detect: add keywords for LDAPResult - v4 #12694
Conversation
Split code to create a generic function that parses LdapIndex
ldap.responses.result_code matches on LDAP result code This keyword maps the following eve fields: ldap.responses[].bind_response.result_code ldap.responses[].search_result_done.result_code ldap.responses[].modify_response.result_code ldap.responses[].add_response.result_code ldap.responses[].del_response.result_code ldap.responses[].mod_dn_response.result_code ldap.responses[].compare_response.result_code ldap.responses[].extended_response.result_code It is an unsigned 32-bit integer Doesn't support prefiltering Ticket: OISF#7532
ldap.responses.message matches on LDAPResult error message This keyword maps the following eve fields: ldap.responses[].bind_response.message ldap.responses[].search_result_done.message ldap.responses[].modify_response.message ldap.responses[].add_response.message ldap.responses[].del_response.message ldap.responses[].mod_dn_response.message ldap.responses[].compare_response.message ldap.responses[].extended_response.message It is a sticky buffer Supports prefiltering Ticket: OISF#7532
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12694 +/- ##
==========================================
- Coverage 80.71% 80.70% -0.02%
==========================================
Files 936 936
Lines 259425 259511 +86
==========================================
+ Hits 209399 209437 +38
- Misses 50026 50074 +48
Flags with carried forward coverage won't be shown. Click here to find out more. |
| alert ldap any any -> any any (msg:"Test LDAP success at last index"; :example-rule-emphasis:`ldap.responses.result_code:success,-1;` sid:1;) | ||
|
|
||
| ldap.responses.message | ||
| ---------------------------- |
There was a problem hiding this comment.
please fix the number of dashes
There was a problem hiding this comment.
Thanks for the work
CI : ✅
Code : checking now
Commits segmentation : ok
Commit messages : good
Git ID set : looks fine for me
CLA : you already contributed
Doc update :
Redmine ticket : ok
Rustfmt rustfmt rust/src/ldap/*.rs in a dedicated commit
Tests : approved suricata-verify PR
Dependencies added: none
| tx, | ||
| &ctx.du32, | ||
| get_ldap_result_code, | ||
| |code, ctx_value| unsafe { rs_detect_u32_match(code, ctx_value) }, |
There was a problem hiding this comment.
Can we use detect_match_uint (maybe detect_match_uint::<u32>) to avoid the unsafe ?
| } | ||
|
|
||
| fn get_ldap_result_code(response: &LdapMessage) -> Option<u32> { | ||
| let result_code = match &response.protocol_op { |
There was a problem hiding this comment.
nit: just return match...
| ---------------------------- | ||
|
|
||
| Matches on LDAP error messages from response operations. | ||
|
|
There was a problem hiding this comment.
We should state that (response) operations not having a LDAPResult (like IntermediateResponse or SearchEntry) put an empty buffer here
| ProtocolOp::ModDnResponse(resp) => resp.diagnostic_message.0.as_str(), | ||
| ProtocolOp::CompareResponse(resp) => resp.diagnostic_message.0.as_str(), | ||
| ProtocolOp::ExtendedResponse(resp) => resp.result.diagnostic_message.0.as_str(), | ||
| _ => "", |
There was a problem hiding this comment.
This behavior needs to be documented
| _de: *mut c_void, _f: *mut c_void, _flags: u8, _state: *mut c_void, tx: *mut c_void, | ||
| _sig: *const c_void, ctx: *const c_void, | ||
| fn match_at_index<T>( | ||
| tx: &LdapTransaction, ctx_value: &DetectUintData<T>, |
There was a problem hiding this comment.
Cool, Could we have a more generic type than LdapTransaction to fit other protocols ?
Ticket: #7532
Contribution style:
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
Our Contribution agreements:
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Changes (if applicable):
(including schema descriptions)
https://redmine.openinfosecfoundation.org/issues/7532
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7532
Description:
ldap.responses.result_codeandldap.responses.messageChanges:
SV_BRANCH=OISF/suricata-verify#2310
Previous PR: #12691