23338889526

Committed 20 Mar 2026 10:29AM UTC coverage: 76.331% (-3.0%) from 79.315%

Build # 23338889526

Build Type

Pull #15053

github

Committed by

web-flow

Commit Message

Merge 00ac1dd14 into 6587e363a

Pull Request Pull Request #15053: Flow queue/v3

Coverage Stats

106 of 127 new or added lines in 8 files covered. (83.46%)

9913 existing lines in 468 files now uncovered.

255689 of 334972 relevant lines covered (76.33%)

4170649.82 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

92.0

/rust/src/ssh/detect.rs

/* Copyright (C) 2020 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

use super::ssh::{
    SCSshEnableHassh, SCSshHasshIsEnabled, SSHConnectionState, SSHTransaction, ALPROTO_SSH,
};
use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
use crate::direction::Direction;
use std::os::raw::{c_int, c_void};
use std::ptr;
use suricata_sys::sys::{
    DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferProgressMpmRegister,
    SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordRegister,
    SCDetectRegisterBufferLowerMd5Callbacks, SCDetectSignatureSetAppProto,
    SCSigMatchSilentErrorEnabled, SCSigTableAppLiteElmt, Signature,
};

#[no_mangle]
pub unsafe extern "C" fn SCSshTxGetProtocol(
    tx: *const c_void, direction: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> bool {
    let tx = cast_pointer!(tx, SSHTransaction);
    match direction.into() {
        Direction::ToServer => {
            let m = &tx.cli_hdr.protover;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
        Direction::ToClient => {
            let m = &tx.srv_hdr.protover;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
    }
    *buffer = ptr::null();
    *buffer_len = 0;

    return false;
}

#[no_mangle]
pub unsafe extern "C" fn SCSshTxGetSoftware(
    tx: *const c_void, direction: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> bool {
    let tx = cast_pointer!(tx, SSHTransaction);
    match direction.into() {
        Direction::ToServer => {
            let m = &tx.cli_hdr.swver;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
        Direction::ToClient => {
            let m = &tx.srv_hdr.swver;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
    }
    *buffer = ptr::null();
    *buffer_len = 0;
    return false;
}

#[no_mangle]
pub unsafe extern "C" fn SCSshTxGetHassh(
    tx: *const c_void, direction: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> bool {
    let tx = cast_pointer!(tx, SSHTransaction);
    match direction.into() {
        Direction::ToServer => {
            let m = &tx.cli_hdr.hassh;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
        Direction::ToClient => {
            let m = &tx.srv_hdr.hassh;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
    }
    *buffer = ptr::null();
    *buffer_len = 0;

    return false;
}

#[no_mangle]
pub unsafe extern "C" fn SCSshTxGetHasshString(
    tx: *const c_void, direction: u8, buffer: *mut *const u8, buffer_len: *mut u32,
) -> bool {
    let tx = cast_pointer!(tx, SSHTransaction);
    match direction.into() {
        Direction::ToServer => {
            let m = &tx.cli_hdr.hassh_string;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
        Direction::ToClient => {
            let m = &tx.srv_hdr.hassh_string;
            if !m.is_empty() {
                *buffer = m.as_ptr();
                *buffer_len = m.len() as u32;
                return true;
            }
        }
    }
    *buffer = ptr::null();
    *buffer_len = 0;

    return false;
}

unsafe extern "C" fn ssh_software_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {
        return -1;
    }
    if SCDetectBufferSetActiveList(de, s, G_SSH_SOFTWARE_BUFFER_ID) < 0 {
        return -1;
    }
    return 0;
}

unsafe extern "C" fn ssh_proto_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {
        return -1;
    }
    if SCDetectBufferSetActiveList(de, s, G_SSH_PROTO_BUFFER_ID) < 0 {
        return -1;
    }
    return 0;
}

unsafe extern "C" fn ssh_hassh_string_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {
        return -1;
    }
    if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_STR_BUFFER_ID) < 0 {
        return -1;
    }
    /* try to enable Hassh */
    SCSshEnableHassh();

    /* Check if Hassh is disabled */
    if !SCSshHasshIsEnabled() {
        if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH_STRING) {
            SCLogError!("hassh support is not enabled");
        }
        return -2;
    }
    return 0;
}

unsafe extern "C" fn ssh_hassh_server_string_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {
        return -1;
    }
    if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_SRV_STR_BUFFER_ID) < 0 {
        return -1;
    }
    /* try to enable Hassh */
    SCSshEnableHassh();

    /* Check if Hassh is disabled */
    if !SCSshHasshIsEnabled() {
        if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH_SERVER_STRING) {
            SCLogError!("hassh support is not enabled");
        }
        return -2;
    }
    return 0;
}

unsafe extern "C" fn ssh_hassh_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {
        return -1;
    }
    if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_BUFFER_ID) < 0 {
        return -1;
    }
    /* try to enable Hassh */
    SCSshEnableHassh();

    /* Check if Hassh is disabled */
    if !SCSshHasshIsEnabled() {
        if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH) {
            SCLogError!("hassh support is not enabled");
        }
        return -2;
    }
    return 0;
}

unsafe extern "C" fn ssh_hassh_server_setup(
    de: *mut DetectEngineCtx, s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {
        return -1;
    }
    if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_SRV_BUFFER_ID) < 0 {
        return -1;
    }
    /* try to enable Hassh */
    SCSshEnableHassh();

    /* Check if Hassh is disabled */
    if !SCSshHasshIsEnabled() {
        if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH_SERVER) {
            SCLogError!("hassh support is not enabled");
        }
        return -2;
    }
    return 0;
}

unsafe extern "C" fn ssh_software_obsolete_setup(
    _de: *mut DetectEngineCtx, _s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    SCLogError!("ssh.softwareversion is obsolete, use now ssh.software");
    return -1;
}

unsafe extern "C" fn ssh_proto_obsolete_setup(
    _de: *mut DetectEngineCtx, _s: *mut Signature, _raw: *const std::os::raw::c_char,
) -> c_int {
    SCLogError!("ssh.softwareversion is obsolete, use now ssh.software");
    return -1;
}

static mut G_SSH_SOFTWARE_BUFFER_ID: c_int = 0;
static mut G_SSH_PROTO_BUFFER_ID: c_int = 0;
static mut G_SSH_HASSH_STR_BUFFER_ID: c_int = 0;
static mut G_SSH_HASSH_SRV_STR_BUFFER_ID: c_int = 0;
static mut G_SSH_HASSH_BUFFER_ID: c_int = 0;
static mut G_SSH_HASSH_SRV_BUFFER_ID: c_int = 0;

static mut DETECT_SSH_HASSH_STRING: u16 = 0;
static mut DETECT_SSH_HASSH_SERVER_STRING: u16 = 0;
static mut DETECT_SSH_HASSH: u16 = 0;
static mut DETECT_SSH_HASSH_SERVER: u16 = 0;

#[no_mangle]
pub unsafe extern "C" fn SCDetectSshRegister() {
    let kw = SigTableElmtStickyBuffer {
        name: String::from("ssh.software"),
        desc: String::from("ssh.software sticky buffer"),
        url: String::from("/rules/ssh-keywords.html#ssh-software"),
        setup: ssh_software_setup,
    };
    let ssh_software_kw_id = helper_keyword_register_sticky_buffer(&kw);
    G_SSH_SOFTWARE_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
        b"ssh_software\0".as_ptr() as *const libc::c_char,
        b"ssh software field\0".as_ptr() as *const libc::c_char,
        ALPROTO_SSH,
        STREAM_TOSERVER | STREAM_TOCLIENT,
        Some(SCSshTxGetSoftware),
        SSHConnectionState::SshStateBannerDone as c_int,
    );
    SCDetectHelperKeywordAliasRegister(
        ssh_software_kw_id,
        b"ssh_software\0".as_ptr() as *const libc::c_char,
    );

    let kw = SCSigTableAppLiteElmt {
        name: b"ssh.softwareversion\0".as_ptr() as *const libc::c_char,
        desc: b"obsolete keyword, use now ssh.software\0".as_ptr() as *const libc::c_char,
        url: std::ptr::null(),
        AppLayerTxMatch: None,
        Setup: Some(ssh_software_obsolete_setup),
        Free: None,
        flags: 0,
    };
    _ = SCDetectHelperKeywordRegister(&kw);

    let kw = SCSigTableAppLiteElmt {
        name: b"ssh.protoversion\0".as_ptr() as *const libc::c_char,
        desc: b"obsolete keyword, use now ssh.proto\0".as_ptr() as *const libc::c_char,
        url: std::ptr::null(),
        AppLayerTxMatch: None,
        Setup: Some(ssh_proto_obsolete_setup),
        Free: None,
        flags: 0,
    };
    _ = SCDetectHelperKeywordRegister(&kw);

    let kw = SigTableElmtStickyBuffer {
        name: String::from("ssh.proto"),
        desc: String::from("ssh.proto sticky buffer"),
        url: String::from("/rules/ssh-keywords.html#ssh-proto"),
        setup: ssh_proto_setup,
    };
    let ssh_proto_kw_id = helper_keyword_register_sticky_buffer(&kw);
    G_SSH_PROTO_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
        b"ssh.proto\0".as_ptr() as *const libc::c_char,
        b"ssh protocol version field\0".as_ptr() as *const libc::c_char,
        ALPROTO_SSH,
        STREAM_TOSERVER | STREAM_TOCLIENT,
        Some(SCSshTxGetProtocol),
        SSHConnectionState::SshStateBannerDone as c_int,
    );
    SCDetectHelperKeywordAliasRegister(
        ssh_proto_kw_id,
        b"ssh_proto\0".as_ptr() as *const libc::c_char,
    );

    let kw = SigTableElmtStickyBuffer {
        name: String::from("ssh.hassh.string"),
        desc: String::from("ssh.hassh.string sticky buffer"),
        url: String::from("/rules/ssh-keywords.html#hassh.string"),
        setup: ssh_hassh_string_setup,
    };
    DETECT_SSH_HASSH_STRING = helper_keyword_register_sticky_buffer(&kw);
    G_SSH_HASSH_STR_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
        b"ssh.hassh.string\0".as_ptr() as *const libc::c_char,
        b"Ssh Client Key Exchange methods For ssh Clients\0".as_ptr() as *const libc::c_char,
        ALPROTO_SSH,
        STREAM_TOSERVER,
        Some(SCSshTxGetHasshString),
        SSHConnectionState::SshStateBannerDone as c_int,
    );
    SCDetectHelperKeywordAliasRegister(
        DETECT_SSH_HASSH_STRING,
        b"ssh-hassh-string\0".as_ptr() as *const libc::c_char,
    );

    let kw = SigTableElmtStickyBuffer {
        name: String::from("ssh.hassh.server.string"),
        desc: String::from("ssh.hassh.server.string sticky buffer"),
        url: String::from("/rules/ssh-keywords.html#ssh.hassh.server.string"),
        setup: ssh_hassh_server_string_setup,
    };
    DETECT_SSH_HASSH_SERVER_STRING = helper_keyword_register_sticky_buffer(&kw);
    G_SSH_HASSH_SRV_STR_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
        b"ssh.hassh.server.string\0".as_ptr() as *const libc::c_char,
        b"Ssh Client Key Exchange methods For ssh Servers\0".as_ptr() as *const libc::c_char,
        ALPROTO_SSH,
        STREAM_TOCLIENT,
        Some(SCSshTxGetHasshString),
        SSHConnectionState::SshStateBannerDone as c_int,
    );
    SCDetectHelperKeywordAliasRegister(
        DETECT_SSH_HASSH_SERVER_STRING,
        b"ssh-hassh-server-string\0".as_ptr() as *const libc::c_char,
    );

    let kw = SigTableElmtStickyBuffer {
        name: String::from("ssh.hassh"),
        desc: String::from("ssh.hassh sticky buffer"),
        url: String::from("/rules/ssh-keywords.html#hassh"),
        setup: ssh_hassh_setup,
    };
    DETECT_SSH_HASSH = helper_keyword_register_sticky_buffer(&kw);
    G_SSH_HASSH_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
        b"ssh.hassh\0".as_ptr() as *const libc::c_char,
        b"Ssh Client Fingerprinting For Ssh Clients\0".as_ptr() as *const libc::c_char,
        ALPROTO_SSH,
        STREAM_TOSERVER,
        Some(SCSshTxGetHassh),
        SSHConnectionState::SshStateBannerDone as c_int,
    );
    SCDetectHelperKeywordAliasRegister(
        DETECT_SSH_HASSH,
        b"ssh-hassh\0".as_ptr() as *const libc::c_char,
    );
    SCDetectRegisterBufferLowerMd5Callbacks(b"ssh.hassh\0".as_ptr() as *const libc::c_char);

    let kw = SigTableElmtStickyBuffer {
        name: String::from("ssh.hassh.server"),
        desc: String::from("ssh.hassh.server sticky buffer"),
        url: String::from("/rules/ssh-keywords.html#ssh.hassh.server"),
        setup: ssh_hassh_server_setup,
    };
    DETECT_SSH_HASSH_SERVER = helper_keyword_register_sticky_buffer(&kw);
    G_SSH_HASSH_SRV_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
        b"ssh.hassh.server\0".as_ptr() as *const libc::c_char,
        b"Ssh Client Fingerprinting For Ssh Servers\0".as_ptr() as *const libc::c_char,
        ALPROTO_SSH,
        STREAM_TOCLIENT,
        Some(SCSshTxGetHassh),
        SSHConnectionState::SshStateBannerDone as c_int,
    );
    SCDetectHelperKeywordAliasRegister(
        DETECT_SSH_HASSH_SERVER,
        b"ssh-hassh-server\0".as_ptr() as *const libc::c_char,
    );
    SCDetectRegisterBufferLowerMd5Callbacks(b"ssh.hassh.server\0".as_ptr() as *const libc::c_char);
}

1	/* Copyright (C) 2020 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	use super::ssh::{
19	SCSshEnableHassh, SCSshHasshIsEnabled, SSHConnectionState, SSHTransaction, ALPROTO_SSH,
20	};
21	use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
22	use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
23	use crate::direction::Direction;
24	use std::os::raw::{c_int, c_void};
25	use std::ptr;
26	use suricata_sys::sys::{
27	DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferProgressMpmRegister,
28	SCDetectHelperKeywordAliasRegister, SCDetectHelperKeywordRegister,
29	SCDetectRegisterBufferLowerMd5Callbacks, SCDetectSignatureSetAppProto,
30	SCSigMatchSilentErrorEnabled, SCSigTableAppLiteElmt, Signature,
31	};
32
33	#[no_mangle]
34	pub unsafe extern "C" fn SCSshTxGetProtocol(	95✔
35	tx: const c_void, direction: u8, buffer: mut const u8, buffer_len: mut u32,	95✔
36	) -> bool {	95✔
37	let tx = cast_pointer!(tx, SSHTransaction);	95✔
38	match direction.into() {	95✔
39	Direction::ToServer => {
40	let m = &tx.cli_hdr.protover;	76✔
41	if !m.is_empty() {	76✔
42	*buffer = m.as_ptr();	75✔
43	*buffer_len = m.len() as u32;	75✔
44	return true;	75✔
45	}	1✔
46	}
47	Direction::ToClient => {
48	let m = &tx.srv_hdr.protover;	19✔
49	if !m.is_empty() {	19✔
50	*buffer = m.as_ptr();	18✔
51	*buffer_len = m.len() as u32;	18✔
52	return true;	18✔
53	}	1✔
54	}
55	}
56	*buffer = ptr::null();	2✔
57	*buffer_len = 0;	2✔
58		2✔
59	return false;	2✔
60	}	95✔
61
62	#[no_mangle]
63	pub unsafe extern "C" fn SCSshTxGetSoftware(	45✔
64	tx: const c_void, direction: u8, buffer: mut const u8, buffer_len: mut u32,	45✔
65	) -> bool {	45✔
66	let tx = cast_pointer!(tx, SSHTransaction);	45✔
67	match direction.into() {	45✔
68	Direction::ToServer => {
69	let m = &tx.cli_hdr.swver;	23✔
70	if !m.is_empty() {	23✔
71	*buffer = m.as_ptr();	22✔
72	*buffer_len = m.len() as u32;	22✔
73	return true;	22✔
74	}	1✔
75	}
76	Direction::ToClient => {
77	let m = &tx.srv_hdr.swver;	22✔
78	if !m.is_empty() {	22✔
79	*buffer = m.as_ptr();	20✔
80	*buffer_len = m.len() as u32;	20✔
81	return true;	20✔
82	}	2✔
83	}
84	}
85	*buffer = ptr::null();	3✔
86	*buffer_len = 0;	3✔
87	return false;	3✔
88	}	45✔
89
90	#[no_mangle]
91	pub unsafe extern "C" fn SCSshTxGetHassh(	21✔
92	tx: const c_void, direction: u8, buffer: mut const u8, buffer_len: mut u32,	21✔
93	) -> bool {	21✔
94	let tx = cast_pointer!(tx, SSHTransaction);	21✔
95	match direction.into() {	21✔
96	Direction::ToServer => {
97	let m = &tx.cli_hdr.hassh;	11✔
98	if !m.is_empty() {	11✔
99	*buffer = m.as_ptr();	8✔
100	*buffer_len = m.len() as u32;	8✔
101	return true;	8✔
102	}	3✔
103	}
104	Direction::ToClient => {
105	let m = &tx.srv_hdr.hassh;	10✔
106	if !m.is_empty() {	10✔
107	*buffer = m.as_ptr();	7✔
108	*buffer_len = m.len() as u32;	7✔
109	return true;	7✔
110	}	3✔
111	}
112	}
113	*buffer = ptr::null();	6✔
114	*buffer_len = 0;	6✔
115		6✔
116	return false;	6✔
117	}	21✔
118
119	#[no_mangle]
120	pub unsafe extern "C" fn SCSshTxGetHasshString(	19✔
121	tx: const c_void, direction: u8, buffer: mut const u8, buffer_len: mut u32,	19✔
122	) -> bool {	19✔
123	let tx = cast_pointer!(tx, SSHTransaction);	19✔
124	match direction.into() {	19✔
125	Direction::ToServer => {
126	let m = &tx.cli_hdr.hassh_string;	10✔
127	if !m.is_empty() {	10✔
128	*buffer = m.as_ptr();	7✔
129	*buffer_len = m.len() as u32;	7✔
130	return true;	7✔
131	}	3✔
132	}
133	Direction::ToClient => {
134	let m = &tx.srv_hdr.hassh_string;	9✔
135	if !m.is_empty() {	9✔
136	*buffer = m.as_ptr();	6✔
137	*buffer_len = m.len() as u32;	6✔
138	return true;	6✔
139	}	3✔
140	}
141	}
142	*buffer = ptr::null();	6✔
143	*buffer_len = 0;	6✔
144		6✔
145	return false;	6✔
146	}	19✔
147
148	unsafe extern "C" fn ssh_software_setup(	12✔
149	de: mut DetectEngineCtx, s: mut Signature, _raw: *const std::os::raw::c_char,	12✔
150	) -> c_int {	12✔
151	if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {	12✔
UNCOV 152	return -1;	×
153	}	12✔
154	if SCDetectBufferSetActiveList(de, s, G_SSH_SOFTWARE_BUFFER_ID) < 0 {	12✔
UNCOV 155	return -1;	×
156	}	12✔
157	return 0;	12✔
158	}	12✔
159
160	unsafe extern "C" fn ssh_proto_setup(	12✔
161	de: mut DetectEngineCtx, s: mut Signature, _raw: *const std::os::raw::c_char,	12✔
162	) -> c_int {	12✔
163	if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {	12✔
UNCOV 164	return -1;	×
165	}	12✔
166	if SCDetectBufferSetActiveList(de, s, G_SSH_PROTO_BUFFER_ID) < 0 {	12✔
167	return -1;	×
168	}	12✔
169	return 0;	12✔
170	}	12✔
171
172	unsafe extern "C" fn ssh_hassh_string_setup(	4✔
173	de: mut DetectEngineCtx, s: mut Signature, _raw: *const std::os::raw::c_char,	4✔
174	) -> c_int {	4✔
175	if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {	4✔
UNCOV 176	return -1;	×
177	}	4✔
178	if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_STR_BUFFER_ID) < 0 {	4✔
UNCOV 179	return -1;	×
180	}	4✔
181	/* try to enable Hassh */	4✔
182	SCSshEnableHassh();	4✔
183		4✔
184	/* Check if Hassh is disabled */	4✔
185	if !SCSshHasshIsEnabled() {	4✔
186	if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH_STRING) {	1✔
187	SCLogError!("hassh support is not enabled");	1✔
188	}	×
189	return -2;	1✔
190	}	3✔
191	return 0;	3✔
192	}	4✔
193
194	unsafe extern "C" fn ssh_hassh_server_string_setup(	4✔
195	de: mut DetectEngineCtx, s: mut Signature, _raw: *const std::os::raw::c_char,	4✔
196	) -> c_int {	4✔
197	if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {	4✔
UNCOV 198	return -1;	×
199	}	4✔
200	if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_SRV_STR_BUFFER_ID) < 0 {	4✔
UNCOV 201	return -1;	×
202	}	4✔
203	/* try to enable Hassh */	4✔
204	SCSshEnableHassh();	4✔
205		4✔
206	/* Check if Hassh is disabled */	4✔
207	if !SCSshHasshIsEnabled() {	4✔
208	if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH_SERVER_STRING) {	1✔
209	SCLogError!("hassh support is not enabled");	1✔
210	}	×
211	return -2;	1✔
212	}	3✔
213	return 0;	3✔
214	}	4✔
215
216	unsafe extern "C" fn ssh_hassh_setup(	4✔
217	de: mut DetectEngineCtx, s: mut Signature, _raw: *const std::os::raw::c_char,	4✔
218	) -> c_int {	4✔
219	if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {	4✔
UNCOV 220	return -1;	×
221	}	4✔
222	if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_BUFFER_ID) < 0 {	4✔
UNCOV 223	return -1;	×
224	}	4✔
225	/* try to enable Hassh */	4✔
226	SCSshEnableHassh();	4✔
227		4✔
228	/* Check if Hassh is disabled */	4✔
229	if !SCSshHasshIsEnabled() {	4✔
230	if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH) {	1✔
231	SCLogError!("hassh support is not enabled");	1✔
232	}	×
233	return -2;	1✔
234	}	3✔
235	return 0;	3✔
236	}	4✔
237
238	unsafe extern "C" fn ssh_hassh_server_setup(	4✔
239	de: mut DetectEngineCtx, s: mut Signature, _raw: *const std::os::raw::c_char,	4✔
240	) -> c_int {	4✔
241	if SCDetectSignatureSetAppProto(s, ALPROTO_SSH) != 0 {	4✔
UNCOV 242	return -1;	×
243	}	4✔
244	if SCDetectBufferSetActiveList(de, s, G_SSH_HASSH_SRV_BUFFER_ID) < 0 {	4✔
UNCOV 245	return -1;	×
246	}	4✔
247	/* try to enable Hassh */	4✔
248	SCSshEnableHassh();	4✔
249		4✔
250	/* Check if Hassh is disabled */	4✔
251	if !SCSshHasshIsEnabled() {	4✔
252	if !SCSigMatchSilentErrorEnabled(de, DETECT_SSH_HASSH_SERVER) {	1✔
253	SCLogError!("hassh support is not enabled");	1✔
254	}	×
255	return -2;	1✔
256	}	3✔
257	return 0;	3✔
258	}	4✔
259
UNCOV 260	unsafe extern "C" fn ssh_software_obsolete_setup(	×
UNCOV 261	_de: mut DetectEngineCtx, _s: mut Signature, _raw: *const std::os::raw::c_char,	×
UNCOV 262	) -> c_int {	×
UNCOV 263	SCLogError!("ssh.softwareversion is obsolete, use now ssh.software");	×
UNCOV 264	return -1;	×
UNCOV 265	}	×
266
UNCOV 267	unsafe extern "C" fn ssh_proto_obsolete_setup(	×
UNCOV 268	_de: mut DetectEngineCtx, _s: mut Signature, _raw: *const std::os::raw::c_char,	×
UNCOV 269	) -> c_int {	×
UNCOV 270	SCLogError!("ssh.softwareversion is obsolete, use now ssh.software");	×
UNCOV 271	return -1;	×
UNCOV 272	}	×
273
274	static mut G_SSH_SOFTWARE_BUFFER_ID: c_int = 0;
275	static mut G_SSH_PROTO_BUFFER_ID: c_int = 0;
276	static mut G_SSH_HASSH_STR_BUFFER_ID: c_int = 0;
277	static mut G_SSH_HASSH_SRV_STR_BUFFER_ID: c_int = 0;
278	static mut G_SSH_HASSH_BUFFER_ID: c_int = 0;
279	static mut G_SSH_HASSH_SRV_BUFFER_ID: c_int = 0;
280
281	static mut DETECT_SSH_HASSH_STRING: u16 = 0;
282	static mut DETECT_SSH_HASSH_SERVER_STRING: u16 = 0;
283	static mut DETECT_SSH_HASSH: u16 = 0;
284	static mut DETECT_SSH_HASSH_SERVER: u16 = 0;
285
286	#[no_mangle]
287	pub unsafe extern "C" fn SCDetectSshRegister() {	2,216✔
288	let kw = SigTableElmtStickyBuffer {	2,216✔
289	name: String::from("ssh.software"),	2,216✔
290	desc: String::from("ssh.software sticky buffer"),	2,216✔
291	url: String::from("/rules/ssh-keywords.html#ssh-software"),	2,216✔
292	setup: ssh_software_setup,	2,216✔
293	};	2,216✔
294	let ssh_software_kw_id = helper_keyword_register_sticky_buffer(&kw);	2,216✔
295	G_SSH_SOFTWARE_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(	2,216✔
296	b"ssh_software\0".as_ptr() as *const libc::c_char,	2,216✔
297	b"ssh software field\0".as_ptr() as *const libc::c_char,	2,216✔
298	ALPROTO_SSH,	2,216✔
299	STREAM_TOSERVER \| STREAM_TOCLIENT,	2,216✔
300	Some(SCSshTxGetSoftware),	2,216✔
301	SSHConnectionState::SshStateBannerDone as c_int,	2,216✔
302	);	2,216✔
303	SCDetectHelperKeywordAliasRegister(	2,216✔
304	ssh_software_kw_id,	2,216✔
305	b"ssh_software\0".as_ptr() as *const libc::c_char,	2,216✔
306	);	2,216✔
307		2,216✔
308	let kw = SCSigTableAppLiteElmt {	2,216✔
309	name: b"ssh.softwareversion\0".as_ptr() as *const libc::c_char,	2,216✔
310	desc: b"obsolete keyword, use now ssh.software\0".as_ptr() as *const libc::c_char,	2,216✔
311	url: std::ptr::null(),	2,216✔
312	AppLayerTxMatch: None,	2,216✔
313	Setup: Some(ssh_software_obsolete_setup),	2,216✔
314	Free: None,	2,216✔
315	flags: 0,	2,216✔
316	};	2,216✔
317	_ = SCDetectHelperKeywordRegister(&kw);	2,216✔
318		2,216✔
319	let kw = SCSigTableAppLiteElmt {	2,216✔
320	name: b"ssh.protoversion\0".as_ptr() as *const libc::c_char,	2,216✔
321	desc: b"obsolete keyword, use now ssh.proto\0".as_ptr() as *const libc::c_char,	2,216✔
322	url: std::ptr::null(),	2,216✔
323	AppLayerTxMatch: None,	2,216✔
324	Setup: Some(ssh_proto_obsolete_setup),	2,216✔
325	Free: None,	2,216✔
326	flags: 0,	2,216✔
327	};	2,216✔
328	_ = SCDetectHelperKeywordRegister(&kw);	2,216✔
329		2,216✔
330	let kw = SigTableElmtStickyBuffer {	2,216✔
331	name: String::from("ssh.proto"),	2,216✔
332	desc: String::from("ssh.proto sticky buffer"),	2,216✔
333	url: String::from("/rules/ssh-keywords.html#ssh-proto"),	2,216✔
334	setup: ssh_proto_setup,	2,216✔
335	};	2,216✔
336	let ssh_proto_kw_id = helper_keyword_register_sticky_buffer(&kw);	2,216✔
337	G_SSH_PROTO_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(	2,216✔
338	b"ssh.proto\0".as_ptr() as *const libc::c_char,	2,216✔
339	b"ssh protocol version field\0".as_ptr() as *const libc::c_char,	2,216✔
340	ALPROTO_SSH,	2,216✔
341	STREAM_TOSERVER \| STREAM_TOCLIENT,	2,216✔
342	Some(SCSshTxGetProtocol),	2,216✔
343	SSHConnectionState::SshStateBannerDone as c_int,	2,216✔
344	);	2,216✔
345	SCDetectHelperKeywordAliasRegister(	2,216✔
346	ssh_proto_kw_id,	2,216✔
347	b"ssh_proto\0".as_ptr() as *const libc::c_char,	2,216✔
348	);	2,216✔
349		2,216✔
350	let kw = SigTableElmtStickyBuffer {	2,216✔
351	name: String::from("ssh.hassh.string"),	2,216✔
352	desc: String::from("ssh.hassh.string sticky buffer"),	2,216✔
353	url: String::from("/rules/ssh-keywords.html#hassh.string"),	2,216✔
354	setup: ssh_hassh_string_setup,	2,216✔
355	};	2,216✔
356	DETECT_SSH_HASSH_STRING = helper_keyword_register_sticky_buffer(&kw);	2,216✔
357	G_SSH_HASSH_STR_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(	2,216✔
358	b"ssh.hassh.string\0".as_ptr() as *const libc::c_char,	2,216✔
359	b"Ssh Client Key Exchange methods For ssh Clients\0".as_ptr() as *const libc::c_char,	2,216✔
360	ALPROTO_SSH,	2,216✔
361	STREAM_TOSERVER,	2,216✔
362	Some(SCSshTxGetHasshString),	2,216✔
363	SSHConnectionState::SshStateBannerDone as c_int,	2,216✔
364	);	2,216✔
365	SCDetectHelperKeywordAliasRegister(	2,216✔
366	DETECT_SSH_HASSH_STRING,	2,216✔
367	b"ssh-hassh-string\0".as_ptr() as *const libc::c_char,	2,216✔
368	);	2,216✔
369		2,216✔
370	let kw = SigTableElmtStickyBuffer {	2,216✔
371	name: String::from("ssh.hassh.server.string"),	2,216✔
372	desc: String::from("ssh.hassh.server.string sticky buffer"),	2,216✔
373	url: String::from("/rules/ssh-keywords.html#ssh.hassh.server.string"),	2,216✔
374	setup: ssh_hassh_server_string_setup,	2,216✔
375	};	2,216✔
376	DETECT_SSH_HASSH_SERVER_STRING = helper_keyword_register_sticky_buffer(&kw);	2,216✔
377	G_SSH_HASSH_SRV_STR_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(	2,216✔
378	b"ssh.hassh.server.string\0".as_ptr() as *const libc::c_char,	2,216✔
379	b"Ssh Client Key Exchange methods For ssh Servers\0".as_ptr() as *const libc::c_char,	2,216✔
380	ALPROTO_SSH,	2,216✔
381	STREAM_TOCLIENT,	2,216✔
382	Some(SCSshTxGetHasshString),	2,216✔
383	SSHConnectionState::SshStateBannerDone as c_int,	2,216✔
384	);	2,216✔
385	SCDetectHelperKeywordAliasRegister(	2,216✔
386	DETECT_SSH_HASSH_SERVER_STRING,	2,216✔
387	b"ssh-hassh-server-string\0".as_ptr() as *const libc::c_char,	2,216✔
388	);	2,216✔
389		2,216✔
390	let kw = SigTableElmtStickyBuffer {	2,216✔
391	name: String::from("ssh.hassh"),	2,216✔
392	desc: String::from("ssh.hassh sticky buffer"),	2,216✔
393	url: String::from("/rules/ssh-keywords.html#hassh"),	2,216✔
394	setup: ssh_hassh_setup,	2,216✔
395	};	2,216✔
396	DETECT_SSH_HASSH = helper_keyword_register_sticky_buffer(&kw);	2,216✔
397	G_SSH_HASSH_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(	2,216✔
398	b"ssh.hassh\0".as_ptr() as *const libc::c_char,	2,216✔
399	b"Ssh Client Fingerprinting For Ssh Clients\0".as_ptr() as *const libc::c_char,	2,216✔
400	ALPROTO_SSH,	2,216✔
401	STREAM_TOSERVER,	2,216✔
402	Some(SCSshTxGetHassh),	2,216✔
403	SSHConnectionState::SshStateBannerDone as c_int,	2,216✔
404	);	2,216✔
405	SCDetectHelperKeywordAliasRegister(	2,216✔
406	DETECT_SSH_HASSH,	2,216✔
407	b"ssh-hassh\0".as_ptr() as *const libc::c_char,	2,216✔
408	);	2,216✔
409	SCDetectRegisterBufferLowerMd5Callbacks(b"ssh.hassh\0".as_ptr() as *const libc::c_char);	2,216✔
410		2,216✔
411	let kw = SigTableElmtStickyBuffer {	2,216✔
412	name: String::from("ssh.hassh.server"),	2,216✔
413	desc: String::from("ssh.hassh.server sticky buffer"),	2,216✔
414	url: String::from("/rules/ssh-keywords.html#ssh.hassh.server"),	2,216✔
415	setup: ssh_hassh_server_setup,	2,216✔
416	};	2,216✔
417	DETECT_SSH_HASSH_SERVER = helper_keyword_register_sticky_buffer(&kw);	2,216✔
418	G_SSH_HASSH_SRV_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(	2,216✔
419	b"ssh.hassh.server\0".as_ptr() as *const libc::c_char,	2,216✔
420	b"Ssh Client Fingerprinting For Ssh Servers\0".as_ptr() as *const libc::c_char,	2,216✔
421	ALPROTO_SSH,	2,216✔
422	STREAM_TOCLIENT,	2,216✔
423	Some(SCSshTxGetHassh),	2,216✔
424	SSHConnectionState::SshStateBannerDone as c_int,	2,216✔
425	);	2,216✔
426	SCDetectHelperKeywordAliasRegister(	2,216✔
427	DETECT_SSH_HASSH_SERVER,	2,216✔
428	b"ssh-hassh-server\0".as_ptr() as *const libc::c_char,	2,216✔
429	);	2,216✔
430	SCDetectRegisterBufferLowerMd5Callbacks(b"ssh.hassh.server\0".as_ptr() as *const libc::c_char);	2,216✔
431	}	2,216✔

OISF / suricata / 23338889526

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous