aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust/ffi: move AppLayerTxData to ffi

Browse Source 
Ticket: 7666
pull/15432/head
Philippe Antoine 3 months ago committed by Victor Julien
parent bce88dd83f
commit b90adcc2bb
5 changed files with 99 additions and 95 deletions
Show Stats Download Patch File Download Diff File

1
rust/Cargo.toml.in
Unescape Escape View File

@ -95,3 +95,4 @@ htp = { package = "suricata-htp", path = "./htp", version = "@PACKAGE_VERSION@"
[dev-dependencies]
test-case = "~3.3.1"
suricata-ffi = { path = "./ffi", version = "@PACKAGE_VERSION@", features = ["testing"] }

1
rust/ffi/Cargo.toml.in
Unescape Escape View File

@ -11,3 +11,4 @@ suricata-sys = { path = "../sys" }
[features]
debug = []
debug-validate = []
testing = []

2
rust/ffi/cbindgen.toml
Unescape Escape View File

@ -17,4 +17,4 @@ exclude = [
"IPPROTO_UDP",
]
item_types = ["constants"]
item_types = ["constants", "functions"]

96
rust/ffi/src/applayer.rs
Unescape Escape View File

@ -17,7 +17,8 @@
//! App-layer utils.
use crate::cast_pointer;
use crate::direction::Direction;
use crate::{cast_pointer, SCLogDebug};
use std::ffi::CStr;
pub use suricata_sys::sys::AppLayerEventType;
use suricata_sys::sys::{
@ -340,3 +341,96 @@ pub unsafe fn get_event_info_by_id<T: AppLayerEvent>(
}
-1
}
#[cfg(not(any(test, feature = "testing")))]
use suricata_sys::sys::{SCAppLayerDecoderEventsSetEventRaw, SCAppLayerTxDataCleanup};
#[derive(Debug, Default, Eq, PartialEq)]
pub struct AppLayerTxData(pub suricata_sys::sys::AppLayerTxData);
impl AppLayerTxData {
/// Create new AppLayerTxData for a transaction that covers both
/// directions.
pub fn new() -> Self {
Self(suricata_sys::sys::AppLayerTxData {
updated_tc: true,
updated_ts: true,
..Default::default()
})
}
/// Create new AppLayerTxData for a transaction in a single
/// direction.
pub fn for_direction(direction: Direction) -> Self {
let (flags, updated_ts, updated_tc) = match direction {
Direction::ToServer => (APP_LAYER_TX_SKIP_INSPECT_TC, true, false),
Direction::ToClient => (APP_LAYER_TX_SKIP_INSPECT_TS, false, true),
};
Self(suricata_sys::sys::AppLayerTxData {
updated_tc,
updated_ts,
flags,
..Default::default()
})
}
pub fn init_files_opened(&mut self) {
self.0.files_opened = 1;
}
pub fn incr_files_opened(&mut self) {
self.0.files_opened += 1;
}
pub fn set_event(&mut self, _event: u8) {
#[cfg(not(any(test, feature = "testing")))]
unsafe {
SCAppLayerDecoderEventsSetEventRaw(&mut self.0.events, _event);
}
}
pub fn update_file_flags(&mut self, state_flags: u16) {
unsafe {
SCTxDataUpdateFileFlags(&mut self.0, state_flags);
}
}
}
impl Drop for AppLayerTxData {
fn drop(&mut self) {
#[cfg(not(any(test, feature = "testing")))]
unsafe {
SCAppLayerTxDataCleanup(&mut self.0);
}
}
}
/// # Safety
///
/// the caller must provide a valid AppLayerTxData pointer
#[no_mangle]
pub unsafe extern "C" fn SCTxDataUpdateFileFlags(
txd: &mut suricata_sys::sys::AppLayerTxData, state_flags: u16,
) {
if (txd.file_flags & state_flags) != state_flags {
SCLogDebug!(
"updating tx file_flags {:04x} with state flags {:04x}",
txd.file_flags,
state_flags
);
let mut nf = state_flags;
// With keyword filestore:both,flow :
// There may be some opened unclosed file in one direction without filestore
// As such it has tx file_flags had FLOWFILE_NO_STORE_TS or TC
// But a new file in the other direction may trigger filestore:both,flow
// And thus set state_flags FLOWFILE_STORE_TS
// If the file was opened without storing it, do not try to store just the end of it
if (txd.file_flags & FLOWFILE_NO_STORE_TS) != 0 && (state_flags & FLOWFILE_STORE_TS) != 0 {
nf &= !FLOWFILE_STORE_TS;
}
if (txd.file_flags & FLOWFILE_NO_STORE_TC) != 0 && (state_flags & FLOWFILE_STORE_TC) != 0 {
nf &= !FLOWFILE_STORE_TC;
}
txd.file_flags |= nf;
}
}

94
rust/src/applayer.rs
Unescape Escape View File

@ -35,103 +35,11 @@ pub use suricata_sys::sys::{
AppLayerTxConfig, StreamSlice,
};
#[cfg(not(test))]
use suricata_sys::sys::SCAppLayerDecoderEventsSetEventRaw;
pub use suricata_ffi::cast_pointer;
#[derive(Debug, Default, Eq, PartialEq)]
pub struct AppLayerTxData(pub suricata_sys::sys::AppLayerTxData);
impl AppLayerTxData {
/// Create new AppLayerTxData for a transaction that covers both
/// directions.
pub fn new() -> Self {
Self (suricata_sys::sys::AppLayerTxData {
updated_tc: true,
updated_ts: true,
..Default::default()
})
}
/// Create new AppLayerTxData for a transaction in a single
/// direction.
pub fn for_direction(direction: Direction) -> Self {
let (flags, updated_ts, updated_tc) = match direction {
Direction::ToServer => (APP_LAYER_TX_SKIP_INSPECT_TC, true, false),
Direction::ToClient => (APP_LAYER_TX_SKIP_INSPECT_TS, false, true),
};
Self (suricata_sys::sys::AppLayerTxData{
updated_tc,
updated_ts,
flags,
..Default::default()
})
}
pub fn init_files_opened(&mut self) {
self.0.files_opened = 1;
}
pub fn incr_files_opened(&mut self) {
self.0.files_opened += 1;
}
pub fn set_event(&mut self, _event: u8) {
#[cfg(not(test))]
unsafe {
SCAppLayerDecoderEventsSetEventRaw(&mut self.0.events, _event);
}
}
pub fn update_file_flags(&mut self, state_flags: u16) {
unsafe {
SCTxDataUpdateFileFlags(&mut self.0, state_flags);
}
}
}
#[cfg(not(test))]
use suricata_sys::sys::SCAppLayerTxDataCleanup;
impl Drop for AppLayerTxData {
fn drop(&mut self) {
#[cfg(not(test))]
unsafe {
SCAppLayerTxDataCleanup(&mut self.0);
}
}
}
pub use suricata_ffi::applayer::{
FLOWFILE_NO_STORE_TS, FLOWFILE_NO_STORE_TC, FLOWFILE_STORE_TS, FLOWFILE_STORE_TC,
};
#[no_mangle]
pub unsafe extern "C" fn SCTxDataUpdateFileFlags(txd: &mut suricata_sys::sys::AppLayerTxData, state_flags: u16) {
if (txd.file_flags & state_flags) != state_flags {
SCLogDebug!("updating tx file_flags {:04x} with state flags {:04x}", txd.file_flags, state_flags);
let mut nf = state_flags;
// With keyword filestore:both,flow :
// There may be some opened unclosed file in one direction without filestore
// As such it has tx file_flags had FLOWFILE_NO_STORE_TS or TC
// But a new file in the other direction may trigger filestore:both,flow
// And thus set state_flags FLOWFILE_STORE_TS
// If the file was opened without storing it, do not try to store just the end of it
if (txd.file_flags & FLOWFILE_NO_STORE_TS) != 0 && (state_flags & FLOWFILE_STORE_TS) != 0 {
nf &= !FLOWFILE_STORE_TS;
}
if (txd.file_flags & FLOWFILE_NO_STORE_TC) != 0 && (state_flags & FLOWFILE_STORE_TC) != 0 {
nf &= !FLOWFILE_STORE_TC;
}
txd.file_flags |= nf;
}
}
pub use suricata_ffi::{export_tx_data_get, export_state_data_get};
pub use suricata_ffi::applayer::{AppLayerEvent, AppLayerEventType, AppLayerResultRust, StreamSliceRust};
pub use suricata_ffi::applayer::{AppLayerEvent, AppLayerEventType, AppLayerResultRust, AppLayerTxData, StreamSliceRust};
/// Rust parser declaration
#[repr(C)]

Write Preview
Loading…
Cancel
Save