aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust: format nfs files

Browse Source 
Ticket: 3836
pull/15486/head
Philippe Antoine 2 months ago committed by Victor Julien
parent a783007408
commit 3bfe6cf4b9
7 changed files with 82 additions and 41 deletions
Show Stats Download Patch File Download Diff File

1
.github/workflows/builds.yml vendored
Unescape Escape View File

@ -394,6 +394,7 @@ jobs:
rust/src/rfb/*.rs rust/src/ssh/*.rs rust/src/utils/*.rs rust/src/websocket/*.rs
rust/src/dhcp/*.rs rust/src/krb/*.rs rust/src/mdns/*.rs rust/src/pop3/*.rs
rust/src/http2/*.rs rust/src/ike/*.rs rust/src/modbus/*.rs rust/src/mqtt/*.rs
rust/src/nfs/*.rs
- name: Check if Cargo.lock.in is up to date
run: |
cp rust/Cargo.lock rust/Cargo.lock.in

2
rust/src/nfs/log.rs
Unescape Escape View File

@ -15,12 +15,12 @@
* 02110-1301, USA.
*/
use crate::detect::EnumString;
use crate::jsonbuilder::{JsonBuilder, JsonError};
use crate::nfs::nfs::*;
use crate::nfs::types::*;
use crc::crc32;
use std::string::String;
use crate::detect::EnumString;
#[no_mangle]
pub extern "C" fn SCNfsTxLoggingIsFiltered(state: &mut NFSState, tx: &NFSTransaction) -> u8 {

77
rust/src/nfs/nfs.rs
Unescape Escape View File

@ -36,9 +36,9 @@ use crate::conf::*;
use crate::core::*;
use crate::direction::Direction;
use crate::direction::DIR_BOTH;
use crate::filetracker::*;
use crate::filecontainer::FileContainerWrapper;
use crate::flow::{Flow, flow_get_last_time};
use crate::filetracker::*;
use crate::flow::{flow_get_last_time, Flow};
use crate::frames::*;
use crate::nfs::nfs2_records::*;
@ -969,7 +969,9 @@ impl NFSState {
return None;
}
pub fn process_write_record<'b>(&mut self, flow: *mut Flow, r: &RpcPacket<'b>, w: &Nfs3RequestWrite<'b>) -> u32 {
pub fn process_write_record<'b>(
&mut self, flow: *mut Flow, r: &RpcPacket<'b>, w: &Nfs3RequestWrite<'b>,
) -> u32 {
let mut fill_bytes = 0;
let pad = w.count % 4;
if pad != 0 {
@ -1011,7 +1013,10 @@ impl NFSState {
tx.is_last = true;
tx.response_done = true;
tx.is_file_closed = true;
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
}
true
} else {
@ -1042,7 +1047,10 @@ impl NFSState {
tx.is_last = true;
tx.request_done = true;
tx.is_file_closed = true;
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
}
}
}
@ -1136,7 +1144,9 @@ impl NFSState {
// update in progress chunks for file transfers
// return how much data we consumed
fn filetracker_update(&mut self, flow: *mut Flow, direction: Direction, data: &[u8], gap_size: u32) -> u32 {
fn filetracker_update(
&mut self, flow: *mut Flow, direction: Direction, data: &[u8], gap_size: u32,
) -> u32 {
let mut chunk_left = if direction == Direction::ToServer {
self.ts_chunk_left
} else {
@ -1239,7 +1249,10 @@ impl NFSState {
tx.id
);
if !flow.is_null() {
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
}
} else {
tx.request_done = true;
@ -1249,7 +1262,10 @@ impl NFSState {
tx.id
);
if !flow.is_null() {
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
}
}
}
@ -1358,14 +1374,20 @@ impl NFSState {
tx.nfs_response_status = reply.status;
tx.is_last = true;
tx.request_done = true;
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
/* if this is a partial record we will close the tx
* when we've received the final data */
if !is_partial {
tx.response_done = true;
SCLogDebug!("TX {} is DONE", tx.id);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
}
}
true
@ -1401,14 +1423,20 @@ impl NFSState {
tx.nfs_response_status = reply.status;
tx.is_last = true;
tx.request_done = true;
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
/* if this is a partial record we will close the tx
* when we've received the final data */
if !is_partial {
tx.response_done = true;
SCLogDebug!("TX {} is DONE", tx.id);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
}
}
}
@ -1457,7 +1485,8 @@ impl NFSState {
pub fn parse_tcp_data_ts_gap(&mut self, gap_size: u32) -> AppLayerResult {
SCLogDebug!("parse_tcp_data_ts_gap ({})", gap_size);
let gap = vec![0; gap_size as usize];
let consumed = self.filetracker_update(std::ptr::null_mut(), Direction::ToServer, &gap, gap_size);
let consumed =
self.filetracker_update(std::ptr::null_mut(), Direction::ToServer, &gap, gap_size);
if consumed > gap_size {
SCLogDebug!("consumed more than GAP size: {} > {}", consumed, gap_size);
return AppLayerResult::ok();
@ -1471,7 +1500,8 @@ impl NFSState {
pub fn parse_tcp_data_tc_gap(&mut self, gap_size: u32) -> AppLayerResult {
SCLogDebug!("parse_tcp_data_tc_gap ({})", gap_size);
let gap = vec![0; gap_size as usize];
let consumed = self.filetracker_update(std::ptr::null_mut(), Direction::ToClient, &gap, gap_size);
let consumed =
self.filetracker_update(std::ptr::null_mut(), Direction::ToClient, &gap, gap_size);
if consumed > gap_size {
SCLogDebug!("consumed more than GAP size: {} > {}", consumed, gap_size);
return AppLayerResult::ok();
@ -1484,8 +1514,8 @@ impl NFSState {
/// Handle partial records
fn parse_tcp_partial_data_ts<'b>(
&mut self, flow: *mut Flow, base_input: &'b [u8], cur_i: &'b [u8], phdr: &RpcRequestPacketPartial,
rec_size: usize,
&mut self, flow: *mut Flow, base_input: &'b [u8], cur_i: &'b [u8],
phdr: &RpcRequestPacketPartial, rec_size: usize,
) -> AppLayerResult {
// special case: avoid buffering file write blobs
// as these can be large.
@ -1674,7 +1704,8 @@ impl NFSState {
/// Handle partial records
fn parse_tcp_partial_data_tc<'b>(
&mut self, flow: *mut Flow, base_input: &'b [u8], cur_i: &'b [u8], phdr: &RpcPacketHeader, rec_size: usize,
&mut self, flow: *mut Flow, base_input: &'b [u8], cur_i: &'b [u8], phdr: &RpcPacketHeader,
rec_size: usize,
) -> AppLayerResult {
// special case: avoid buffering file read blobs
// as these can be large.
@ -1858,9 +1889,7 @@ impl NFSState {
AppLayerResult::ok()
}
/// Parsing function
pub fn parse_udp_ts(
&mut self, flow: *mut Flow, stream_slice: &StreamSlice,
) -> AppLayerResult {
pub fn parse_udp_ts(&mut self, flow: *mut Flow, stream_slice: &StreamSlice) -> AppLayerResult {
let input = stream_slice.as_slice();
SCLogDebug!("parse_udp_ts ({})", input.len());
self.add_rpc_udp_ts_pdu(flow, stream_slice, input, input.len() as i64);
@ -1900,9 +1929,7 @@ impl NFSState {
}
/// Parsing function
pub fn parse_udp_tc(
&mut self, flow: *mut Flow, stream_slice: &StreamSlice,
) -> AppLayerResult {
pub fn parse_udp_tc(&mut self, flow: *mut Flow, stream_slice: &StreamSlice) -> AppLayerResult {
let input = stream_slice.as_slice();
SCLogDebug!("parse_udp_tc ({})", input.len());
self.add_rpc_udp_tc_pdu(flow, stream_slice, input, input.len() as i64);
@ -2043,7 +2070,9 @@ unsafe extern "C" fn nfs_tx_get_alstate_progress(
}
}
unsafe extern "C" fn nfs_get_tx_data(tx: *mut std::os::raw::c_void) -> *mut suricata_sys::sys::AppLayerTxData {
unsafe extern "C" fn nfs_get_tx_data(
tx: *mut std::os::raw::c_void,
) -> *mut suricata_sys::sys::AppLayerTxData {
let tx = cast_pointer!(tx, NFSTransaction);
return &mut tx.tx_data.0;
}

4
rust/src/nfs/nfs2.rs
Unescape Escape View File

@ -103,7 +103,9 @@ impl NFSState {
self.requestmap.put(r.hdr.xid, xidmap);
}
pub fn process_reply_record_v2(&mut self, flow: *mut Flow, r: &RpcReplyPacket, xidmap: &NFSRequestXidMap) {
pub fn process_reply_record_v2(
&mut self, flow: *mut Flow, r: &RpcReplyPacket, xidmap: &NFSRequestXidMap,
) {
let mut nfs_status = 0;
let resp_handle = Vec::new();

6
rust/src/nfs/nfs3.rs
Unescape Escape View File

@ -18,8 +18,8 @@
// written by Victor Julien
use crate::direction::Direction;
use crate::nfs::nfs::*;
use crate::flow::Flow;
use crate::nfs::nfs::*;
use crate::nfs::nfs3_records::*;
use crate::nfs::rpc_records::*;
use crate::nfs::types::*;
@ -200,7 +200,9 @@ impl NFSState {
self.requestmap.put(r.hdr.xid, xidmap);
}
pub fn process_reply_record_v3(&mut self, flow: *mut Flow, r: &RpcReplyPacket, xidmap: &mut NFSRequestXidMap) {
pub fn process_reply_record_v3(
&mut self, flow: *mut Flow, r: &RpcReplyPacket, xidmap: &mut NFSRequestXidMap,
) {
let mut nfs_status = 0;
let mut resp_handle = Vec::new();

22
rust/src/nfs/nfs4.rs
Unescape Escape View File

@ -22,8 +22,8 @@ use nom7::number::streaming::be_u32;
use nom7::{Err, IResult};
use crate::direction::Direction;
use crate::nfs::nfs::*;
use crate::flow::Flow;
use crate::nfs::nfs::*;
use crate::nfs::nfs4_records::*;
use crate::nfs::nfs_records::*;
use crate::nfs::rpc_records::*;
@ -378,9 +378,11 @@ impl NFSState {
self.namemap
.put(rd.value.to_vec(), xidmap.file_name.to_vec());
}
Nfs4ResponseContent::PutRootFH(s) if s == NFS4_OK && xidmap.file_name.is_empty() => {
xidmap.file_name = b"<mount_root>".to_vec();
SCLogDebug!("filename {:?}", xidmap.file_name);
Nfs4ResponseContent::PutRootFH(s)
if s == NFS4_OK && xidmap.file_name.is_empty() =>
{
xidmap.file_name = b"<mount_root>".to_vec();
SCLogDebug!("filename {:?}", xidmap.file_name);
}
_ => {}
}
@ -388,11 +390,19 @@ impl NFSState {
if main_opcode_status_set {
let resp_handle = Vec::new();
self.mark_response_tx_done(flow, r.hdr.xid, r.reply_state, main_opcode_status, &resp_handle);
self.mark_response_tx_done(
flow,
r.hdr.xid,
r.reply_state,
main_opcode_status,
&resp_handle,
);
}
}
pub fn process_reply_record_v4(&mut self, flow: *mut Flow, r: &RpcReplyPacket, xidmap: &mut NFSRequestXidMap) {
pub fn process_reply_record_v4(
&mut self, flow: *mut Flow, r: &RpcReplyPacket, xidmap: &mut NFSRequestXidMap,
) {
if xidmap.procedure == NFSPROC4_COMPOUND {
let mut data = r.prog_data;

11
rust/src/nfs/types.rs
Unescape Escape View File

@ -323,8 +323,7 @@ pub enum NfsProc4 {
pub const NFS4_OK: u32 = 0;
pub(super) fn nfs_is_read(version: u16, proc: u32) -> bool {
match version
{
match version {
2 => proc == (NfsProc2::READ as u32),
3 => proc == (NfsProc3::READ as u32),
4 => proc == (NfsProc4::READ as u32),
@ -333,8 +332,7 @@ pub(super) fn nfs_is_read(version: u16, proc: u32) -> bool {
}
pub(super) fn nfs_is_write(version: u16, proc: u32) -> bool {
match version
{
match version {
2 => proc == (NfsProc2::WRITE as u32),
3 => proc == (NfsProc3::WRITE as u32),
4 => proc == (NfsProc4::WRITE as u32),
@ -343,11 +341,10 @@ pub(super) fn nfs_is_write(version: u16, proc: u32) -> bool {
}
pub(super) fn nfs_is_rename(version: u16, proc: u32) -> bool {
match version
{
match version {
2 => proc == (NfsProc2::RENAME as u32),
3 => proc == (NfsProc3::RENAME as u32),
4 => proc == (NfsProc4::RENAME as u32),
_ => false,
}
}
}

Write Preview
Loading…
Cancel
Save