/src/suricata8/src/detect-ike-vendor.c
Line | Count | Source |
1 | | /* Copyright (C) 2020-2022 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | /** |
19 | | * |
20 | | * \author Frank Honza <frank.honza@dcso.de> |
21 | | */ |
22 | | |
23 | | #include "suricata-common.h" |
24 | | #include "conf.h" |
25 | | #include "detect.h" |
26 | | #include "detect-parse.h" |
27 | | #include "detect-engine.h" |
28 | | #include "detect-engine-buffer.h" |
29 | | #include "detect-engine-prefilter.h" |
30 | | #include "detect-engine-content-inspection.h" |
31 | | #include "detect-engine-mpm.h" |
32 | | #include "detect-ike-vendor.h" |
33 | | #include "rust.h" |
34 | | #include "app-layer-parser.h" |
35 | | #include "util-byte.h" |
36 | | |
37 | | #include "util-profiling.h" |
38 | | |
39 | | static int DetectIkeVendorSetup(DetectEngineCtx *, Signature *, const char *); |
40 | | |
41 | | static int g_ike_vendor_buffer_id = 0; |
42 | | |
43 | | /** |
44 | | * \brief Registration function for ike.vendor keyword. |
45 | | */ |
46 | | void DetectIkeVendorRegister(void) |
47 | 5 | { |
48 | 5 | sigmatch_table[DETECT_IKE_VENDOR].name = "ike.vendor"; |
49 | 5 | sigmatch_table[DETECT_IKE_VENDOR].desc = "match IKE Vendor"; |
50 | 5 | sigmatch_table[DETECT_IKE_VENDOR].url = "/rules/ike-keywords.html#ike-vendor"; |
51 | 5 | sigmatch_table[DETECT_IKE_VENDOR].Setup = DetectIkeVendorSetup; |
52 | 5 | sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_NOOPT; |
53 | 5 | sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_INFO_STICKY_BUFFER; |
54 | | |
55 | 5 | DetectAppLayerMultiRegister( |
56 | 5 | "ike.vendor", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, SCIkeTxGetVendor, 1); |
57 | | |
58 | 5 | g_ike_vendor_buffer_id = DetectBufferTypeGetByName("ike.vendor"); |
59 | | |
60 | 5 | DetectBufferTypeSupportsMultiInstance("ike.vendor"); |
61 | 5 | } |
62 | | |
63 | | /** |
64 | | * \brief setup the sticky buffer keyword used in the rule |
65 | | * |
66 | | * \param de_ctx Pointer to the Detection Engine Context |
67 | | * \param s Pointer to the Signature to which the current keyword belongs |
68 | | * \param str Should hold an empty string always |
69 | | * |
70 | | * \retval 0 On success |
71 | | * \retval -1 On failure |
72 | | */ |
73 | | |
74 | | static int DetectIkeVendorSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) |
75 | 120 | { |
76 | 120 | if (SCDetectBufferSetActiveList(de_ctx, s, g_ike_vendor_buffer_id) < 0) |
77 | 6 | return -1; |
78 | 114 | if (SCDetectSignatureSetAppProto(s, ALPROTO_IKE) < 0) |
79 | 3 | return -1; |
80 | 111 | return 0; |
81 | 114 | } |