*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn tolower_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_TOLOWER_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_TOLOWER_ID, ptr::null_mut());
}
fn tolower_transform_do(input: &[u8], output: &mut [u8]) {
unsafe extern "C" fn toupper_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_TOUPPER_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_TOUPPER_ID, ptr::null_mut());
}
fn toupper_transform_do(input: &[u8], output: &mut [u8]) {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn compress_whitespace_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_COMPRESS_WHITESPACE_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_COMPRESS_WHITESPACE_ID, ptr::null_mut());
}
fn compress_whitespace_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn domain_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_DOMAIN_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_DOMAIN_ID, ptr::null_mut());
}
fn get_domain(input: &[u8], output: &mut [u8]) -> u32 {
unsafe extern "C" fn tld_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_TLD_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_TLD_ID, ptr::null_mut());
}
fn get_tld(input: &[u8], output: &mut [u8]) -> u32 {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn dot_prefix_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_DOT_PREFIX_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_DOT_PREFIX_ID, ptr::null_mut());
}
fn dot_prefix_transform_do(input: &[u8], output: &mut [u8]) {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use crate::ffi::hashing::{G_DISABLE_HASHING, SC_SHA1_LEN, SC_SHA256_LEN};
SCLogError!("MD5 hashing has been disabled, needed for to_md5 keyword");
return -1;
}
- return DetectSignatureAddTransform(s, G_TRANSFORM_MD5_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_MD5_ID, ptr::null_mut());
}
fn md5_transform_do(input: &[u8], output: &mut [u8]) {
SCLogError!("SHA1 hashing has been disabled, needed for to_sha1 keyword");
return -1;
}
- return DetectSignatureAddTransform(s, G_TRANSFORM_SHA1_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_SHA1_ID, ptr::null_mut());
}
fn sha1_transform_do(input: &[u8], output: &mut [u8]) {
SCLogError!("SHA256 hashing has been disabled, needed for to_sha256 keyword");
return -1;
}
- return DetectSignatureAddTransform(s, G_TRANSFORM_SHA256_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_SHA256_ID, ptr::null_mut());
}
fn sha256_transform_do(input: &[u8], output: &mut [u8]) {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn header_lowersetup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_HEADER_LOWER_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_HEADER_LOWER_ID, ptr::null_mut());
}
fn header_lowertransform_do(input: &[u8], output: &mut [u8]) {
unsafe extern "C" fn strip_pseudo_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_STRIP_PSEUDO_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_STRIP_PSEUDO_ID, ptr::null_mut());
}
fn strip_pseudo_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
//! Module for transforms
-use std::os::raw::{c_int, c_void};
-
-use suricata_sys::sys::{InspectionBuffer, SCTransformTableElmt, Signature};
+use suricata_sys::sys::InspectionBuffer;
pub mod casechange;
pub mod compress_whitespace;
/// cbindgen:ignore
extern "C" {
- pub fn DetectSignatureAddTransform(
- s: *mut Signature, transform_id: c_int, ctx: *mut c_void,
- ) -> c_int;
pub fn InspectionBufferPtr(buf: *const InspectionBuffer) -> *const u8;
pub fn InspectionBufferLength(buf: *const InspectionBuffer) -> u32;
pub fn InspectionBufferCopy(ibuf: *const InspectionBuffer, buf: *const u8, buf_len: u32);
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn strip_whitespace_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_STRIP_WHITESPACE_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_STRIP_WHITESPACE_ID, ptr::null_mut());
}
fn strip_whitespace_transform_do(input: &[u8], output: &mut [u8]) -> u32 {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_NOOPT;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::os::raw::{c_int, c_void};
unsafe extern "C" fn url_decode_setup(
_de: *mut DetectEngineCtx, s: *mut Signature, _opt: *const std::os::raw::c_char,
) -> c_int {
- return DetectSignatureAddTransform(s, G_TRANSFORM_URL_DECODE_ID, ptr::null_mut());
+ return SCDetectSignatureAddTransform(s, G_TRANSFORM_URL_DECODE_ID, ptr::null_mut());
}
fn hex_value(i: u8) -> Option<u8> {
*/
use super::{
- DetectSignatureAddTransform, InspectionBufferCheckAndExpand, InspectionBufferLength,
- InspectionBufferPtr, InspectionBufferTruncate, SCTransformTableElmt,
+ InspectionBufferCheckAndExpand, InspectionBufferLength, InspectionBufferPtr,
+ InspectionBufferTruncate,
};
use crate::detect::SIGMATCH_QUOTES_MANDATORY;
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, InspectionBuffer, SCDetectHelperTransformRegister,
- Signature,
+ SCDetectSignatureAddTransform, SCTransformTableElmt, Signature,
};
use std::ffi::CStr;
if ctx.is_null() {
return -1;
}
- let r = DetectSignatureAddTransform(s, G_TRANSFORM_XOR_ID, ctx);
+ let r = SCDetectSignatureAddTransform(s, G_TRANSFORM_XOR_ID, ctx);
if r != 0 {
xor_free(de, ctx);
}
de_ctx: *mut DetectEngineCtx, s: *mut Signature, list: ::std::os::raw::c_int,
) -> ::std::os::raw::c_int;
}
+extern "C" {
+ pub fn SCDetectSignatureAddTransform(
+ s: *mut Signature, transform: ::std::os::raw::c_int, options: *mut ::std::os::raw::c_void,
+ ) -> ::std::os::raw::c_int;
+}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct Flow_ {
}
return last;
}
+
+int SCDetectSignatureAddTransform(Signature *s, int transform, void *options)
+{
+ /* we only support buffers */
+ if (s->init_data->list == 0) {
+ SCReturnInt(-1);
+ }
+ if (!s->init_data->list_set) {
+ SCLogError("transforms must directly follow stickybuffers");
+ SCReturnInt(-1);
+ }
+ if (s->init_data->transforms.cnt >= DETECT_TRANSFORMS_MAX) {
+ SCReturnInt(-1);
+ }
+
+ s->init_data->transforms.transforms[s->init_data->transforms.cnt].transform = transform;
+ s->init_data->transforms.transforms[s->init_data->transforms.cnt].options = options;
+
+ s->init_data->transforms.cnt++;
+ SCLogDebug("Added transform #%d [%s]", s->init_data->transforms.cnt, s->sig_str);
+
+ SCReturnInt(0);
+}
int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s);
SigMatch *DetectBufferGetFirstSigMatch(const Signature *s, const uint32_t buf_id);
SigMatch *DetectBufferGetLastSigMatch(const Signature *s, const uint32_t buf_id);
+int SCDetectSignatureAddTransform(Signature *s, int transform, void *options);
#endif /* SURICATA_DETECT_ENGINE_BUFFER_H */
SCFree(s);
}
-int DetectSignatureAddTransform(Signature *s, int transform, void *options)
-{
- /* we only support buffers */
- if (s->init_data->list == 0) {
- SCReturnInt(-1);
- }
- if (!s->init_data->list_set) {
- SCLogError("transforms must directly follow stickybuffers");
- SCReturnInt(-1);
- }
- if (s->init_data->transforms.cnt >= DETECT_TRANSFORMS_MAX) {
- SCReturnInt(-1);
- }
-
- s->init_data->transforms.transforms[s->init_data->transforms.cnt].transform = transform;
- s->init_data->transforms.transforms[s->init_data->transforms.cnt].options = options;
-
- s->init_data->transforms.cnt++;
- SCLogDebug("Added transform #%d [%s]",
- s->init_data->transforms.cnt,
- s->sig_str);
-
- SCReturnInt(0);
-}
-
/**
* \brief this function is used to set multiple possible app-layer protos
* \brief into the current signature (for example ja4 for both tls and quic)
SigMatch *DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list, ...);
SigMatch *DetectGetLastSMByListId(const Signature *s, int list_id, ...);
-int DetectSignatureAddTransform(Signature *s, int transform, void *options);
int WARN_UNUSED DetectSignatureSetAppProto(Signature *s, AppProto alproto);
int WARN_UNUSED DetectSignatureSetMultiAppProto(Signature *s, const AppProto *alprotos);
#include "suricata-common.h"
#include "detect.h"
-#include "detect-parse.h"
#include "detect-engine.h"
+#include "detect-engine-buffer.h"
#include "detect-byte.h"
#include "rust.h"
goto exit_path;
}
- r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_FROM_BASE64, b64d);
+ r = SCDetectSignatureAddTransform(s, DETECT_TRANSFORM_FROM_BASE64, b64d);
exit_path:
if (r != 0)
#include "detect.h"
#include "detect-engine.h"
-#include "detect-parse.h"
+#include "detect-engine-buffer.h"
#include "detect-transform-pcrexform.h"
#include "detect-pcre.h"
SCReturnInt(-1);
}
- int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_PCREXFORM, pxd);
+ int r = SCDetectSignatureAddTransform(s, DETECT_TRANSFORM_PCREXFORM, pxd);
if (r != 0) {
DetectTransformPcrexformFree(de_ctx, pxd);
}