mirror of https://github.com/OISF/suricata
plugin: add in-tree app-layer template plugin for testing
Ticket: 7151 Ticket: 7152 Ticket: 7154pull/12980/head
Philippe Antoine
1 year ago
committed by
Jason Ish
parent
51859050cb
commit
5e87b6bd51
@ -0,0 +1,3 @@
|
||||
[build]
|
||||
# custom flags to pass to all compiler invocations
|
||||
rustflags = ["-Clink-args=-Wl,-undefined,dynamic_lookup"]
|
||||
@ -0,0 +1,17 @@
|
||||
[package]
|
||||
name = "suricata-altemplate"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
|
||||
[lib]
|
||||
crate-type = ["cdylib"]
|
||||
|
||||
[dependencies]
|
||||
nom7 = { version="7.0", package="nom" }
|
||||
libc = "~0.2.82"
|
||||
suricata = { path = "../../../rust/" }
|
||||
suricata-sys = { path = "../../../rust/sys" }
|
||||
|
||||
[features]
|
||||
default = ["suricata8"]
|
||||
suricata8 = []
|
||||
@ -0,0 +1,2 @@
|
||||
alert altemplate any any -> any any (msg:"TEST"; altemplate.buffer; content:"Hello"; flow:established,to_server; sid:1; rev:1;)
|
||||
alert altemplate any any -> any any (msg:"TEST"; altemplate.buffer; content:"Bye"; flow:established,to_client; sid:2; rev:1;)
|
||||
@ -0,0 +1,17 @@
|
||||
%YAML 1.1
|
||||
---
|
||||
|
||||
outputs:
|
||||
- eve-log:
|
||||
enabled: yes
|
||||
types:
|
||||
- altemplate
|
||||
- alert
|
||||
- flow
|
||||
|
||||
app-layer:
|
||||
protocols:
|
||||
altemplate:
|
||||
enabled: yes
|
||||
detection-ports:
|
||||
dp: 7000
|
||||
@ -0,0 +1,104 @@
|
||||
/* Copyright (C) 2024 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
// same file as rust/src/applayertemplate/detect.rs except
|
||||
// TEMPLATE_START_REMOVE removed
|
||||
// different paths for use statements
|
||||
// keywords prefixed with altemplate instead of just template
|
||||
|
||||
use super::template::{TemplateTransaction, ALPROTO_TEMPLATE};
|
||||
use std::os::raw::{c_int, c_void};
|
||||
use suricata::cast_pointer;
|
||||
use suricata::detect::{
|
||||
DetectBufferSetActiveList, DetectHelperBufferMpmRegister, DetectHelperGetData,
|
||||
DetectHelperKeywordRegister, DetectSignatureSetAppProto, SCSigTableElmt,
|
||||
SIGMATCH_INFO_STICKY_BUFFER, SIGMATCH_NOOPT,
|
||||
};
|
||||
use suricata::direction::Direction;
|
||||
|
||||
static mut G_TEMPLATE_BUFFER_BUFFER_ID: c_int = 0;
|
||||
|
||||
unsafe extern "C" fn template_buffer_setup(
|
||||
de: *mut c_void, s: *mut c_void, _raw: *const std::os::raw::c_char,
|
||||
) -> c_int {
|
||||
if DetectSignatureSetAppProto(s, ALPROTO_TEMPLATE) != 0 {
|
||||
return -1;
|
||||
}
|
||||
if DetectBufferSetActiveList(de, s, G_TEMPLATE_BUFFER_BUFFER_ID) < 0 {
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/// Get the request/response buffer for a transaction from C.
|
||||
unsafe extern "C" fn template_buffer_get_data(
|
||||
tx: *const c_void, flags: u8, buf: *mut *const u8, len: *mut u32,
|
||||
) -> bool {
|
||||
let tx = cast_pointer!(tx, TemplateTransaction);
|
||||
if flags & Direction::ToClient as u8 != 0 {
|
||||
if let Some(ref response) = tx.response {
|
||||
*len = response.len() as u32;
|
||||
*buf = response.as_ptr();
|
||||
return true;
|
||||
}
|
||||
} else if let Some(ref request) = tx.request {
|
||||
*len = request.len() as u32;
|
||||
*buf = request.as_ptr();
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
unsafe extern "C" fn template_buffer_get(
|
||||
de: *mut c_void, transforms: *const c_void, flow: *const c_void, flow_flags: u8,
|
||||
tx: *const c_void, list_id: c_int,
|
||||
) -> *mut c_void {
|
||||
return DetectHelperGetData(
|
||||
de,
|
||||
transforms,
|
||||
flow,
|
||||
flow_flags,
|
||||
tx,
|
||||
list_id,
|
||||
template_buffer_get_data,
|
||||
);
|
||||
}
|
||||
|
||||
pub(super) unsafe extern "C" fn detect_template_register() {
|
||||
// TODO create a suricata-verify test
|
||||
// Setup a keyword structure and register it
|
||||
let kw = SCSigTableElmt {
|
||||
name: b"altemplate.buffer\0".as_ptr() as *const libc::c_char,
|
||||
desc: b"Template content modifier to match on the template buffer\0".as_ptr()
|
||||
as *const libc::c_char,
|
||||
// TODO use the right anchor for url and write doc
|
||||
url: b"/rules/template-keywords.html#buffer\0".as_ptr() as *const libc::c_char,
|
||||
Setup: template_buffer_setup,
|
||||
flags: SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER,
|
||||
AppLayerTxMatch: None,
|
||||
Free: None,
|
||||
};
|
||||
let _g_template_buffer_kw_id = DetectHelperKeywordRegister(&kw);
|
||||
G_TEMPLATE_BUFFER_BUFFER_ID = DetectHelperBufferMpmRegister(
|
||||
b"altemplate.buffer\0".as_ptr() as *const libc::c_char,
|
||||
b"template.buffer intern description\0".as_ptr() as *const libc::c_char,
|
||||
ALPROTO_TEMPLATE,
|
||||
true, //toclient
|
||||
true, //toserver
|
||||
template_buffer_get,
|
||||
);
|
||||
}
|
||||
@ -0,0 +1,5 @@
|
||||
mod detect;
|
||||
mod log;
|
||||
mod parser;
|
||||
pub mod plugin;
|
||||
mod template;
|
||||
@ -0,0 +1,80 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
// same file as rust/src/applayertemplate/logger.rs except
|
||||
// different paths for use statements
|
||||
// open_object using altemplate instead of just template
|
||||
// Addition of SCJsonBuilderWrapper to look like a rust app-layer
|
||||
// even if we must use C API for SCJsonBuilder (because of its rust repr)
|
||||
|
||||
use super::template::TemplateTransaction;
|
||||
use std::ffi::CString;
|
||||
use suricata::cast_pointer;
|
||||
use suricata::jsonbuilder::JsonError;
|
||||
use suricata_sys::jsonbuilder::{SCJbClose, SCJbOpenObject, SCJbSetString, SCJsonBuilder};
|
||||
|
||||
use std;
|
||||
|
||||
// syntax sugar around C API of SCJsonBuilder to feel like a normal app-layer in log_template
|
||||
pub struct SCJsonBuilderWrapper {
|
||||
inner: *mut SCJsonBuilder,
|
||||
}
|
||||
|
||||
impl SCJsonBuilderWrapper {
|
||||
fn close(&mut self) -> Result<(), JsonError> {
|
||||
if unsafe { !SCJbClose(self.inner) } {
|
||||
return Err(JsonError::Memory);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
fn open_object(&mut self, key: &str) -> Result<(), JsonError> {
|
||||
let keyc = CString::new(key).unwrap();
|
||||
if unsafe { !SCJbOpenObject(self.inner, keyc.as_ptr()) } {
|
||||
return Err(JsonError::Memory);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
fn set_string(&mut self, key: &str, val: &str) -> Result<(), JsonError> {
|
||||
let keyc = CString::new(key).unwrap();
|
||||
let valc = CString::new(val.escape_default().to_string()).unwrap();
|
||||
if unsafe { !SCJbSetString(self.inner, keyc.as_ptr(), valc.as_ptr()) } {
|
||||
return Err(JsonError::Memory);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
fn log_template(tx: &TemplateTransaction, js: &mut SCJsonBuilderWrapper) -> Result<(), JsonError> {
|
||||
js.open_object("altemplate")?;
|
||||
if let Some(ref request) = tx.request {
|
||||
js.set_string("request", request)?;
|
||||
}
|
||||
if let Some(ref response) = tx.response {
|
||||
js.set_string("response", response)?;
|
||||
}
|
||||
js.close()?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub(super) unsafe extern "C" fn template_logger_log(
|
||||
tx: *const std::os::raw::c_void, js: *mut std::os::raw::c_void,
|
||||
) -> bool {
|
||||
let tx = cast_pointer!(tx, TemplateTransaction);
|
||||
let js = cast_pointer!(js, SCJsonBuilder);
|
||||
let mut js = SCJsonBuilderWrapper { inner: js };
|
||||
log_template(tx, &mut js).is_ok()
|
||||
}
|
||||
@ -0,0 +1,66 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
// same file as rust/src/applayertemplate/parser.rs except this comment
|
||||
|
||||
use nom7::{
|
||||
bytes::streaming::{take, take_until},
|
||||
combinator::map_res,
|
||||
IResult,
|
||||
};
|
||||
use std;
|
||||
|
||||
fn parse_len(input: &str) -> Result<u32, std::num::ParseIntError> {
|
||||
input.parse::<u32>()
|
||||
}
|
||||
|
||||
pub(super) fn parse_message(i: &[u8]) -> IResult<&[u8], String> {
|
||||
let (i, len) = map_res(map_res(take_until(":"), std::str::from_utf8), parse_len)(i)?;
|
||||
let (i, _sep) = take(1_usize)(i)?;
|
||||
let (i, msg) = map_res(take(len as usize), std::str::from_utf8)(i)?;
|
||||
let result = msg.to_string();
|
||||
Ok((i, result))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use nom7::Err;
|
||||
|
||||
/// Simple test of some valid data.
|
||||
#[test]
|
||||
fn test_parse_valid() {
|
||||
let buf = b"12:Hello World!4:Bye.";
|
||||
|
||||
let result = parse_message(buf);
|
||||
match result {
|
||||
Ok((remainder, message)) => {
|
||||
// Check the first message.
|
||||
assert_eq!(message, "Hello World!");
|
||||
|
||||
// And we should have 6 bytes left.
|
||||
assert_eq!(remainder.len(), 6);
|
||||
}
|
||||
Err(Err::Incomplete(_)) => {
|
||||
panic!("Result should not have been incomplete.");
|
||||
}
|
||||
Err(Err::Error(err)) | Err(Err::Failure(err)) => {
|
||||
panic!("Result should not be an error: {:?}.", err);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,45 @@
|
||||
use super::template::template_register_parser;
|
||||
use crate::detect::detect_template_register;
|
||||
use crate::log::template_logger_log;
|
||||
use std::ffi::CString;
|
||||
use suricata::{SCLogError, SCLogNotice};
|
||||
use suricata_sys::sys::{
|
||||
SCAppLayerPlugin, SCOutputJsonLogDirection, SCPlugin, SCPluginRegisterAppLayer, SC_API_VERSION,
|
||||
SC_PACKAGE_VERSION,
|
||||
};
|
||||
|
||||
extern "C" fn altemplate_plugin_init() {
|
||||
suricata::plugin::init();
|
||||
SCLogNotice!("Initializing altemplate plugin");
|
||||
let plugin = SCAppLayerPlugin {
|
||||
name: b"altemplate\0".as_ptr() as *const libc::c_char,
|
||||
logname: b"JsonaltemplateLog\0".as_ptr() as *const libc::c_char,
|
||||
confname: b"eve-log.altemplate\0".as_ptr() as *const libc::c_char,
|
||||
dir: SCOutputJsonLogDirection::LOG_DIR_PACKET as u8,
|
||||
Register: Some(template_register_parser),
|
||||
Logger: Some(template_logger_log),
|
||||
KeywordsRegister: Some(detect_template_register),
|
||||
};
|
||||
unsafe {
|
||||
if SCPluginRegisterAppLayer(Box::into_raw(Box::new(plugin))) != 0 {
|
||||
SCLogError!("Failed to register altemplate plugin");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[no_mangle]
|
||||
extern "C" fn SCPluginRegister() -> *const SCPlugin {
|
||||
// leak the CString
|
||||
let plugin_version =
|
||||
CString::new(env!("CARGO_PKG_VERSION")).unwrap().into_raw() as *const libc::c_char;
|
||||
let plugin = SCPlugin {
|
||||
version: SC_API_VERSION, // api version for suricata compatibility
|
||||
suricata_version: SC_PACKAGE_VERSION.as_ptr() as *const libc::c_char,
|
||||
name: b"altemplate\0".as_ptr() as *const libc::c_char,
|
||||
plugin_version,
|
||||
license: b"MIT\0".as_ptr() as *const libc::c_char,
|
||||
author: b"Philippe Antoine\0".as_ptr() as *const libc::c_char,
|
||||
Init: Some(altemplate_plugin_init),
|
||||
};
|
||||
Box::into_raw(Box::new(plugin))
|
||||
}
|
||||
@ -0,0 +1,504 @@
|
||||
/* Copyright (C) 2018-2022 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
// same file as rust/src/applayertemplate/template.rs except
|
||||
// different paths for use statements
|
||||
// remove TEMPLATE_START_REMOVE
|
||||
// name is altemplate instead of template
|
||||
|
||||
use super::parser;
|
||||
use nom7 as nom;
|
||||
use std;
|
||||
use std::collections::VecDeque;
|
||||
use std::ffi::CString;
|
||||
use std::os::raw::{c_char, c_int, c_void};
|
||||
use suricata::applayer::{
|
||||
state_get_tx_iterator, AppLayerEvent, AppLayerParserConfParserEnabled,
|
||||
AppLayerParserRegisterLogger, AppLayerParserStateIssetFlag,
|
||||
AppLayerProtoDetectConfProtoDetectionEnabled, AppLayerRegisterParser,
|
||||
AppLayerRegisterProtocolDetection, AppLayerResult, AppLayerStateData, AppLayerTxData,
|
||||
RustParser, State, StreamSlice, Transaction, APP_LAYER_PARSER_EOF_TC, APP_LAYER_PARSER_EOF_TS,
|
||||
APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
|
||||
};
|
||||
use suricata::conf::conf_get;
|
||||
use suricata::core::{ALPROTO_UNKNOWN, IPPROTO_TCP};
|
||||
use suricata::flow::Flow;
|
||||
use suricata::{
|
||||
build_slice, cast_pointer, export_state_data_get, export_tx_data_get, SCLogError, SCLogNotice,
|
||||
};
|
||||
use suricata_sys::sys::AppProto;
|
||||
|
||||
static mut TEMPLATE_MAX_TX: usize = 256;
|
||||
|
||||
pub(super) static mut ALPROTO_TEMPLATE: AppProto = ALPROTO_UNKNOWN;
|
||||
|
||||
#[derive(AppLayerEvent)]
|
||||
enum TemplateEvent {
|
||||
TooManyTransactions,
|
||||
}
|
||||
|
||||
pub(super) struct TemplateTransaction {
|
||||
tx_id: u64,
|
||||
pub request: Option<String>,
|
||||
pub response: Option<String>,
|
||||
|
||||
tx_data: AppLayerTxData,
|
||||
}
|
||||
|
||||
impl Default for TemplateTransaction {
|
||||
fn default() -> Self {
|
||||
Self::new()
|
||||
}
|
||||
}
|
||||
|
||||
impl TemplateTransaction {
|
||||
pub fn new() -> TemplateTransaction {
|
||||
Self {
|
||||
tx_id: 0,
|
||||
request: None,
|
||||
response: None,
|
||||
tx_data: AppLayerTxData::new(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Transaction for TemplateTransaction {
|
||||
fn id(&self) -> u64 {
|
||||
self.tx_id
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Default)]
|
||||
struct TemplateState {
|
||||
state_data: AppLayerStateData,
|
||||
tx_id: u64,
|
||||
transactions: VecDeque<TemplateTransaction>,
|
||||
request_gap: bool,
|
||||
response_gap: bool,
|
||||
}
|
||||
|
||||
impl State<TemplateTransaction> for TemplateState {
|
||||
fn get_transaction_count(&self) -> usize {
|
||||
self.transactions.len()
|
||||
}
|
||||
|
||||
fn get_transaction_by_index(&self, index: usize) -> Option<&TemplateTransaction> {
|
||||
self.transactions.get(index)
|
||||
}
|
||||
}
|
||||
|
||||
impl TemplateState {
|
||||
pub fn new() -> Self {
|
||||
Default::default()
|
||||
}
|
||||
|
||||
// Free a transaction by ID.
|
||||
fn free_tx(&mut self, tx_id: u64) {
|
||||
let len = self.transactions.len();
|
||||
let mut found = false;
|
||||
let mut index = 0;
|
||||
for i in 0..len {
|
||||
let tx = &self.transactions[i];
|
||||
if tx.tx_id == tx_id + 1 {
|
||||
found = true;
|
||||
index = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if found {
|
||||
self.transactions.remove(index);
|
||||
}
|
||||
}
|
||||
|
||||
pub fn get_tx(&mut self, tx_id: u64) -> Option<&TemplateTransaction> {
|
||||
self.transactions.iter().find(|tx| tx.tx_id == tx_id + 1)
|
||||
}
|
||||
|
||||
fn new_tx(&mut self) -> TemplateTransaction {
|
||||
let mut tx = TemplateTransaction::new();
|
||||
self.tx_id += 1;
|
||||
tx.tx_id = self.tx_id;
|
||||
return tx;
|
||||
}
|
||||
|
||||
fn find_request(&mut self) -> Option<&mut TemplateTransaction> {
|
||||
self.transactions
|
||||
.iter_mut()
|
||||
.find(|tx| tx.response.is_none())
|
||||
}
|
||||
|
||||
fn parse_request(&mut self, input: &[u8]) -> AppLayerResult {
|
||||
// We're not interested in empty requests.
|
||||
if input.is_empty() {
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
// If there was gap, check we can sync up again.
|
||||
if self.request_gap {
|
||||
if probe(input).is_err() {
|
||||
// The parser now needs to decide what to do as we are not in sync.
|
||||
// For this template, we'll just try again next time.
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
// It looks like we're in sync with a message header, clear gap
|
||||
// state and keep parsing.
|
||||
self.request_gap = false;
|
||||
}
|
||||
|
||||
let mut start = input;
|
||||
while !start.is_empty() {
|
||||
match parser::parse_message(start) {
|
||||
Ok((rem, request)) => {
|
||||
start = rem;
|
||||
|
||||
SCLogNotice!("Request: {}", request);
|
||||
let mut tx = self.new_tx();
|
||||
tx.request = Some(request);
|
||||
if self.transactions.len() >= unsafe { TEMPLATE_MAX_TX } {
|
||||
tx.tx_data
|
||||
.set_event(TemplateEvent::TooManyTransactions as u8);
|
||||
}
|
||||
self.transactions.push_back(tx);
|
||||
if self.transactions.len() >= unsafe { TEMPLATE_MAX_TX } {
|
||||
return AppLayerResult::err();
|
||||
}
|
||||
}
|
||||
Err(nom::Err::Incomplete(_)) => {
|
||||
// Not enough data. This parser doesn't give us a good indication
|
||||
// of how much data is missing so just ask for one more byte so the
|
||||
// parse is called as soon as more data is received.
|
||||
let consumed = input.len() - start.len();
|
||||
let needed = start.len() + 1;
|
||||
return AppLayerResult::incomplete(consumed as u32, needed as u32);
|
||||
}
|
||||
Err(_) => {
|
||||
return AppLayerResult::err();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Input was fully consumed.
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
fn parse_response(&mut self, input: &[u8]) -> AppLayerResult {
|
||||
// We're not interested in empty responses.
|
||||
if input.is_empty() {
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
if self.response_gap {
|
||||
if probe(input).is_err() {
|
||||
// The parser now needs to decide what to do as we are not in sync.
|
||||
// For this template, we'll just try again next time.
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
// It looks like we're in sync with a message header, clear gap
|
||||
// state and keep parsing.
|
||||
self.response_gap = false;
|
||||
}
|
||||
let mut start = input;
|
||||
while !start.is_empty() {
|
||||
match parser::parse_message(start) {
|
||||
Ok((rem, response)) => {
|
||||
start = rem;
|
||||
|
||||
if let Some(tx) = self.find_request() {
|
||||
tx.tx_data.updated_tc = true;
|
||||
tx.response = Some(response);
|
||||
SCLogNotice!("Found response for request:");
|
||||
SCLogNotice!("- Request: {:?}", tx.request);
|
||||
SCLogNotice!("- Response: {:?}", tx.response);
|
||||
}
|
||||
}
|
||||
Err(nom::Err::Incomplete(_)) => {
|
||||
let consumed = input.len() - start.len();
|
||||
let needed = start.len() + 1;
|
||||
return AppLayerResult::incomplete(consumed as u32, needed as u32);
|
||||
}
|
||||
Err(_) => {
|
||||
return AppLayerResult::err();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// All input was fully consumed.
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
fn on_request_gap(&mut self, _size: u32) {
|
||||
self.request_gap = true;
|
||||
}
|
||||
|
||||
fn on_response_gap(&mut self, _size: u32) {
|
||||
self.response_gap = true;
|
||||
}
|
||||
}
|
||||
|
||||
/// Probe for a valid header.
|
||||
///
|
||||
/// As this template protocol uses messages prefixed with the size
|
||||
/// as a string followed by a ':', we look at up to the first 10
|
||||
/// characters for that pattern.
|
||||
fn probe(input: &[u8]) -> nom::IResult<&[u8], ()> {
|
||||
let size = std::cmp::min(10, input.len());
|
||||
let (rem, prefix) = nom::bytes::complete::take(size)(input)?;
|
||||
nom::sequence::terminated(
|
||||
nom::bytes::complete::take_while1(nom::character::is_digit),
|
||||
nom::bytes::complete::tag(":"),
|
||||
)(prefix)?;
|
||||
Ok((rem, ()))
|
||||
}
|
||||
|
||||
// C exports.
|
||||
|
||||
/// C entry point for a probing parser.
|
||||
unsafe extern "C" fn rs_template_probing_parser(
|
||||
_flow: *const Flow, _direction: u8, input: *const u8, input_len: u32, _rdir: *mut u8,
|
||||
) -> AppProto {
|
||||
// Need at least 2 bytes.
|
||||
if input_len > 1 && !input.is_null() {
|
||||
let slice = build_slice!(input, input_len as usize);
|
||||
if probe(slice).is_ok() {
|
||||
return ALPROTO_TEMPLATE;
|
||||
}
|
||||
}
|
||||
return ALPROTO_UNKNOWN;
|
||||
}
|
||||
|
||||
extern "C" fn rs_template_state_new(
|
||||
_orig_state: *mut c_void, _orig_proto: AppProto,
|
||||
) -> *mut c_void {
|
||||
let state = TemplateState::new();
|
||||
let boxed = Box::new(state);
|
||||
return Box::into_raw(boxed) as *mut c_void;
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_state_free(state: *mut c_void) {
|
||||
std::mem::drop(Box::from_raw(state as *mut TemplateState));
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_state_tx_free(state: *mut c_void, tx_id: u64) {
|
||||
let state = cast_pointer!(state, TemplateState);
|
||||
state.free_tx(tx_id);
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_parse_request(
|
||||
_flow: *const Flow, state: *mut c_void, pstate: *mut c_void, stream_slice: StreamSlice,
|
||||
_data: *const c_void,
|
||||
) -> AppLayerResult {
|
||||
let eof = AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) > 0;
|
||||
|
||||
if eof {
|
||||
// If needed, handle EOF, or pass it into the parser.
|
||||
return AppLayerResult::ok();
|
||||
}
|
||||
|
||||
let state = cast_pointer!(state, TemplateState);
|
||||
|
||||
if stream_slice.is_gap() {
|
||||
// Here we have a gap signaled by the input being null, but a greater
|
||||
// than 0 input_len which provides the size of the gap.
|
||||
state.on_request_gap(stream_slice.gap_size());
|
||||
AppLayerResult::ok()
|
||||
} else {
|
||||
let buf = stream_slice.as_slice();
|
||||
state.parse_request(buf)
|
||||
}
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_parse_response(
|
||||
_flow: *const Flow, state: *mut c_void, pstate: *mut c_void, stream_slice: StreamSlice,
|
||||
_data: *const c_void,
|
||||
) -> AppLayerResult {
|
||||
let _eof = AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC) > 0;
|
||||
let state = cast_pointer!(state, TemplateState);
|
||||
|
||||
if stream_slice.is_gap() {
|
||||
// Here we have a gap signaled by the input being null, but a greater
|
||||
// than 0 input_len which provides the size of the gap.
|
||||
state.on_response_gap(stream_slice.gap_size());
|
||||
AppLayerResult::ok()
|
||||
} else {
|
||||
let buf = stream_slice.as_slice();
|
||||
state.parse_response(buf)
|
||||
}
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_state_get_tx(state: *mut c_void, tx_id: u64) -> *mut c_void {
|
||||
let state = cast_pointer!(state, TemplateState);
|
||||
match state.get_tx(tx_id) {
|
||||
Some(tx) => {
|
||||
return tx as *const _ as *mut _;
|
||||
}
|
||||
None => {
|
||||
return std::ptr::null_mut();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_state_get_tx_count(state: *mut c_void) -> u64 {
|
||||
let state = cast_pointer!(state, TemplateState);
|
||||
return state.tx_id;
|
||||
}
|
||||
|
||||
unsafe extern "C" fn rs_template_tx_get_alstate_progress(tx: *mut c_void, _direction: u8) -> c_int {
|
||||
let tx = cast_pointer!(tx, TemplateTransaction);
|
||||
|
||||
// Transaction is done if we have a response.
|
||||
if tx.response.is_some() {
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
export_tx_data_get!(rs_template_get_tx_data, TemplateTransaction);
|
||||
export_state_data_get!(rs_template_get_state_data, TemplateState);
|
||||
|
||||
// Parser name as a C style string.
|
||||
const PARSER_NAME: &[u8] = b"altemplate\0";
|
||||
|
||||
pub(super) unsafe extern "C" fn template_register_parser() {
|
||||
let default_port = CString::new("[7000]").unwrap();
|
||||
let parser = RustParser {
|
||||
name: PARSER_NAME.as_ptr() as *const c_char,
|
||||
default_port: default_port.as_ptr(),
|
||||
ipproto: IPPROTO_TCP,
|
||||
probe_ts: Some(rs_template_probing_parser),
|
||||
probe_tc: Some(rs_template_probing_parser),
|
||||
min_depth: 0,
|
||||
max_depth: 16,
|
||||
state_new: rs_template_state_new,
|
||||
state_free: rs_template_state_free,
|
||||
tx_free: rs_template_state_tx_free,
|
||||
parse_ts: rs_template_parse_request,
|
||||
parse_tc: rs_template_parse_response,
|
||||
get_tx_count: rs_template_state_get_tx_count,
|
||||
get_tx: rs_template_state_get_tx,
|
||||
tx_comp_st_ts: 1,
|
||||
tx_comp_st_tc: 1,
|
||||
tx_get_progress: rs_template_tx_get_alstate_progress,
|
||||
get_eventinfo: Some(TemplateEvent::get_event_info),
|
||||
get_eventinfo_byid: Some(TemplateEvent::get_event_info_by_id),
|
||||
localstorage_new: None,
|
||||
localstorage_free: None,
|
||||
get_tx_files: None,
|
||||
get_tx_iterator: Some(state_get_tx_iterator::<TemplateState, TemplateTransaction>),
|
||||
get_tx_data: rs_template_get_tx_data,
|
||||
get_state_data: rs_template_get_state_data,
|
||||
apply_tx_config: None,
|
||||
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
|
||||
get_frame_id_by_name: None,
|
||||
get_frame_name_by_id: None,
|
||||
get_state_id_by_name: None,
|
||||
get_state_name_by_id: None,
|
||||
};
|
||||
|
||||
let ip_proto_str = CString::new("tcp").unwrap();
|
||||
|
||||
if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
|
||||
let alproto = AppLayerRegisterProtocolDetection(&parser, 1);
|
||||
ALPROTO_TEMPLATE = alproto;
|
||||
if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
|
||||
let _ = AppLayerRegisterParser(&parser, alproto);
|
||||
}
|
||||
if let Some(val) = conf_get("app-layer.protocols.template.max-tx") {
|
||||
if let Ok(v) = val.parse::<usize>() {
|
||||
TEMPLATE_MAX_TX = v;
|
||||
} else {
|
||||
SCLogError!("Invalid value for template.max-tx");
|
||||
}
|
||||
}
|
||||
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TEMPLATE);
|
||||
SCLogNotice!("Rust template parser registered.");
|
||||
} else {
|
||||
SCLogNotice!("Protocol detector and parser disabled for TEMPLATE.");
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod test {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn test_probe() {
|
||||
assert!(probe(b"1").is_err());
|
||||
assert!(probe(b"1:").is_ok());
|
||||
assert!(probe(b"123456789:").is_ok());
|
||||
assert!(probe(b"0123456789:").is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_incomplete() {
|
||||
let mut state = TemplateState::new();
|
||||
let buf = b"5:Hello3:bye";
|
||||
|
||||
let r = state.parse_request(&buf[0..0]);
|
||||
assert_eq!(
|
||||
r,
|
||||
AppLayerResult {
|
||||
status: 0,
|
||||
consumed: 0,
|
||||
needed: 0
|
||||
}
|
||||
);
|
||||
|
||||
let r = state.parse_request(&buf[0..1]);
|
||||
assert_eq!(
|
||||
r,
|
||||
AppLayerResult {
|
||||
status: 1,
|
||||
consumed: 0,
|
||||
needed: 2
|
||||
}
|
||||
);
|
||||
|
||||
let r = state.parse_request(&buf[0..2]);
|
||||
assert_eq!(
|
||||
r,
|
||||
AppLayerResult {
|
||||
status: 1,
|
||||
consumed: 0,
|
||||
needed: 3
|
||||
}
|
||||
);
|
||||
|
||||
// This is the first message and only the first message.
|
||||
let r = state.parse_request(&buf[0..7]);
|
||||
assert_eq!(
|
||||
r,
|
||||
AppLayerResult {
|
||||
status: 0,
|
||||
consumed: 0,
|
||||
needed: 0
|
||||
}
|
||||
);
|
||||
|
||||
// The first message and a portion of the second.
|
||||
let r = state.parse_request(&buf[0..9]);
|
||||
assert_eq!(
|
||||
r,
|
||||
AppLayerResult {
|
||||
status: 1,
|
||||
consumed: 7,
|
||||
needed: 3
|
||||
}
|
||||
);
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue