Skip to content

7.0.x 7323 mqtt/v1 #12155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jasonish wants to merge 2 commits into from
Closed

7.0.x 7323 mqtt/v1 #12155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6dde3ee
mqtt: add reason code support for SUBACK
satta Oct 20, 2024
d474393
mqtt: double-check detection directions
jasonish Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions rust/src/mqtt/detect.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,6 +373,27 @@ pub unsafe extern "C" fn rs_mqtt_tx_get_reason_code(tx: &MQTTTransaction, result

#[no_mangle]
pub extern "C" fn rs_mqtt_tx_unsuback_has_reason_code(tx: &MQTTTransaction, code: u8) -> u8 {
for msg in tx.msg.iter() {
match msg.op {
MQTTOperation::UNSUBACK(ref unsuback) => {
if let Some(ref reason_codes) = unsuback.reason_codes {
for rc in reason_codes.iter() {
if *rc == code {
return 1;
}
}
}
}
MQTTOperation::SUBACK(ref suback) => {
for rc in suback.qoss.iter() {
if *rc == code {
return 1;
}
}
}
_ => {}
}
}
for msg in tx.msg.iter() {
if let MQTTOperation::UNSUBACK(ref unsuback) = msg.op {
if let Some(ref reason_codes) = unsuback.reason_codes {
Expand Down
2 changes: 1 addition & 1 deletion src/detect-mqtt-connack-sessionpresent.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ void DetectMQTTConnackSessionPresentRegister (void)
DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);

DetectAppLayerInspectEngineRegister2("mqtt.connack.session_present", ALPROTO_MQTT,
SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL);
SIG_FLAG_TOCLIENT, 1, DetectEngineInspectGenericList, NULL);
Comment on lines 65 to +66
Copy link
Member Author

@jasonish jasonish Nov 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@catenacyber Here in the C version of registering this keyword we use a progress of 1. However, over in master when going through Rust its always a progress of 0. Should these be 0 over here? What was the reason for always using a progress of 0 instead of carrying over the values from C.

Copy link
Contributor

@catenacyber catenacyber Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there was no reason.

Does that change behavior ?

See cca59cd for some similar stuff...

You can try to have a MQTT transaction with a request and no answer yet (so tx progress is 1 to server, but 0 to client) and a rule to_client that gets evaluated and dropped before getting the data...
Does that make sense ?

Copy link
Member Author

@jasonish jasonish Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know mqtt enough right now. But looks to be an oversight in the Rust registration of keywords?

Copy link
Contributor

@catenacyber catenacyber Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess a review of all progresses could be beneficial (some inconsistent progress seen in TLS for multi-buffer IIRC)


mqtt_connack_session_present_id = DetectBufferTypeGetByName("mqtt.connack.session_present");
}
Expand Down
4 changes: 4 additions & 0 deletions src/detect-mqtt-publish-topic.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,10 +81,14 @@ void DetectMQTTPublishTopicRegister(void)
DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_MQTT,
SIG_FLAG_TOSERVER, 0,
DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_MQTT, SIG_FLAG_TOCLIENT, 0,
DetectEngineInspectBufferGeneric, GetData);

DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
PrefilterGenericMpmRegister, GetData, ALPROTO_MQTT,
1);
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_MQTT, 1);
Comment on lines +90 to +91
Copy link
Member Author

@jasonish jasonish Nov 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, we've changed the progress from 1 to 0 with the migration to Rust for keyword registration.


DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);

Expand Down
2 changes: 2 additions & 0 deletions src/detect-mqtt-reason-code.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,8 @@ void DetectMQTTReasonCodeRegister (void)

DetectAppLayerInspectEngineRegister2("mqtt.reason_code", ALPROTO_MQTT, SIG_FLAG_TOSERVER, 1,
DetectEngineInspectGenericList, NULL);
DetectAppLayerInspectEngineRegister2("mqtt.reason_code", ALPROTO_MQTT, SIG_FLAG_TOCLIENT, 1,
DetectEngineInspectGenericList, NULL);

mqtt_reason_code_id = DetectBufferTypeGetByName("mqtt.reason_code");
}
Expand Down
4 changes: 4 additions & 0 deletions src/detect-mqtt-subscribe-topic.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,10 +214,14 @@ void DetectMQTTSubscribeTopicRegister (void)
DetectAppLayerMpmRegister2("mqtt.subscribe.topic", SIG_FLAG_TOSERVER, 1,
PrefilterMpmMQTTSubscribeTopicRegister, NULL,
ALPROTO_MQTT, 1);
DetectAppLayerMpmRegister2("mqtt.subscribe.topic", SIG_FLAG_TOCLIENT, 1,
PrefilterMpmMQTTSubscribeTopicRegister, NULL, ALPROTO_MQTT, 1);

DetectAppLayerInspectEngineRegister2("mqtt.subscribe.topic",
ALPROTO_MQTT, SIG_FLAG_TOSERVER, 1,
DetectEngineInspectMQTTSubscribeTopic, NULL);
DetectAppLayerInspectEngineRegister2("mqtt.subscribe.topic", ALPROTO_MQTT, SIG_FLAG_TOCLIENT, 1,
DetectEngineInspectMQTTSubscribeTopic, NULL);

DetectBufferTypeSetDescriptionByName("mqtt.subscribe.topic",
"subscribe topic query");
Expand Down
2 changes: 2 additions & 0 deletions src/detect-mqtt-type.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,8 @@ void DetectMQTTTypeRegister (void)
sigmatch_table[DETECT_AL_MQTT_TYPE].RegisterTests = MQTTTypeRegisterTests;
#endif

DetectAppLayerInspectEngineRegister2(
"mqtt.type", ALPROTO_MQTT, SIG_FLAG_TOCLIENT, 1, DetectEngineInspectGenericList, NULL);
DetectAppLayerInspectEngineRegister2(
"mqtt.type", ALPROTO_MQTT, SIG_FLAG_TOSERVER, 1, DetectEngineInspectGenericList, NULL);

Expand Down