mirror of https://github.com/OISF/suricata
templates: remove C app-layer templates
Jason Ish
3 years ago
committed by
Victor Julien
parent
05e16820de
commit
8683154115
@ -1,564 +0,0 @@
|
||||
/* Copyright (C) 2015-2021 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/*
|
||||
* TODO: Update \author in this file and app-layer-template.h.
|
||||
* TODO: Implement your app-layer logic with unit tests.
|
||||
* TODO: Remove SCLogNotice statements or convert to debug.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <yourname@domain>
|
||||
*
|
||||
* Template application layer detector and parser for learning and
|
||||
* template purposes.
|
||||
*
|
||||
* This template implements a simple application layer for something
|
||||
* like the echo protocol running on port 7.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "suricata.h"
|
||||
#include "stream.h"
|
||||
#include "conf.h"
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-detect-proto.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-template.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "util-validate.h"
|
||||
#include "util-enum.h"
|
||||
|
||||
/* The default port to probe for echo traffic if not provided in the
|
||||
* configuration file. */
|
||||
#define TEMPLATE_DEFAULT_PORT "7"
|
||||
|
||||
/* The minimum size for a message. For some protocols this might
|
||||
* be the size of a header. */
|
||||
#define TEMPLATE_MIN_FRAME_LEN 1
|
||||
|
||||
/* Enum of app-layer events for the protocol. Normally you might
|
||||
* have events for errors in parsing data, like unexpected data being
|
||||
* received. For template we'll make something up, and log an app-layer
|
||||
* level alert if an empty message is received.
|
||||
*
|
||||
* Example rule:
|
||||
*
|
||||
* alert template any any -> any any (msg:"SURICATA Template empty message"; \
|
||||
* app-layer-event:template.empty_message; sid:X; rev:Y;)
|
||||
*/
|
||||
enum {
|
||||
TEMPLATE_DECODER_EVENT_EMPTY_MESSAGE,
|
||||
};
|
||||
|
||||
SCEnumCharMap template_decoder_event_table[] = {
|
||||
{"EMPTY_MESSAGE", TEMPLATE_DECODER_EVENT_EMPTY_MESSAGE},
|
||||
|
||||
// event table must be NULL-terminated
|
||||
{ NULL, -1 },
|
||||
};
|
||||
|
||||
static TemplateTransaction *TemplateTxAlloc(TemplateState *state)
|
||||
{
|
||||
TemplateTransaction *tx = SCCalloc(1, sizeof(TemplateTransaction));
|
||||
if (unlikely(tx == NULL)) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* Increment the transaction ID on the state each time one is
|
||||
* allocated. */
|
||||
tx->tx_id = state->transaction_max++;
|
||||
|
||||
TAILQ_INSERT_TAIL(&state->tx_list, tx, next);
|
||||
|
||||
return tx;
|
||||
}
|
||||
|
||||
static void TemplateTxFree(void *txv)
|
||||
{
|
||||
TemplateTransaction *tx = txv;
|
||||
|
||||
if (tx->request_buffer != NULL) {
|
||||
SCFree(tx->request_buffer);
|
||||
}
|
||||
|
||||
if (tx->response_buffer != NULL) {
|
||||
SCFree(tx->response_buffer);
|
||||
}
|
||||
|
||||
AppLayerDecoderEventsFreeEvents(&tx->tx_data.events);
|
||||
|
||||
SCFree(tx);
|
||||
}
|
||||
|
||||
static void *TemplateStateAlloc(void *orig_state, AppProto proto_orig)
|
||||
{
|
||||
SCLogNotice("Allocating template state.");
|
||||
TemplateState *state = SCCalloc(1, sizeof(TemplateState));
|
||||
if (unlikely(state == NULL)) {
|
||||
return NULL;
|
||||
}
|
||||
TAILQ_INIT(&state->tx_list);
|
||||
return state;
|
||||
}
|
||||
|
||||
static void TemplateStateFree(void *state)
|
||||
{
|
||||
TemplateState *template_state = state;
|
||||
TemplateTransaction *tx;
|
||||
SCLogNotice("Freeing template state.");
|
||||
while ((tx = TAILQ_FIRST(&template_state->tx_list)) != NULL) {
|
||||
TAILQ_REMOVE(&template_state->tx_list, tx, next);
|
||||
TemplateTxFree(tx);
|
||||
}
|
||||
SCFree(template_state);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Callback from the application layer to have a transaction freed.
|
||||
*
|
||||
* \param state a void pointer to the TemplateState object.
|
||||
* \param tx_id the transaction ID to free.
|
||||
*/
|
||||
static void TemplateStateTxFree(void *statev, uint64_t tx_id)
|
||||
{
|
||||
TemplateState *state = statev;
|
||||
TemplateTransaction *tx = NULL, *ttx;
|
||||
|
||||
SCLogNotice("Freeing transaction %"PRIu64, tx_id);
|
||||
|
||||
TAILQ_FOREACH_SAFE(tx, &state->tx_list, next, ttx) {
|
||||
|
||||
/* Continue if this is not the transaction we are looking
|
||||
* for. */
|
||||
if (tx->tx_id != tx_id) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/* Remove and free the transaction. */
|
||||
TAILQ_REMOVE(&state->tx_list, tx, next);
|
||||
TemplateTxFree(tx);
|
||||
return;
|
||||
}
|
||||
|
||||
SCLogNotice("Transaction %"PRIu64" not found.", tx_id);
|
||||
}
|
||||
|
||||
static int TemplateStateGetEventInfo(const char *event_name, int *event_id,
|
||||
AppLayerEventType *event_type)
|
||||
{
|
||||
*event_id = SCMapEnumNameToValue(event_name, template_decoder_event_table);
|
||||
if (*event_id == -1) {
|
||||
SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in "
|
||||
"template enum map table.", event_name);
|
||||
/* This should be treated as fatal. */
|
||||
return -1;
|
||||
}
|
||||
|
||||
*event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int TemplateStateGetEventInfoById(int event_id, const char **event_name,
|
||||
AppLayerEventType *event_type)
|
||||
{
|
||||
*event_name = SCMapEnumValueToName(event_id, template_decoder_event_table);
|
||||
if (*event_name == NULL) {
|
||||
SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%d\" not present in "
|
||||
"template enum map table.", event_id);
|
||||
/* This should be treated as fatal. */
|
||||
return -1;
|
||||
}
|
||||
|
||||
*event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Probe the input to server to see if it looks like template.
|
||||
*
|
||||
* \retval ALPROTO_TEMPLATE if it looks like template,
|
||||
* ALPROTO_FAILED, if it is clearly not ALPROTO_TEMPLATE,
|
||||
* otherwise ALPROTO_UNKNOWN.
|
||||
*/
|
||||
static AppProto TemplateProbingParserTs(Flow *f, uint8_t direction,
|
||||
const uint8_t *input, uint32_t input_len, uint8_t *rdir)
|
||||
{
|
||||
/* Very simple test - if there is input, this is template. */
|
||||
if (input_len >= TEMPLATE_MIN_FRAME_LEN) {
|
||||
SCLogNotice("Detected as ALPROTO_TEMPLATE.");
|
||||
return ALPROTO_TEMPLATE;
|
||||
}
|
||||
|
||||
SCLogNotice("Protocol not detected as ALPROTO_TEMPLATE.");
|
||||
return ALPROTO_UNKNOWN;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Probe the input to client to see if it looks like template.
|
||||
* TemplateProbingParserTs can be used instead if the protocol
|
||||
* is symmetric.
|
||||
*
|
||||
* \retval ALPROTO_TEMPLATE if it looks like template,
|
||||
* ALPROTO_FAILED, if it is clearly not ALPROTO_TEMPLATE,
|
||||
* otherwise ALPROTO_UNKNOWN.
|
||||
*/
|
||||
static AppProto TemplateProbingParserTc(Flow *f, uint8_t direction,
|
||||
const uint8_t *input, uint32_t input_len, uint8_t *rdir)
|
||||
{
|
||||
/* Very simple test - if there is input, this is template. */
|
||||
if (input_len >= TEMPLATE_MIN_FRAME_LEN) {
|
||||
SCLogNotice("Detected as ALPROTO_TEMPLATE.");
|
||||
return ALPROTO_TEMPLATE;
|
||||
}
|
||||
|
||||
SCLogNotice("Protocol not detected as ALPROTO_TEMPLATE.");
|
||||
return ALPROTO_UNKNOWN;
|
||||
}
|
||||
|
||||
static AppLayerResult TemplateParseRequest(Flow *f, void *statev, AppLayerParserState *pstate,
|
||||
StreamSlice stream_slice, void *local_data)
|
||||
{
|
||||
TemplateState *state = statev;
|
||||
const uint8_t *input = StreamSliceGetData(&stream_slice);
|
||||
uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
|
||||
const uint8_t flags = StreamSliceGetFlags(&stream_slice);
|
||||
|
||||
SCLogNotice("Parsing template request: len=%"PRIu32, input_len);
|
||||
|
||||
if (input == NULL) {
|
||||
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
|
||||
/* This is a signal that the stream is done. Do any
|
||||
* cleanup if needed. Usually nothing is required here. */
|
||||
SCReturnStruct(APP_LAYER_OK);
|
||||
} else if (flags & STREAM_GAP) {
|
||||
/* This is a signal that there has been a gap in the
|
||||
* stream. This only needs to be handled if gaps were
|
||||
* enabled during protocol registration. The input_len
|
||||
* contains the size of the gap. */
|
||||
SCReturnStruct(APP_LAYER_OK);
|
||||
}
|
||||
/* This should not happen. If input is NULL, one of the above should be
|
||||
* true. */
|
||||
DEBUG_VALIDATE_BUG_ON(true);
|
||||
SCReturnStruct(APP_LAYER_ERROR);
|
||||
}
|
||||
|
||||
/* Normally you would parse out data here and store it in the
|
||||
* transaction object, but as this is echo, we'll just record the
|
||||
* request data. */
|
||||
|
||||
/* Also, if this protocol may have a "protocol data unit" span
|
||||
* multiple chunks of data, which is always a possibility with
|
||||
* TCP, you may need to do some buffering here.
|
||||
*
|
||||
* For the sake of simplicity, buffering is left out here, but
|
||||
* even for an echo protocol we may want to buffer until a new
|
||||
* line is seen, assuming its text based.
|
||||
*/
|
||||
|
||||
/* Allocate a transaction.
|
||||
*
|
||||
* But note that if a "protocol data unit" is not received in one
|
||||
* chunk of data, and the buffering is done on the transaction, we
|
||||
* may need to look for the transaction that this newly received
|
||||
* data belongs to.
|
||||
*/
|
||||
TemplateTransaction *tx = TemplateTxAlloc(state);
|
||||
if (unlikely(tx == NULL)) {
|
||||
SCLogNotice("Failed to allocate new Template tx.");
|
||||
goto end;
|
||||
}
|
||||
SCLogNotice("Allocated Template tx %"PRIu64".", tx->tx_id);
|
||||
|
||||
/* Make a copy of the request. */
|
||||
tx->request_buffer = SCCalloc(1, input_len);
|
||||
if (unlikely(tx->request_buffer == NULL)) {
|
||||
goto end;
|
||||
}
|
||||
memcpy(tx->request_buffer, input, input_len);
|
||||
tx->request_buffer_len = input_len;
|
||||
|
||||
/* Here we check for an empty message and create an app-layer
|
||||
* event. */
|
||||
if ((input_len == 1 && tx->request_buffer[0] == '\n') ||
|
||||
(input_len == 2 && tx->request_buffer[0] == '\r')) {
|
||||
SCLogNotice("Creating event for empty message.");
|
||||
AppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, TEMPLATE_DECODER_EVENT_EMPTY_MESSAGE);
|
||||
}
|
||||
|
||||
end:
|
||||
SCReturnStruct(APP_LAYER_OK);
|
||||
}
|
||||
|
||||
static AppLayerResult TemplateParseResponse(Flow *f, void *statev, AppLayerParserState *pstate,
|
||||
StreamSlice stream_slice, void *local_data)
|
||||
{
|
||||
TemplateState *state = statev;
|
||||
TemplateTransaction *tx = NULL, *ttx;
|
||||
const uint8_t *input = StreamSliceGetData(&stream_slice);
|
||||
uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
|
||||
|
||||
SCLogNotice("Parsing Template response.");
|
||||
|
||||
/* Likely connection closed, we can just return here. */
|
||||
if ((input == NULL || input_len == 0) &&
|
||||
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)) {
|
||||
SCReturnStruct(APP_LAYER_OK);
|
||||
}
|
||||
|
||||
/* Probably don't want to create a transaction in this case
|
||||
* either. */
|
||||
if (input == NULL || input_len == 0) {
|
||||
SCReturnStruct(APP_LAYER_OK);
|
||||
}
|
||||
|
||||
/* Look up the existing transaction for this response. In the case
|
||||
* of echo, it will be the most recent transaction on the
|
||||
* TemplateState object. */
|
||||
|
||||
/* We should just grab the last transaction, but this is to
|
||||
* illustrate how you might traverse the transaction list to find
|
||||
* the transaction associated with this response. */
|
||||
TAILQ_FOREACH(ttx, &state->tx_list, next) {
|
||||
tx = ttx;
|
||||
}
|
||||
|
||||
if (tx == NULL) {
|
||||
SCLogNotice("Failed to find transaction for response on state %p.",
|
||||
state);
|
||||
goto end;
|
||||
}
|
||||
|
||||
SCLogNotice("Found transaction %"PRIu64" for response on state %p.",
|
||||
tx->tx_id, state);
|
||||
|
||||
/* If the protocol requires multiple chunks of data to complete, you may
|
||||
* run into the case where you have existing response data.
|
||||
*
|
||||
* In this case, we just log that there is existing data and free it. But
|
||||
* you might want to realloc the buffer and append the data.
|
||||
*/
|
||||
if (tx->response_buffer != NULL) {
|
||||
SCLogNotice("WARNING: Transaction already has response data, "
|
||||
"existing data will be overwritten.");
|
||||
SCFree(tx->response_buffer);
|
||||
}
|
||||
|
||||
/* Make a copy of the response. */
|
||||
tx->response_buffer = SCCalloc(1, input_len);
|
||||
if (unlikely(tx->response_buffer == NULL)) {
|
||||
goto end;
|
||||
}
|
||||
memcpy(tx->response_buffer, input, input_len);
|
||||
tx->response_buffer_len = input_len;
|
||||
|
||||
/* Set the response_done flag for transaction state checking in
|
||||
* TemplateGetStateProgress(). */
|
||||
tx->response_done = 1;
|
||||
|
||||
end:
|
||||
SCReturnStruct(APP_LAYER_OK);
|
||||
}
|
||||
|
||||
static uint64_t TemplateGetTxCnt(void *statev)
|
||||
{
|
||||
const TemplateState *state = statev;
|
||||
SCLogNotice("Current tx count is %"PRIu64".", state->transaction_max);
|
||||
return state->transaction_max;
|
||||
}
|
||||
|
||||
static void *TemplateGetTx(void *statev, uint64_t tx_id)
|
||||
{
|
||||
TemplateState *state = statev;
|
||||
TemplateTransaction *tx;
|
||||
|
||||
SCLogDebug("Requested tx ID %" PRIu64 ".", tx_id);
|
||||
|
||||
TAILQ_FOREACH(tx, &state->tx_list, next) {
|
||||
if (tx->tx_id == tx_id) {
|
||||
SCLogDebug("Transaction %" PRIu64 " found, returning tx object %p.", tx_id, tx);
|
||||
return tx;
|
||||
}
|
||||
}
|
||||
|
||||
SCLogDebug("Transaction ID %" PRIu64 " not found.", tx_id);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Return the state of a transaction in a given direction.
|
||||
*
|
||||
* In the case of the echo protocol, the existence of a transaction
|
||||
* means that the request is done. However, some protocols that may
|
||||
* need multiple chunks of data to complete the request may need more
|
||||
* than just the existence of a transaction for the request to be
|
||||
* considered complete.
|
||||
*
|
||||
* For the response to be considered done, the response for a request
|
||||
* needs to be seen. The response_done flag is set on response for
|
||||
* checking here.
|
||||
*/
|
||||
static int TemplateGetStateProgress(void *txv, uint8_t direction)
|
||||
{
|
||||
TemplateTransaction *tx = txv;
|
||||
|
||||
SCLogNotice("Transaction progress requested for tx ID %"PRIu64
|
||||
", direction=0x%02x", tx->tx_id, direction);
|
||||
|
||||
if (direction & STREAM_TOCLIENT && tx->response_done) {
|
||||
return 1;
|
||||
}
|
||||
else if (direction & STREAM_TOSERVER) {
|
||||
/* For the template, just the existence of the transaction means the
|
||||
* request is done. */
|
||||
return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief retrieve the tx data used for logging, config, detection
|
||||
*/
|
||||
static AppLayerTxData *TemplateGetTxData(void *vtx)
|
||||
{
|
||||
TemplateTransaction *tx = vtx;
|
||||
return &tx->tx_data;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief retrieve the state data
|
||||
*/
|
||||
static AppLayerStateData *TemplateGetStateData(void *vstate)
|
||||
{
|
||||
TemplateState *state = vstate;
|
||||
return &state->state_data;
|
||||
}
|
||||
|
||||
void RegisterTemplateParsers(void)
|
||||
{
|
||||
const char *proto_name = "template";
|
||||
|
||||
/* Check if Template TCP detection is enabled. If it does not exist in
|
||||
* the configuration file then it will be disabled by default. */
|
||||
if (AppLayerProtoDetectConfProtoDetectionEnabledDefault("tcp", proto_name, false)) {
|
||||
|
||||
SCLogDebug("Template TCP protocol detection enabled.");
|
||||
|
||||
AppLayerProtoDetectRegisterProtocol(ALPROTO_TEMPLATE, proto_name);
|
||||
|
||||
if (RunmodeIsUnittests()) {
|
||||
|
||||
SCLogNotice("Unittest mode, registering default configuration.");
|
||||
AppLayerProtoDetectPPRegister(IPPROTO_TCP, TEMPLATE_DEFAULT_PORT,
|
||||
ALPROTO_TEMPLATE, 0, TEMPLATE_MIN_FRAME_LEN, STREAM_TOSERVER,
|
||||
TemplateProbingParserTs, TemplateProbingParserTc);
|
||||
|
||||
}
|
||||
else {
|
||||
|
||||
if (!AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP,
|
||||
proto_name, ALPROTO_TEMPLATE, 0, TEMPLATE_MIN_FRAME_LEN,
|
||||
TemplateProbingParserTs, TemplateProbingParserTc)) {
|
||||
SCLogDebug("No template app-layer configuration, enabling echo"
|
||||
" detection TCP detection on port %s.",
|
||||
TEMPLATE_DEFAULT_PORT);
|
||||
AppLayerProtoDetectPPRegister(IPPROTO_TCP,
|
||||
TEMPLATE_DEFAULT_PORT, ALPROTO_TEMPLATE, 0,
|
||||
TEMPLATE_MIN_FRAME_LEN, STREAM_TOSERVER,
|
||||
TemplateProbingParserTs, TemplateProbingParserTc);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
else {
|
||||
SCLogDebug("Protocol detector and parser disabled for Template.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
|
||||
|
||||
SCLogNotice("Registering Template protocol parser.");
|
||||
|
||||
/* Register functions for state allocation and freeing. A
|
||||
* state is allocated for every new Template flow. */
|
||||
AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateStateAlloc, TemplateStateFree);
|
||||
|
||||
/* Register request parser for parsing frame from server to client. */
|
||||
AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
STREAM_TOSERVER, TemplateParseRequest);
|
||||
|
||||
/* Register response parser for parsing frames from server to client. */
|
||||
AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
STREAM_TOCLIENT, TemplateParseResponse);
|
||||
|
||||
/* Register a function to be called by the application layer
|
||||
* when a transaction is to be freed. */
|
||||
AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateStateTxFree);
|
||||
|
||||
/* Register a function to return the current transaction count. */
|
||||
AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateGetTxCnt);
|
||||
|
||||
/* Transaction handling. */
|
||||
AppLayerParserRegisterStateProgressCompletionStatus(ALPROTO_TEMPLATE, 1, 1);
|
||||
AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP,
|
||||
ALPROTO_TEMPLATE, TemplateGetStateProgress);
|
||||
AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateGetTx);
|
||||
AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateGetTxData);
|
||||
AppLayerParserRegisterStateDataFunc(IPPROTO_TCP, ALPROTO_TEMPLATE, TemplateGetStateData);
|
||||
|
||||
AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateStateGetEventInfo);
|
||||
AppLayerParserRegisterGetEventInfoById(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateStateGetEventInfoById);
|
||||
|
||||
/* Leave this is if your parser can handle gaps, otherwise
|
||||
* remove. */
|
||||
AppLayerParserRegisterOptionFlags(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
APP_LAYER_PARSER_OPT_ACCEPT_GAPS);
|
||||
}
|
||||
else {
|
||||
SCLogDebug("Template protocol parsing disabled.");
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_TEMPLATE,
|
||||
TemplateParserRegisterTests);
|
||||
#endif
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
#endif
|
||||
|
||||
void TemplateParserRegisterTests(void)
|
||||
{
|
||||
#ifdef UNITTESTS
|
||||
#endif
|
||||
}
|
||||
@ -1,67 +0,0 @@
|
||||
/* Copyright (C) 2015-2021 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <yourname@domain>
|
||||
*/
|
||||
|
||||
#ifndef __APP_LAYER_TEMPLATE_H__
|
||||
#define __APP_LAYER_TEMPLATE_H__
|
||||
|
||||
|
||||
|
||||
#include "rust.h"
|
||||
|
||||
void RegisterTemplateParsers(void);
|
||||
void TemplateParserRegisterTests(void);
|
||||
|
||||
typedef struct TemplateTransaction
|
||||
{
|
||||
/** Internal transaction ID. */
|
||||
uint64_t tx_id;
|
||||
|
||||
uint8_t *request_buffer;
|
||||
uint32_t request_buffer_len;
|
||||
|
||||
uint8_t *response_buffer;
|
||||
uint32_t response_buffer_len;
|
||||
|
||||
uint8_t response_done; /*<< Flag to be set when the response is
|
||||
* seen. */
|
||||
|
||||
AppLayerTxData tx_data;
|
||||
|
||||
TAILQ_ENTRY(TemplateTransaction) next;
|
||||
|
||||
} TemplateTransaction;
|
||||
|
||||
typedef struct TemplateState {
|
||||
AppLayerStateData state_data;
|
||||
|
||||
/** List of Template transactions associated with this
|
||||
* state. */
|
||||
TAILQ_HEAD(, TemplateTransaction) tx_list;
|
||||
|
||||
/** A count of the number of transactions created. The
|
||||
* transaction ID for each transaction is allocated
|
||||
* by incrementing this value. */
|
||||
uint64_t transaction_max;
|
||||
} TemplateState;
|
||||
|
||||
#endif /* __APP_LAYER_TEMPLATE_H__ */
|
||||
@ -1,152 +0,0 @@
|
||||
/* Copyright (C) 2015-2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/*
|
||||
* TODO: Update the \author in this file and detect-template-buffer.h.
|
||||
* TODO: Update description in the \file section below.
|
||||
* TODO: Remove SCLogNotice statements or convert to debug.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <yourname@domain>
|
||||
*
|
||||
* Set up of the "template_buffer" keyword to allow content
|
||||
* inspections on the decoded template application layer buffers.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "conf.h"
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-engine-prefilter.h"
|
||||
#include "app-layer-template.h"
|
||||
#include "detect-template-buffer.h"
|
||||
|
||||
static int DetectTemplateBufferSetup(DetectEngineCtx *, Signature *, const char *);
|
||||
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms,
|
||||
Flow *_f, const uint8_t flow_flags,
|
||||
void *txv, const int list_id);
|
||||
#ifdef UNITTESTS
|
||||
static void DetectTemplateBufferRegisterTests(void);
|
||||
#endif
|
||||
static int g_template_buffer_id = 0;
|
||||
|
||||
void DetectTemplateBufferRegister(void)
|
||||
{
|
||||
/* TEMPLATE_START_REMOVE */
|
||||
/* Prevent registration of this buffer unless explicitly enabled or when
|
||||
* running unittests. This will be removed during code generation from this
|
||||
* template. */
|
||||
if (!RunmodeIsUnittests()) {
|
||||
if (ConfGetNode("app-layer.protocols.template") == NULL) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
/* TEMPLATE_END_REMOVE */
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].name = "template_buffer";
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].desc =
|
||||
"Template content modifier to match on the template buffers";
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].Setup = DetectTemplateBufferSetup;
|
||||
#ifdef UNITTESTS
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].RegisterTests =
|
||||
DetectTemplateBufferRegisterTests;
|
||||
#endif
|
||||
|
||||
sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_NOOPT;
|
||||
|
||||
/* register inspect engines - these are called per signature */
|
||||
DetectAppLayerInspectEngineRegister2("template_buffer",
|
||||
ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER, 0,
|
||||
DetectEngineInspectBufferGeneric, GetData);
|
||||
DetectAppLayerInspectEngineRegister2("template_buffer",
|
||||
ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT, 0,
|
||||
DetectEngineInspectBufferGeneric, GetData);
|
||||
|
||||
/* register mpm engines - these are called in the prefilter stage */
|
||||
DetectAppLayerMpmRegister2("template_buffer", SIG_FLAG_TOSERVER, 0,
|
||||
PrefilterGenericMpmRegister, GetData,
|
||||
ALPROTO_TEMPLATE, 0);
|
||||
DetectAppLayerMpmRegister2("template_buffer", SIG_FLAG_TOCLIENT, 0,
|
||||
PrefilterGenericMpmRegister, GetData,
|
||||
ALPROTO_TEMPLATE, 0);
|
||||
|
||||
|
||||
g_template_buffer_id = DetectBufferTypeGetByName("template_buffer");
|
||||
|
||||
/* NOTE: You may want to change this to SCLogNotice during development. */
|
||||
SCLogDebug("Template application layer detect registered.");
|
||||
}
|
||||
|
||||
static int DetectTemplateBufferSetup(DetectEngineCtx *de_ctx, Signature *s,
|
||||
const char *str)
|
||||
{
|
||||
/* store list id. Content, pcre, etc will be added to the list at this
|
||||
* id. */
|
||||
s->init_data->list = g_template_buffer_id;
|
||||
|
||||
/* set the app proto for this signature. This means it will only be
|
||||
* evaluated against flows that are ALPROTO_TEMPLATE */
|
||||
if (DetectSignatureSetAppProto(s, ALPROTO_TEMPLATE) != 0)
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/** \internal
|
||||
* \brief get the data to inspect from the transaction.
|
||||
* This function gets the data, sets up the InspectionBuffer object
|
||||
* and applies transformations (if any).
|
||||
*
|
||||
* \retval buffer or NULL in case of error
|
||||
*/
|
||||
static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
|
||||
const DetectEngineTransforms *transforms,
|
||||
Flow *_f, const uint8_t flow_flags,
|
||||
void *txv, const int list_id)
|
||||
{
|
||||
InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
|
||||
if (buffer->inspect == NULL) {
|
||||
const TemplateTransaction *tx = (TemplateTransaction *)txv;
|
||||
const uint8_t *data = NULL;
|
||||
uint32_t data_len = 0;
|
||||
|
||||
if (flow_flags & STREAM_TOSERVER) {
|
||||
data = tx->request_buffer;
|
||||
data_len = tx->request_buffer_len;
|
||||
} else if (flow_flags & STREAM_TOCLIENT) {
|
||||
data = tx->response_buffer;
|
||||
data_len = tx->response_buffer_len;
|
||||
} else {
|
||||
return NULL; /* no buffer */
|
||||
}
|
||||
|
||||
InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
|
||||
InspectionBufferApplyTransforms(buffer, transforms);
|
||||
}
|
||||
|
||||
return buffer;
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
#include "detect-engine-alert.h"
|
||||
#include "tests/detect-template-buffer.c"
|
||||
#endif
|
||||
@ -1,30 +0,0 @@
|
||||
/* Copyright (C) 2015-2017 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <yourname@domain>
|
||||
*/
|
||||
|
||||
#ifndef __DETECT_TEMPLATE_BUFFER_H__
|
||||
#define __DETECT_TEMPLATE_BUFFER_H__
|
||||
|
||||
|
||||
void DetectTemplateBufferRegister(void);
|
||||
|
||||
#endif /* __DETECT_TEMPLATE_BUFFER_H__ */
|
||||
@ -1,29 +0,0 @@
|
||||
/* Copyright (C) 2015 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author FirstName LastName <name@domain>
|
||||
*/
|
||||
|
||||
#ifndef __OUTPUT_JSON_TEMPLATE_H__
|
||||
#define __OUTPUT_JSON_TEMPLATE_H__
|
||||
|
||||
void JsonTemplateLogRegister(void);
|
||||
|
||||
#endif /* __OUTPUT_JSON_TEMPLATE_H__ */
|
||||
Loading…
Reference in New Issue