upstream/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-02-18 18:18:04 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

rust: bindgen SCDetectGetLastSMFromLists

Browse source 
to use it from rust keywords
This commit is contained in:
Philippe Antoine 2026-02-05 10:34:22 +01:00 committed by Victor Julien
parent 697c641400
commit df495d7e22
23 changed files with 67 additions and 81 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
rust/sys/src/sys.rs
View file

@ -554,6 +554,9 @@ extern "C" {
extern "C" {
pub fn SCSigMatchSilentErrorEnabled(de_ctx: *const DetectEngineCtx, id: u16) -> bool;
}
extern "C" {
pub fn SCDetectGetLastSMFromLists(s: *const Signature, ...) -> *mut SigMatch;
}
extern "C" {
pub fn SCDetectSignatureSetAppProto(
s: *mut Signature, alproto: AppProto,

2
src/detect-base64-data.c
View file

@ -51,7 +51,7 @@ static int DetectBase64DataSetup(DetectEngineCtx *de_ctx, Signature *s,
SigMatch *pm = NULL;
/* Check for a preceding base64_decode. */
pm = DetectGetLastSMFromLists(s, DETECT_BASE64_DECODE, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_BASE64_DECODE, -1);
if (pm == NULL) {
SCLogError("\"base64_data\" keyword seen without preceding base64_decode.");
return -1;

6
src/detect-base64-decode.c
View file

@ -209,10 +209,8 @@ static int DetectBase64DecodeSetup(DetectEngineCtx *de_ctx, Signature *s,
sm_list = s->init_data->list;
}
else {
pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, -1);
if (pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
}

13
src/detect-byte-extract.c
View file

@ -268,13 +268,12 @@ static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const c
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (data->endian == EndianDCE) {
if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -290,10 +289,8 @@ static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const c
goto error;
} else if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

14
src/detect-bytejump.c
View file

@ -526,14 +526,12 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (data->flags & DETECT_BYTEJUMP_DCE) {
if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -549,10 +547,8 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
goto error;
} else if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

15
src/detect-bytemath.c
View file

@ -301,7 +301,7 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
if (!prev_pm) {
SCLogError("relative specified without "
"previous pattern match");
@ -310,11 +310,8 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
} else if (data->endian == EndianDCE) {
if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP,
DETECT_BYTE_EXTRACT,
DETECT_BYTEMATH,
DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -330,10 +327,8 @@ static int DetectByteMathSetup(DetectEngineCtx *de_ctx, Signature *s, const char
goto error;
} else if (data->flags & DETECT_BYTEMATH_FLAG_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP,
DETECT_BYTE_EXTRACT, DETECT_BYTEMATH,
DETECT_ISDATAAT, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_BYTEMATH, DETECT_ISDATAAT, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

14
src/detect-bytetest.c
View file

@ -585,15 +585,13 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTETEST_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (data->flags & DETECT_BYTETEST_DCE) {
if (data->flags & DETECT_BYTETEST_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {
@ -609,10 +607,8 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
goto error;
} else if (data->flags & DETECT_BYTETEST_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL) {
sm_list = DETECT_SM_LIST_PMATCH;
} else {

37
src/detect-csum.c
View file

@ -872,23 +872,26 @@ static int DetectCsumInvalidArgsTestParse02(void)
}
#undef TEST2
#define TEST3(kwstr, kwtype) { \
DetectEngineCtx *de_ctx = DetectEngineCtxInit();\
FAIL_IF_NULL(de_ctx);\
Signature *s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any ("mystr(kwstr)"-csum:valid; sid:1;)");\
FAIL_IF_NULL(s);\
SigMatch *sm = DetectGetLastSMFromLists(s, (kwtype), -1);\
FAIL_IF_NULL(sm);\
FAIL_IF_NULL(sm->ctx);\
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 1);\
s = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any ("mystr(kwstr)"-csum:INVALID; sid:2;)");\
FAIL_IF_NULL(s);\
sm = DetectGetLastSMFromLists(s, (kwtype), -1);\
FAIL_IF_NULL(sm);\
FAIL_IF_NULL(sm->ctx);\
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 0);\
DetectEngineCtxFree(de_ctx);\
}
#define TEST3(kwstr, kwtype) \
{ \
DetectEngineCtx *de_ctx = DetectEngineCtxInit(); \
FAIL_IF_NULL(de_ctx); \
Signature *s = DetectEngineAppendSig( \
de_ctx, "alert ip any any -> any any (" mystr(kwstr) "-csum:valid; sid:1;)"); \
FAIL_IF_NULL(s); \
SigMatch *sm = SCDetectGetLastSMFromLists(s, (kwtype), -1); \
FAIL_IF_NULL(sm); \
FAIL_IF_NULL(sm->ctx); \
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 1); \
s = DetectEngineAppendSig( \
de_ctx, "alert ip any any -> any any (" mystr(kwstr) "-csum:INVALID; sid:2;)"); \
FAIL_IF_NULL(s); \
sm = SCDetectGetLastSMFromLists(s, (kwtype), -1); \
FAIL_IF_NULL(sm); \
FAIL_IF_NULL(sm->ctx); \
FAIL_IF_NOT(((DetectCsumData *)sm->ctx)->valid == 0); \
DetectEngineCtxFree(de_ctx); \
}
static int DetectCsumValidArgsTestParse03(void)
{

4
src/detect-depth.c
View file

@ -68,7 +68,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, const char *
int ret = -1;
/* retrieve the sm to apply the depth against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("depth needs "
"preceding content, uricontent option, http_client_body, "
@ -143,7 +143,7 @@ static int DetectStartsWithSetup (DetectEngineCtx *de_ctx, Signature *s, const c
int ret = -1;
/* retrieve the sm to apply the depth against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("startswith needs a "
"preceding content option.");

4
src/detect-detection-filter.c
View file

@ -236,13 +236,13 @@ static int DetectDetectionFilterSetup(DetectEngineCtx *de_ctx, Signature *s, con
SigMatch *tmpm = NULL;
/* checks if there's a previous instance of threshold */
tmpm = DetectGetLastSMFromLists(s, DETECT_THRESHOLD, -1);
tmpm = SCDetectGetLastSMFromLists(s, DETECT_THRESHOLD, -1);
if (tmpm != NULL) {
SCLogError("\"detection_filter\" and \"threshold\" are not allowed in the same rule");
SCReturnInt(-1);
}
/* checks there's no previous instance of detection_filter */
tmpm = DetectGetLastSMFromLists(s, DETECT_DETECTION_FILTER, -1);
tmpm = SCDetectGetLastSMFromLists(s, DETECT_DETECTION_FILTER, -1);
if (tmpm != NULL) {
SCLogError("At most one \"detection_filter\" is allowed per rule");
SCReturnInt(-1);

2
src/detect-distance.c
View file

@ -72,7 +72,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
const char *str = distancestr;
/* retrieve the sm to apply the distance against */
SigMatch *pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("distance needs "
"preceding content, uricontent option, http_client_body, "

2
src/detect-dsize.c
View file

@ -119,7 +119,7 @@ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *
{
DetectU16Data *dd = NULL;
if (DetectGetLastSMFromLists(s, DETECT_DSIZE, -1)) {
if (SCDetectGetLastSMFromLists(s, DETECT_DSIZE, -1)) {
SCLogError("Can't use 2 or more dsizes in "
"the same sig. Invalidating signature.");
return -1;

2
src/detect-fast-pattern.c
View file

@ -217,7 +217,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, const c
pcre2_match_data *match = NULL;
SigMatch *pm1 = DetectGetLastSMFromMpmLists(de_ctx, s);
SigMatch *pm2 = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm2 = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm1 == NULL && pm2 == NULL) {
SCLogError("fast_pattern found inside "
"the rule, without a content context. Please use a "

2
src/detect-filemagic.c
View file

@ -218,7 +218,7 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
return -1;
}
SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *sm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (sm == NULL)
return -1;

4
src/detect-filename.c
View file

@ -144,7 +144,7 @@ static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char
}
SCFree(dotstr);
SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *sm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (sm == NULL)
return -1;
@ -182,7 +182,7 @@ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
return -1;
}
SigMatch *sm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *sm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (sm == NULL)
return -1;

10
src/detect-isdataat.c
View file

@ -327,13 +327,11 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isda
sm_list = s->init_data->list;
if (idad->flags & ISDATAAT_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);
}
} else if (idad->flags & ISDATAAT_RELATIVE) {
prev_pm = DetectGetLastSMFromLists(s,
DETECT_CONTENT, DETECT_PCRE,
DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,
DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
prev_pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, DETECT_BYTETEST,
DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT, DETECT_ISDATAAT, DETECT_BYTEMATH, -1);
if (prev_pm == NULL)
sm_list = DETECT_SM_LIST_PMATCH;
else {
@ -422,7 +420,7 @@ static int DetectEndsWithSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
int ret = -1;
/* retrieve the sm to apply the depth against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("endswith needs a "
"preceding content option");

2
src/detect-nocase.c
View file

@ -67,7 +67,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, const char
}
/* retrieve the sm to apply the nocase against */
pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("nocase needs "
"preceding content option");

2
src/detect-offset.c
View file

@ -56,7 +56,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, const char *offset
const char *str = offsetstr;
/* retrieve the sm to apply the offset against */
SigMatch *pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("offset needs preceding content option.");
return -1;

2
src/detect-parse.c
View file

@ -560,7 +560,7 @@ SigMatch *DetectGetLastSMFromMpmLists(const DetectEngineCtx *de_ctx, const Signa
*
* \retval Pointer to Last sm.
*/
SigMatch *DetectGetLastSMFromLists(const Signature *s, ...)
SigMatch *SCDetectGetLastSMFromLists(const Signature *s, ...)
{
SigMatch *sm_last = NULL;
SigMatch *sm_new;

2
src/detect-parse.h
View file

@ -79,7 +79,7 @@ void SigTableApplyStrictCommandLineOption(const char *str);
SigMatch *DetectGetLastSM(const Signature *);
SigMatch *DetectGetLastSMFromMpmLists(const DetectEngineCtx *de_ctx, const Signature *s);
SigMatch *DetectGetLastSMFromLists(const Signature *s, ...);
SigMatch *SCDetectGetLastSMFromLists(const Signature *s, ...);
SigMatch *DetectGetLastSMByListPtr(const Signature *s, SigMatch *sm_list, ...);
SigMatch *DetectGetLastSMByListId(const Signature *s, int list_id, ...);

2
src/detect-smb-version.c
View file

@ -74,7 +74,7 @@ static int DetectSmbVersionSetup(DetectEngineCtx *de_ctx, Signature *s, const ch
return -1;
}
if (DetectGetLastSMFromLists(s, DETECT_SMB_VERSION, -1)) {
if (SCDetectGetLastSMFromLists(s, DETECT_SMB_VERSION, -1)) {
SCLogError("Can't use 2 or more smb.version declarations in "
"the same sig. Invalidating signature.");
return -1;

2
src/detect-threshold.c
View file

@ -291,7 +291,7 @@ static int DetectThresholdSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
SigMatch *tmpm = NULL;
/* checks if there is a previous instance of detection_filter */
tmpm = DetectGetLastSMFromLists(s, DETECT_THRESHOLD, DETECT_DETECTION_FILTER, -1);
tmpm = SCDetectGetLastSMFromLists(s, DETECT_THRESHOLD, DETECT_DETECTION_FILTER, -1);
if (tmpm != NULL) {
if (tmpm->type == DETECT_DETECTION_FILTER) {
SCLogError("\"detection_filter\" and "

2
src/detect-within.c
View file

@ -73,7 +73,7 @@ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, const char *
const char *str = withinstr;
/* retrieve the sm to apply the within against */
SigMatch *pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
SigMatch *pm = SCDetectGetLastSMFromLists(s, DETECT_CONTENT, -1);
if (pm == NULL) {
SCLogError("within needs preceding content option");
return -1;