aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust/quic: replace rs_ naming with SC

Browse Source
pull/13152/head
Jason Ish 7 months ago committed by Victor Julien
parent bfa0acf278
commit 4e2f1de308
12 changed files with 40 additions and 56 deletions
Show Stats Download Patch File Download Diff File

14
rust/src/quic/detect.rs
Unescape Escape View File

@ -21,7 +21,7 @@ use std::os::raw::c_void;
use std::ptr; use std::ptr;
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_ua( pub unsafe extern "C" fn SCQuicTxGetUa(
tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 { ) -> u8 {
if let Some(ua) = &tx.ua { if let Some(ua) = &tx.ua {
@ -36,7 +36,7 @@ pub unsafe extern "C" fn rs_quic_tx_get_ua(
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_sni( pub unsafe extern "C" fn SCQuicTxGetSni(
tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 { ) -> u8 {
if let Some(sni) = &tx.sni { if let Some(sni) = &tx.sni {
@ -51,7 +51,7 @@ pub unsafe extern "C" fn rs_quic_tx_get_sni(
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_ja3( pub unsafe extern "C" fn SCQuicTxGetJa3(
tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 { ) -> u8 {
if let Some(ja3) = &tx.ja3 { if let Some(ja3) = &tx.ja3 {
@ -66,7 +66,7 @@ pub unsafe extern "C" fn rs_quic_tx_get_ja3(
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_ja4( pub unsafe extern "C" fn SCQuicTxGetJa4(
tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 { ) -> u8 {
if let Some(ja4) = &tx.ja4 { if let Some(ja4) = &tx.ja4 {
@ -81,7 +81,7 @@ pub unsafe extern "C" fn rs_quic_tx_get_ja4(
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_version( pub unsafe extern "C" fn SCQuicTxGetVersion(
tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32, tx: &QuicTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
) -> u8 { ) -> u8 {
if tx.header.flags.is_long { if tx.header.flags.is_long {
@ -97,7 +97,7 @@ pub unsafe extern "C" fn rs_quic_tx_get_version(
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_cyu_hash( pub unsafe extern "C" fn SCQuicTxGetCyuHash(
_de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8, _de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8,
buffer_len: *mut u32, buffer_len: *mut u32,
) -> bool { ) -> bool {
@ -120,7 +120,7 @@ pub unsafe extern "C" fn rs_quic_tx_get_cyu_hash(
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_cyu_string( pub unsafe extern "C" fn SCQuicTxGetCyuString(
_de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8, _de: *mut DetectEngineThreadCtx, tx: *const c_void, _flags: u8, i: u32, buffer: *mut *const u8,
buffer_len: *mut u32, buffer_len: *mut u32,
) -> bool { ) -> bool {

2
rust/src/quic/logger.rs
Unescape Escape View File

@ -154,7 +154,7 @@ fn log_quic(tx: &QuicTransaction, js: &mut JsonBuilder) -> Result<(), JsonError>
} }
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_to_json( pub unsafe extern "C" fn SCQuicLogJson(
tx: *mut std::os::raw::c_void, js: &mut JsonBuilder, tx: *mut std::os::raw::c_void, js: &mut JsonBuilder,
) -> bool { ) -> bool {
let tx = cast_pointer!(tx, QuicTransaction); let tx = cast_pointer!(tx, QuicTransaction);

60
rust/src/quic/quic.rs
Unescape Escape View File

@ -426,8 +426,7 @@ impl QuicState {
} }
} }
#[no_mangle] extern "C" fn quic_state_new(
pub extern "C" fn rs_quic_state_new(
_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto, _orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto,
) -> *mut std::os::raw::c_void { ) -> *mut std::os::raw::c_void {
let state = QuicState::new(); let state = QuicState::new();
@ -435,20 +434,17 @@ pub extern "C" fn rs_quic_state_new(
return Box::into_raw(boxed) as *mut _; return Box::into_raw(boxed) as *mut _;
} }
#[no_mangle] extern "C" fn quic_state_free(state: *mut std::os::raw::c_void) {
pub extern "C" fn rs_quic_state_free(state: *mut std::os::raw::c_void) {
// Just unbox... // Just unbox...
std::mem::drop(unsafe { Box::from_raw(state as *mut QuicState) }); std::mem::drop(unsafe { Box::from_raw(state as *mut QuicState) });
} }
#[no_mangle] unsafe extern "C" fn quic_state_tx_free(state: *mut std::os::raw::c_void, tx_id: u64) {
pub unsafe extern "C" fn rs_quic_state_tx_free(state: *mut std::os::raw::c_void, tx_id: u64) {
let state = cast_pointer!(state, QuicState); let state = cast_pointer!(state, QuicState);
state.free_tx(tx_id); state.free_tx(tx_id);
} }
#[no_mangle] unsafe extern "C" fn quic_probing_parser(
pub unsafe extern "C" fn rs_quic_probing_parser(
_flow: *const Flow, _direction: u8, input: *const u8, input_len: u32, _rdir: *mut u8, _flow: *const Flow, _direction: u8, input: *const u8, input_len: u32, _rdir: *mut u8,
) -> AppProto { ) -> AppProto {
if input.is_null() { if input.is_null() {
@ -463,8 +459,7 @@ pub unsafe extern "C" fn rs_quic_probing_parser(
} }
} }
#[no_mangle] unsafe extern "C" fn quic_parse_tc(
pub unsafe extern "C" fn rs_quic_parse_tc(
_flow: *const Flow, state: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void, _flow: *const Flow, state: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void,
stream_slice: StreamSlice, _data: *const std::os::raw::c_void, stream_slice: StreamSlice, _data: *const std::os::raw::c_void,
) -> AppLayerResult { ) -> AppLayerResult {
@ -478,8 +473,7 @@ pub unsafe extern "C" fn rs_quic_parse_tc(
} }
} }
#[no_mangle] unsafe extern "C" fn quic_parse_ts(
pub unsafe extern "C" fn rs_quic_parse_ts(
_flow: *const Flow, state: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void, _flow: *const Flow, state: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void,
stream_slice: StreamSlice, _data: *const std::os::raw::c_void, stream_slice: StreamSlice, _data: *const std::os::raw::c_void,
) -> AppLayerResult { ) -> AppLayerResult {
@ -493,8 +487,7 @@ pub unsafe extern "C" fn rs_quic_parse_ts(
} }
} }
#[no_mangle] unsafe extern "C" fn quic_state_get_tx(
pub unsafe extern "C" fn rs_quic_state_get_tx(
state: *mut std::os::raw::c_void, tx_id: u64, state: *mut std::os::raw::c_void, tx_id: u64,
) -> *mut std::os::raw::c_void { ) -> *mut std::os::raw::c_void {
let state = cast_pointer!(state, QuicState); let state = cast_pointer!(state, QuicState);
@ -508,28 +501,19 @@ pub unsafe extern "C" fn rs_quic_state_get_tx(
} }
} }
#[no_mangle] unsafe extern "C" fn quic_state_get_tx_count(state: *mut std::os::raw::c_void) -> u64 {
pub unsafe extern "C" fn rs_quic_state_get_tx_count(state: *mut std::os::raw::c_void) -> u64 {
let state = cast_pointer!(state, QuicState); let state = cast_pointer!(state, QuicState);
return state.max_tx_id; return state.max_tx_id;
} }
#[no_mangle] unsafe extern "C" fn quic_tx_get_alstate_progress(
pub extern "C" fn rs_quic_state_progress_completion_status(_direction: u8) -> std::os::raw::c_int {
// This parser uses 1 to signal transaction completion status.
return 1;
}
#[no_mangle]
pub unsafe extern "C" fn rs_quic_tx_get_alstate_progress(
tx: *mut std::os::raw::c_void, _direction: u8, tx: *mut std::os::raw::c_void, _direction: u8,
) -> std::os::raw::c_int { ) -> std::os::raw::c_int {
let _tx = cast_pointer!(tx, QuicTransaction); let _tx = cast_pointer!(tx, QuicTransaction);
return 1; return 1;
} }
#[no_mangle] unsafe extern "C" fn quic_state_get_tx_iterator(
pub unsafe extern "C" fn rs_quic_state_get_tx_iterator(
_ipproto: u8, _alproto: AppProto, state: *mut std::os::raw::c_void, min_tx_id: u64, _ipproto: u8, _alproto: AppProto, state: *mut std::os::raw::c_void, min_tx_id: u64,
_max_tx_id: u64, istate: &mut u64, _max_tx_id: u64, istate: &mut u64,
) -> applayer::AppLayerGetTxIterTuple { ) -> applayer::AppLayerGetTxIterTuple {
@ -553,32 +537,32 @@ export_state_data_get!(quic_get_state_data, QuicState);
const PARSER_NAME: &[u8] = b"quic\0"; const PARSER_NAME: &[u8] = b"quic\0";
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_quic_register_parser() { pub unsafe extern "C" fn SCRegisterQuicParser() {
let default_port = CString::new("[443,80]").unwrap(); let default_port = CString::new("[443,80]").unwrap();
let parser = RustParser { let parser = RustParser {
name: PARSER_NAME.as_ptr() as *const std::os::raw::c_char, name: PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
default_port: default_port.as_ptr(), default_port: default_port.as_ptr(),
ipproto: IPPROTO_UDP, ipproto: IPPROTO_UDP,
probe_ts: Some(rs_quic_probing_parser), probe_ts: Some(quic_probing_parser),
probe_tc: Some(rs_quic_probing_parser), probe_tc: Some(quic_probing_parser),
min_depth: 0, min_depth: 0,
max_depth: 16, max_depth: 16,
state_new: rs_quic_state_new, state_new: quic_state_new,
state_free: rs_quic_state_free, state_free: quic_state_free,
tx_free: rs_quic_state_tx_free, tx_free: quic_state_tx_free,
parse_ts: rs_quic_parse_ts, parse_ts: quic_parse_ts,
parse_tc: rs_quic_parse_tc, parse_tc: quic_parse_tc,
get_tx_count: rs_quic_state_get_tx_count, get_tx_count: quic_state_get_tx_count,
get_tx: rs_quic_state_get_tx, get_tx: quic_state_get_tx,
tx_comp_st_ts: 1, tx_comp_st_ts: 1,
tx_comp_st_tc: 1, tx_comp_st_tc: 1,
tx_get_progress: rs_quic_tx_get_alstate_progress, tx_get_progress: quic_tx_get_alstate_progress,
get_eventinfo: Some(QuicEvent::get_event_info), get_eventinfo: Some(QuicEvent::get_event_info),
get_eventinfo_byid: Some(QuicEvent::get_event_info_by_id), get_eventinfo_byid: Some(QuicEvent::get_event_info_by_id),
localstorage_new: None, localstorage_new: None,
localstorage_free: None, localstorage_free: None,
get_tx_files: None, get_tx_files: None,
get_tx_iterator: Some(rs_quic_state_get_tx_iterator), get_tx_iterator: Some(quic_state_get_tx_iterator),
get_tx_data: quic_get_tx_data, get_tx_data: quic_get_tx_data,
get_state_data: quic_get_state_data, get_state_data: quic_get_state_data,
apply_tx_config: None, apply_tx_config: None,

2
src/app-layer-parser.c
Unescape Escape View File

@ -1794,7 +1794,7 @@ void AppLayerParserRegisterProtocolParsers(void)
SCRegisterDhcpParser(); SCRegisterDhcpParser();
SCRegisterSnmpParser(); SCRegisterSnmpParser();
SCRegisterSipParser(); SCRegisterSipParser();
rs_quic_register_parser(); SCRegisterQuicParser();
rs_websocket_register_parser(); rs_websocket_register_parser();
SCRegisterLdapTcpParser(); SCRegisterLdapTcpParser();
SCRegisterLdapUdpParser(); SCRegisterLdapUdpParser();

2
src/detect-ja4-hash.c
Unescape Escape View File

@ -170,7 +170,7 @@ static InspectionBuffer *Ja4DetectGetHash(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (rs_quic_tx_get_ja4(txv, &b, &b_len) != 1) if (SCQuicTxGetJa4(txv, &b, &b_len) != 1)
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;

2
src/detect-quic-cyu-hash.c
Unescape Escape View File

@ -69,7 +69,7 @@ void DetectQuicCyuHashRegister(void)
#endif #endif
DetectAppLayerMultiRegister( DetectAppLayerMultiRegister(
BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, rs_quic_tx_get_cyu_hash, 2); BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, SCQuicTxGetCyuHash, 2);
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);

2
src/detect-quic-cyu-string.c
Unescape Escape View File

@ -67,7 +67,7 @@ void DetectQuicCyuStringRegister(void)
#endif #endif
DetectAppLayerMultiRegister( DetectAppLayerMultiRegister(
BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, rs_quic_tx_get_cyu_string, 2); BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, SCQuicTxGetCyuString, 2);
DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);

2
src/detect-quic-sni.c
Unescape Escape View File

@ -55,7 +55,7 @@ static InspectionBuffer *GetSniData(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (rs_quic_tx_get_sni(txv, &b, &b_len) != 1) if (SCQuicTxGetSni(txv, &b, &b_len) != 1)
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;

2
src/detect-quic-ua.c
Unescape Escape View File

@ -55,7 +55,7 @@ static InspectionBuffer *GetUaData(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (rs_quic_tx_get_ua(txv, &b, &b_len) != 1) if (SCQuicTxGetUa(txv, &b, &b_len) != 1)
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;

2
src/detect-quic-version.c
Unescape Escape View File

@ -55,7 +55,7 @@ static InspectionBuffer *GetVersionData(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (rs_quic_tx_get_version(txv, &b, &b_len) != 1) if (SCQuicTxGetVersion(txv, &b, &b_len) != 1)
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;

2
src/output.c
Unescape Escape View File

@ -914,7 +914,7 @@ void OutputRegisterRootLoggers(void)
// ALPROTO_IKE special: uses state // ALPROTO_IKE special: uses state
RegisterSimpleJsonApplayerLogger( RegisterSimpleJsonApplayerLogger(
ALPROTO_KRB5, (EveJsonSimpleTxLogFunc)SCKrb5LogJsonResponse, NULL); ALPROTO_KRB5, (EveJsonSimpleTxLogFunc)SCKrb5LogJsonResponse, NULL);
RegisterSimpleJsonApplayerLogger(ALPROTO_QUIC, (EveJsonSimpleTxLogFunc)rs_quic_to_json, NULL); RegisterSimpleJsonApplayerLogger(ALPROTO_QUIC, (EveJsonSimpleTxLogFunc)SCQuicLogJson, NULL);
// ALPROTO_DHCP TODO missing // ALPROTO_DHCP TODO missing
RegisterSimpleJsonApplayerLogger(ALPROTO_SIP, (EveJsonSimpleTxLogFunc)SCSipLogJson, NULL); RegisterSimpleJsonApplayerLogger(ALPROTO_SIP, (EveJsonSimpleTxLogFunc)SCSipLogJson, NULL);
RegisterSimpleJsonApplayerLogger(ALPROTO_RFB, (EveJsonSimpleTxLogFunc)rs_rfb_logger_log, NULL); RegisterSimpleJsonApplayerLogger(ALPROTO_RFB, (EveJsonSimpleTxLogFunc)rs_rfb_logger_log, NULL);

4
src/util-ja3.c
Unescape Escape View File

@ -267,7 +267,7 @@ InspectionBuffer *Ja3DetectGetHash(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (rs_quic_tx_get_ja3(txv, &b, &b_len) != 1) if (SCQuicTxGetJa3(txv, &b, &b_len) != 1)
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;
@ -292,7 +292,7 @@ InspectionBuffer *Ja3DetectGetString(DetectEngineThreadCtx *det_ctx,
uint32_t b_len = 0; uint32_t b_len = 0;
const uint8_t *b = NULL; const uint8_t *b = NULL;
if (rs_quic_tx_get_ja3(txv, &b, &b_len) != 1) if (SCQuicTxGetJa3(txv, &b, &b_len) != 1)
return NULL; return NULL;
if (b == NULL || b_len == 0) if (b == NULL || b_len == 0)
return NULL; return NULL;

Write Preview
Loading…
Cancel
Save