OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-12 02:07:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

nfs: use nfsv2 procedure names with nfs_procedure keyword

Browse Source 
Ticket: 5140
This commit is contained in:
Philippe Antoine
2025-12-02 06:21:52 +00:00
committed by Victor Julien
parent 257ed82dbd
commit 2349f19977
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/src/nfs/detect.rs
+10 -4
View File
@@ -25,7 +25,7 @@ use suricata_sys::sys::{
};
use super::nfs::{NFSTransaction, NFSTransactionTypeData};
use super::types::{NfsProc3, NfsProc4};
use super::types::{NfsProc2, NfsProc3, NfsProc4};
use crate::core::STREAM_TOSERVER;
use crate::detect::uint::{
detect_match_uint, detect_parse_uint_enum, detect_parse_uint_inclusive, DetectUintData,
@@ -40,6 +40,7 @@ static mut G_NFS_PROCEDURE_KW_ID: u16 = 0;
static mut G_NFS_PROCEDURE_BUFFER_ID: c_int = 0;
struct DetectNfsProcedureDataVersion {
v2: Option<DetectUintData<u32>>,
v3: Option<DetectUintData<u32>>,
v4: Option<DetectUintData<u32>>,
}
@@ -53,13 +54,14 @@ fn nfs_procedure_parse_aux(s: &str) -> Option<DetectNfsProcedureData> {
if let Ok((_, ctx)) = detect_parse_uint_inclusive::<u32>(s) {
return Some(DetectNfsProcedureData::Num(ctx));
}
let v2 = detect_parse_uint_enum::<u32, NfsProc2>(s);
let v3 = detect_parse_uint_enum::<u32, NfsProc3>(s);
let v4 = detect_parse_uint_enum::<u32, NfsProc4>(s);
if v3.is_none() && v4.is_none() {
if v2.is_none() && v3.is_none() && v4.is_none() {
return None;
}
return Some(DetectNfsProcedureData::VersionLiteral(
DetectNfsProcedureDataVersion { v3, v4 },
DetectNfsProcedureDataVersion { v2, v3, v4 },
));
}
@@ -104,7 +106,11 @@ unsafe extern "C" fn nfs_procedure_setup(
fn nfs_procedure_match_val(proc: u32, nfs_version: u16, ctx: &DetectNfsProcedureData) -> bool {
match ctx {
DetectNfsProcedureData::VersionLiteral(ver) => {
if nfs_version < 4 {
if nfs_version < 3 {
if let Some(du32v2) = &ver.v2 {
return detect_match_uint(du32v2, proc);
}
} else if nfs_version == 3 {
if let Some(du32v3) = &ver.v3 {
return detect_match_uint(du32v3, proc);
}