aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

proto/detect: remove probing parser offset argument

Browse Source 
Remove offset argument as it was unused.
pull/3440/head
Victor Julien 7 years ago
parent 991ec4ed60
commit fd38989113
21 changed files with 38 additions and 58 deletions
Show Stats Download Patch File Download Diff File

3
rust/src/dhcp/dhcp.rs
Unescape Escape View File

@ -201,8 +201,7 @@ impl DHCPState {
#[no_mangle]
pub extern "C" fn rs_dhcp_probing_parser(_flow: *const Flow,
input: *const libc::uint8_t,
input_len: u32,
_offset: *const u32) -> AppProto {
input_len: u32) -> AppProto {
if input_len < DHCP_MIN_FRAME_LEN {
return ALPROTO_UNKNOWN;
}

2
rust/src/ikev2/ikev2.rs
Unescape Escape View File

@ -610,7 +610,7 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const libc::c_char,
static mut ALPROTO_IKEV2 : AppProto = ALPROTO_UNKNOWN;
#[no_mangle]
pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow, input:*const libc::uint8_t, input_len: u32, _offset: *const u32) -> AppProto {
pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow, input:*const libc::uint8_t, input_len: u32) -> AppProto {
let slice = build_slice!(input,input_len as usize);
let alproto = unsafe{ ALPROTO_IKEV2 };
match parse_ikev2_header(slice) {

6
rust/src/krb/krb5.rs
Unescape Escape View File

@ -404,7 +404,7 @@ pub extern "C" fn rs_krb5_state_get_event_info(event_name: *const libc::c_char,
static mut ALPROTO_KRB5 : AppProto = ALPROTO_UNKNOWN;
#[no_mangle]
pub extern "C" fn rs_krb5_probing_parser(_flow: *const Flow, input:*const libc::uint8_t, input_len: u32, _offset: *const u32) -> AppProto {
pub extern "C" fn rs_krb5_probing_parser(_flow: *const Flow, input:*const libc::uint8_t, input_len: u32) -> AppProto {
let slice = build_slice!(input,input_len as usize);
let alproto = unsafe{ ALPROTO_KRB5 };
if slice.len() <= 10 { return unsafe{ALPROTO_FAILED}; }
@ -438,13 +438,13 @@ pub extern "C" fn rs_krb5_probing_parser(_flow: *const Flow, input:*const libc::
}
#[no_mangle]
pub extern "C" fn rs_krb5_probing_parser_tcp(_flow: *const Flow, input:*const libc::uint8_t, input_len: u32, _offset: *const u32) -> AppProto {
pub extern "C" fn rs_krb5_probing_parser_tcp(_flow: *const Flow, input:*const libc::uint8_t, input_len: u32) -> AppProto {
let slice = build_slice!(input,input_len as usize);
if slice.len() <= 14 { return unsafe{ALPROTO_FAILED}; }
match be_u32(slice) {
IResult::Done(rem, record_mark) => {
if record_mark != rem.len() as u32 { return unsafe{ALPROTO_FAILED}; }
return rs_krb5_probing_parser(_flow, rem.as_ptr(), rem.len() as u32, _offset);
return rs_krb5_probing_parser(_flow, rem.as_ptr(), rem.len() as u32);
},
IResult::Incomplete(_) => {
return ALPROTO_UNKNOWN;

2
rust/src/ntp/ntp.rs
Unescape Escape View File

@ -343,7 +343,7 @@ pub extern "C" fn rs_ntp_state_get_event_info(event_name: *const libc::c_char,
static mut ALPROTO_NTP : AppProto = ALPROTO_UNKNOWN;
#[no_mangle]
pub extern "C" fn ntp_probing_parser(_flow: *const Flow, input:*const u8, input_len: u32, _offset: *const u32) -> AppProto {
pub extern "C" fn ntp_probing_parser(_flow: *const Flow, input:*const u8, input_len: u32) -> AppProto {
let slice: &[u8] = unsafe { std::slice::from_raw_parts(input as *mut u8, input_len as usize) };
let alproto = unsafe{ ALPROTO_NTP };
match parse_ntp(slice) {

2
rust/src/parser.rs
Unescape Escape View File

@ -125,7 +125,7 @@ pub type ParseFn = extern "C" fn (flow: *const Flow,
input_len: u32,
data: *const c_void,
flags: u8) -> i8;
pub type ProbeFn = extern "C" fn (flow: *const Flow,input:*const u8, input_len: u32, offset: *const u32) -> AppProto;
pub type ProbeFn = extern "C" fn (flow: *const Flow,input:*const u8, input_len: u32) -> AppProto;
pub type StateAllocFn = extern "C" fn () -> *mut c_void;
pub type StateFreeFn = extern "C" fn (*mut c_void);
pub type StateTxFreeFn = extern "C" fn (*mut c_void, u64);

11
src/app-layer-detect-proto.c
Unescape Escape View File

@ -420,9 +420,9 @@ static AppProto AppLayerProtoDetectPPGetProto(Flow *f,
}
if (direction & STREAM_TOSERVER && pe->ProbingParserTs != NULL) {
alproto = pe->ProbingParserTs(f, buf, buflen, NULL);
alproto = pe->ProbingParserTs(f, buf, buflen);
} else if (pe->ProbingParserTc != NULL) {
alproto = pe->ProbingParserTc(f, buf, buflen, NULL);
alproto = pe->ProbingParserTc(f, buf, buflen);
}
if (alproto != ALPROTO_UNKNOWN && alproto != ALPROTO_FAILED)
goto end;
@ -441,9 +441,9 @@ static AppProto AppLayerProtoDetectPPGetProto(Flow *f,
}
if (direction & STREAM_TOSERVER && pe->ProbingParserTs != NULL) {
alproto = pe->ProbingParserTs(f, buf, buflen, NULL);
alproto = pe->ProbingParserTs(f, buf, buflen);
} else if (pe->ProbingParserTc != NULL) {
alproto = pe->ProbingParserTc(f, buf, buflen, NULL);
alproto = pe->ProbingParserTc(f, buf, buflen);
}
if (alproto != ALPROTO_UNKNOWN && alproto != ALPROTO_FAILED)
goto end;
@ -3105,8 +3105,7 @@ static int AppLayerProtoDetectPPTestData(AppLayerProtoDetectProbingParser *pp,
static uint16_t ProbingParserDummyForTesting(Flow *f,
uint8_t *input,
uint32_t input_len,
uint32_t *offset)
uint32_t input_len)
{
return 0;
}

3
src/app-layer-detect-proto.h
Unescape Escape View File

@ -28,8 +28,7 @@
typedef struct AppLayerProtoDetectThreadCtx_ AppLayerProtoDetectThreadCtx;
typedef AppProto (*ProbingParserFPtr)(Flow *f,
uint8_t *input, uint32_t input_len,
uint32_t *offset);
uint8_t *input, uint32_t input_len);
/***** Protocol Retrieval *****/

13
src/app-layer-dnp3.c
Unescape Escape View File

@ -264,8 +264,7 @@ static int DNP3ContainsBanner(const uint8_t *input, uint32_t len)
/**
* \brief DNP3 probing parser.
*/
static uint16_t DNP3ProbingParser(Flow *f, uint8_t *input, uint32_t len,
uint32_t *offset)
static uint16_t DNP3ProbingParser(Flow *f, uint8_t *input, uint32_t len)
{
DNP3LinkHeader *hdr = (DNP3LinkHeader *)input;
@ -2044,25 +2043,25 @@ static int DNP3ProbingParserTest(void)
};
/* Valid frame. */
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(pkt), NULL) != ALPROTO_DNP3);
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(pkt)) != ALPROTO_DNP3);
/* Send too little bytes. */
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(DNP3LinkHeader) - 1, NULL) != ALPROTO_UNKNOWN);
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(DNP3LinkHeader) - 1) != ALPROTO_UNKNOWN);
/* Bad start bytes. */
pkt[0] = 0x06;
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(pkt), NULL) != ALPROTO_FAILED);
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(pkt)) != ALPROTO_FAILED);
/* Restore start byte. */
pkt[0] = 0x05;
/* Set the length to a value less than the minimum length of 5. */
pkt[2] = 0x03;
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(pkt), NULL) != ALPROTO_FAILED);
FAIL_IF(DNP3ProbingParser(NULL, pkt, sizeof(pkt)) != ALPROTO_FAILED);
/* Send a banner. */
char mybanner[] = "Welcome to DNP3 SCADA.";
FAIL_IF(DNP3ProbingParser(NULL, (uint8_t *)mybanner, sizeof(mybanner), NULL) != ALPROTO_DNP3);
FAIL_IF(DNP3ProbingParser(NULL, (uint8_t *)mybanner, sizeof(mybanner)) != ALPROTO_DNP3);
PASS;
}

3
src/app-layer-dns-tcp-rust.c
Unescape Escape View File

@ -52,8 +52,7 @@ static int RustDNSTCPParseResponse(Flow *f, void *state,
local_data);
}
static uint16_t RustDNSTCPProbe(Flow *f, uint8_t *input, uint32_t len,
uint32_t *offset)
static uint16_t RustDNSTCPProbe(Flow *f, uint8_t *input, uint32_t len)
{
SCLogDebug("RustDNSTCPProbe");
if (len == 0 || len < sizeof(DNSHeader)) {

13
src/app-layer-dns-tcp.c
Unescape Escape View File

@ -62,8 +62,7 @@ struct DNSTcpHeader_ {
} __attribute__((__packed__));
typedef struct DNSTcpHeader_ DNSTcpHeader;
static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
uint32_t *offset);
static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen);
/** \internal
* \param input_len at least enough for the DNSTcpHeader
@ -317,7 +316,7 @@ static int DNSTCPRequestParse(Flow *f, void *dstate,
/* Clear gap state. */
if (dns_state->gap_ts) {
if (DNSTcpProbingParser(f, input, input_len, NULL) == ALPROTO_DNS) {
if (DNSTcpProbingParser(f, input, input_len) == ALPROTO_DNS) {
SCLogDebug("New data probed as DNS, clearing gap state.");
BufferReset(dns_state);
dns_state->gap_ts = 0;
@ -557,7 +556,7 @@ static int DNSTCPResponseParse(Flow *f, void *dstate,
/* Clear gap state. */
if (dns_state->gap_tc) {
if (DNSTcpProbingParser(f, input, input_len, NULL) == ALPROTO_DNS) {
if (DNSTcpProbingParser(f, input, input_len) == ALPROTO_DNS) {
SCLogDebug("New data probed as DNS, clearing gap state.");
BufferReset(dns_state);
dns_state->gap_tc = 0;
@ -639,8 +638,7 @@ bad_data:
SCReturnInt(-1);
}
static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
uint32_t *offset)
static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen)
{
if (ilen == 0 || ilen < sizeof(DNSTcpHeader)) {
SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSTcpHeader));
@ -680,8 +678,7 @@ static uint16_t DNSTcpProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
* This is a minimal parser that just checks that the input contains enough
* data for a TCP DNS response.
*/
static uint16_t DNSTcpProbeResponse(Flow *f, uint8_t *input, uint32_t len,
uint32_t *offset)
static uint16_t DNSTcpProbeResponse(Flow *f, uint8_t *input, uint32_t len)
{
if (len == 0 || len < sizeof(DNSTcpHeader)) {
return ALPROTO_UNKNOWN;

3
src/app-layer-dns-udp-rust.c
Unescape Escape View File

@ -50,8 +50,7 @@ static int RustDNSUDPParseResponse(Flow *f, void *state,
local_data);
}
static uint16_t DNSUDPProbe(Flow *f, uint8_t *input, uint32_t len,
uint32_t *offset)
static uint16_t DNSUDPProbe(Flow *f, uint8_t *input, uint32_t len)
{
if (len == 0 || len < sizeof(DNSHeader)) {
return ALPROTO_UNKNOWN;

3
src/app-layer-dns-udp.c
Unescape Escape View File

@ -330,8 +330,7 @@ insufficient_data:
SCReturnInt(-1);
}
static uint16_t DNSUdpProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
uint32_t *offset)
static uint16_t DNSUdpProbingParser(Flow *f, uint8_t *input, uint32_t ilen)
{
if (ilen == 0 || ilen < sizeof(DNSHeader)) {
SCLogDebug("ilen too small, hoped for at least %"PRIuMAX, (uintmax_t)sizeof(DNSHeader));

3
src/app-layer-enip.c
Unescape Escape View File

@ -359,8 +359,7 @@ static int ENIPParse(Flow *f, void *state, AppLayerParserState *pstate,
static uint16_t ENIPProbingParser(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static uint16_t ENIPProbingParser(Flow *f, uint8_t *input, uint32_t input_len)
{
// SCLogDebug("ENIPProbingParser %d", input_len);
if (input_len < sizeof(ENIPEncapHdr))

3
src/app-layer-modbus.c
Unescape Escape View File

@ -1428,8 +1428,7 @@ static void ModbusStateFree(void *state)
static uint16_t ModbusProbingParser(Flow *f,
uint8_t *input,
uint32_t input_len,
uint32_t *offset)
uint32_t input_len)
{
ModbusHeader *header = (ModbusHeader *) input;

6
src/app-layer-nfs-tcp.c
Unescape Escape View File

@ -112,8 +112,7 @@ static AppLayerDecoderEvents *NFSTCPGetEvents(void *state, uint64_t id)
* \retval ALPROTO_NFS if it looks like echo, otherwise
* ALPROTO_UNKNOWN.
*/
static AppProto NFSTCPProbingParserTS(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static AppProto NFSTCPProbingParserTS(Flow *f, uint8_t *input, uint32_t input_len)
{
if (input_len < NFSTCP_MIN_FRAME_LEN) {
return ALPROTO_UNKNOWN;
@ -130,8 +129,7 @@ static AppProto NFSTCPProbingParserTS(Flow *f, uint8_t *input, uint32_t input_le
return ALPROTO_UNKNOWN;
}
static AppProto NFSTCPProbingParserTC(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static AppProto NFSTCPProbingParserTC(Flow *f, uint8_t *input, uint32_t input_len)
{
if (input_len < NFSTCP_MIN_FRAME_LEN) {
return ALPROTO_UNKNOWN;

6
src/app-layer-nfs-udp.c
Unescape Escape View File

@ -109,8 +109,7 @@ static AppLayerDecoderEvents *NFSGetEvents(void *state, uint64_t id)
* \retval ALPROTO_NFS if it looks like echo, otherwise
* ALPROTO_UNKNOWN.
*/
static AppProto NFSProbingParserTS(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static AppProto NFSProbingParserTS(Flow *f, uint8_t *input, uint32_t input_len)
{
SCLogDebug("probing");
if (input_len < NFS_MIN_FRAME_LEN) {
@ -131,8 +130,7 @@ static AppProto NFSProbingParserTS(Flow *f, uint8_t *input, uint32_t input_len,
return ALPROTO_UNKNOWN;
}
static AppProto NFSProbingParserTC(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static AppProto NFSProbingParserTC(Flow *f, uint8_t *input, uint32_t input_len)
{
SCLogDebug("probing");
if (input_len < NFS_MIN_FRAME_LEN) {

2
src/app-layer-smb-tcp-rust.c
Unescape Escape View File

@ -78,7 +78,7 @@ static int RustSMBTCPParseResponse(Flow *f, void *state,
}
static uint16_t RustSMBTCPProbe(Flow *f,
uint8_t *input, uint32_t len, uint32_t *offset)
uint8_t *input, uint32_t len)
{
SCLogDebug("RustSMBTCPProbe");

3
src/app-layer-smb.c
Unescape Escape View File

@ -1510,8 +1510,7 @@ static int SMBGetAlstateProgress(void *tx, uint8_t direction)
#define SMB_PROBING_PARSER_MIN_DEPTH 8
static uint16_t SMBProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
uint32_t *offset)
static uint16_t SMBProbingParser(Flow *f, uint8_t *input, uint32_t ilen)
{
int32_t len;
int32_t input_len = ilen;

3
src/app-layer-ssl.c
Unescape Escape View File

@ -2332,8 +2332,7 @@ static void SSLStateTransactionFree(void *state, uint64_t tx_id)
/* do nothing */
}
static uint16_t SSLProbingParser(Flow *f, uint8_t *input, uint32_t ilen,
uint32_t *offset)
static uint16_t SSLProbingParser(Flow *f, uint8_t *input, uint32_t ilen)
{
/* probably a rst/fin sending an eof */
if (ilen == 0)

3
src/app-layer-template.c
Unescape Escape View File

@ -195,8 +195,7 @@ static AppLayerDecoderEvents *TemplateGetEvents(void *state, uint64_t tx_id)
* \retval ALPROTO_TEMPLATE if it looks like echo, otherwise
* ALPROTO_UNKNOWN.
*/
static AppProto TemplateProbingParser(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static AppProto TemplateProbingParser(Flow *f, uint8_t *input, uint32_t input_len)
{
/* Very simple test - if there is input, this is echo. */
if (input_len >= TEMPLATE_MIN_FRAME_LEN) {

3
src/app-layer-tftp.c
Unescape Escape View File

@ -112,8 +112,7 @@ static AppLayerDecoderEvents *TFTPGetEvents(void *state, uint64_t tx_id)
* \retval ALPROTO_TFTP if it looks like echo, otherwise
* ALPROTO_UNKNOWN.
*/
static AppProto TFTPProbingParser(Flow *f, uint8_t *input, uint32_t input_len,
uint32_t *offset)
static AppProto TFTPProbingParser(Flow *f, uint8_t *input, uint32_t input_len)
{
/* Very simple test - if there is input, this is tftp.
* Also check if it's starting by a zero */

Write Preview
Loading…
Cancel
Save