &mut DHCPTransaction, res: *mut u64,
-) -> u8 {
- for option in &tx.message.options {
- if option.code == DHCP_OPT_RENEWAL_TIME {
- if let DHCPOptionWrapper::TimeValue(ref time_value) = option.option {
- *res = time_value.seconds as u64;
- return 1;
- }
- }
+unsafe extern "C" fn dhcp_detect_time_free(_de: *mut c_void, ctx: *mut c_void) {
+ // Just unbox...
+ let ctx = cast_pointer!(ctx, DetectUintData<u64>);
+ rs_detect_u64_free(ctx);
+}
+
+unsafe extern "C" fn dhcp_detect_rebindingtime_setup(
+ de: *mut c_void, s: *mut c_void, raw: *const libc::c_char,
+) -> c_int {
+ if DetectSignatureSetAppProto(s, ALPROTO_DHCP) != 0 {
+ return -1;
+ }
+ let ctx = rs_detect_u64_parse(raw) as *mut c_void;
+ if ctx.is_null() {
+ return -1;
+ }
+ if SigMatchAppendSMToList(
+ de,
+ s,
+ G_DHCP_REBINDING_TIME_KW_ID,
+ ctx,
+ G_DHCP_REBINDING_TIME_BUFFER_ID,
+ )
+ .is_null()
+ {
+ dhcp_detect_time_free(std::ptr::null_mut(), ctx);
+ return -1;
+ }
+ return 0;
+}
+
+unsafe extern "C" fn dhcp_detect_rebindingtime_match(
+ _de: *mut c_void, _f: *mut c_void, _flags: u8, _state: *mut c_void, tx: *mut c_void,
+ _sig: *const c_void, ctx: *const c_void,
+) -> c_int {
+ let tx = cast_pointer!(tx, DHCPTransaction);
+ let ctx = cast_pointer!(ctx, DetectUintData<u64>);
+ if let Some(val) = rs_dhcp_tx_get_time(tx, DHCP_OPT_REBINDING_TIME) {
+ return rs_detect_u64_match(val, ctx);
+ }
+ return 0;
+}
+
+unsafe extern "C" fn dhcp_detect_renewaltime_setup(
+ de: *mut c_void, s: *mut c_void, raw: *const libc::c_char,
+) -> c_int {
+ if DetectSignatureSetAppProto(s, ALPROTO_DHCP) != 0 {
+ return -1;
+ }
+ let ctx = rs_detect_u64_parse(raw) as *mut c_void;
+ if ctx.is_null() {
+ return -1;
+ }
+ if SigMatchAppendSMToList(
+ de,
+ s,
+ G_DHCP_RENEWAL_TIME_KW_ID,
+ ctx,
+ G_DHCP_RENEWAL_TIME_BUFFER_ID,
+ )
+ .is_null()
+ {
+ dhcp_detect_time_free(std::ptr::null_mut(), ctx);
+ return -1;
}
return 0;
}
+
+unsafe extern "C" fn dhcp_detect_renewaltime_match(
+ _de: *mut c_void, _f: *mut c_void, _flags: u8, _state: *mut c_void, tx: *mut c_void,
+ _sig: *const c_void, ctx: *const c_void,
+) -> c_int {
+ let tx = cast_pointer!(tx, DHCPTransaction);
+ let ctx = cast_pointer!(ctx, DetectUintData<u64>);
+ if let Some(val) = rs_dhcp_tx_get_time(tx, DHCP_OPT_RENEWAL_TIME) {
+ return rs_detect_u64_match(val, ctx);
+ }
+ return 0;
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn ScDetectDHCPRegister() {
+ let kw = SCSigTableElmt {
+ name: b"dhcp.leasetime\0".as_ptr() as *const libc::c_char,
+ desc: b"match DHCP leasetime\0".as_ptr() as *const libc::c_char,
+ url: b"/rules/dhcp-keywords.html#dhcp-leasetime\0".as_ptr() as *const libc::c_char,
+ AppLayerTxMatch: Some(dhcp_detect_leasetime_match),
+ Setup: dhcp_detect_leasetime_setup,
+ Free: Some(dhcp_detect_time_free),
+ flags: 0,
+ };
+ unsafe {
+ G_DHCP_LEASE_TIME_KW_ID = DetectHelperKeywordRegister(&kw);
+ G_DHCP_LEASE_TIME_BUFFER_ID = DetectHelperBufferRegister(
+ b"dhcp.leasetime\0".as_ptr() as *const libc::c_char,
+ ALPROTO_DHCP,
+ true,
+ true,
+ );
+ }
+ let kw = SCSigTableElmt {
+ name: b"dhcp.rebinding_time\0".as_ptr() as *const libc::c_char,
+ desc: b"match DHCP rebinding time\0".as_ptr() as *const libc::c_char,
+ url: b"/rules/dhcp-keywords.html#dhcp-rebinding-time\0".as_ptr() as *const libc::c_char,
+ AppLayerTxMatch: Some(dhcp_detect_rebindingtime_match),
+ Setup: dhcp_detect_rebindingtime_setup,
+ Free: Some(dhcp_detect_time_free),
+ flags: 0,
+ };
+ unsafe {
+ G_DHCP_REBINDING_TIME_KW_ID = DetectHelperKeywordRegister(&kw);
+ G_DHCP_REBINDING_TIME_BUFFER_ID = DetectHelperBufferRegister(
+ b"dhcp.rebinding-time\0".as_ptr() as *const libc::c_char,
+ ALPROTO_DHCP,
+ true,
+ true,
+ );
+ }
+ let kw = SCSigTableElmt {
+ name: b"dhcp.renewal_time\0".as_ptr() as *const libc::c_char,
+ desc: b"match DHCP renewal time\0".as_ptr() as *const libc::c_char,
+ url: b"/rules/dhcp-keywords.html#dhcp-renewal-time\0".as_ptr() as *const libc::c_char,
+ AppLayerTxMatch: Some(dhcp_detect_renewaltime_match),
+ Setup: dhcp_detect_renewaltime_setup,
+ Free: Some(dhcp_detect_time_free),
+ flags: 0,
+ };
+ unsafe {
+ G_DHCP_RENEWAL_TIME_KW_ID = DetectHelperKeywordRegister(&kw);
+ G_DHCP_RENEWAL_TIME_BUFFER_ID = DetectHelperBufferRegister(
+ b"dhcp.renewal-time\0".as_ptr() as *const libc::c_char,
+ ALPROTO_DHCP,
+ true,
+ true,
+ );
+ }
+}
use std;
use std::ffi::CString;
-static mut ALPROTO_DHCP: AppProto = ALPROTO_UNKNOWN;
+pub(super) static mut ALPROTO_DHCP: AppProto = ALPROTO_UNKNOWN;
static DHCP_MIN_FRAME_LEN: u32 = 232;
detect-smb-ntlmssp.h \
detect-smb-share.h \
detect-smb-version.h \
- detect-dhcp-leasetime.h \
- detect-dhcp-rebinding-time.h \
- detect-dhcp-renewal-time.h \
detect-ssh-hassh.h \
detect-ssh-hassh-server.h \
detect-ssh-hassh-server-string.h \
detect-smb-ntlmssp.c \
detect-smb-share.c \
detect-smb-version.c \
- detect-dhcp-leasetime.c \
- detect-dhcp-rebinding-time.c \
- detect-dhcp-renewal-time.c \
detect-ssh-hassh.c \
detect-ssh-hassh-server.c \
detect-ssh-hassh-server-string.c \
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-#include "suricata-common.h"
-#include "rust.h"
-#include "detect-dhcp-leasetime.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-uint.h"
-#include "detect-parse.h"
-
-static int g_buffer_id = 0;
-
-/**
- * \internal
- * \brief Function to match leasetime of a TX
- *
- * \param t Pointer to thread vars.
- * \param det_ctx Pointer to the pattern matcher thread.
- * \param f Pointer to the current flow.
- * \param flags Flags.
- * \param state App layer state.
- * \param s Pointer to the Signature.
- * \param m Pointer to the sigmatch that we will cast into
- * DetectU64Data.
- *
- * \retval 0 no match.
- * \retval 1 match.
- */
-static int DetectDHCPLeaseTimeMatch(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags,
- void *state, void *txv, const Signature *s, const SigMatchCtx *ctx)
-{
- SCEnter();
-
- uint64_t leasetime;
- if (rs_dhcp_tx_get_leasetime(txv, &leasetime)) {
- const DetectU64Data *dd = (const DetectU64Data *)ctx;
- if (DetectU64Match(leasetime, dd)) {
- SCReturnInt(1);
- }
- }
- SCReturnInt(0);
-}
-
-/**
- * \internal
- * \brief Function to free memory associated with DetectU64Data.
- *
- * \param de_ptr Pointer to DetectU64Data.
- */
-static void DetectDHCPLeaseTimeFree(DetectEngineCtx *de_ctx, void *ptr)
-{
- rs_detect_u64_free(ptr);
-}
-
-/**
- * \brief Function to add the parsed dhcp leasetime field into the current signature.
- *
- * \param de_ctx Pointer to the Detection Engine Context.
- * \param s Pointer to the Current Signature.
- * \param rawstr Pointer to the user provided flags options.
- * \param type Defines if this is notBefore or notAfter.
- *
- * \retval 0 on Success.
- * \retval -1 on Failure.
- */
-static int DetectDHCPLeaseTimeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
-{
- if (DetectSignatureSetAppProto(s, ALPROTO_DHCP) != 0)
- return -1;
-
- DetectU64Data *dd = DetectU64Parse(rawstr);
- if (dd == NULL) {
- SCLogError("Parsing \'%s\' failed for %s", rawstr,
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].name);
- return -1;
- }
-
- /* okay so far so good, lets get this into a SigMatch
- * and put it in the Signature. */
-
- if (SigMatchAppendSMToList(
- de_ctx, s, DETECT_AL_DHCP_LEASETIME, (SigMatchCtx *)dd, g_buffer_id) == NULL) {
- goto error;
- }
- return 0;
-
-error:
- DetectDHCPLeaseTimeFree(de_ctx, dd);
- return -1;
-}
-
-/**
- * \brief Registration function for dhcp.procedure keyword.
- */
-void DetectDHCPLeaseTimeRegister(void)
-{
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].name = "dhcp.leasetime";
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].desc = "match DHCP leasetime";
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].url = "/rules/dhcp-keywords.html#dhcp-leasetime";
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].AppLayerTxMatch = DetectDHCPLeaseTimeMatch;
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].Setup = DetectDHCPLeaseTimeSetup;
- sigmatch_table[DETECT_AL_DHCP_LEASETIME].Free = DetectDHCPLeaseTimeFree;
-
- DetectAppLayerInspectEngineRegister("dhcp.leasetime", ALPROTO_DHCP, SIG_FLAG_TOSERVER, 0,
- DetectEngineInspectGenericList, NULL);
-
- DetectAppLayerInspectEngineRegister("dhcp.leasetime", ALPROTO_DHCP, SIG_FLAG_TOCLIENT, 0,
- DetectEngineInspectGenericList, NULL);
-
- g_buffer_id = DetectBufferTypeGetByName("dhcp.leasetime");
-}
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-#ifndef SURICATA_DETECT_DHCP_LEASETIME_H
-#define SURICATA_DETECT_DHCP_LEASETIME_H
-
-void DetectDHCPLeaseTimeRegister(void);
-
-#endif /* SURICATA_DETECT_DHCP_LEASETIME_H */
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-#include "suricata-common.h"
-#include "rust.h"
-#include "detect-dhcp-rebinding-time.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-uint.h"
-#include "detect-parse.h"
-
-static int g_buffer_id = 0;
-
-/**
- * \internal
- * \brief Function to match rebinding time of a TX
- *
- * \param t Pointer to thread vars.
- * \param det_ctx Pointer to the pattern matcher thread.
- * \param f Pointer to the current flow.
- * \param flags Flags.
- * \param state App layer state.
- * \param s Pointer to the Signature.
- * \param m Pointer to the sigmatch that we will cast into
- * DetectU64Data.
- *
- * \retval 0 no match.
- * \retval 1 match.
- */
-static int DetectDHCPRebindingTimeMatch(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags,
- void *state, void *txv, const Signature *s, const SigMatchCtx *ctx)
-{
- SCEnter();
-
- uint64_t res;
- if (rs_dhcp_tx_get_rebinding_time(txv, &res)) {
- const DetectU64Data *dd = (const DetectU64Data *)ctx;
- if (DetectU64Match(res, dd)) {
- SCReturnInt(1);
- }
- }
- SCReturnInt(0);
-}
-
-/**
- * \internal
- * \brief Function to free memory associated with DetectU64Data.
- *
- * \param de_ptr Pointer to DetectU64Data.
- */
-static void DetectDHCPRebindingTimeFree(DetectEngineCtx *de_ctx, void *ptr)
-{
- rs_detect_u64_free(ptr);
-}
-
-/**
- * \brief Function to add the parsed dhcp rebinding time field into the current signature.
- *
- * \param de_ctx Pointer to the Detection Engine Context.
- * \param s Pointer to the Current Signature.
- * \param rawstr Pointer to the user provided flags options.
- * \param type Defines if this is notBefore or notAfter.
- *
- * \retval 0 on Success.
- * \retval -1 on Failure.
- */
-static int DetectDHCPRebindingTimeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
-{
- if (DetectSignatureSetAppProto(s, ALPROTO_DHCP) != 0)
- return -1;
-
- DetectU64Data *dd = DetectU64Parse(rawstr);
- if (dd == NULL) {
- SCLogError("Parsing \'%s\' failed for %s", rawstr,
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].name);
- return -1;
- }
-
- /* okay so far so good, lets get this into a SigMatch
- * and put it in the Signature. */
-
- if (SigMatchAppendSMToList(
- de_ctx, s, DETECT_AL_DHCP_REBINDING_TIME, (SigMatchCtx *)dd, g_buffer_id) == NULL) {
- goto error;
- }
- return 0;
-
-error:
- DetectDHCPRebindingTimeFree(de_ctx, dd);
- return -1;
-}
-
-/**
- * \brief Registration function for dhcp.procedure keyword.
- */
-void DetectDHCPRebindingTimeRegister(void)
-{
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].name = "dhcp.rebinding_time";
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].desc = "match DHCP rebinding time";
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].url =
- "/rules/dhcp-keywords.html#dhcp-rebinding-time";
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].AppLayerTxMatch = DetectDHCPRebindingTimeMatch;
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].Setup = DetectDHCPRebindingTimeSetup;
- sigmatch_table[DETECT_AL_DHCP_REBINDING_TIME].Free = DetectDHCPRebindingTimeFree;
-
- DetectAppLayerInspectEngineRegister("dhcp.rebinding-time", ALPROTO_DHCP, SIG_FLAG_TOSERVER, 0,
- DetectEngineInspectGenericList, NULL);
-
- DetectAppLayerInspectEngineRegister("dhcp.rebinding-time", ALPROTO_DHCP, SIG_FLAG_TOCLIENT, 0,
- DetectEngineInspectGenericList, NULL);
-
- g_buffer_id = DetectBufferTypeGetByName("dhcp.rebinding-time");
-}
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-#ifndef SURICATA_DETECT_DHCP_REBINDING_TIME_H
-#define SURICATA_DETECT_DHCP_REBINDING_TIME_H
-
-void DetectDHCPRebindingTimeRegister(void);
-
-#endif /* SURICATA_DETECT_DHCP_REBINDING_TIME_H */
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-#include "suricata-common.h"
-#include "rust.h"
-#include "detect-dhcp-renewal-time.h"
-#include "detect-engine.h"
-#include "detect-engine-mpm.h"
-#include "detect-engine-prefilter.h"
-#include "detect-engine-uint.h"
-#include "detect-parse.h"
-
-static int g_buffer_id = 0;
-
-/**
- * \internal
- * \brief Function to match renewal time of a TX
- *
- * \param t Pointer to thread vars.
- * \param det_ctx Pointer to the pattern matcher thread.
- * \param f Pointer to the current flow.
- * \param flags Flags.
- * \param state App layer state.
- * \param s Pointer to the Signature.
- * \param m Pointer to the sigmatch that we will cast into
- * DetectU64Data.
- *
- * \retval 0 no match.
- * \retval 1 match.
- */
-static int DetectDHCPRenewalTimeMatch(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags,
- void *state, void *txv, const Signature *s, const SigMatchCtx *ctx)
-{
- SCEnter();
-
- uint64_t res;
- if (rs_dhcp_tx_get_renewal_time(txv, &res)) {
- const DetectU64Data *dd = (const DetectU64Data *)ctx;
- if (DetectU64Match(res, dd)) {
- SCReturnInt(1);
- }
- }
- SCReturnInt(0);
-}
-
-/**
- * \internal
- * \brief Function to free memory associated with DetectU64Data.
- *
- * \param de_ptr Pointer to DetectU64Data.
- */
-static void DetectDHCPRenewalTimeFree(DetectEngineCtx *de_ctx, void *ptr)
-{
- rs_detect_u64_free(ptr);
-}
-
-/**
- * \brief Function to add the parsed dhcp renewal time field into the current signature.
- *
- * \param de_ctx Pointer to the Detection Engine Context.
- * \param s Pointer to the Current Signature.
- * \param rawstr Pointer to the user provided flags options.
- * \param type Defines if this is notBefore or notAfter.
- *
- * \retval 0 on Success.
- * \retval -1 on Failure.
- */
-static int DetectDHCPRenewalTimeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *rawstr)
-{
- if (DetectSignatureSetAppProto(s, ALPROTO_DHCP) != 0)
- return -1;
-
- DetectU64Data *dd = DetectU64Parse(rawstr);
- if (dd == NULL) {
- SCLogError("Parsing \'%s\' failed for %s", rawstr,
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].name);
- return -1;
- }
-
- /* okay so far so good, lets get this into a SigMatch
- * and put it in the Signature. */
-
- if (SigMatchAppendSMToList(
- de_ctx, s, DETECT_AL_DHCP_RENEWAL_TIME, (SigMatchCtx *)dd, g_buffer_id) == NULL) {
- goto error;
- }
- return 0;
-
-error:
- DetectDHCPRenewalTimeFree(de_ctx, dd);
- return -1;
-}
-
-/**
- * \brief Registration function for dhcp.procedure keyword.
- */
-void DetectDHCPRenewalTimeRegister(void)
-{
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].name = "dhcp.renewal_time";
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].desc = "match DHCP renewal time";
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].url = "/rules/dhcp-keywords.html#dhcp-renewal-time";
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].AppLayerTxMatch = DetectDHCPRenewalTimeMatch;
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].Setup = DetectDHCPRenewalTimeSetup;
- sigmatch_table[DETECT_AL_DHCP_RENEWAL_TIME].Free = DetectDHCPRenewalTimeFree;
-
- DetectAppLayerInspectEngineRegister("dhcp.renewal-time", ALPROTO_DHCP, SIG_FLAG_TOSERVER, 0,
- DetectEngineInspectGenericList, NULL);
-
- DetectAppLayerInspectEngineRegister("dhcp.renewal-time", ALPROTO_DHCP, SIG_FLAG_TOCLIENT, 0,
- DetectEngineInspectGenericList, NULL);
-
- g_buffer_id = DetectBufferTypeGetByName("dhcp.renewal-time");
-}
+++ /dev/null
-/* Copyright (C) 2022 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-#ifndef SURICATA_DETECT_DHCP_RENEWAL_TIME_H
-#define SURICATA_DETECT_DHCP_RENEWAL_TIME_H
-
-void DetectDHCPRenewalTimeRegister(void);
-
-#endif /* SURICATA_DETECT_DHCP_RENEWAL_TIME_H */
#include "detect-rfb-name.h"
#include "detect-target.h"
#include "detect-template-rust-buffer.h"
-#include "detect-dhcp-leasetime.h"
-#include "detect-dhcp-rebinding-time.h"
-#include "detect-dhcp-renewal-time.h"
#include "detect-mqtt-type.h"
#include "detect-mqtt-flags.h"
#include "detect-mqtt-qos.h"
DetectRfbNameRegister();
DetectTargetRegister();
DetectTemplateRustBufferRegister();
- DetectDHCPLeaseTimeRegister();
- DetectDHCPRebindingTimeRegister();
- DetectDHCPRenewalTimeRegister();
DetectMQTTTypeRegister();
DetectMQTTFlagsRegister();
DetectMQTTQosRegister();
DetectFileHandlerRegister();
ScDetectSNMPRegister();
+ ScDetectDHCPRegister();
/* close keyword registration */
DetectBufferTypeCloseRegistration();
DETECT_FTPDATA,
DETECT_TARGET,
DETECT_AL_TEMPLATE_BUFFER,
- DETECT_AL_DHCP_LEASETIME,
- DETECT_AL_DHCP_REBINDING_TIME,
- DETECT_AL_DHCP_RENEWAL_TIME,
DETECT_AL_MQTT_TYPE,
DETECT_AL_MQTT_FLAGS,
DETECT_AL_MQTT_QOS,
projects / thirdparty / suricata.git / commitdiff
