rust/nfs: add support for detect_flags API

diff --git a/rust/src/nfs/nfs.rs b/rust/src/nfs/nfs.rs
index 9b18d7d904818561f63208d596217f36d2534288..20b35575e41d98e3af5d48673423b8c2eea58a4e 100644 (file)
--- a/rust/src/nfs/nfs.rs
+++ b/rust/src/nfs/nfs.rs
@@ -171,6 +171,9 @@ pub struct NFSTransaction {
     /// attempt failed.
     pub type_data: Option<NFSTransactionTypeData>,
 
+    detect_flags_ts: u64,
+    detect_flags_tc: u64,
+
     pub logged: LoggerFlags,
     pub de_state: Option<*mut DetectEngineState>,
     pub events: *mut AppLayerDecoderEvents,
@@ -198,6 +201,8 @@ impl NFSTransaction {
             file_tx_direction: 0,
             file_handle:Vec::new(),
             type_data: None,
+            detect_flags_ts: 0,
+            detect_flags_tc: 0,
             logged: LoggerFlags::new(),
             de_state: None,
             events: std::ptr::null_mut(),
@@ -1916,6 +1921,32 @@ pub extern "C" fn rs_nfs3_state_get_tx_detect_state(
     }
 }
 
+#[no_mangle]
+pub extern "C" fn rs_nfs_tx_set_detect_flags(
+                                       tx: &mut NFSTransaction,
+                                       direction: libc::uint8_t,
+                                       flags: libc::uint64_t)
+{
+    if (direction & STREAM_TOSERVER) != 0 {
+        tx.detect_flags_ts = flags as u64;
+    } else {
+        tx.detect_flags_tc = flags as u64;
+    }
+}
+
+#[no_mangle]
+pub extern "C" fn rs_nfs_tx_get_detect_flags(
+                                       tx: &mut NFSTransaction,
+                                       direction: libc::uint8_t)
+                                       -> libc::uint64_t
+{
+    if (direction & STREAM_TOSERVER) != 0 {
+        return tx.detect_flags_ts as libc::uint64_t;
+    } else {
+        return tx.detect_flags_tc as libc::uint64_t;
+    }
+}
+
 #[no_mangle]
 pub extern "C" fn rs_nfs_state_has_events(state: &mut NFSState) -> u8 {
     if state.events > 0 {

diff --git a/src/app-layer-nfs-tcp.c b/src/app-layer-nfs-tcp.c
index 61e007de583124b9cfd903d199c0d11d00849047..1c68dd0b7be04adf6c19f4d96680586f30f1a3e8 100644 (file)
--- a/src/app-layer-nfs-tcp.c
+++ b/src/app-layer-nfs-tcp.c
@@ -242,6 +242,16 @@ static FileContainer *NFSTCPGetFiles(void *state, uint8_t direction)
     return rs_nfs3_getfiles(direction, state);
 }
 
+static void NFSTCPSetDetectFlags(void *tx, uint8_t dir, uint64_t flags)
+{
+    rs_nfs_tx_set_detect_flags(tx, dir, flags);
+}
+
+static uint64_t NFSTCPGetDetectFlags(void *tx, uint8_t dir)
+{
+    return rs_nfs_tx_get_detect_flags(tx, dir);
+}
+
 static StreamingBufferConfig sbcfg = STREAMING_BUFFER_CONFIG_INITIALIZER;
 static SuricataFileContext sfc = { &sbcfg };
 
@@ -342,6 +352,9 @@ void RegisterNFSTCPParsers(void)
         AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_NFS,
                 NFSTCPGetEvents);
 
+        AppLayerParserRegisterDetectFlagsFuncs(IPPROTO_TCP, ALPROTO_NFS,
+                                               NFSTCPGetDetectFlags, NFSTCPSetDetectFlags);
+
         /* This parser accepts gaps. */
         AppLayerParserRegisterOptionFlags(IPPROTO_TCP, ALPROTO_NFS,
                 APP_LAYER_PARSER_OPT_ACCEPT_GAPS);

diff --git a/src/app-layer-nfs-udp.c b/src/app-layer-nfs-udp.c
index 74d581c88a19b83af4893088f0c1fcc4b4bae9ab..71a836c86964a22858436f2bad3610653ae6a359 100644 (file)
--- a/src/app-layer-nfs-udp.c
+++ b/src/app-layer-nfs-udp.c
@@ -247,6 +247,16 @@ static FileContainer *NFSGetFiles(void *state, uint8_t direction)
     return rs_nfs3_getfiles(direction, state);
 }
 
+static void NFSSetDetectFlags(void *tx, uint8_t dir, uint64_t flags)
+{
+    rs_nfs_tx_set_detect_flags(tx, dir, flags);
+}
+
+static uint64_t NFSGetDetectFlags(void *tx, uint8_t dir)
+{
+    return rs_nfs_tx_get_detect_flags(tx, dir);
+}
+
 static StreamingBufferConfig sbcfg = STREAMING_BUFFER_CONFIG_INITIALIZER;
 static SuricataFileContext sfc = { &sbcfg };
 
@@ -346,6 +356,10 @@ void RegisterNFSUDPParsers(void)
             NFSStateGetEventInfo);
         AppLayerParserRegisterGetEventsFunc(IPPROTO_UDP, ALPROTO_NFS,
             NFSGetEvents);
+
+        AppLayerParserRegisterDetectFlagsFuncs(IPPROTO_UDP, ALPROTO_NFS,
+                                               NFSGetDetectFlags, NFSSetDetectFlags);
+
     }
     else {
         SCLogNotice("NFS protocol parsing disabled.");