sawp crate has its own Direction enum as follows.
pub enum Direction {
ToClient = 0,
ToServer = 1,
Unknown = 2,
}
While it is correct to send this Direction enum as argument to the
sawp_pop3 parser as it expects, it is not correct to use it where the
direction param is obtained from the internal API of Suricata.
The reason is that Suricata's definition of its Direction enum is as
follows.
pub enum Direction {
ToServer = 0x04,
ToClient = 0x08,
}
This can lead to issues like incorrect progress tracking of a transaction in
a direction which could cause inspection on incorrect data and buggy behavior.
use crate::conf::{conf_get, get_memval};
use crate::core::{ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP};
use crate::flow::Flow;
+use crate::direction;
use std;
use std::collections::VecDeque;
use std::ffi::CString;
unsafe extern "C" fn pop3_tx_get_alstate_progress(tx: *mut c_void, direction: u8) -> c_int {
let tx = cast_pointer!(tx, POP3Transaction);
- if direction == Direction::ToServer as u8 {
+ if direction == u8::from(direction::Direction::ToServer) {
(tx.request.is_some() || tx.complete) as c_int
} else {
(tx.response.is_some() || tx.complete) as c_int