aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust: bindgen frames functions

Browse Source 
Ticket: 7667
pull/14271/head
Philippe Antoine 1 year ago committed by Victor Julien
parent 92c7be1cb6
commit 439f96dea7
21 changed files with 137 additions and 107 deletions
Show Stats Download Patch File Download Diff File

9
rust/src/dcerpc/dcerpc.rs
Unescape Escape View File

@ -897,10 +897,11 @@ impl DCERPCState {
}
let mut frag_bytes_consumed: u16 = 0;
let mut flow = std::ptr::null();
if let Some(f) = self.flow {
flow = f;
}
let flow = if let Some(f) = self.flow {
f
} else {
std::ptr::null_mut()
};
// Check if header data was complete. In case of EoF or incomplete data, wait for more
// data else return error
if self.header.is_none() && !cur_i.is_empty() {

4
rust/src/dns/dns.rs
Unescape Escape View File

@ -638,7 +638,7 @@ impl DNSState {
}
pub(crate) fn parse_request_udp(
&mut self, flow: *const Flow, stream_slice: StreamSlice,
&mut self, flow: *mut Flow, stream_slice: StreamSlice,
) -> bool {
let input = stream_slice.as_slice();
let frame = Frame::new(
@ -652,7 +652,7 @@ impl DNSState {
self.parse_request(input, false, frame, flow)
}
fn parse_response_udp(&mut self, flow: *const Flow, stream_slice: StreamSlice) -> bool {
fn parse_response_udp(&mut self, flow: *mut Flow, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
let frame = Frame::new(
flow,

4
rust/src/enip/enip.rs
Unescape Escape View File

@ -81,7 +81,7 @@ impl State<EnipTransaction> for EnipState {
}
fn process_frames(
pdu: &parser::EnipPdu, stream_slice: &StreamSlice, flow: *const Flow, input: &[u8],
pdu: &parser::EnipPdu, stream_slice: &StreamSlice, flow: *mut Flow, input: &[u8],
tx_id: Option<u64>,
) {
let _pdu = Frame::new(
@ -234,7 +234,7 @@ impl EnipState {
}
fn parse_udp(
&mut self, stream_slice: StreamSlice, request: bool, flow: *const Flow,
&mut self, stream_slice: StreamSlice, request: bool, flow: *mut Flow,
) -> AppLayerResult {
let input = stream_slice.as_slice();
match parser::parse_enip_pdu(input) {

52
rust/src/frames.rs
Unescape Escape View File

@ -18,33 +18,16 @@
//! Module for bindings to the Suricata C frame API.
use crate::applayer::StreamSlice;
use crate::flow::Flow;
#[cfg(not(test))]
use crate::core::STREAM_TOSERVER;
use crate::direction::Direction;
use crate::flow::Flow;
#[cfg(not(test))]
#[repr(C)]
struct CFrame {
_private: [u8; 0],
}
// Defined in app-layer-register.h
#[allow(unused_doc_comments)]
/// cbindgen:ignore
extern "C" {
#[cfg(not(test))]
fn AppLayerFrameNewByRelativeOffset(
flow: *const Flow, stream_slice: *const StreamSlice, frame_start_rel: u32, len: i64,
dir: i32, frame_type: u8,
) -> *const CFrame;
fn AppLayerFrameAddEventById(flow: *const Flow, dir: i32, id: i64, event: u8);
fn AppLayerFrameSetLengthById(flow: *const Flow, dir: i32, id: i64, len: i64);
#[cfg(not(test))]
fn AppLayerFrameSetTxIdById(flow: *const Flow, dir: i32, id: i64, tx_id: u64);
#[cfg(not(test))]
fn AppLayerFrameGetId(frame: *const CFrame) -> i64;
}
use std::os::raw::c_void;
#[cfg(not(test))]
use suricata_sys::sys::{SCAppLayerFrameNewByRelativeOffset, SCAppLayerFrameSetTxIdById};
use suricata_sys::sys::{SCAppLayerFrameAddEventById, SCAppLayerFrameSetLengthById};
pub struct Frame {
pub id: i64,
@ -61,30 +44,35 @@ impl Frame {
#[cfg(not(test))]
#[allow(clippy::not_unsafe_ptr_arg_deref)]
pub fn new(
flow: *const Flow, stream_slice: &StreamSlice, frame_start: &[u8], frame_len: i64,
flow: *mut Flow, stream_slice: &StreamSlice, frame_start: &[u8], frame_len: i64,
frame_type: u8, tx_id: Option<u64>,
) -> Option<Self> {
let offset = frame_start.as_ptr() as usize - stream_slice.as_slice().as_ptr() as usize;
SCLogDebug!("offset {} stream_slice.len() {} frame_start.len() {}", offset, stream_slice.len(), frame_start.len());
SCLogDebug!(
"offset {} stream_slice.len() {} frame_start.len() {}",
offset,
stream_slice.len(),
frame_start.len()
);
let frame = unsafe {
AppLayerFrameNewByRelativeOffset(
SCAppLayerFrameNewByRelativeOffset(
flow,
stream_slice,
stream_slice as *const _ as *const c_void,
offset as u32,
frame_len,
(stream_slice.flags() & STREAM_TOSERVER == 0).into(),
frame_type,
)
};
let id = unsafe { AppLayerFrameGetId(frame) };
if id > 0 {
if !frame.is_null() {
let id = unsafe { (*frame).id };
let r = Self {
id,
direction: Direction::from(stream_slice.flags()),
};
if let Some(tx_id) = tx_id {
unsafe {
AppLayerFrameSetTxIdById(flow, r.direction(), id, tx_id);
SCAppLayerFrameSetTxIdById(flow, r.direction(), id, tx_id);
};
}
Some(r)
@ -117,7 +105,7 @@ impl Frame {
#[allow(clippy::not_unsafe_ptr_arg_deref)]
pub fn set_len(&self, flow: *const Flow, len: i64) {
unsafe {
AppLayerFrameSetLengthById(flow, self.direction(), self.id, len);
SCAppLayerFrameSetLengthById(flow, self.direction(), self.id, len);
};
}
@ -125,7 +113,7 @@ impl Frame {
#[allow(clippy::not_unsafe_ptr_arg_deref)]
pub fn set_tx(&self, flow: *const Flow, tx_id: u64) {
unsafe {
AppLayerFrameSetTxIdById(flow, self.direction(), self.id, tx_id);
SCAppLayerFrameSetTxIdById(flow, self.direction(), self.id, tx_id);
};
}
@ -138,7 +126,7 @@ impl Frame {
#[allow(clippy::not_unsafe_ptr_arg_deref)]
pub fn add_event(&self, flow: *const Flow, event: u8) {
unsafe {
AppLayerFrameAddEventById(flow, self.direction(), self.id, event);
SCAppLayerFrameAddEventById(flow, self.direction(), self.id, event);
};
}
}

4
rust/src/ldap/ldap.rs
Unescape Escape View File

@ -373,7 +373,7 @@ impl LdapState {
}
fn parse_request_udp(
&mut self, flow: *const Flow, stream_slice: StreamSlice,
&mut self, flow: *mut Flow, stream_slice: StreamSlice,
) -> AppLayerResult {
let input = stream_slice.as_slice();
let _pdu = Frame::new(
@ -411,7 +411,7 @@ impl LdapState {
}
fn parse_response_udp(
&mut self, flow: *const Flow, stream_slice: StreamSlice,
&mut self, flow: *mut Flow, stream_slice: StreamSlice,
) -> AppLayerResult {
let input = stream_slice.as_slice();
if input.is_empty() {

2
rust/src/mqtt/mqtt.rs
Unescape Escape View File

@ -611,7 +611,7 @@ impl MQTTState {
}
fn mqtt_hdr_and_data_frames(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &MQTTMessage,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &MQTTMessage,
) {
let hdr = stream_slice.as_slice();
//MQTT payload has a fixed header of 2 bytes

24
rust/src/nfs/nfs.rs
Unescape Escape View File

@ -537,7 +537,7 @@ impl NFSState {
}
fn add_rpc_udp_ts_pdu(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
) -> Option<Frame> {
let rpc_udp_ts_pdu = Frame::new(
flow,
@ -552,7 +552,7 @@ impl NFSState {
}
fn add_rpc_udp_ts_creds(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], creds_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], creds_len: i64,
) {
let _rpc_udp_ts_creds = Frame::new(
flow,
@ -566,7 +566,7 @@ impl NFSState {
}
fn add_rpc_tcp_ts_pdu(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
) -> Option<Frame> {
let rpc_tcp_ts_pdu = Frame::new(
flow,
@ -581,7 +581,7 @@ impl NFSState {
}
fn add_rpc_tcp_ts_creds(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], creds_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], creds_len: i64,
) {
let _rpc_tcp_ts_creds = Frame::new(
flow,
@ -595,7 +595,7 @@ impl NFSState {
}
fn add_nfs_ts_frame(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nfs_len: i64,
) {
let _nfs_req_pdu = Frame::new(
flow,
@ -609,7 +609,7 @@ impl NFSState {
}
fn add_nfs4_ts_frames(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs4_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nfs4_len: i64,
) {
let _nfs4_ts_pdu = Frame::new(
flow,
@ -643,7 +643,7 @@ impl NFSState {
}
fn add_rpc_udp_tc_pdu(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
) -> Option<Frame> {
let rpc_udp_tc_pdu = Frame::new(
flow,
@ -658,7 +658,7 @@ impl NFSState {
}
fn add_rpc_udp_tc_frames(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64,
) {
if rpc_len > 8 {
let _rpc_udp_tc_hdr = Frame::new(
@ -683,7 +683,7 @@ impl NFSState {
}
fn add_rpc_tcp_tc_pdu(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_tcp_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], rpc_tcp_len: i64,
) -> Option<Frame> {
let rpc_tcp_tc_pdu = Frame::new(
flow,
@ -698,7 +698,7 @@ impl NFSState {
}
fn add_rpc_tcp_tc_frames(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_tcp_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], rpc_tcp_len: i64,
) {
if rpc_tcp_len > 12 {
let _rpc_tcp_tc_hdr = Frame::new(
@ -723,7 +723,7 @@ impl NFSState {
}
fn add_nfs_tc_frames(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nfs_len: i64,
) {
if nfs_len > 0 {
let _nfs_tc_pdu = Frame::new(
@ -748,7 +748,7 @@ impl NFSState {
}
fn add_nfs4_tc_frames(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs4_len: i64,
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nfs4_len: i64,
) {
if nfs4_len > 0 {
let _nfs4_tc_pdu = Frame::new(

8
rust/src/sip/sip.rs
Unescape Escape View File

@ -122,7 +122,7 @@ impl SIPState {
}
// app-layer-frame-documentation tag start: parse_request
fn parse_request(&mut self, flow: *const Flow, stream_slice: StreamSlice) -> bool {
fn parse_request(&mut self, flow: *mut Flow, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
let _pdu = Frame::new(
flow,
@ -222,7 +222,7 @@ impl SIPState {
return AppLayerResult::ok();
}
fn parse_response(&mut self, flow: *const Flow, stream_slice: StreamSlice) -> bool {
fn parse_response(&mut self, flow: *mut Flow, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
let _pdu = Frame::new(
flow,
@ -336,7 +336,7 @@ impl SIPTransaction {
}
// app-layer-frame-documentation tag start: function to add frames
fn sip_frames_ts(flow: *const Flow, stream_slice: &StreamSlice, r: &Request, tx_id: u64) {
fn sip_frames_ts(flow: *mut Flow, stream_slice: &StreamSlice, r: &Request, tx_id: u64) {
let oi = stream_slice.as_slice();
let _f = Frame::new(
flow,
@ -372,7 +372,7 @@ fn sip_frames_ts(flow: *const Flow, stream_slice: &StreamSlice, r: &Request, tx_
}
// app-layer-frame-documentation tag end: function to add frames
fn sip_frames_tc(flow: *const Flow, stream_slice: &StreamSlice, r: &Response, tx_id: u64) {
fn sip_frames_tc(flow: *mut Flow, stream_slice: &StreamSlice, r: &Response, tx_id: u64) {
let oi = stream_slice.as_slice();
let _f = Frame::new(
flow,

36
rust/src/smb/smb.rs
Unescape Escape View File

@ -1241,7 +1241,7 @@ impl SMBState {
return consumed;
}
fn add_nbss_ts_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
fn add_nbss_ts_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8, None);
SCLogDebug!("NBSS PDU frame {:?}", nbss_pdu);
let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8, None);
@ -1251,12 +1251,12 @@ impl SMBState {
(nbss_pdu, nbss_hdr_frame, nbss_data_frame)
}
fn add_smb1_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
fn add_smb1_ts_pdu_frame(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8, None);
SCLogDebug!("SMB PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb1_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
fn add_smb1_ts_hdr_data_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
let _smb1_hdr = Frame::new(flow, stream_slice, input, 32_i64, SMBFrameType::SMB1Hdr as u8, None);
SCLogDebug!("SMBv1 HDR frame {:?}", _smb1_hdr);
if input.len() > 32 {
@ -1265,12 +1265,12 @@ impl SMBState {
}
}
fn add_smb2_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
fn add_smb2_ts_pdu_frame(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8, None);
SCLogDebug!("SMBv2 PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb2_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
fn add_smb2_ts_hdr_data_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8, None);
SCLogDebug!("SMBv2 HDR frame {:?}", _smb2_hdr);
if input.len() > hdr_len as usize {
@ -1279,12 +1279,12 @@ impl SMBState {
}
}
fn add_smb3_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
fn add_smb3_ts_pdu_frame(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8, None);
SCLogDebug!("SMBv3 PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb3_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
fn add_smb3_ts_hdr_data_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8, None);
SCLogDebug!("SMBv3 HDR frame {:?}", _smb3_hdr);
if input.len() > 52 {
@ -1294,7 +1294,7 @@ impl SMBState {
}
/// return bytes consumed
pub fn parse_tcp_data_ts_partial(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8]) -> usize
pub fn parse_tcp_data_ts_partial(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8]) -> usize
{
SCLogDebug!("incomplete of size {}", input.len());
if input.len() < 512 {
@ -1378,7 +1378,7 @@ impl SMBState {
}
/// Parsing function, handling TCP chunks fragmentation
pub fn parse_tcp_data_ts(&mut self, flow: *const Flow, stream_slice: &StreamSlice) -> AppLayerResult
pub fn parse_tcp_data_ts(&mut self, flow: *mut Flow, stream_slice: &StreamSlice) -> AppLayerResult
{
let mut cur_i = stream_slice.as_slice();
let consumed = self.handle_skip(Direction::ToServer, cur_i.len() as u32);
@ -1577,7 +1577,7 @@ impl SMBState {
AppLayerResult::ok()
}
fn add_nbss_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
fn add_nbss_tc_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8, None);
SCLogDebug!("NBSS PDU frame {:?}", nbss_pdu);
let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8, None);
@ -1587,12 +1587,12 @@ impl SMBState {
(nbss_pdu, nbss_hdr_frame, nbss_data_frame)
}
fn add_smb1_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
fn add_smb1_tc_pdu_frame(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8, None);
SCLogDebug!("SMB PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb1_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
fn add_smb1_tc_hdr_data_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
let _smb1_hdr = Frame::new(flow, stream_slice, input, SMB1_HEADER_SIZE as i64, SMBFrameType::SMB1Hdr as u8, None);
SCLogDebug!("SMBv1 HDR frame {:?}", _smb1_hdr);
if input.len() > SMB1_HEADER_SIZE {
@ -1602,12 +1602,12 @@ impl SMBState {
}
}
fn add_smb2_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
fn add_smb2_tc_pdu_frame(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8, None);
SCLogDebug!("SMBv2 PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb2_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
fn add_smb2_tc_hdr_data_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8, None);
SCLogDebug!("SMBv2 HDR frame {:?}", _smb2_hdr);
if input.len() > hdr_len as usize {
@ -1616,11 +1616,11 @@ impl SMBState {
}
}
fn add_smb3_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
fn add_smb3_tc_pdu_frame(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
let _smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8, None);
SCLogDebug!("SMBv3 PDU frame {:?}", _smb_pdu);
}
fn add_smb3_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
fn add_smb3_tc_hdr_data_frames(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8, None);
SCLogDebug!("SMBv3 HDR frame {:?}", _smb3_hdr);
if input.len() > 52 {
@ -1630,7 +1630,7 @@ impl SMBState {
}
/// return bytes consumed
pub fn parse_tcp_data_tc_partial(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8]) -> usize
pub fn parse_tcp_data_tc_partial(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8]) -> usize
{
SCLogDebug!("incomplete of size {}", input.len());
if input.len() < 512 {
@ -1715,7 +1715,7 @@ impl SMBState {
}
/// Parsing function, handling TCP chunks fragmentation
pub fn parse_tcp_data_tc(&mut self, flow: *const Flow, stream_slice: &StreamSlice) -> AppLayerResult
pub fn parse_tcp_data_tc(&mut self, flow: *mut Flow, stream_slice: &StreamSlice) -> AppLayerResult
{
let mut cur_i = stream_slice.as_slice();
let consumed = self.handle_skip(Direction::ToClient, cur_i.len() as u32);

2
rust/src/ssh/ssh.rs
Unescape Escape View File

@ -141,7 +141,7 @@ impl SSHState {
fn parse_record(
&mut self, mut input: &[u8], resp: bool, pstate: *mut AppLayerParserState,
flow: *const Flow, stream_slice: &StreamSlice,
flow: *mut Flow, stream_slice: &StreamSlice,
) -> AppLayerResult {
let (hdr, ohdr) = if !resp {
(&mut self.transaction.cli_hdr, &self.transaction.srv_hdr)

4
rust/src/telnet/telnet.rs
Unescape Escape View File

@ -140,7 +140,7 @@ impl TelnetState {
// app-layer-frame-documentation tag start: parse_request
fn parse_request(
&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8],
&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8],
) -> AppLayerResult {
// We're not interested in empty requests.
if input.is_empty() {
@ -254,7 +254,7 @@ impl TelnetState {
return AppLayerResult::ok();
}
fn parse_response(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8]) -> AppLayerResult {
fn parse_response(&mut self, flow: *mut Flow, stream_slice: &StreamSlice, input: &[u8]) -> AppLayerResult {
// We're not interested in empty responses.
if input.is_empty() {
return AppLayerResult::ok();

41
rust/sys/src/sys.rs
Unescape Escape View File

@ -918,6 +918,47 @@ extern "C" {
len: u32,
) -> ::std::os::raw::c_int;
}
pub type FrameId = i64;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct Frame {
#[doc = "< protocol specific field type. E.g. NBSS.HDR or SMB.DATA"]
pub type_: u8,
#[doc = "< frame flags: FRAME_FLAG_*"]
pub flags: u8,
pub event_cnt: u8,
#[doc = "< per frame store for events"]
pub events: [u8; 4usize],
#[doc = "< offset from the start of the stream"]
pub offset: u64,
pub len: i64,
pub id: i64,
#[doc = "< tx_id to match this frame. UINT64T_MAX if not used."]
pub tx_id: u64,
#[doc = "< inspection tracker relative to the start of the frame"]
pub inspect_progress: u64,
}
extern "C" {
pub fn SCAppLayerFrameNewByRelativeOffset(
f: *mut Flow, stream_slice: *const ::std::os::raw::c_void, frame_start_rel: u32, len: i64,
dir: ::std::os::raw::c_int, frame_type: u8,
) -> *mut Frame;
}
extern "C" {
pub fn SCAppLayerFrameAddEventById(
f: *const Flow, dir: ::std::os::raw::c_int, id: FrameId, e: u8,
);
}
extern "C" {
pub fn SCAppLayerFrameSetLengthById(
f: *const Flow, dir: ::std::os::raw::c_int, id: FrameId, len: i64,
);
}
extern "C" {
pub fn SCAppLayerFrameSetTxIdById(
f: *const Flow, dir: ::std::os::raw::c_int, id: FrameId, tx_id: u64,
);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct MpmPattern_ {

26
src/app-layer-frames.c
Unescape Escape View File

@ -27,6 +27,7 @@
#include "flow.h"
#include "stream-tcp.h"
#include "rust.h"
#include "app-layer-frames.h"
#include "app-layer-parser.h"
@ -539,9 +540,13 @@ static Frame *AppLayerFrameUdp(
/** \brief create new frame using a relative offset from the start of the stream slice
*/
Frame *AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice,
const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type)
Frame *SCAppLayerFrameNewByRelativeOffset(Flow *f, const void *ss, const uint32_t frame_start_rel,
const int64_t len, int dir, uint8_t frame_type)
{
// need to hide StreamSlice argument
// as we cannot bindgen a C function with an argument whose type
// is defined in rust (at least before a suricata_core crate)
const StreamSlice *stream_slice = (const StreamSlice *)ss;
if (!(FrameConfigTypeIsEnabled(f->alproto, frame_type)))
return NULL;
@ -653,21 +658,12 @@ void AppLayerFrameAddEvent(Frame *r, uint8_t e)
}
}
void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e)
void SCAppLayerFrameAddEventById(const Flow *f, const int dir, const FrameId id, uint8_t e)
{
Frame *frame = AppLayerFrameGetById(f, dir, id);
AppLayerFrameAddEvent(frame, e);
}
FrameId AppLayerFrameGetId(Frame *r)
{
if (r != NULL) {
return r->id;
} else {
return -1;
}
}
void AppLayerFrameSetLength(Frame *frame, int64_t len)
{
if (frame != NULL) {
@ -676,7 +672,7 @@ void AppLayerFrameSetLength(Frame *frame, int64_t len)
}
}
void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len)
void SCAppLayerFrameSetLengthById(const Flow *f, const int dir, const FrameId id, int64_t len)
{
Frame *frame = AppLayerFrameGetById(f, dir, id);
AppLayerFrameSetLength(frame, len);
@ -691,13 +687,13 @@ void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id)
}
}
void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id)
void SCAppLayerFrameSetTxIdById(const Flow *f, const int dir, const FrameId id, uint64_t tx_id)
{
Frame *frame = AppLayerFrameGetById(f, dir, id);
AppLayerFrameSetTxId(frame, tx_id);
}
Frame *AppLayerFrameGetById(Flow *f, const int dir, const FrameId frame_id)
Frame *AppLayerFrameGetById(const Flow *f, const int dir, const FrameId frame_id)
{
FramesContainer *frames_container = AppLayerFramesGetContainer(f);
SCLogDebug("get frame_id %" PRIi64 " direction %u/%s frames_container %p", frame_id, dir,

19
src/app-layer-frames.h
Unescape Escape View File

@ -24,8 +24,6 @@
#ifndef SURICATA_APP_LAYER_FRAMES_H
#define SURICATA_APP_LAYER_FRAMES_H
#include "rust.h"
/** special value for matching any type */
#define FRAME_ANY_TYPE 62
/** max 63 to fit the 64 bit per protocol space */
@ -76,11 +74,14 @@ typedef struct FramesContainer {
} FramesContainer;
void FramesFree(Frames *frames);
#ifndef SURICATA_BINDGEN_H
// do not let bindgen see Packet
void FramesPrune(Flow *f, Packet *p);
#endif
Frame *AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice,
const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type);
Frame *AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice,
Frame *SCAppLayerFrameNewByRelativeOffset(Flow *f, const void *stream_slice,
const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type);
Frame *AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice,
const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type);
@ -90,21 +91,19 @@ Frame *FrameGetByIndex(Frames *frames, const uint32_t idx);
Frame *FrameGetById(Frames *frames, const int64_t id);
Frame *FrameGetLastOpenByType(Frames *frames, const uint8_t frame_type);
Frame *AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id);
Frame *AppLayerFrameGetById(const Flow *f, const int direction, const FrameId frame_id);
Frame *AppLayerFrameGetLastOpenByType(Flow *f, const int direction, const uint8_t frame_type);
FrameId AppLayerFrameGetId(Frame *r);
void AppLayerFrameAddEvent(Frame *frame, uint8_t e);
void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e);
void SCAppLayerFrameAddEventById(const Flow *f, const int dir, const FrameId id, uint8_t e);
void AppLayerFrameSetLength(Frame *frame, int64_t len);
void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len);
void SCAppLayerFrameSetLengthById(const Flow *f, const int dir, const FrameId id, int64_t len);
void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id);
void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id);
void SCAppLayerFrameSetTxIdById(const Flow *f, const int dir, const FrameId id, uint64_t tx_id);
void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction);
FramesContainer *AppLayerFramesGetContainer(Flow *f);
FramesContainer *AppLayerFramesGetContainer(const Flow *f);
FramesContainer *AppLayerFramesSetupContainer(Flow *f);
void FrameConfigInit(void);

2
src/app-layer-parser.c
Unescape Escape View File

@ -181,7 +181,7 @@ void AppLayerFramesFreeContainer(Flow *f)
f->alparser->frames = NULL;
}
FramesContainer *AppLayerFramesGetContainer(Flow *f)
FramesContainer *AppLayerFramesGetContainer(const Flow *f)
{
if (f == NULL || f->alparser == NULL)
return NULL;

2
src/app-layer-smtp.h
Unescape Escape View File

@ -24,9 +24,9 @@
#ifndef SURICATA_APP_LAYER_SMTP_H
#define SURICATA_APP_LAYER_SMTP_H
#include "rust.h"
#include "app-layer-frames.h"
#include "util-streaming-buffer.h"
#include "rust.h"
/* Limit till the data would be buffered in current line */
#define SMTP_LINE_BUFFER_LIMIT 4096

1
src/bindgen.h
Unescape Escape View File

@ -54,6 +54,7 @@
#include "app-layer-events.h"
#include "app-layer-http2.h"
#include "app-layer-htp-range.h"
#include "app-layer-frames.h"
#include "util-mpm.h"
#include "util-file.h"

1
src/detect-engine-frame.c
Unescape Escape View File

@ -26,6 +26,7 @@
#include "suricata.h"
#include "app-layer-parser.h"
#include "rust.h"
#include "app-layer-frames.h"
#include "detect-engine.h"

1
src/detect-engine-frame.h
Unescape Escape View File

@ -22,6 +22,7 @@
*
*/
#include "rust.h"
#include "app-layer-frames.h"
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,

1
src/detect-frame.c
Unescape Escape View File

@ -24,6 +24,7 @@
#include "decode.h"
#include "detect.h"
#include "rust.h"
#include "app-layer-frames.h"
#include "app-layer-parser.h"

1
src/flow-timeout.c
Unescape Escape View File

@ -59,6 +59,7 @@
#include "detect-engine-state.h"
#include "stream.h"
#include "rust.h"
#include "app-layer-frames.h"
#include "app-layer-parser.h"
#include "app-layer.h"

Write Preview
Loading…
Cancel
Save