aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rust: move AppLayerEvents funcs out of RustContext

Browse Source 
Ticket: 7667

just use it directly, with bindgen, and cfg not test
pull/13884/head
Philippe Antoine 5 months ago committed by Victor Julien
parent 2b419a5a26
commit c52121586a
19 changed files with 85 additions and 73 deletions
Show Stats Download Patch File Download Diff File

18
rust/src/applayer.rs
Unescape Escape View File

@ -29,9 +29,9 @@ use crate::core::StreamingBufferConfig;
// Make the AppLayerEvent derive macro available to users importing
// AppLayerEvent from this module.
pub use suricata_derive::AppLayerEvent;
use suricata_sys::sys::{AppLayerParserState, AppProto, DetectEngineState};
use suricata_sys::sys::{AppLayerParserState, AppProto, DetectEngineState, AppLayerDecoderEvents};
#[cfg(not(test))]
use suricata_sys::sys::{SCDetectEngineStateFree};
use suricata_sys::sys::{SCDetectEngineStateFree, SCAppLayerDecoderEventsFreeEvents, SCAppLayerDecoderEventsSetEventRaw};
/// Cast pointer to a variable, as a mutable reference to an object
///
@ -148,7 +148,7 @@ pub struct AppLayerTxData {
detect_progress_tc: u8,
de_state: *mut DetectEngineState,
pub events: *mut core::AppLayerDecoderEvents,
pub events: *mut AppLayerDecoderEvents,
txbits: *mut GenericVar,
}
@ -178,8 +178,11 @@ impl AppLayerTxData {
SCDetectEngineStateFree(self.de_state);
}
}
#[cfg(not(test))]
if !self.events.is_null() {
core::sc_app_layer_decoder_events_free_events(&mut self.events);
unsafe {
SCAppLayerDecoderEventsFreeEvents(&mut self.events);
}
}
if !self.txbits.is_null() {
core::sc_generic_var_free(self.txbits);
@ -244,8 +247,11 @@ impl AppLayerTxData {
self.files_opened += 1;
}
pub fn set_event(&mut self, event: u8) {
core::sc_app_layer_decoder_events_set_event_raw(&mut self.events, event);
pub fn set_event(&mut self, _event: u8) {
#[cfg(not(test))]
unsafe {
SCAppLayerDecoderEventsSetEventRaw(&mut self.events, _event);
}
}
pub fn update_file_flags(&mut self, state_flags: u16) {

31
rust/src/core.rs
Unescape Escape View File

@ -24,7 +24,6 @@ use crate::filecontainer::*;
use crate::flow::Flow;
/// Opaque C types.
pub enum AppLayerDecoderEvents {}
pub enum GenericVar {}
#[repr(C)]
@ -82,12 +81,6 @@ pub type SCLogMessageFunc =
pub type AppLayerParserTriggerRawStreamInspectionFunc =
extern "C" fn (flow: *mut Flow, direction: i32);
pub type AppLayerDecoderEventsSetEventRawFunc =
extern "C" fn (events: *mut *mut AppLayerDecoderEvents,
event: u8);
pub type AppLayerDecoderEventsFreeEventsFunc =
extern "C" fn (events: *mut *mut AppLayerDecoderEvents);
pub enum StreamingBufferConfig {}
@ -144,8 +137,6 @@ pub type GenericVarFreeFunc =
#[repr(C)]
pub struct SuricataContext {
pub SCLogMessage: SCLogMessageFunc,
AppLayerDecoderEventsSetEventRaw: AppLayerDecoderEventsSetEventRawFunc,
AppLayerDecoderEventsFreeEvents: AppLayerDecoderEventsFreeEventsFunc,
pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc,
pub HttpRangeFreeBlock: SCHttpRangeFreeBlock,
@ -205,25 +196,3 @@ pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *mut Flow, direct
}
}
}
/// AppLayerDecoderEventsSetEventRaw wrapper.
pub fn sc_app_layer_decoder_events_set_event_raw(
events: *mut *mut AppLayerDecoderEvents, event: u8)
{
unsafe {
if let Some(c) = SC {
(c.AppLayerDecoderEventsSetEventRaw)(events, event);
}
}
}
/// AppLayerDecoderEventsFreeEvents wrapper.
pub fn sc_app_layer_decoder_events_free_events(
events: *mut *mut AppLayerDecoderEvents)
{
unsafe {
if let Some(c) = SC {
(c.AppLayerDecoderEventsFreeEvents)(events);
}
}
}

39
rust/sys/src/sys.rs
Unescape Escape View File

@ -733,6 +733,8 @@ pub struct AppLayerParserState_ {
_unused: [u8; 0],
}
pub type AppLayerParserState = AppLayerParserState_;
#[doc = " \\brief Data structure to store app layer decoder events."]
pub type AppLayerDecoderEvents = AppLayerDecoderEvents_;
extern "C" {
#[doc = " \\brief Given a protocol name, checks if the parser is enabled in\n the conf file.\n\n \\param alproto_name Name of the app layer protocol.\n\n \\retval 1 If enabled.\n \\retval 0 If disabled."]
pub fn SCAppLayerParserConfParserEnabled(
@ -763,6 +765,43 @@ extern "C" {
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct SCEnumCharMap_ {
pub enum_name: *const ::std::os::raw::c_char,
pub enum_value: ::std::os::raw::c_int,
}
pub type SCEnumCharMap = SCEnumCharMap_;
extern "C" {
pub fn SCMapEnumNameToValue(
arg1: *const ::std::os::raw::c_char, arg2: *mut SCEnumCharMap,
) -> ::std::os::raw::c_int;
}
extern "C" {
pub fn SCMapEnumValueToName(
arg1: ::std::os::raw::c_int, arg2: *mut SCEnumCharMap,
) -> *const ::std::os::raw::c_char;
}
#[doc = " \\brief Data structure to store app layer decoder events."]
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct AppLayerDecoderEvents_ {
pub events: *mut u8,
pub cnt: u8,
pub events_buffer_size: u8,
pub event_last_logged: u8,
}
extern "C" {
pub fn SCAppLayerDecoderEventsSetEventRaw(sevents: *mut *mut AppLayerDecoderEvents, event: u8);
}
extern "C" {
pub fn SCAppLayerDecoderEventsFreeEvents(events: *mut *mut AppLayerDecoderEvents);
}
extern "C" {
pub fn SCAppLayerGetEventIdByName(
event_name: *const ::std::os::raw::c_char, table: *mut SCEnumCharMap, event_id: *mut u8,
) -> ::std::os::raw::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct MpmPattern_ {
pub len: u16,
pub flags: u8,

4
src/app-layer-dnp3.c
Unescape Escape View File

@ -461,7 +461,7 @@ static void *DNP3StateAlloc(void *orig_state, AppProto proto_orig)
static void DNP3SetEvent(DNP3State *dnp3, uint8_t event)
{
if (dnp3 && dnp3->curr) {
AppLayerDecoderEventsSetEventRaw(&dnp3->curr->tx_data.events, event);
SCAppLayerDecoderEventsSetEventRaw(&dnp3->curr->tx_data.events, event);
dnp3->events++;
}
else {
@ -474,7 +474,7 @@ static void DNP3SetEvent(DNP3State *dnp3, uint8_t event)
*/
static void DNP3SetEventTx(DNP3Transaction *tx, uint8_t event)
{
AppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, event);
SCAppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, event);
tx->dnp3->events++;
}

4
src/app-layer-events.c
Unescape Escape View File

@ -93,7 +93,7 @@ int AppLayerGetPktEventInfo(const char *event_name, uint8_t *event_id)
* memory will be allocated.
* \param event The event to be stored.
*/
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
void SCAppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
{
if (*sevents == NULL) {
AppLayerDecoderEvents *new_devents = SCCalloc(1, sizeof(AppLayerDecoderEvents));
@ -135,7 +135,7 @@ void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
}
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
void SCAppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
{
if (events && *events != NULL) {
if ((*events)->events != NULL)

6
src/app-layer-events.h
Unescape Escape View File

@ -55,8 +55,9 @@ int AppLayerGetPktEventInfo(const char *event_name, uint8_t *event_id);
int AppLayerGetEventInfoById(
uint8_t event_id, const char **event_name, AppLayerEventType *event_type);
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event);
void SCAppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event);
#ifndef SURICATA_BINDGEN_H
static inline int AppLayerDecoderEventsIsEventSet(
const AppLayerDecoderEvents *devents, uint8_t event)
{
@ -71,9 +72,10 @@ static inline int AppLayerDecoderEventsIsEventSet(
return 0;
}
#endif
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events);
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events);
void SCAppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events);
int DetectEngineGetEventInfo(
const char *event_name, uint8_t *event_id, AppLayerEventType *event_type);
int SCAppLayerGetEventIdByName(const char *event_name, SCEnumCharMap *table, uint8_t *event_id);

4
src/app-layer-ftp.c
Unescape Escape View File

@ -462,7 +462,7 @@ static AppLayerResult FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserSt
state->current_line_truncated_ts = false;
}
if (tx->request_truncated) {
AppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, FtpEventRequestCommandTooLong);
SCAppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, FtpEventRequestCommandTooLong);
}
/* change direction (default to server) so expectation will handle
@ -705,7 +705,7 @@ static AppLayerResult FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserS
if (likely(wrapper)) {
response->truncated = state->current_line_truncated_tc;
if (response->truncated) {
AppLayerDecoderEventsSetEventRaw(
SCAppLayerDecoderEventsSetEventRaw(
&tx->tx_data.events, FtpEventResponseCommandTooLong);
}
if (line.lf_found) {

4
src/app-layer-htp-file.c
Unescape Escape View File

@ -112,7 +112,7 @@ static int HTPParseAndCheckContentRange(
{
int r = HTPParseContentRange(rawvalue, range);
if (r != 0) {
AppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, HTTP_DECODER_EVENT_RANGE_INVALID);
SCAppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, HTTP_DECODER_EVENT_RANGE_INVALID);
s->events++;
SCLogDebug("parsing range failed, going back to normal file");
return r;
@ -129,7 +129,7 @@ static int HTPParseAndCheckContentRange(
SCLogDebug("range without all information");
return -3;
} else if (range->start > range->end || range->end > range->size - 1) {
AppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, HTTP_DECODER_EVENT_RANGE_INVALID);
SCAppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, HTTP_DECODER_EVENT_RANGE_INVALID);
s->events++;
SCLogDebug("invalid range");
return -4;

4
src/app-layer-htp.c
Unescape Escape View File

@ -427,7 +427,7 @@ static void HTPSetEvent(HtpState *s, HtpTxUserData *htud,
SCLogDebug("setting event %u", e);
if (htud) {
AppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, e);
SCAppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, e);
s->events++;
return;
}
@ -440,7 +440,7 @@ static void HTPSetEvent(HtpState *s, HtpTxUserData *htud,
tx = HTPStateGetTx(s, tx_id - 1);
if (tx != NULL) {
htud = (HtpTxUserData *)htp_tx_get_user_data(tx);
AppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, e);
SCAppLayerDecoderEventsSetEventRaw(&htud->tx_data.events, e);
s->events++;
return;
}

2
src/app-layer-parser.c
Unescape Escape View File

@ -249,7 +249,7 @@ void AppLayerParserStateFree(AppLayerParserState *pstate)
SCEnter();
if (pstate->decoder_events != NULL)
AppLayerDecoderEventsFreeEvents(&pstate->decoder_events);
SCAppLayerDecoderEventsFreeEvents(&pstate->decoder_events);
AppLayerParserFramesFreeContainer(pstate->frames);
SCFree(pstate);

2
src/app-layer-smtp.c
Unescape Escape View File

@ -468,7 +468,7 @@ static void SMTPSetEvent(SMTPState *s, uint8_t e)
SCLogDebug("setting event %u", e);
if (s->curr_tx != NULL) {
AppLayerDecoderEventsSetEventRaw(&s->curr_tx->tx_data.events, e);
SCAppLayerDecoderEventsSetEventRaw(&s->curr_tx->tx_data.events, e);
// s->events++;
return;
}

2
src/app-layer-ssl.c
Unescape Escape View File

@ -328,7 +328,7 @@ static inline int SafeMemcpy(void *dst, size_t dst_offset, size_t dst_size,
if ((ssl_state) == NULL) { \
SCLogDebug("could not set decoder event %u", event); \
} else { \
AppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \
SCAppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \
(ssl_state)->events++; \
} \
} while (0)

24
src/app-layer.c
Unescape Escape View File

@ -317,18 +317,18 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
/* we bail out whatever the pp and pm states if
* we received too much data */
} else if (size_tc > 2 * size_tc_limit || size_ts > 2 * size_ts_limit) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
} else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
size_ts > size_ts_limit && size_tc == 0) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
} else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
size_tc > size_tc_limit && size_ts == 0) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
@ -338,7 +338,7 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
} else if (size_tc > size_tc_limit && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
!(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) &&
FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
@ -348,7 +348,7 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
} else if (size_ts > size_ts_limit && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
!(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) && FLOW_IS_PM_DONE(f, STREAM_TOSERVER) &&
FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
goto failure;
}
@ -427,7 +427,7 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
if (*alproto != ALPROTO_UNKNOWN) {
if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != *alproto) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS);
if (ssn->data_first_seen_dir == APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER) {
@ -504,7 +504,7 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
* As the second data was recognized as P1, the protocol did not change !
*/
FlowUnsetChangeProtoFlag(f);
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_UNEXPECTED_PROTOCOL);
}
}
@ -530,7 +530,7 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
first_data_dir = AppLayerParserGetFirstDataDir(f->proto, f->alproto);
if (first_data_dir && !(first_data_dir & ssn->data_first_seen_dir)) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_WRONG_DIRECTION_FIRST_DATA);
goto detect_error;
}
@ -652,7 +652,7 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
}
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION);
TcpSessionSetReassemblyDepth(ssn,
AppLayerParserGetStreamDepth(f));
@ -815,11 +815,11 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet
if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN &&
f->alproto != f->alproto_expect) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_UNEXPECTED_PROTOCOL);
if (f->alproto_expect == ALPROTO_TLS && f->alproto != ALPROTO_TLS) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_NO_TLS_AFTER_STARTTLS);
}
@ -938,7 +938,7 @@ int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *
default:
if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != ALPROTO_FAILED) {
if (*alproto_otherdir != *alproto) {
AppLayerDecoderEventsSetEventRaw(
SCAppLayerDecoderEventsSetEventRaw(
&p->app_layer_events, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS);
// data already sent to parser, we cannot change the protocol to use the one
// of the server

1
src/bindgen.h
Unescape Escape View File

@ -50,6 +50,7 @@
#include "app-layer-detect-proto.h"
#include "app-layer-parser.h"
#include "app-layer-register.h"
#include "app-layer-events.h"
#include "util-mpm.h"
#include "util-file.h"

4
src/detect-engine.c
Unescape Escape View File

@ -3582,7 +3582,7 @@ static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
det_ctx->json_content_capacity = 0;
}
AppLayerDecoderEventsFreeEvents(&det_ctx->decoder_events);
SCAppLayerDecoderEventsFreeEvents(&det_ctx->decoder_events);
PrefilterPktNonPFStatsDump();
SCFree(det_ctx);
@ -5003,7 +5003,7 @@ const char *DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
/* events api */
void DetectEngineSetEvent(DetectEngineThreadCtx *det_ctx, uint8_t e)
{
AppLayerDecoderEventsSetEventRaw(&det_ctx->decoder_events, e);
SCAppLayerDecoderEventsSetEventRaw(&det_ctx->decoder_events, e);
det_ctx->events++;
}

2
src/packet.c
Unescape Escape View File

@ -166,7 +166,7 @@ void PacketDestructor(Packet *p)
PacketAlertFree(p->alerts.alerts);
PACKET_FREE_EXTDATA(p);
SCSpinDestroy(&p->persistent.tunnel_lock);
AppLayerDecoderEventsFreeEvents(&p->app_layer_events);
SCAppLayerDecoderEventsFreeEvents(&p->app_layer_events);
PACKET_PROFILING_RESET(p);
}

2
src/rust-context.c
Unescape Escape View File

@ -26,8 +26,6 @@
const SuricataContext suricata_context = {
SCLogMessage,
AppLayerDecoderEventsSetEventRaw,
AppLayerDecoderEventsFreeEvents,
AppLayerParserTriggerRawStreamInspection,
HttpRangeFreeBlock,

3
src/rust-context.h
Unescape Escape View File

@ -37,9 +37,6 @@ struct AppLayerParser;
typedef struct SuricataContext_ {
SCError (*SCLogMessage)(const SCLogLevel, const char *, const unsigned int, const char *,
const char *, const char *message);
void (*AppLayerDecoderEventsSetEventRaw)(AppLayerDecoderEvents **,
uint8_t);
void (*AppLayerDecoderEventsFreeEvents)(AppLayerDecoderEvents **);
void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction);
void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *);

2
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -864,7 +864,7 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre
if (RB_EMPTY(&stream->seg_tree) &&
stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED) {
AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
SCAppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
APPLAYER_PROTO_DETECTION_SKIPPED);
}

Write Preview
Loading…
Cancel
Save