aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

plugin: reduce dependency on suricata crate

Browse Source 
Ticket: 7666

The end goal is to remove all dependencies on suricata and just
use suricata_sys or suricata_ffi

For now, make usage of what is already available
pull/14888/head
Philippe Antoine 6 months ago committed by Victor Julien
parent 926fde859e
commit 2a90cef318
2 changed files with 50 additions and 41 deletions
Show Stats Download Patch File Download Diff File

2
examples/plugins/altemplate/src/plugin.rs
Unescape Escape View File

@ -9,7 +9,7 @@ use suricata_sys::sys::{
}; };
extern "C" fn altemplate_plugin_init() { extern "C" fn altemplate_plugin_init() {
suricata::plugin::init(); suricata_ffi::plugin::init();
SCLogNotice!("Initializing altemplate plugin"); SCLogNotice!("Initializing altemplate plugin");
let plugin = SCAppLayerPlugin { let plugin = SCAppLayerPlugin {
name: b"altemplate\0".as_ptr() as *const libc::c_char, name: b"altemplate\0".as_ptr() as *const libc::c_char,

89
examples/plugins/altemplate/src/template.rs
Unescape Escape View File

@ -26,26 +26,26 @@ use std;
use std::collections::VecDeque; use std::collections::VecDeque;
use std::ffi::CString; use std::ffi::CString;
use std::os::raw::{c_char, c_int, c_void}; use std::os::raw::{c_char, c_int, c_void};
use suricata::applayer::{AppLayerResultRust, StreamSliceRust};
use suricata::applayer::{ use suricata::applayer::{
applayer_register_protocol_detection, state_get_tx_iterator, AppLayerEvent, state_get_tx_iterator, AppLayerEvent, AppLayerTxData, State, Transaction,
AppLayerRegisterParser, AppLayerResult, AppLayerStateData, AppLayerTxData, RustParser, State, APP_LAYER_PARSER_EOF_TC, APP_LAYER_PARSER_EOF_TS, APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
StreamSlice, Transaction, APP_LAYER_PARSER_EOF_TC, APP_LAYER_PARSER_EOF_TS,
APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
}; };
use suricata::applayer::{AppLayerResultRust, StreamSliceRust};
use suricata::conf::conf_get; use suricata::conf::conf_get;
use suricata::core::{ALPROTO_UNKNOWN, IPPROTO_TCP}; use suricata::core::IPPROTO_TCP;
use suricata::{build_slice, cast_pointer, export_state_data_get, export_tx_data_get}; use suricata::{build_slice, cast_pointer, export_state_data_get, export_tx_data_get};
use suricata_ffi::{SCLogError, SCLogNotice}; use suricata_ffi::{SCLogError, SCLogNotice};
use suricata_sys::sys::AppProtoEnum::ALPROTO_UNKNOWN;
use suricata_sys::sys::{ use suricata_sys::sys::{
AppLayerParserState, AppProto, Flow, SCAppLayerParserConfParserEnabled, AppLayerParser, AppLayerParserState, AppLayerProtocolDetect, AppLayerResult, AppLayerStateData,
SCAppLayerParserRegisterLogger, SCAppLayerParserStateIssetFlag, AppProto, Flow, SCAppLayerParserConfParserEnabled, SCAppLayerParserRegisterLogger,
SCAppLayerProtoDetectConfProtoDetectionEnabled, SCAppLayerParserStateIssetFlag, SCAppLayerProtoDetectConfProtoDetectionEnabled,
SCAppLayerRegisterParser, SCAppLayerRegisterProtocolDetection, StreamSlice,
}; };
static mut TEMPLATE_MAX_TX: usize = 256; static mut TEMPLATE_MAX_TX: usize = 256;
pub(super) static mut ALPROTO_TEMPLATE: AppProto = ALPROTO_UNKNOWN; pub(super) static mut ALPROTO_TEMPLATE: AppProto = ALPROTO_UNKNOWN as AppProto;
#[derive(AppLayerEvent)] #[derive(AppLayerEvent)]
enum TemplateEvent { enum TemplateEvent {
@ -280,7 +280,7 @@ unsafe extern "C" fn template_probing_parser(
return ALPROTO_TEMPLATE; return ALPROTO_TEMPLATE;
} }
} }
return ALPROTO_UNKNOWN; return ALPROTO_UNKNOWN as AppProto;
} }
extern "C" fn template_state_new(_orig_state: *mut c_void, _orig_proto: AppProto) -> *mut c_void { extern "C" fn template_state_new(_orig_state: *mut c_void, _orig_proto: AppProto) -> *mut c_void {
@ -375,47 +375,56 @@ const PARSER_NAME: &[u8] = b"altemplate\0";
pub(super) unsafe extern "C" fn template_register_parser() { pub(super) unsafe extern "C" fn template_register_parser() {
let default_port = CString::new("[7000]").unwrap(); let default_port = CString::new("[7000]").unwrap();
let parser = RustParser { let parser = AppLayerParser {
name: PARSER_NAME.as_ptr() as *const c_char, name: PARSER_NAME.as_ptr() as *const c_char,
default_port: default_port.as_ptr(), default_port: default_port.as_ptr(),
ipproto: IPPROTO_TCP, ip_proto: IPPROTO_TCP,
probe_ts: Some(template_probing_parser), ProbeTS: Some(template_probing_parser),
probe_tc: Some(template_probing_parser), ProbeTC: Some(template_probing_parser),
min_depth: 0, min_depth: 0,
max_depth: 16, max_depth: 16,
state_new: template_state_new, StateAlloc: Some(template_state_new),
state_free: template_state_free, StateFree: Some(template_state_free),
tx_free: template_state_tx_free, StateTransactionFree: Some(template_state_tx_free),
parse_ts: template_parse_request, ParseTS: Some(template_parse_request),
parse_tc: template_parse_response, ParseTC: Some(template_parse_response),
get_tx_count: template_state_get_tx_count, StateGetTxCnt: Some(template_state_get_tx_count),
get_tx: template_state_get_tx, StateGetTx: Some(template_state_get_tx),
tx_comp_st_ts: 1, complete_ts: 1,
tx_comp_st_tc: 1, complete_tc: 1,
tx_get_progress: template_tx_get_alstate_progress, StateGetProgress: Some(template_tx_get_alstate_progress),
get_eventinfo: Some(TemplateEvent::get_event_info), StateGetEventInfo: Some(TemplateEvent::get_event_info),
get_eventinfo_byid: Some(TemplateEvent::get_event_info_by_id), StateGetEventInfoById: Some(TemplateEvent::get_event_info_by_id),
localstorage_new: None, LocalStorageAlloc: None,
localstorage_free: None, LocalStorageFree: None,
get_tx_files: None, GetTxFiles: None,
get_tx_iterator: Some(state_get_tx_iterator::<TemplateState, TemplateTransaction>), GetTxIterator: Some(state_get_tx_iterator::<TemplateState, TemplateTransaction>),
get_tx_data: template_get_tx_data, GetTxData: Some(template_get_tx_data),
get_state_data: template_get_state_data, GetStateData: Some(template_get_state_data),
apply_tx_config: None, ApplyTxConfig: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS, flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
get_frame_id_by_name: None, GetFrameIdByName: None,
get_frame_name_by_id: None, GetFrameNameById: None,
get_state_id_by_name: None, GetStateIdByName: None,
get_state_name_by_id: None, GetStateNameById: None,
}; };
let ip_proto_str = CString::new("tcp").unwrap(); let ip_proto_str = CString::new("tcp").unwrap();
if SCAppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 { if SCAppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let alproto = applayer_register_protocol_detection(&parser, 1); let parser_detect = AppLayerProtocolDetect {
name: parser.name,
default_port: parser.default_port,
ip_proto: parser.ip_proto,
ProbeTS: parser.ProbeTS,
ProbeTC: parser.ProbeTC,
min_depth: parser.min_depth,
max_depth: parser.max_depth,
};
let alproto = SCAppLayerRegisterProtocolDetection(&parser_detect, 1);
ALPROTO_TEMPLATE = alproto; ALPROTO_TEMPLATE = alproto;
if SCAppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 { if SCAppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, alproto); let _ = SCAppLayerRegisterParser(&parser, alproto);
} }
if let Some(val) = conf_get("app-layer.protocols.template.max-tx") { if let Some(val) = conf_get("app-layer.protocols.template.max-tx") {
if let Ok(v) = val.parse::<usize>() { if let Ok(v) = val.parse::<usize>() {

Write Preview
Loading…
Cancel
Save