/src/suricata8/rust/src/quic/detect.rs
Line | Count | Source |
1 | | /* Copyright (C) 2021 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER}; |
19 | | use crate::quic::quic::QuicTransaction; |
20 | | use std::os::raw::c_void; |
21 | | use std::ptr; |
22 | | use suricata_sys::sys::DetectEngineThreadCtx; |
23 | | |
24 | | #[no_mangle] |
25 | 0 | pub unsafe extern "C" fn SCQuicTxGetUa( |
26 | 0 | tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, |
27 | 0 | ) -> u8 { |
28 | 0 | if let Some(ua) = &tx.ua { |
29 | 0 | *buffer = ua.as_ptr(); |
30 | 0 | *buffer_len = ua.len() as u32; |
31 | 0 | 1 |
32 | | } else { |
33 | 0 | *buffer = ptr::null(); |
34 | 0 | *buffer_len = 0; |
35 | 0 | 0 |
36 | | } |
37 | 0 | } |
38 | | |
39 | | #[no_mangle] |
40 | 0 | pub unsafe extern "C" fn SCQuicTxGetSni( |
41 | 0 | tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, |
42 | 0 | ) -> u8 { |
43 | 0 | if let Some(sni) = &tx.sni { |
44 | 0 | *buffer = sni.as_ptr(); |
45 | 0 | *buffer_len = sni.len() as u32; |
46 | 0 | 1 |
47 | | } else { |
48 | 0 | *buffer = ptr::null(); |
49 | 0 | *buffer_len = 0; |
50 | 0 | 0 |
51 | | } |
52 | 0 | } |
53 | | |
54 | | #[no_mangle] |
55 | 0 | pub unsafe extern "C" fn SCQuicTxGetJa3( |
56 | 0 | tx: *const c_void, dir: u8, buffer: *mut *const u8, buffer_len: *mut u32, |
57 | 0 | ) -> bool { |
58 | 0 | if tx.is_null() { |
59 | 0 | *buffer = ptr::null(); |
60 | 0 | *buffer_len = 0; |
61 | 0 | return false; |
62 | 0 | } |
63 | 0 | let tx = cast_pointer!(tx, QuicTransaction); |
64 | 0 | if tx.client { |
65 | 0 | if dir & STREAM_TOSERVER == 0 { |
66 | 0 | return false; |
67 | 0 | } |
68 | 0 | } else if dir & STREAM_TOCLIENT == 0 { |
69 | 0 | return false; |
70 | 0 | } |
71 | 0 | if let Some(ja3) = &tx.ja3 { |
72 | 0 | *buffer = ja3.as_ptr(); |
73 | 0 | *buffer_len = ja3.len() as u32; |
74 | 0 | return true; |
75 | 0 | } |
76 | 0 | return false; |
77 | 0 | } |
78 | | |
79 | | #[no_mangle] |
80 | | pub unsafe extern "C" fn SCQuicTxGetJa4( |
81 | | tx: *const c_void, buffer: *mut *const u8, buffer_len: *mut u32, |
82 | | ) -> u8 { |
83 | | if tx.is_null() { |
84 | | *buffer = ptr::null(); |
85 | | *buffer_len = 0; |
86 | | return 0; |
87 | | } |
88 | | let tx = cast_pointer!(tx, QuicTransaction); |
89 | | if let Some(ja4) = &tx.ja4 { |
90 | | *buffer = ja4.as_ref().as_ptr(); |
91 | | *buffer_len = ja4.as_ref().len() as u32; |
92 | | 1 |
93 | | } else { |
94 | | *buffer = ptr::null(); |
95 | | *buffer_len = 0; |
96 | | 0 |
97 | | } |
98 | | } |
99 | | |
100 | | #[no_mangle] |
101 | 0 | pub unsafe extern "C" fn SCQuicTxGetVersion( |
102 | 0 | tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, |
103 | 0 | ) -> u8 { |
104 | 0 | if tx.header.flags.is_long { |
105 | 0 | let s = &tx.header.version_buf; |
106 | 0 | *buffer = s.as_ptr(); |
107 | 0 | *buffer_len = s.len() as u32; |
108 | 0 | 1 |
109 | | } else { |
110 | 0 | *buffer = ptr::null(); |
111 | 0 | *buffer_len = 0; |
112 | 0 | 0 |
113 | | } |
114 | 0 | } |
115 | | |
116 | | #[no_mangle] |
117 | 0 | pub unsafe extern "C" fn SCQuicTxGetCyuHash( |
118 | 0 | _de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8, |
119 | 0 | buffer_len: *mut u32, |
120 | 0 | ) -> bool { |
121 | 0 | let tx = cast_pointer!(tx, QuicTransaction); |
122 | 0 | if (i as usize) < tx.cyu.len() { |
123 | 0 | let cyu = &tx.cyu[i as usize]; |
124 | | |
125 | 0 | let p = &cyu.hash; |
126 | | |
127 | 0 | *buffer = p.as_ptr(); |
128 | 0 | *buffer_len = p.len() as u32; |
129 | | |
130 | 0 | true |
131 | | } else { |
132 | 0 | *buffer = ptr::null(); |
133 | 0 | *buffer_len = 0; |
134 | | |
135 | 0 | false |
136 | | } |
137 | 0 | } |
138 | | |
139 | | #[no_mangle] |
140 | 0 | pub unsafe extern "C" fn SCQuicTxGetCyuString( |
141 | 0 | _de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8, |
142 | 0 | buffer_len: *mut u32, |
143 | 0 | ) -> bool { |
144 | 0 | let tx = cast_pointer!(tx, QuicTransaction); |
145 | 0 | if (i as usize) < tx.cyu.len() { |
146 | 0 | let cyu = &tx.cyu[i as usize]; |
147 | | |
148 | 0 | let p = &cyu.string; |
149 | | |
150 | 0 | *buffer = p.as_ptr(); |
151 | 0 | *buffer_len = p.len() as u32; |
152 | 0 | true |
153 | | } else { |
154 | 0 | *buffer = ptr::null(); |
155 | 0 | *buffer_len = 0; |
156 | | |
157 | 0 | false |
158 | | } |
159 | 0 | } |