mirror of https://github.com/OISF/suricata
dcerpc: Add rust registration function
Get rid of the C glue code and move registration completely to Rust.pull/6139/head
Shivani Bhardwaj
5 years ago
committed by
Victor Julien
parent
a0a09a102b
commit
bac69af7e4
@ -1,202 +0,0 @@
|
||||
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "suricata.h"
|
||||
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
#include "threads.h"
|
||||
|
||||
#include "util-print.h"
|
||||
#include "util-pool.h"
|
||||
#include "util-debug.h"
|
||||
|
||||
#include "flow-util.h"
|
||||
|
||||
#include "detect-engine-state.h"
|
||||
|
||||
#include "stream-tcp-private.h"
|
||||
#include "stream-tcp-reassemble.h"
|
||||
#include "stream-tcp.h"
|
||||
#include "stream.h"
|
||||
|
||||
#include "app-layer-protos.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer.h"
|
||||
|
||||
#include "util-spm.h"
|
||||
#include "util-unittest.h"
|
||||
|
||||
#include "app-layer-dcerpc-common.h"
|
||||
#include "app-layer-dcerpc.h"
|
||||
|
||||
static AppLayerResult DCERPCParseRequest(Flow *f, void *dcerpc_state,
|
||||
AppLayerParserState *pstate,
|
||||
const uint8_t *input, uint32_t input_len,
|
||||
void *local_data, const uint8_t flags)
|
||||
{
|
||||
if (input == NULL && input_len > 0) {
|
||||
AppLayerResult res = rs_parse_dcerpc_request_gap(dcerpc_state, input_len);
|
||||
SCLogDebug("DCERPC request GAP of %u bytes, retval %d", input_len, res.status);
|
||||
SCReturnStruct(res);
|
||||
} else {
|
||||
AppLayerResult res = rs_dcerpc_parse_request(
|
||||
f, dcerpc_state, pstate, input, input_len, local_data, flags);
|
||||
SCLogDebug("DCERPC request%s of %u bytes, retval %d",
|
||||
(input == NULL && input_len > 0) ? " is GAP" : "", input_len, res.status);
|
||||
SCReturnStruct(res);
|
||||
}
|
||||
}
|
||||
|
||||
static AppLayerResult DCERPCParseResponse(Flow *f, void *dcerpc_state,
|
||||
AppLayerParserState *pstate,
|
||||
const uint8_t *input, uint32_t input_len,
|
||||
void *local_data, const uint8_t flags)
|
||||
{
|
||||
if (input == NULL && input_len > 0) {
|
||||
AppLayerResult res = rs_parse_dcerpc_response_gap(dcerpc_state, input_len);
|
||||
SCLogDebug("DCERPC response GAP of %u bytes, retval %d", input_len, res.status);
|
||||
SCReturnStruct(res);
|
||||
} else {
|
||||
AppLayerResult res = rs_dcerpc_parse_response(
|
||||
f, dcerpc_state, pstate, input, input_len, local_data, flags);
|
||||
SCLogDebug("DCERPC response%s of %u bytes, retval %d",
|
||||
(input == NULL && input_len > 0) ? " is GAP" : "", input_len, res.status);
|
||||
SCReturnStruct(res);
|
||||
}
|
||||
}
|
||||
|
||||
static void *RustDCERPCStateNew(void *state_orig, AppProto proto_orig)
|
||||
{
|
||||
return rs_dcerpc_state_new(state_orig, proto_orig);
|
||||
}
|
||||
|
||||
static void DCERPCStateFree(void *s)
|
||||
{
|
||||
return rs_dcerpc_state_free(s);
|
||||
}
|
||||
|
||||
static int DCERPCSetTxDetectState(void *vtx, DetectEngineState *de_state)
|
||||
{
|
||||
return rs_dcerpc_set_tx_detect_state(vtx, de_state);
|
||||
}
|
||||
|
||||
static DetectEngineState *DCERPCGetTxDetectState(void *vtx)
|
||||
{
|
||||
return rs_dcerpc_get_tx_detect_state(vtx);
|
||||
}
|
||||
|
||||
static void DCERPCStateTransactionFree(void *state, uint64_t tx_id)
|
||||
{
|
||||
return rs_dcerpc_state_transaction_free(state, tx_id);
|
||||
}
|
||||
|
||||
static void *DCERPCGetTx(void *state, uint64_t tx_id)
|
||||
{
|
||||
return rs_dcerpc_get_tx(state, tx_id);
|
||||
}
|
||||
|
||||
static uint64_t DCERPCGetTxCnt(void *state)
|
||||
{
|
||||
return rs_dcerpc_get_tx_cnt(state);
|
||||
}
|
||||
|
||||
static int DCERPCGetAlstateProgress(void *tx, uint8_t direction)
|
||||
{
|
||||
return rs_dcerpc_get_alstate_progress(tx, direction);
|
||||
}
|
||||
|
||||
static uint16_t DCERPCTCPProbe(
|
||||
Flow *f, uint8_t direction, const uint8_t *input, uint32_t len, uint8_t *rdir)
|
||||
{
|
||||
SCLogDebug("DCERPCTCPProbe");
|
||||
|
||||
const int r = rs_dcerpc_probe_tcp(f, direction, input, len, rdir);
|
||||
switch (r) {
|
||||
case 1:
|
||||
return ALPROTO_DCERPC;
|
||||
case 0:
|
||||
return ALPROTO_UNKNOWN;
|
||||
case -1:
|
||||
default:
|
||||
return ALPROTO_FAILED;
|
||||
}
|
||||
}
|
||||
|
||||
static int DCERPCRegisterPatternsForProtocolDetection(void)
|
||||
{
|
||||
if (AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0,
|
||||
STREAM_TOSERVER, DCERPCTCPProbe, 0, 0) < 0) {
|
||||
return -1;
|
||||
}
|
||||
if (AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0,
|
||||
STREAM_TOCLIENT, DCERPCTCPProbe, 0, 0) < 0) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void RegisterDCERPCParsers(void)
|
||||
{
|
||||
const char *proto_name = "dcerpc";
|
||||
|
||||
if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
|
||||
AppLayerProtoDetectRegisterProtocol(ALPROTO_DCERPC, proto_name);
|
||||
if (DCERPCRegisterPatternsForProtocolDetection() < 0)
|
||||
return;
|
||||
} else {
|
||||
SCLogInfo("Protocol detection and parser disabled for %s protocol.",
|
||||
proto_name);
|
||||
return;
|
||||
}
|
||||
|
||||
if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
|
||||
AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOSERVER,
|
||||
DCERPCParseRequest);
|
||||
AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOCLIENT,
|
||||
DCERPCParseResponse);
|
||||
AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_DCERPC, RustDCERPCStateNew,
|
||||
DCERPCStateFree);
|
||||
AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_DCERPC, STREAM_TOSERVER);
|
||||
|
||||
|
||||
AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCStateTransactionFree);
|
||||
|
||||
AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_DCERPC,
|
||||
DCERPCGetTxDetectState, DCERPCSetTxDetectState);
|
||||
|
||||
AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCGetTx);
|
||||
AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_DCERPC, rs_dcerpc_get_tx_data);
|
||||
|
||||
AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCGetTxCnt);
|
||||
|
||||
AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_DCERPC, DCERPCGetAlstateProgress);
|
||||
|
||||
AppLayerParserRegisterStateProgressCompletionStatus(ALPROTO_DCERPC, 1, 1);
|
||||
|
||||
/* This parser accepts gaps. */
|
||||
AppLayerParserRegisterOptionFlags(IPPROTO_TCP, ALPROTO_DCERPC, APP_LAYER_PARSER_OPT_ACCEPT_GAPS);
|
||||
|
||||
AppLayerParserRegisterTruncateFunc(IPPROTO_TCP, ALPROTO_DCERPC, rs_dcerpc_state_trunc);
|
||||
} else {
|
||||
SCLogInfo("Parsed disabled for %s protocol. Protocol detection"
|
||||
"still on.", proto_name);
|
||||
}
|
||||
return;
|
||||
}
|
||||
@ -1,24 +0,0 @@
|
||||
/* Copyright (C) 2020 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
#ifndef __APP_LAYER_DCERPC_RUST_H__
|
||||
#define __APP_LAYER_DCERPC_RUST_H__
|
||||
|
||||
void RegisterDCERPCParsers(void);
|
||||
|
||||
#endif /* __APP_LAYER_DCERPC_H__ */
|
||||
|
||||
Loading…
Reference in New Issue