diff --git a/scripts/setup-app-layer-detect.sh b/scripts/setup-app-layer-detect.sh deleted file mode 100755 index ff5aab6fc3..0000000000 --- a/scripts/setup-app-layer-detect.sh +++ /dev/null @@ -1,168 +0,0 @@ -#! /usr/bin/env bash -# -# Script to provision a new application layer detector and parser. - -set -e - -# Fail if "ed" is not available. -if ! which ed > /dev/null 2>&1; then - echo "error: the program \"ed\" is required for this script" - exit 1 -fi - -function usage() { - cat < - -This script will provision content inspection for app-layer decoded -buffers. - -Examples: - - $0 Gopher Buffer - $0 DNP3 Buffer - $0 Http Etag - -EOF -} - -# Make sure we are running from the correct directory. -set_dir() { - if [ -e ./suricata.c ]; then - cd .. - elif [ -e ./src/suricata.c ]; then - # Do nothing. - true - else - echo "error: this does not appear to be a suricata source directory." - exit 1 - fi -} - -fail_if_exists() { - path="$1" - if test -e "${path}"; then - echo "error: ${path} already exists." - exit 1 - fi -} - -function copy_template_file() { - src="$1" - dst="$2" - - echo "Creating ${dst}." - - sed -e '/TEMPLATE_START_REMOVE/,/TEMPLATE_END_REMOVE/d' \ - -e "s/TEMPLATE_BUFFER/${protoname_upper}_${buffername_upper}/g" \ - -e "s/TEMPLATE/${protoname_upper}/g" \ - -e "s/template-buffer/${protoname_lower}-${buffername_lower}/g" \ - -e "s/template/${protoname_lower}/g" \ - -e "s/TemplateBuffer/${protoname}${buffername}/g" \ - -e "s/Template/${protoname}/g" \ - > ${dst} < ${src} -} - -function copy_templates() { - detect_h_dst="src/detect-${protoname_lower}-${buffername_lower}.h" - detect_c_dst="src/detect-${protoname_lower}-${buffername_lower}.c" - tests_detect_c_dst="src/tests/detect-${protoname_lower}-${buffername_lower}.c" - - fail_if_exists ${detect_h_dst} - fail_if_exists ${detect_c_dst} - fail_if_exists ${tests_detect_c_dst} - - copy_template_file "src/detect-template-buffer.h" ${detect_h_dst} - copy_template_file "src/detect-template-buffer.c" ${detect_c_dst} - copy_template_file "src/tests/detect-template-buffer.c" ${tests_detect_c_dst} -} - -function patch() { - filename="src/Makefile.am" - echo "Patching ${filename}." - ed -s ${filename} > /dev/null < /dev/null < /dev/null < /dev/null < -1: + new = line.replace("template-buffer", "%s-%s" % ( + protoname.lower(), buffername.lower())) + output.write(new) + + if line.find("DetectTemplateBufferRegister") > -1: + new = line.replace("TemplateBuffer", "%s%s" % ( + protoname, buffername)) + output.write(new) + + output.write(line) + open(filename, "w").write(output.getvalue()) + +def detect_patch_detect_enginer_register_h(protoname, buffername): + filename = "src/detect-engine-register.h" + print("Patching %s." % (filename)) + output = io.StringIO() + with open(filename) as infile: + for line in infile: + + if line.find("DETECT_AL_TEMPLATE_BUFFER") > -1: + new = line.replace("TEMPLATE_BUFFER", "%s_%s" % ( + protoname.upper(), buffername.upper())) + output.write(new) + + output.write(line) + open(filename, "w").write(output.getvalue()) + def proto_exists(proto): upper = proto.upper() for line in open("src/app-layer-protos.h"): @@ -308,6 +397,13 @@ Examples: %(progname)s DNP3 %(progname)s Gopher + +This script can also setup a detect buffer. This is a separate +operation that must be done after creating the parser. + +Examples: + + %(progname)s --detect Gopher Request """ % { "progname": progname, } def main(): @@ -320,7 +416,11 @@ def main(): help="Generate logger.") parser.add_argument("--parser", action="store_true", default=False, help="Generate parser.") + parser.add_argument("--detect", action="store_true", default=False, + help="Generate detect module.") parser.add_argument("proto", help="Name of protocol") + parser.add_argument("buffer", help="Name of buffer (for --detect)", + nargs="?") args = parser.parse_args() proto = args.proto @@ -332,14 +432,20 @@ def main(): # Determine what to generate. parser = False logger = False + detect = False # If no --parser or no --logger, generate both. - if not args.parser and not args.logger: + if not args.parser and not args.logger and not args.detect: parser = True logger = True else: parser = args.parser logger = args.logger + detect = args.detect + + if detect: + if args.buffer is None: + raise SetupError("--detect requires a buffer name") # Make sure we are in the correct directory. if os.path.exists("./suricata.c"): @@ -373,6 +479,14 @@ def main(): logger_patch_suricata_yaml_in(proto) logger_patch_util_profiling_c(proto) + if detect: + if not proto_exists(proto): + raise SetupError("no app-layer parser exists for %s" % (proto)) + detect_copy_templates(proto, args.buffer, args.rust) + detect_patch_makefile_am(proto, args.buffer) + detect_patch_detect_enginer_register_c(proto, args.buffer) + detect_patch_detect_enginer_register_h(proto, args.buffer) + if parser: if args.rust: print(""" @@ -416,6 +530,17 @@ A JSON application layer transaction logger for the protocol "proto_lower": proto.lower(), }) + if detect: + print(""" +The following files have been created and linked into the build: + + detect-%(protoname_lower)s-%(buffername_lower)s.h + detect-%(protoname_lower)s-%(buffername_lower)s.c +""" % { + "protoname_lower": proto.lower(), + "buffername_lower": args.buffer.lower(), +}) + if parser or logger: print(""" Suricata should now build cleanly. Try running "make".