aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'a472dec865'
${ noResults }
suricata/rust/src/parser.rs

189 lines
7.8 KiB
Rust
Raw Normal View History Unescape Escape

rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/* Copyright (C) 2017 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
// written by Pierre Chifflier <chifflier@wzdftpd.net>
//! Parser registration functions and common interface
use core::{DetectEngineState,Flow,AppLayerEventType,AppLayerDecoderEvents,AppProto};
use filecontainer::FileContainer;
Rust: expose function AppLayerParserRegisterGetTxIterator
7 years ago
use applayer;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
rust: remove libc crate dependency Use std::os::raw instead.
6 years ago
use std::os::raw::{c_void,c_char,c_int};
rust: add get_tx_iterator to parser registration
7 years ago
use applayer::{AppLayerGetTxIterTuple};
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Rust parser declaration
#[repr(C)]
pub struct RustParser {
/// Parser name.
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub name: *const c_char,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Default port
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub default_port: *const c_char,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
rust/mingw: fix missing IPPROTO_* declarations The libc crate doesn't provide these on MinGW, so define them in our 'core' instead. We only use IPPROTO_TCP and IPPROTO_UDP. Bug #2733
6 years ago
/// IP Protocol (core::IPPROTO_UDP, core::IPPROTO_TCP, etc.)
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub ipproto: c_int,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Probing function, for packets going to server
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub probe_ts: ProbeFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Probing function, for packets going to client
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub probe_tc: ProbeFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Minimum frame depth for probing
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub min_depth: u16,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Maximum frame depth for probing
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub max_depth: u16,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Allocation function for a new state
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub state_new: StateAllocFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function called to free a state
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub state_free: StateFreeFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Parsing function, for packets going to server
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub parse_ts: ParseFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Parsing function, for packets going to client
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub parse_tc: ParseFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Get the current transaction count
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_tx_count: StateGetTxCntFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Get a transaction
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_tx: StateGetTxFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function called to free a transaction
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub tx_free: StateTxFreeFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function returning the current transaction completion status
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub tx_get_comp_st: StateGetTxCompletionStatusFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function returning the current transaction progress
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub tx_get_progress: StateGetProgressFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Logged transaction getter function
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_tx_logged: Option<GetTxLoggedFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Logged transaction setter function
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub set_tx_logged: Option<SetTxLoggedFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function called to get a detection state
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_de_state: GetDetectStateFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function called to set a detection state
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub set_de_state: SetDetectStateFn,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function to get events
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_events: Option<GetEventsFn>,
/// Function to get an event id from a description
pub get_eventinfo: Option<GetEventInfoFn>,
/// Function to get an event description from an event id
pub get_eventinfo_byid: Option<GetEventInfoByIdFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function to allocate local storage
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub localstorage_new: Option<LocalStorageNewFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function to free local storage
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub localstorage_free: Option<LocalStorageFreeFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function to get transaction MPM ID
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_tx_mpm_id: Option<GetTxMpmIDFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function to set transaction MPM ID
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub set_tx_mpm_id: Option<SetTxMpmIDFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
/// Function to get files
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_files: Option<GetFilesFn>,
rust: add get_tx_iterator to parser registration
7 years ago
/// Function to get the TX iterator
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub get_tx_iterator: Option<GetTxIteratorFn>,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
}
/// Create a slice, given a buffer and a length
///
/// UNSAFE !
#[macro_export]
macro_rules! build_slice {
($buf:ident, $len:expr) => ( unsafe{ std::slice::from_raw_parts($buf, $len) } );
}
/// Cast pointer to a variable, as a mutable reference to an object
///
/// UNSAFE !
#[macro_export]
macro_rules! cast_pointer {
($ptr:ident, $ty:ty) => ( unsafe{ &mut *($ptr as *mut $ty) } );
}
pub type ParseFn = extern "C" fn (flow: *const Flow,
state: *mut c_void,
Rust: fix prototype of parsing function (make pstate mutable)
8 years ago
pstate: *mut c_void,
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
input: *const u8,
input_len: u32,
app-layer: pass STREAM_* flags to parser Pass the STREAM_* flags to the app-layer parser functions so that the parser can know more about how it is called.
7 years ago
data: *const c_void,
rust/applayer: use correct return type for Parser The mismatch between the types would randomly lead to the return code of the Rust parser to be not correctly handled over the C/Rust boundary. This would lead to the API considering a parser to be in error state when it was not.
7 years ago
flags: u8) -> i32;
proto-detect: improve midstream support When Suricata picks up a flow it assumes the first packet is toserver. In a perfect world without packet loss and where all sessions neatly start after Suricata itself started, this would be true. However, in reality we have to account for packet loss and Suricata starting to get packets for flows already active be for Suricata is (re)started. The protocol records on the wire would often be able to tell us more though. For example in SMB1 and SMB2 records there is a flag that indicates whether the record is a request or a response. This patch is enabling the procotol detection engine to utilize this information to 'reverse' the flow. There are three ways in which this is supported in this patch: 1. patterns for detection are registered per direction. If the proto was not recognized in the traffic direction, and midstream is enabled, the pattern set for the opposing direction is also evaluated. If that matches, the flow is considered to be in the wrong direction and is reversed. 2. probing parsers now have a way to feed back their understanding of the flow direction. They are now passed the direction as Suricata sees the traffic when calling the probing parsers. The parser can then see if its own observation matches that, and pass back it's own view to the caller. 3. a new pattern + probing parser set up: probing parsers can now be registered with a pattern, so that when the pattern matches the probing parser is called as well. The probing parser can then provide the protocol detection engine with the direction of the traffic. The process of reversing takes a multi step approach as well: a. reverse the current packets direction b. reverse most of the flows direction sensitive flags c. tag the flow as 'reversed'. This is because the 5 tuple is *not* reversed, since it is immutable after the flows creation. Most of the currently registered parsers benefit already: - HTTP/SMTP/FTP/TLS patterns are registered per direction already so they will benefit from the pattern midstream logic in (1) above. - the Rust based SMB parser uses a mix of pattern + probing parser as described in (3) above. - the NFS detection is purely done by probing parser and is updated to consider the direction in that parser. Other protocols, such as DNS, are still to do. Ticket: #2572
6 years ago
pub type ProbeFn = extern "C" fn (flow: *const Flow,direction: u8,input:*const u8, input_len: u32, rdir: *mut u8) -> AppProto;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
pub type StateAllocFn = extern "C" fn () -> *mut c_void;
pub type StateFreeFn = extern "C" fn (*mut c_void);
pub type StateTxFreeFn = extern "C" fn (*mut c_void, u64);
pub type StateGetTxFn = extern "C" fn (*mut c_void, u64) -> *mut c_void;
pub type StateGetTxCntFn = extern "C" fn (*mut c_void) -> u64;
pub type StateGetTxCompletionStatusFn = extern "C" fn (u8) -> c_int;
pub type StateGetProgressFn = extern "C" fn (*mut c_void, u8) -> c_int;
pub type GetDetectStateFn = extern "C" fn (*mut c_void) -> *mut DetectEngineState;
rust: update 'external' api for app layer changes Remove unused HasTxDetectState function and remove state argument from SetTxDetectState. Update NTP code.
8 years ago
pub type SetDetectStateFn = extern "C" fn (*mut c_void, &mut DetectEngineState) -> c_int;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
pub type GetEventInfoFn = extern "C" fn (*const c_char, *mut c_int, *mut AppLayerEventType) -> c_int;
rust/parser: Extend Rust parser for event-by-id Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.
6 years ago
pub type GetEventInfoByIdFn = extern "C" fn (c_int, *mut *const c_char, *mut AppLayerEventType) -> i8;
eve/logging: 2991 Optimize logging by TX This changeset makes changes to the TX logging path. Since the txn is passed to the TX logger, the TX can be used directly instead of through the TX id.
6 years ago
pub type GetEventsFn = extern "C" fn (*mut c_void) -> *mut AppLayerDecoderEvents;
app-layer: use logger bits to avoid looping Avoid looping in transaction output. Update app-layer API to store the bits in one step and retrieve the bits in a single step as well. Update users of the API.
8 years ago
pub type GetTxLoggedFn = extern "C" fn (*mut c_void, *mut c_void) -> u32;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
pub type SetTxLoggedFn = extern "C" fn (*mut c_void, *mut c_void, u32);
pub type LocalStorageNewFn = extern "C" fn () -> *mut c_void;
pub type LocalStorageFreeFn = extern "C" fn (*mut c_void);
pub type GetTxMpmIDFn = extern "C" fn (*mut c_void) -> u64;
pub type SetTxMpmIDFn = extern "C" fn (*mut c_void, u64) -> c_int;
pub type GetFilesFn = extern "C" fn (*mut c_void, u8) -> *mut FileContainer;
rust: add get_tx_iterator to parser registration
7 years ago
pub type GetTxIteratorFn = extern "C" fn (ipproto: u8, alproto: AppProto,
state: *mut c_void,
min_tx_id: u64,
max_tx_id: u64,
istate: &mut u64)
-> AppLayerGetTxIterTuple;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
// Defined in app-layer-register.h
extern {
pub fn AppLayerRegisterProtocolDetection(parser: *const RustParser, enable_default: c_int) -> AppProto;
rust/ntp: convert parser to new registration method Converting the NTP parser to the new registration method is a simple, 3-steps process: - change the extern functions to use generic input parameters (functions in all parsers must share common types to be generic) and cast them - declare the Parser structure - remove the C code and call the registration function
8 years ago
pub fn AppLayerRegisterParser(parser: *const RustParser, alproto: AppProto) -> c_int;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
}
// Defined in app-layer-detect-proto.h
extern {
pub fn AppLayerProtoDetectConfProtoDetectionEnabled(ipproto: *const c_char, proto: *const c_char) -> c_int;
}
// Defined in app-layer-parser.h
Rust: expose function AppLayerParserStateSetFlag
8 years ago
pub const APP_LAYER_PARSER_EOF : u8 = 0b0;
pub const APP_LAYER_PARSER_NO_INSPECTION : u8 = 0b1;
pub const APP_LAYER_PARSER_NO_REASSEMBLY : u8 = 0b10;
pub const APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD : u8 = 0b100;
pub const APP_LAYER_PARSER_BYPASS_READY : u8 = 0b1000;
Rust: expose function AppLayerParserRegisterGetTxIterator
7 years ago
pub type AppLayerGetTxIteratorFn = extern "C" fn (ipproto: u8,
alproto: AppProto,
alstate: *mut c_void,
min_tx_id: u64,
max_tx_id: u64,
istate: &mut u64) -> applayer::AppLayerGetTxIterTuple;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
extern {
Rust: expose function AppLayerParserStateSetFlag
8 years ago
pub fn AppLayerParserStateSetFlag(state: *mut c_void, flag: u8);
rust: expose AppLayerParserStateIssetFlag to Rust.
7 years ago
pub fn AppLayerParserStateIssetFlag(state: *mut c_void, flag: u8) -> c_int;
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
pub fn AppLayerParserConfParserEnabled(ipproto: *const c_char, proto: *const c_char) -> c_int;
Rust: expose function AppLayerParserRegisterGetTxIterator
7 years ago
pub fn AppLayerParserRegisterGetTxIterator(ipproto: u8, alproto: AppProto, fun: AppLayerGetTxIteratorFn);
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked.
8 years ago
}