|
|
|
|
@ -17,18 +17,16 @@
|
|
|
|
|
|
|
|
|
|
//! Parser registration functions and common interface module.
|
|
|
|
|
|
|
|
|
|
use std;
|
|
|
|
|
use crate::core::STREAM_TOSERVER;
|
|
|
|
|
use crate::direction::Direction;
|
|
|
|
|
use crate::flow::Flow;
|
|
|
|
|
use std::os::raw::{c_void,c_char,c_int};
|
|
|
|
|
use std;
|
|
|
|
|
use std::os::raw::{c_char, c_int, c_void};
|
|
|
|
|
|
|
|
|
|
// Make the AppLayerEvent derive macro available to users importing
|
|
|
|
|
// AppLayerEvent from this module.
|
|
|
|
|
pub use suricata_derive::AppLayerEvent;
|
|
|
|
|
use suricata_sys::sys::{
|
|
|
|
|
AppLayerGetTxIterState, AppLayerParserState, AppProto,
|
|
|
|
|
};
|
|
|
|
|
use suricata_sys::sys::{AppLayerGetTxIterState, AppLayerParserState, AppProto};
|
|
|
|
|
|
|
|
|
|
pub use suricata_sys::sys::{
|
|
|
|
|
AppLayerGetFileState, AppLayerGetTxIterTuple, AppLayerResult, AppLayerStateData,
|
|
|
|
|
@ -37,68 +35,70 @@ pub use suricata_sys::sys::{
|
|
|
|
|
|
|
|
|
|
pub use suricata_ffi::cast_pointer;
|
|
|
|
|
|
|
|
|
|
pub use suricata_ffi::{export_tx_data_get, export_state_data_get};
|
|
|
|
|
pub use suricata_ffi::{export_state_data_get, export_tx_data_get};
|
|
|
|
|
|
|
|
|
|
pub use suricata_ffi::applayer::{AppLayerEvent, AppLayerEventType, AppLayerResultRust, AppLayerTxData, StreamSliceRust};
|
|
|
|
|
pub use suricata_ffi::applayer::{
|
|
|
|
|
AppLayerEvent, AppLayerEventType, AppLayerResultRust, AppLayerTxData, StreamSliceRust,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/// Rust parser declaration
|
|
|
|
|
#[repr(C)]
|
|
|
|
|
pub struct RustParser {
|
|
|
|
|
/// Parser name.
|
|
|
|
|
pub name: *const c_char,
|
|
|
|
|
pub name: *const c_char,
|
|
|
|
|
/// Default port
|
|
|
|
|
pub default_port: *const c_char,
|
|
|
|
|
pub default_port: *const c_char,
|
|
|
|
|
|
|
|
|
|
/// IP Protocol (core::IPPROTO_UDP, core::IPPROTO_TCP, etc.)
|
|
|
|
|
pub ipproto: u8,
|
|
|
|
|
pub ipproto: u8,
|
|
|
|
|
|
|
|
|
|
/// Probing function, for packets going to server
|
|
|
|
|
pub probe_ts: Option<ProbeFn>,
|
|
|
|
|
pub probe_ts: Option<ProbeFn>,
|
|
|
|
|
/// Probing function, for packets going to client
|
|
|
|
|
pub probe_tc: Option<ProbeFn>,
|
|
|
|
|
pub probe_tc: Option<ProbeFn>,
|
|
|
|
|
|
|
|
|
|
/// Minimum frame depth for probing
|
|
|
|
|
pub min_depth: u16,
|
|
|
|
|
pub min_depth: u16,
|
|
|
|
|
/// Maximum frame depth for probing
|
|
|
|
|
pub max_depth: u16,
|
|
|
|
|
pub max_depth: u16,
|
|
|
|
|
|
|
|
|
|
/// Allocation function for a new state
|
|
|
|
|
pub state_new: StateAllocFn,
|
|
|
|
|
pub state_new: StateAllocFn,
|
|
|
|
|
/// Function called to free a state
|
|
|
|
|
pub state_free: StateFreeFn,
|
|
|
|
|
pub state_free: StateFreeFn,
|
|
|
|
|
|
|
|
|
|
/// Parsing function, for packets going to server
|
|
|
|
|
pub parse_ts: ParseFn,
|
|
|
|
|
pub parse_ts: ParseFn,
|
|
|
|
|
/// Parsing function, for packets going to client
|
|
|
|
|
pub parse_tc: ParseFn,
|
|
|
|
|
pub parse_tc: ParseFn,
|
|
|
|
|
|
|
|
|
|
/// Get the current transaction count
|
|
|
|
|
pub get_tx_count: StateGetTxCntFn,
|
|
|
|
|
pub get_tx_count: StateGetTxCntFn,
|
|
|
|
|
/// Get a transaction
|
|
|
|
|
pub get_tx: StateGetTxFn,
|
|
|
|
|
pub get_tx: StateGetTxFn,
|
|
|
|
|
/// Function called to free a transaction
|
|
|
|
|
pub tx_free: StateTxFreeFn,
|
|
|
|
|
pub tx_free: StateTxFreeFn,
|
|
|
|
|
/// Progress values at which the tx is considered complete in a direction
|
|
|
|
|
pub tx_comp_st_ts: c_int,
|
|
|
|
|
pub tx_comp_st_tc: c_int,
|
|
|
|
|
pub tx_comp_st_ts: c_int,
|
|
|
|
|
pub tx_comp_st_tc: c_int,
|
|
|
|
|
/// Function returning the current transaction progress
|
|
|
|
|
pub tx_get_progress: StateGetProgressFn,
|
|
|
|
|
pub tx_get_progress: StateGetProgressFn,
|
|
|
|
|
|
|
|
|
|
/// Function to get an event id from a description
|
|
|
|
|
pub get_eventinfo: Option<GetEventInfoFn>,
|
|
|
|
|
pub get_eventinfo: Option<GetEventInfoFn>,
|
|
|
|
|
/// Function to get an event description from an event id
|
|
|
|
|
pub get_eventinfo_byid: Option<GetEventInfoByIdFn>,
|
|
|
|
|
|
|
|
|
|
/// Function to allocate local storage
|
|
|
|
|
pub localstorage_new: Option<LocalStorageNewFn>,
|
|
|
|
|
pub localstorage_new: Option<LocalStorageNewFn>,
|
|
|
|
|
/// Function to free local storage
|
|
|
|
|
pub localstorage_free: Option<LocalStorageFreeFn>,
|
|
|
|
|
pub localstorage_free: Option<LocalStorageFreeFn>,
|
|
|
|
|
|
|
|
|
|
/// Function to get files
|
|
|
|
|
pub get_tx_files: Option<GetTxFilesFn>,
|
|
|
|
|
pub get_tx_files: Option<GetTxFilesFn>,
|
|
|
|
|
|
|
|
|
|
/// Function to get the TX iterator
|
|
|
|
|
pub get_tx_iterator: Option<GetTxIteratorFn>,
|
|
|
|
|
pub get_tx_iterator: Option<GetTxIteratorFn>,
|
|
|
|
|
|
|
|
|
|
pub get_state_data: GetStateDataFn,
|
|
|
|
|
pub get_tx_data: GetTxDataFn,
|
|
|
|
|
@ -124,36 +124,51 @@ pub trait AppLayerGetFileStateRust {
|
|
|
|
|
|
|
|
|
|
impl AppLayerGetFileStateRust for AppLayerGetFileState {
|
|
|
|
|
fn err() -> AppLayerGetFileState {
|
|
|
|
|
AppLayerGetFileState { fc: std::ptr::null_mut(), cfg: std::ptr::null() }
|
|
|
|
|
AppLayerGetFileState {
|
|
|
|
|
fc: std::ptr::null_mut(),
|
|
|
|
|
cfg: std::ptr::null(),
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
pub type ParseFn = unsafe extern "C" fn (flow: *mut Flow,
|
|
|
|
|
state: *mut c_void,
|
|
|
|
|
pstate: *mut AppLayerParserState,
|
|
|
|
|
stream_slice: StreamSlice,
|
|
|
|
|
data: *mut c_void) -> AppLayerResult;
|
|
|
|
|
pub type ProbeFn = unsafe extern "C" fn (flow: *const Flow, flags: u8, input:*const u8, input_len: u32, rdir: *mut u8) -> AppProto;
|
|
|
|
|
pub type StateAllocFn = unsafe extern "C" fn (*mut c_void, AppProto) -> *mut c_void;
|
|
|
|
|
pub type StateFreeFn = unsafe extern "C" fn (*mut c_void);
|
|
|
|
|
pub type StateTxFreeFn = unsafe extern "C" fn (*mut c_void, u64);
|
|
|
|
|
pub type StateGetTxFn = unsafe extern "C" fn (*mut c_void, u64) -> *mut c_void;
|
|
|
|
|
pub type StateGetTxCntFn = unsafe extern "C" fn (*mut c_void) -> u64;
|
|
|
|
|
pub type StateGetProgressFn = unsafe extern "C" fn (*mut c_void, u8) -> c_int;
|
|
|
|
|
pub type GetEventInfoFn = unsafe extern "C" fn (*const c_char, event_id: *mut u8, *mut AppLayerEventType) -> c_int;
|
|
|
|
|
pub type GetEventInfoByIdFn = unsafe extern "C" fn (event_id: u8, *mut *const c_char, *mut AppLayerEventType) -> c_int;
|
|
|
|
|
pub type LocalStorageNewFn = unsafe extern "C" fn () -> *mut c_void;
|
|
|
|
|
pub type LocalStorageFreeFn = unsafe extern "C" fn (*mut c_void);
|
|
|
|
|
pub type GetTxFilesFn = unsafe extern "C" fn (*mut c_void, u8) -> AppLayerGetFileState;
|
|
|
|
|
pub type GetTxIteratorFn = unsafe extern "C" fn (ipproto: u8, alproto: AppProto,
|
|
|
|
|
state: *mut c_void,
|
|
|
|
|
min_tx_id: u64,
|
|
|
|
|
max_tx_id: u64,
|
|
|
|
|
istate: *mut AppLayerGetTxIterState)
|
|
|
|
|
-> AppLayerGetTxIterTuple;
|
|
|
|
|
pub type ParseFn = unsafe extern "C" fn(
|
|
|
|
|
flow: *mut Flow,
|
|
|
|
|
state: *mut c_void,
|
|
|
|
|
pstate: *mut AppLayerParserState,
|
|
|
|
|
stream_slice: StreamSlice,
|
|
|
|
|
data: *mut c_void,
|
|
|
|
|
) -> AppLayerResult;
|
|
|
|
|
pub type ProbeFn = unsafe extern "C" fn(
|
|
|
|
|
flow: *const Flow,
|
|
|
|
|
flags: u8,
|
|
|
|
|
input: *const u8,
|
|
|
|
|
input_len: u32,
|
|
|
|
|
rdir: *mut u8,
|
|
|
|
|
) -> AppProto;
|
|
|
|
|
pub type StateAllocFn = unsafe extern "C" fn(*mut c_void, AppProto) -> *mut c_void;
|
|
|
|
|
pub type StateFreeFn = unsafe extern "C" fn(*mut c_void);
|
|
|
|
|
pub type StateTxFreeFn = unsafe extern "C" fn(*mut c_void, u64);
|
|
|
|
|
pub type StateGetTxFn = unsafe extern "C" fn(*mut c_void, u64) -> *mut c_void;
|
|
|
|
|
pub type StateGetTxCntFn = unsafe extern "C" fn(*mut c_void) -> u64;
|
|
|
|
|
pub type StateGetProgressFn = unsafe extern "C" fn(*mut c_void, u8) -> c_int;
|
|
|
|
|
pub type GetEventInfoFn =
|
|
|
|
|
unsafe extern "C" fn(*const c_char, event_id: *mut u8, *mut AppLayerEventType) -> c_int;
|
|
|
|
|
pub type GetEventInfoByIdFn =
|
|
|
|
|
unsafe extern "C" fn(event_id: u8, *mut *const c_char, *mut AppLayerEventType) -> c_int;
|
|
|
|
|
pub type LocalStorageNewFn = unsafe extern "C" fn() -> *mut c_void;
|
|
|
|
|
pub type LocalStorageFreeFn = unsafe extern "C" fn(*mut c_void);
|
|
|
|
|
pub type GetTxFilesFn = unsafe extern "C" fn(*mut c_void, u8) -> AppLayerGetFileState;
|
|
|
|
|
pub type GetTxIteratorFn = unsafe extern "C" fn(
|
|
|
|
|
ipproto: u8,
|
|
|
|
|
alproto: AppProto,
|
|
|
|
|
state: *mut c_void,
|
|
|
|
|
min_tx_id: u64,
|
|
|
|
|
max_tx_id: u64,
|
|
|
|
|
istate: *mut AppLayerGetTxIterState,
|
|
|
|
|
) -> AppLayerGetTxIterTuple;
|
|
|
|
|
pub type GetTxDataFn = unsafe extern "C" fn(*mut c_void) -> *mut suricata_sys::sys::AppLayerTxData;
|
|
|
|
|
pub type GetStateDataFn = unsafe extern "C" fn(*mut c_void) -> *mut AppLayerStateData;
|
|
|
|
|
pub type ApplyTxConfigFn = unsafe extern "C" fn (*mut c_void, *mut c_void, c_int, AppLayerTxConfig);
|
|
|
|
|
pub type ApplyTxConfigFn = unsafe extern "C" fn(*mut c_void, *mut c_void, c_int, AppLayerTxConfig);
|
|
|
|
|
pub type GetFrameIdByName = unsafe extern "C" fn(*const c_char) -> c_int;
|
|
|
|
|
pub type GetFrameNameById = unsafe extern "C" fn(u8) -> *const c_char;
|
|
|
|
|
pub type GetStateIdByName = unsafe extern "C" fn(*const c_char, u8) -> c_int;
|
|
|
|
|
@ -163,7 +178,7 @@ use suricata_sys::sys::{AppLayerParser, SCAppLayerRegisterParser};
|
|
|
|
|
|
|
|
|
|
#[allow(non_snake_case)]
|
|
|
|
|
pub fn AppLayerRegisterParser(parser: &RustParser, alproto: AppProto) -> c_int {
|
|
|
|
|
let det = AppLayerParser{
|
|
|
|
|
let det = AppLayerParser {
|
|
|
|
|
name: parser.name,
|
|
|
|
|
default_port: parser.default_port,
|
|
|
|
|
ip_proto: parser.ipproto,
|
|
|
|
|
@ -204,13 +219,15 @@ pub fn AppLayerRegisterParser(parser: &RustParser, alproto: AppProto) -> c_int {
|
|
|
|
|
GetStateIdByName: parser.get_state_id_by_name,
|
|
|
|
|
GetStateNameById: parser.get_state_name_by_id,
|
|
|
|
|
};
|
|
|
|
|
unsafe {SCAppLayerRegisterParser(&det, alproto) }
|
|
|
|
|
unsafe { SCAppLayerRegisterParser(&det, alproto) }
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
use suricata_sys::sys::{AppLayerProtocolDetect, SCAppLayerRegisterProtocolDetection};
|
|
|
|
|
|
|
|
|
|
pub fn applayer_register_protocol_detection(parser: &RustParser, enable_default: c_int) -> AppProto {
|
|
|
|
|
let det = AppLayerProtocolDetect{
|
|
|
|
|
pub fn applayer_register_protocol_detection(
|
|
|
|
|
parser: &RustParser, enable_default: c_int,
|
|
|
|
|
) -> AppProto {
|
|
|
|
|
let det = AppLayerProtocolDetect {
|
|
|
|
|
name: parser.name,
|
|
|
|
|
default_port: parser.default_port,
|
|
|
|
|
ip_proto: parser.ipproto,
|
|
|
|
|
@ -219,14 +236,14 @@ pub fn applayer_register_protocol_detection(parser: &RustParser, enable_default:
|
|
|
|
|
min_depth: parser.min_depth,
|
|
|
|
|
max_depth: parser.max_depth,
|
|
|
|
|
};
|
|
|
|
|
unsafe {SCAppLayerRegisterProtocolDetection(&det, enable_default) }
|
|
|
|
|
unsafe { SCAppLayerRegisterProtocolDetection(&det, enable_default) }
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
pub use suricata_ffi::applayer::{
|
|
|
|
|
APP_LAYER_PARSER_BYPASS_READY, APP_LAYER_PARSER_EOF_TC, APP_LAYER_PARSER_EOF_TS,
|
|
|
|
|
APP_LAYER_PARSER_NO_INSPECTION, APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD,
|
|
|
|
|
APP_LAYER_PARSER_NO_REASSEMBLY, APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
|
|
|
|
|
APP_LAYER_TX_SKIP_INSPECT_TS, APP_LAYER_TX_SKIP_INSPECT_TC,
|
|
|
|
|
APP_LAYER_PARSER_NO_REASSEMBLY, APP_LAYER_PARSER_OPT_ACCEPT_GAPS, APP_LAYER_TX_SKIP_INSPECT_TC,
|
|
|
|
|
APP_LAYER_TX_SKIP_INSPECT_TS,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
pub const _APP_LAYER_TX_INSPECTED_TS: u8 = BIT_U8!(2);
|
|
|
|
|
@ -251,7 +268,9 @@ pub trait AppLayerFrameType {
|
|
|
|
|
/// Create a frame type variant from a u8.
|
|
|
|
|
///
|
|
|
|
|
/// None will be returned if there is no matching enum variant.
|
|
|
|
|
fn from_u8(value: u8) -> Option<Self> where Self: std::marker::Sized;
|
|
|
|
|
fn from_u8(value: u8) -> Option<Self>
|
|
|
|
|
where
|
|
|
|
|
Self: std::marker::Sized;
|
|
|
|
|
|
|
|
|
|
/// Return the u8 value of the enum where the first entry has the value of 0.
|
|
|
|
|
fn as_u8(&self) -> u8;
|
|
|
|
|
@ -259,14 +278,19 @@ pub trait AppLayerFrameType {
|
|
|
|
|
/// Create a frame type variant from a &str.
|
|
|
|
|
///
|
|
|
|
|
/// None will be returned if there is no matching enum variant.
|
|
|
|
|
fn from_str(s: &str) -> Option<Self> where Self: std::marker::Sized;
|
|
|
|
|
fn from_str(s: &str) -> Option<Self>
|
|
|
|
|
where
|
|
|
|
|
Self: std::marker::Sized;
|
|
|
|
|
|
|
|
|
|
/// Return a pointer to a C string of the enum variant suitable as-is for
|
|
|
|
|
/// FFI.
|
|
|
|
|
fn to_cstring(&self) -> *const std::os::raw::c_char;
|
|
|
|
|
|
|
|
|
|
/// Converts a C string formatted name to a frame type ID.
|
|
|
|
|
unsafe extern "C" fn ffi_id_from_name(name: *const std::os::raw::c_char) -> i32 where Self: Sized {
|
|
|
|
|
unsafe extern "C" fn ffi_id_from_name(name: *const std::os::raw::c_char) -> i32
|
|
|
|
|
where
|
|
|
|
|
Self: Sized,
|
|
|
|
|
{
|
|
|
|
|
if name.is_null() {
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
@ -279,8 +303,13 @@ pub trait AppLayerFrameType {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/// Converts a variant ID to an FFI safe name.
|
|
|
|
|
extern "C" fn ffi_name_from_id(id: u8) -> *const std::os::raw::c_char where Self: Sized {
|
|
|
|
|
Self::from_u8(id).map(|s| s.to_cstring()).unwrap_or_else(std::ptr::null)
|
|
|
|
|
extern "C" fn ffi_name_from_id(id: u8) -> *const std::os::raw::c_char
|
|
|
|
|
where
|
|
|
|
|
Self: Sized,
|
|
|
|
|
{
|
|
|
|
|
Self::from_u8(id)
|
|
|
|
|
.map(|s| s.to_cstring())
|
|
|
|
|
.unwrap_or_else(std::ptr::null)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|