From b00788af8b6241ce5ff43b9837beb1ce2e995d73 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 12 Jun 2025 15:30:25 +0200 Subject: [PATCH] rust: bindgen SCAppLayerParserTriggerRawStreamInspection Ticket: 7667 --- rust/src/core.rs | 18 +++++++++--------- rust/sys/src/sys.rs | 5 +++++ src/app-layer-dnp3.c | 4 ++-- src/app-layer-events.c | 1 - src/app-layer-htp.c | 8 ++++---- src/app-layer-parser.c | 4 ++-- src/app-layer-parser.h | 2 +- src/app-layer-smtp.c | 8 ++++---- src/app-layer-ssl.c | 4 ++-- src/app-layer.c | 36 +++++++++++++++--------------------- src/rust-context.c | 1 - src/rust-context.h | 1 - src/stream-tcp-reassemble.c | 3 +-- 13 files changed, 45 insertions(+), 50 deletions(-) diff --git a/rust/src/core.rs b/rust/src/core.rs index 3c3fa94753..621942014d 100644 --- a/rust/src/core.rs +++ b/rust/src/core.rs @@ -19,6 +19,8 @@ use std; use suricata_sys::sys::{AppProto, AppProtoEnum, SCLogLevel}; +#[cfg(not(test))] +use suricata_sys::sys::SCAppLayerParserTriggerRawStreamInspection; use crate::filecontainer::*; use crate::flow::Flow; @@ -79,9 +81,6 @@ pub type SCLogMessageFunc = subsystem: *const std::os::raw::c_char, message: *const std::os::raw::c_char) -> std::os::raw::c_int; -pub type AppLayerParserTriggerRawStreamInspectionFunc = - extern "C" fn (flow: *mut Flow, direction: i32); - pub enum StreamingBufferConfig {} // Opaque flow type (defined in C) @@ -137,7 +136,6 @@ pub type GenericVarFreeFunc = #[repr(C)] pub struct SuricataContext { pub SCLogMessage: SCLogMessageFunc, - pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc, pub HttpRangeFreeBlock: SCHttpRangeFreeBlock, pub HTPFileCloseHandleRange: SCHTPFileCloseHandleRange, @@ -188,11 +186,13 @@ pub fn sc_generic_var_free(gvar: *mut GenericVar) } } -/// AppLayerParserTriggerRawStreamInspection wrapper -pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *mut Flow, direction: i32) { +/// SCAppLayerParserTriggerRawStreamInspection wrapper +#[cfg(not(test))] +pub(crate) fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *mut Flow, direction: i32) { unsafe { - if let Some(c) = SC { - (c.AppLayerParserTriggerRawStreamInspection)(flow, direction); - } + SCAppLayerParserTriggerRawStreamInspection(flow, direction); } } + +#[cfg(test)] +pub(crate) fn sc_app_layer_parser_trigger_raw_stream_inspection(_flow: *const Flow, _direction: i32) {} diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs index 05170642da..2e55b3d0d3 100644 --- a/rust/sys/src/sys.rs +++ b/rust/sys/src/sys.rs @@ -749,6 +749,11 @@ extern "C" { extern "C" { pub fn SCAppLayerParserRegisterLogger(ipproto: u8, alproto: AppProto); } +extern "C" { + pub fn SCAppLayerParserTriggerRawStreamInspection( + f: *mut Flow, direction: ::std::os::raw::c_int, + ); +} extern "C" { pub fn SCAppLayerParserSetStreamDepth(ipproto: u8, alproto: AppProto, stream_depth: u32); } diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c index cb1081fb61..4f55e39821 100644 --- a/src/app-layer-dnp3.c +++ b/src/app-layer-dnp3.c @@ -925,7 +925,7 @@ static void DNP3HandleUserDataRequest( tx->complete = 1; } if (f != NULL) { - AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); + SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); } } @@ -1002,7 +1002,7 @@ static void DNP3HandleUserDataResponse( tx->complete = 1; } if (f != NULL) { - AppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT); + SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT); } } diff --git a/src/app-layer-events.c b/src/app-layer-events.c index 2429d99582..4e6ced0c2e 100644 --- a/src/app-layer-events.c +++ b/src/app-layer-events.c @@ -134,7 +134,6 @@ void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events) } } - void SCAppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events) { if (events && *events != NULL) { diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index d17cdc3fb6..d7862e0d75 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -1470,7 +1470,7 @@ end: /* body still in progress, but due to min inspect size we need to inspect now */ StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOSERVER, depth); - AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); + SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); } /* after the start of the body, disable the depth logic */ } else if (tx_ud->request_body.body_inspected > 0) { @@ -1562,7 +1562,7 @@ static int HTPCallbackResponseBodyData(const htp_connp_t *connp, htp_tx_data_t * /* body still in progress, but due to min inspect size we need to inspect now */ StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOCLIENT, depth); - AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); + SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); } /* after the start of the body, disable the depth logic */ } else if (tx_ud->response_body.body_inspected > 0) { @@ -1767,7 +1767,7 @@ static int HTPCallbackRequestComplete(const htp_connp_t *connp, htp_tx_t *tx) hstate->last_request_data_stamp = abs_right_edge; /* request done, do raw reassembly now to inspect state and stream * at the same time. */ - AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); + SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); SCReturnInt(HTP_STATUS_OK); } @@ -1816,7 +1816,7 @@ static int HTPCallbackResponseComplete(const htp_connp_t *connp, htp_tx_t *tx) /* response done, do raw reassembly now to inspect state and stream * at the same time. */ - AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); + SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); /* handle HTTP CONNECT */ if (htp_tx_request_method_number(tx) == HTP_METHOD_CONNECT) { diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 3d73111848..08757c4c2a 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -1315,7 +1315,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) { SCLogDebug("app-layer parser does not accept gaps"); if (f->alstate != NULL && !FlowChangeProto(f)) { - AppLayerParserTriggerRawStreamInspection(f, direction); + SCAppLayerParserTriggerRawStreamInspection(f, direction); } AppLayerIncGapErrorCounter(tv, f); goto error; @@ -1554,7 +1554,7 @@ LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto) SCReturnUInt(r); } -void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction) +void SCAppLayerParserTriggerRawStreamInspection(Flow *f, int direction) { SCEnter(); diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h index d1a6bbdcbf..32c7d26445 100644 --- a/src/app-layer-parser.h +++ b/src/app-layer-parser.h @@ -272,7 +272,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate); bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate); int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto); -void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction); +void SCAppLayerParserTriggerRawStreamInspection(Flow *f, int direction); void SCAppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth); uint32_t AppLayerParserGetStreamDepth(const Flow *f); void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags); diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c index fd901e109d..a0136ed201 100644 --- a/src/app-layer-smtp.c +++ b/src/app-layer-smtp.c @@ -812,7 +812,7 @@ static int SMTPProcessCommandDATA( depth = (uint32_t)(smtp_config.content_inspect_min_size + (state->toserver_data_count - state->toserver_last_data_stamp)); - AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); + SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); SCLogDebug( "StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth); StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth); @@ -840,7 +840,7 @@ static int SMTPProcessCommandDATA( } depth = (uint32_t)(state->toserver_data_count - state->toserver_last_data_stamp); - AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); + SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); SCLogDebug("StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth); StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth); } @@ -984,7 +984,7 @@ static int SMTPProcessReply( state->cmds_cnt = 0; state->cmds_idx = 0; } - AppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT); + SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT); return 0; } @@ -1186,7 +1186,7 @@ static int SMTPProcessRequest( * STARTTLS and DATA */ if (!(state->parser_state & SMTP_PARSER_STATE_COMMAND_DATA_MODE)) { int r = 0; - AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); + SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); if (line->len >= 8 && SCMemcmpLowercase("starttls", line->buf, 8) == 0) { state->current_command = SMTP_COMMAND_STARTTLS; diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index f2c5ccb475..c252b9012a 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -328,7 +328,7 @@ static inline int SafeMemcpy(void *dst, size_t dst_offset, size_t dst_size, if ((ssl_state) == NULL) { \ SCLogDebug("could not set decoder event %u", event); \ } else { \ - SCAppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \ + SCAppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \ (ssl_state)->events++; \ } \ } while (0) @@ -2624,7 +2624,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat if (ssl_state->curr_connp->bytes_processed >= ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) { SCLogDebug("record complete, trigger RAW"); - AppLayerParserTriggerRawStreamInspection( + SCAppLayerParserTriggerRawStreamInspection( ssl_state->f, direction == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT); SSLParserReset(ssl_state); ValidateRecordState(ssl_state->curr_connp); diff --git a/src/app-layer.c b/src/app-layer.c index e965be398c..79ebd4ead0 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -322,14 +322,12 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv, } else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && size_ts > size_ts_limit && size_tc == 0) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_PROTO_DETECTION_SKIPPED); + SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; } else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) && size_tc > size_tc_limit && size_ts == 0) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_PROTO_DETECTION_SKIPPED); + SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; /* little data in ts direction, pp done, pm not done (max @@ -338,8 +336,7 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv, } else if (size_tc > size_tc_limit && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_PROTO_DETECTION_SKIPPED); + SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; /* little data in tc direction, pp done, pm not done (max @@ -348,8 +345,7 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv, } else if (size_ts > size_ts_limit && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) && !(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) && FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_PROTO_DETECTION_SKIPPED); + SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); goto failure; } return; @@ -427,8 +423,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, if (*alproto != ALPROTO_UNKNOWN) { if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != *alproto) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS); + SCAppLayerDecoderEventsSetEventRaw( + &p->app_layer_events, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS); if (ssn->data_first_seen_dir == APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) { /* if we already invoked the parser, we go with that proto */ @@ -504,8 +500,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, * As the second data was recognized as P1, the protocol did not change ! */ FlowUnsetChangeProtoFlag(f); - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_UNEXPECTED_PROTOCOL); + SCAppLayerDecoderEventsSetEventRaw( + &p->app_layer_events, APPLAYER_UNEXPECTED_PROTOCOL); } } @@ -530,8 +526,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, first_data_dir = AppLayerParserGetFirstDataDir(f->proto, f->alproto); if (first_data_dir && !(first_data_dir & ssn->data_first_seen_dir)) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_WRONG_DIRECTION_FIRST_DATA); + SCAppLayerDecoderEventsSetEventRaw( + &p->app_layer_events, APPLAYER_WRONG_DIRECTION_FIRST_DATA); goto detect_error; } /* This can happen if the current direction is not the @@ -652,8 +648,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, StreamTcpUpdateAppLayerProgress(ssn, direction, data_len); } - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION); + SCAppLayerDecoderEventsSetEventRaw( + &p->app_layer_events, APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION); TcpSessionSetReassemblyDepth(ssn, AppLayerParserGetStreamDepth(f)); AppLayerIncFlowCounter(tv, f); @@ -815,13 +811,11 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN && f->alproto != f->alproto_expect) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_UNEXPECTED_PROTOCOL); + SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_UNEXPECTED_PROTOCOL); if (f->alproto_expect == ALPROTO_TLS && f->alproto != ALPROTO_TLS) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_NO_TLS_AFTER_STARTTLS); - + SCAppLayerDecoderEventsSetEventRaw( + &p->app_layer_events, APPLAYER_NO_TLS_AFTER_STARTTLS); } } } else { diff --git a/src/rust-context.c b/src/rust-context.c index a1959ec7c8..bd077a2d8a 100644 --- a/src/rust-context.c +++ b/src/rust-context.c @@ -26,7 +26,6 @@ const SuricataContext suricata_context = { SCLogMessage, - AppLayerParserTriggerRawStreamInspection, HttpRangeFreeBlock, HTPFileCloseHandleRange, diff --git a/src/rust-context.h b/src/rust-context.h index 4fe0e039ad..6f02110a08 100644 --- a/src/rust-context.h +++ b/src/rust-context.h @@ -37,7 +37,6 @@ struct AppLayerParser; typedef struct SuricataContext_ { SCError (*SCLogMessage)(const SCLogLevel, const char *, const unsigned int, const char *, const char *, const char *message); - void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction); void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *); bool (*HTPFileCloseHandleRange)(const StreamingBufferConfig *sbcfg, FileContainer *, diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 0a9ce68e74..f841649b1f 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -864,8 +864,7 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre if (RB_EMPTY(&stream->seg_tree) && stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED) { - SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, - APPLAYER_PROTO_DETECTION_SKIPPED); + SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED); } int r = StreamTcpReassembleInsertSegment(tv, ra_ctx, stream, seg, p, p->payload, payload_len);