aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust: bindgen SCAppLayerParserTriggerRawStreamInspection

Browse Source 
Ticket: 7667
pull/13884/head
Philippe Antoine 1 year ago committed by Victor Julien
parent c52121586a
commit b00788af8b
13 changed files with 45 additions and 50 deletions
Show Stats Download Patch File Download Diff File

18
rust/src/core.rs
Unescape Escape View File

@ -19,6 +19,8 @@
use std;
use suricata_sys::sys::{AppProto, AppProtoEnum, SCLogLevel};
#[cfg(not(test))]
use suricata_sys::sys::SCAppLayerParserTriggerRawStreamInspection;
use crate::filecontainer::*;
use crate::flow::Flow;
@ -79,9 +81,6 @@ pub type SCLogMessageFunc =
subsystem: *const std::os::raw::c_char,
message: *const std::os::raw::c_char) -> std::os::raw::c_int;
pub type AppLayerParserTriggerRawStreamInspectionFunc =
extern "C" fn (flow: *mut Flow, direction: i32);
pub enum StreamingBufferConfig {}
// Opaque flow type (defined in C)
@ -137,7 +136,6 @@ pub type GenericVarFreeFunc =
#[repr(C)]
pub struct SuricataContext {
pub SCLogMessage: SCLogMessageFunc,
pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc,
pub HttpRangeFreeBlock: SCHttpRangeFreeBlock,
pub HTPFileCloseHandleRange: SCHTPFileCloseHandleRange,
@ -188,11 +186,13 @@ pub fn sc_generic_var_free(gvar: *mut GenericVar)
}
}
/// AppLayerParserTriggerRawStreamInspection wrapper
pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *mut Flow, direction: i32) {
/// SCAppLayerParserTriggerRawStreamInspection wrapper
#[cfg(not(test))]
pub(crate) fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *mut Flow, direction: i32) {
unsafe {
if let Some(c) = SC {
(c.AppLayerParserTriggerRawStreamInspection)(flow, direction);
}
SCAppLayerParserTriggerRawStreamInspection(flow, direction);
}
}
#[cfg(test)]
pub(crate) fn sc_app_layer_parser_trigger_raw_stream_inspection(_flow: *const Flow, _direction: i32) {}

5
rust/sys/src/sys.rs
Unescape Escape View File

@ -749,6 +749,11 @@ extern "C" {
extern "C" {
pub fn SCAppLayerParserRegisterLogger(ipproto: u8, alproto: AppProto);
}
extern "C" {
pub fn SCAppLayerParserTriggerRawStreamInspection(
f: *mut Flow, direction: ::std::os::raw::c_int,
);
}
extern "C" {
pub fn SCAppLayerParserSetStreamDepth(ipproto: u8, alproto: AppProto, stream_depth: u32);
}

4
src/app-layer-dnp3.c
Unescape Escape View File

@ -925,7 +925,7 @@ static void DNP3HandleUserDataRequest(
tx->complete = 1;
}
if (f != NULL) {
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
}
}
@ -1002,7 +1002,7 @@ static void DNP3HandleUserDataResponse(
tx->complete = 1;
}
if (f != NULL) {
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT);
SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT);
}
}

1
src/app-layer-events.c
Unescape Escape View File

@ -134,7 +134,6 @@ void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
}
}
void SCAppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
{
if (events && *events != NULL) {

8
src/app-layer-htp.c
Unescape Escape View File

@ -1470,7 +1470,7 @@ end:
/* body still in progress, but due to min inspect size we need to inspect now */
StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOSERVER, depth);
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
}
/* after the start of the body, disable the depth logic */
} else if (tx_ud->request_body.body_inspected > 0) {
@ -1562,7 +1562,7 @@ static int HTPCallbackResponseBodyData(const htp_connp_t *connp, htp_tx_data_t *
/* body still in progress, but due to min inspect size we need to inspect now */
StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOCLIENT, depth);
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
}
/* after the start of the body, disable the depth logic */
} else if (tx_ud->response_body.body_inspected > 0) {
@ -1767,7 +1767,7 @@ static int HTPCallbackRequestComplete(const htp_connp_t *connp, htp_tx_t *tx)
hstate->last_request_data_stamp = abs_right_edge;
/* request done, do raw reassembly now to inspect state and stream
* at the same time. */
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
SCReturnInt(HTP_STATUS_OK);
}
@ -1816,7 +1816,7 @@ static int HTPCallbackResponseComplete(const htp_connp_t *connp, htp_tx_t *tx)
/* response done, do raw reassembly now to inspect state and stream
* at the same time. */
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
SCAppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
/* handle HTTP CONNECT */
if (htp_tx_request_method_number(tx) == HTP_METHOD_CONNECT) {

4
src/app-layer-parser.c
Unescape Escape View File

@ -1315,7 +1315,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow
if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) {
SCLogDebug("app-layer parser does not accept gaps");
if (f->alstate != NULL && !FlowChangeProto(f)) {
AppLayerParserTriggerRawStreamInspection(f, direction);
SCAppLayerParserTriggerRawStreamInspection(f, direction);
}
AppLayerIncGapErrorCounter(tv, f);
goto error;
@ -1554,7 +1554,7 @@ LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
SCReturnUInt(r);
}
void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction)
void SCAppLayerParserTriggerRawStreamInspection(Flow *f, int direction)
{
SCEnter();

2
src/app-layer-parser.h
Unescape Escape View File

@ -272,7 +272,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate);
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate);
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction);
void SCAppLayerParserTriggerRawStreamInspection(Flow *f, int direction);
void SCAppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
uint32_t AppLayerParserGetStreamDepth(const Flow *f);
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);

8
src/app-layer-smtp.c
Unescape Escape View File

@ -812,7 +812,7 @@ static int SMTPProcessCommandDATA(
depth = (uint32_t)(smtp_config.content_inspect_min_size +
(state->toserver_data_count -
state->toserver_last_data_stamp));
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCLogDebug(
"StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth);
StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth);
@ -840,7 +840,7 @@ static int SMTPProcessCommandDATA(
}
depth = (uint32_t)(state->toserver_data_count -
state->toserver_last_data_stamp);
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCLogDebug("StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth);
StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth);
}
@ -984,7 +984,7 @@ static int SMTPProcessReply(
state->cmds_cnt = 0;
state->cmds_idx = 0;
}
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT);
SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOCLIENT);
return 0;
}
@ -1186,7 +1186,7 @@ static int SMTPProcessRequest(
* STARTTLS and DATA */
if (!(state->parser_state & SMTP_PARSER_STATE_COMMAND_DATA_MODE)) {
int r = 0;
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCAppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
if (line->len >= 8 && SCMemcmpLowercase("starttls", line->buf, 8) == 0) {
state->current_command = SMTP_COMMAND_STARTTLS;

4
src/app-layer-ssl.c
Unescape Escape View File

@ -328,7 +328,7 @@ static inline int SafeMemcpy(void *dst, size_t dst_offset, size_t dst_size,
if ((ssl_state) == NULL) { \
SCLogDebug("could not set decoder event %u", event); \
} else { \
SCAppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \
SCAppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \
(ssl_state)->events++; \
} \
} while (0)
@ -2624,7 +2624,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat
if (ssl_state->curr_connp->bytes_processed >=
ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) {
SCLogDebug("record complete, trigger RAW");
AppLayerParserTriggerRawStreamInspection(
SCAppLayerParserTriggerRawStreamInspection(
ssl_state->f, direction == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
SSLParserReset(ssl_state);
ValidateRecordState(ssl_state->curr_connp);

36
src/app-layer.c
Unescape Escape View File

@ -322,14 +322,12 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
} else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
size_ts > size_ts_limit && size_tc == 0) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
} else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
size_tc > size_tc_limit && size_ts == 0) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
/* little data in ts direction, pp done, pm not done (max
@ -338,8 +336,7 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
} else if (size_tc > size_tc_limit && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
!(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) &&
FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
/* little data in tc direction, pp done, pm not done (max
@ -348,8 +345,7 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
} else if (size_ts > size_ts_limit && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
!(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) && FLOW_IS_PM_DONE(f, STREAM_TOSERVER) &&
FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
}
return;
@ -427,8 +423,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
if (*alproto != ALPROTO_UNKNOWN) {
if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != *alproto) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS);
SCAppLayerDecoderEventsSetEventRaw(
&p->app_layer_events, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS);
if (ssn->data_first_seen_dir == APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) {
/* if we already invoked the parser, we go with that proto */
@ -504,8 +500,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
* As the second data was recognized as P1, the protocol did not change !
*/
FlowUnsetChangeProtoFlag(f);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_UNEXPECTED_PROTOCOL);
SCAppLayerDecoderEventsSetEventRaw(
&p->app_layer_events, APPLAYER_UNEXPECTED_PROTOCOL);
}
}
@ -530,8 +526,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
first_data_dir = AppLayerParserGetFirstDataDir(f->proto, f->alproto);
if (first_data_dir && !(first_data_dir & ssn->data_first_seen_dir)) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_WRONG_DIRECTION_FIRST_DATA);
SCAppLayerDecoderEventsSetEventRaw(
&p->app_layer_events, APPLAYER_WRONG_DIRECTION_FIRST_DATA);
goto detect_error;
}
/* This can happen if the current direction is not the
@ -652,8 +648,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
}
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION);
SCAppLayerDecoderEventsSetEventRaw(
&p->app_layer_events, APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION);
TcpSessionSetReassemblyDepth(ssn,
AppLayerParserGetStreamDepth(f));
AppLayerIncFlowCounter(tv, f);
@ -815,13 +811,11 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet
if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN &&
f->alproto != f->alproto_expect) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_UNEXPECTED_PROTOCOL);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_UNEXPECTED_PROTOCOL);
if (f->alproto_expect == ALPROTO_TLS && f->alproto != ALPROTO_TLS) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_NO_TLS_AFTER_STARTTLS);
SCAppLayerDecoderEventsSetEventRaw(
&p->app_layer_events, APPLAYER_NO_TLS_AFTER_STARTTLS);
}
}
} else {

1
src/rust-context.c
Unescape Escape View File

@ -26,7 +26,6 @@
const SuricataContext suricata_context = {
SCLogMessage,
AppLayerParserTriggerRawStreamInspection,
HttpRangeFreeBlock,
HTPFileCloseHandleRange,

1
src/rust-context.h
Unescape Escape View File

@ -37,7 +37,6 @@ struct AppLayerParser;
typedef struct SuricataContext_ {
SCError (*SCLogMessage)(const SCLogLevel, const char *, const unsigned int, const char *,
const char *, const char *message);
void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction);
void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *);
bool (*HTPFileCloseHandleRange)(const StreamingBufferConfig *sbcfg, FileContainer *,

3
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -864,8 +864,7 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre
if (RB_EMPTY(&stream->seg_tree) &&
stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED) {
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
}
int r = StreamTcpReassembleInsertSegment(tv, ra_ctx, stream, seg, p, p->payload, payload_len);

Write Preview
Loading…
Cancel
Save