From 49caf005a479326ac1acffd135e79f0c58e5d944 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Sun, 14 Apr 2024 21:34:57 +0200 Subject: [PATCH] detect/analyzer: create tojson function for generic integers As will be needed for tcp.mss --- rust/src/detect/mod.rs | 1 + rust/src/detect/tojson/mod.rs | 79 +++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 rust/src/detect/tojson/mod.rs diff --git a/rust/src/detect/mod.rs b/rust/src/detect/mod.rs index cad086f161b5..2b1fd0e464b0 100644 --- a/rust/src/detect/mod.rs +++ b/rust/src/detect/mod.rs @@ -25,6 +25,7 @@ pub mod stream_size; pub mod uint; pub mod uri; pub mod requires; +pub mod tojson; /// EnumString trait that will be implemented on enums that /// derive StringEnum. diff --git a/rust/src/detect/tojson/mod.rs b/rust/src/detect/tojson/mod.rs new file mode 100644 index 000000000000..2c552bcfa0bc --- /dev/null +++ b/rust/src/detect/tojson/mod.rs @@ -0,0 +1,79 @@ +/* Copyright (C) 2024 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +use crate::detect::uint::{DetectIntType, DetectUintData, DetectUintMode}; +use crate::jsonbuilder::{JsonBuilder, JsonError}; + +pub fn detect_uint_to_json( + js: &mut JsonBuilder, du: &DetectUintData, +) -> Result<(), JsonError> +where + u64: From, +{ + match du.mode { + DetectUintMode::DetectUintModeEqual => { + js.set_uint("equal", du.arg1.into())?; + } + DetectUintMode::DetectUintModeNe => { + js.set_uint("diff", du.arg1.into())?; + } + DetectUintMode::DetectUintModeLt => { + js.set_uint("lt", du.arg1.into())?; + } + DetectUintMode::DetectUintModeLte => { + js.set_uint("lte", du.arg1.into())?; + } + DetectUintMode::DetectUintModeGt => { + js.set_uint("gt", du.arg1.into())?; + } + DetectUintMode::DetectUintModeGte => { + js.set_uint("gte", du.arg1.into())?; + } + DetectUintMode::DetectUintModeRange => { + js.open_object("range")?; + js.set_uint("min", du.arg1.into())?; + js.set_uint("max", du.arg2.into())?; + js.close()?; + } + DetectUintMode::DetectUintModeNegRg => { + js.open_object("negated_range")?; + js.set_uint("min", du.arg1.into())?; + js.set_uint("max", du.arg2.into())?; + js.close()?; + } + DetectUintMode::DetectUintModeBitmask => { + js.open_object("bitmask")?; + js.set_uint("mask", du.arg1.into())?; + js.set_uint("value", du.arg2.into())?; + js.close()?; + } + DetectUintMode::DetectUintModeNegBitmask => { + js.open_object("negated_bitmask")?; + js.set_uint("mask", du.arg1.into())?; + js.set_uint("value", du.arg2.into())?; + js.close()?; + } + } + Ok(()) +} + +#[no_mangle] +pub unsafe extern "C" fn SCDetectU16ToJson( + js: &mut JsonBuilder, du: &DetectUintData, +) -> bool { + return detect_uint_to_json(js, du).is_ok(); +}