mysql: implement keyword rows

Task #3446

rust/src/mysql/mysql.rs

@@ -1034,6 +1034,27 @@ pub unsafe extern "C" fn SCMysqlTxGetCommand(
     false
 }
 
+/// Get the mysql rows at index i
+#[no_mangle]
+pub unsafe extern "C" fn SCMysqlGetRowsData(
+    tx: &mut MysqlTransaction, i: u32, buf: *mut *const u8, len: *mut u32,
+) -> bool {
+    if let Some(rows) = &tx.rows {
+        if !rows.is_empty() {
+            let index = i as usize;
+            if let Some(row) = rows.get(index) {
+                if !row.is_empty() {
+                    *buf = row.as_ptr();
+                    *len = row.len() as u32;
+                    return true;
+                }
+            }
+        }
+    }
+
+    false
+}
+
 // Parser name as a C style string.
 const PARSER_NAME: &[u8] = b"mysql\0";
 

src/Makefile.am

@@ -243,6 +243,7 @@ noinst_HEADERS = \
 	detect-quic-cyu-string.h \
 	detect-msg.h \
 	detect-mysql-command.h \
+	detect-mysql-rows.h \
 	detect-nfs-procedure.h \
 	detect-nfs-version.h \
 	detect-noalert.h \
@@ -813,6 +814,7 @@ libsuricata_c_a_SOURCES = \
 	detect-quic-cyu-string.c \
 	detect-msg.c \
 	detect-mysql-command.c \
+	detect-mysql-rows.c \
 	detect-nfs-procedure.c \
 	detect-nfs-version.c \
 	detect-noalert.c \

src/detect-engine-register.c

@@ -261,6 +261,7 @@
 #include "detect-ike-nonce-payload.h"
 #include "detect-ike-key-exchange-payload.h"
 #include "detect-mysql-command.h"
+#include "detect-mysql-rows.h"
 
 #include "action-globals.h"
 #include "tm-threads.h"

src/detect-engine-register.h

@@ -329,6 +329,7 @@ enum DetectKeywordId {
     DETECT_AL_JA4_HASH,
 
     DETECT_AL_MYSQL_COMMAND,
+    DETECT_AL_MYSQL_ROWS,
 
     /* make sure this stays last */
     DETECT_TBLSIZE_STATIC,

src/detect-mysql-rows.c

@@ -0,0 +1,88 @@
+/* Copyright (C) 2023 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * Detect keyword for Mysql rows: mysql.rows
+ */
+
+#include "detect.h"
+#include "detect-parse.h"
+#include "detect-engine.h"
+#include "detect-engine-prefilter.h"
+#include "detect-engine-content-inspection.h"
+#include "detect-mysql-rows.h"
+#include "util-profiling.h"
+#include "rust.h"
+
+static int detect_buffer_id = 0;
+
+static int DetectSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
+{
+    if (DetectBufferSetActiveList(de_ctx, s, detect_buffer_id) < 0) {
+        return -1;
+    }
+    if (DetectSignatureSetAppProto(s, ALPROTO_MYSQL) < 0) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static InspectionBuffer *GetBuffer(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t flags, void *txv,
+        const int list_id, uint32_t local_id)
+{
+    SCEnter();
+
+    InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, local_id);
+    if (buffer == NULL)
+        return NULL;
+    if (buffer->initialized)
+        return buffer;
+
+    const uint8_t *data;
+    uint32_t data_len;
+    if (SCMysqlGetRowsData(txv, local_id, &data, &data_len) == 0) {
+        InspectionBufferSetupMultiEmpty(buffer);
+        return NULL;
+    }
+    InspectionBufferSetupMulti(buffer, transforms, data, data_len);
+    buffer->flags = DETECT_CI_FLAGS_SINGLE;
+
+    SCReturnPtr(buffer, "InspectionBuffer");
+    return buffer;
+}
+
+void DetectMysqlRowsRegister(void)
+{
+    static const char *keyword = "mysql.rows";
+    sigmatch_table[DETECT_AL_MYSQL_ROWS].name = keyword;
+    sigmatch_table[DETECT_AL_MYSQL_ROWS].desc = "Mysql rows";
+    sigmatch_table[DETECT_AL_MYSQL_ROWS].url = "todo";
+    sigmatch_table[DETECT_AL_MYSQL_ROWS].Setup = DetectSetup;
+    sigmatch_table[DETECT_AL_MYSQL_ROWS].flags |= SIGMATCH_NOOPT;
+
+     DetectAppLayerMultiRegister(keyword, ALPROTO_MYSQL, SIG_FLAG_TOCLIENT, 0,
+            GetBuffer, 2, 1);
+
+    DetectBufferTypeSetDescriptionByName(keyword, "mysql rows");
+    DetectBufferTypeSupportsMultiInstance(keyword);
+
+    detect_buffer_id = DetectBufferTypeGetByName(keyword);
+}

src/detect-mysql-rows.h

@@ -0,0 +1,23 @@
+/* Copyright (C) 2023 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef SURICATA_DETECT_MYSQL_ROWS_H
+#define SURICATA_DETECT_MYSQL_ROWS_H
+
+void DetectMysqlRowsRegister(void);
+
+#endif /* SURICATA_DETECT_MYSQL_ROWS_H */