Skip to content

Lua ssh 7607 v4 #13027

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 6 commits into from
Closed

Lua ssh 7607 v4 #13027

wants to merge 6 commits into from

Conversation

catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7607

Describe changes:

  • lua: convert ssh function into suricata.ssh lib
  • add hooks for ssh to be able to add lua lib
  • use a derive AppLayerState to get hooks for rust ssh

SV_BRANCH=OISF/suricata-verify#2445

#13024 clean with passing commit-check

To enable easily hooks for rust app-layers such as SSH
So that we can use a short string for hooks in the end, by not
having each value of the enum repeating the name of the enum
Allows signature like `alert ssh:banner_done`
@@ -65,11 +65,12 @@ pub enum SSHEvent {

#[repr(u8)]
#[derive(Copy, Clone, PartialOrd, PartialEq, Eq)]
/// cbindgen:prefix-with-name=true
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jasonish any better trick ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now I get in C SSHConnectionState_BannerDone Ideally I would like SshStateBannerDone

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Elsewhere we just use full names inside the enum. Annoying to use from Rust though... So:

pub enum SSHConnectionState {
    SSHConnectionStateInProgress,
}

this is preferable if also using from C, as it keeps the identifier name the same.

See discussion here: #8417

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure I knew that, and that is the current state but this fits bad with the derive introduced here...

Should the derive do the magic to strip the common prefix ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will probably have to, I don't think you'll get the desired output with cbindgen alone?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Managed to have something with Derive macro helper attributes

fn to_cstring(&self) -> *const c_char;

/// Converts a C string formatted name to a state progress.
unsafe extern "C" fn ffi_id_from_name(name: *const c_char, _dir: u8) -> c_int
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not know where to put this, but this is for protocols which do not need the direction (like SSH)

Copy link
Member

@jasonish jasonish Apr 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably as good here as any. However, perhaps the function doc should contain the additional information:

for protocols which do not need the direction (like SSH)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

adding

}

/// Converts a variant ID to an FFI name.
unsafe extern "C" fn ffi_name_from_id(id: c_int, _dir: u8) -> *const c_char
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure c_int is the best API but it is what it is

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 25702

@catenacyber catenacyber marked this pull request as draft April 16, 2025 09:50
@catenacyber
Copy link
Contributor Author

Draft : need to take care of Jason's review, especially remove the commit ssh: rename connection state and adapt the derive magic

@catenacyber catenacyber mentioned this pull request Apr 16, 2025
@catenacyber
Copy link
Contributor Author

Next in #13032

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants