aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ikev1: rename ikev2 to common ike

Browse Source 
Renaming was done with shell commands, git mv for moving the files and content like
find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
pull/5961/head
frank honza 5 years ago committed by Victor Julien
parent ab6171c429
commit ecdf9f6b0b
24 changed files with 247 additions and 241 deletions
Show Stats Download Patch File Download Diff File

4
doc/userguide/partials/eve-log.yaml
Unescape Escape View File

@ -160,8 +160,8 @@ outputs:
# NFS logging. Requires Rust.
- nfs
# IKEv2 logging. Requires Rust.
- ikev2
# IKE logging. Requires Rust.
- ike
- ssh
- stats:
totals: yes # stats for all threads merged together

2
doc/userguide/rules/intro.rst
Unescape Escape View File

@ -89,7 +89,7 @@ you can pick from. These are:
* dnp3 (disabled by default)
* enip (disabled by default)
* nfs
* ikev2
* ike
* krb5
* ntp
* dhcp

26
rules/ipsec-events.rules
Unescape Escape View File

@ -4,16 +4,16 @@
#
# These sigs fire at most once per connection.
#
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 malformed request data"; flow:to_server; app-layer-event:ikev2.malformed_data; classtype:protocol-command-decode; sid:2224000; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 malformed response data"; flow:to_client; app-layer-event:ikev2.malformed_data; classtype:protocol-command-decode; sid:2224001; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Encryption)"; flow:to_client; app-layer-event:ikev2.weak_crypto_enc; classtype:protocol-command-decode; sid:2224002; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (PRF)"; flow:to_client; app-layer-event:ikev2.weak_crypto_prf; classtype:protocol-command-decode; sid:2224003; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Auth)"; flow:to_client; app-layer-event:ikev2.weak_crypto_auth; classtype:protocol-command-decode; sid:2224004; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman)"; flow:to_client; app-layer-event:ikev2.weak_crypto_dh; classtype:protocol-command-decode; sid:2224005; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no Diffie-Hellman exchange parameters"; flow:to_client; app-layer-event:ikev2.weak_crypto_nodh; classtype:protocol-command-decode; sid:2224006; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no authentication"; flow:to_client; app-layer-event:ikev2.weak_crypto_noauth; classtype:protocol-command-decode; sid:2224007; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no encryption (AH)"; flow:to_client; app-layer-event:ikev2.no_encryption; classtype:protocol-command-decode; sid:2224008; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 invalid proposal"; flow:to_server; app-layer-event:ikev2.invalid_proposal; classtype:protocol-command-decode; sid:2224009; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 invalid proposal selected"; flow:to_client; app-layer-event:ikev2.invalid_proposal; classtype:protocol-command-decode; sid:2224010; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 unknown proposal"; flow:to_server; app-layer-event:ikev2.unknown_proposal; classtype:protocol-command-decode; sid:2224011; rev:1;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 unknown proposal selected"; flow:to_client; app-layer-event:ikev2.unknown_proposal; classtype:protocol-command-decode; sid:2224012; rev:1;)
alert ike any any -> any any (msg:"SURICATA IKE malformed request data"; flow:to_server; app-layer-event:ike.malformed_data; classtype:protocol-command-decode; sid:2224000; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE malformed response data"; flow:to_client; app-layer-event:ike.malformed_data; classtype:protocol-command-decode; sid:2224001; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Encryption)"; flow:to_client; app-layer-event:ike.weak_crypto_enc; classtype:protocol-command-decode; sid:2224002; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (PRF)"; flow:to_client; app-layer-event:ike.weak_crypto_prf; classtype:protocol-command-decode; sid:2224003; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Auth)"; flow:to_client; app-layer-event:ike.weak_crypto_auth; classtype:protocol-command-decode; sid:2224004; rev:3;)
alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Diffie-Hellman)"; flow:to_client; app-layer-event:ike.weak_crypto_dh; classtype:protocol-command-decode; sid:2224005; rev:3;)
alert ike any any -> any any (msg:"SURICATA IKE no Diffie-Hellman exchange parameters"; flow:to_client; app-layer-event:ike.weak_crypto_nodh; classtype:protocol-command-decode; sid:2224006; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE no authentication"; flow:to_client; app-layer-event:ike.weak_crypto_noauth; classtype:protocol-command-decode; sid:2224007; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE no encryption (AH)"; flow:to_client; app-layer-event:ike.no_encryption; classtype:protocol-command-decode; sid:2224008; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE invalid proposal"; flow:to_server; app-layer-event:ike.invalid_proposal; classtype:protocol-command-decode; sid:2224009; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE invalid proposal selected"; flow:to_client; app-layer-event:ike.invalid_proposal; classtype:protocol-command-decode; sid:2224010; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE unknown proposal"; flow:to_server; app-layer-event:ike.unknown_proposal; classtype:protocol-command-decode; sid:2224011; rev:2;)
alert ike any any -> any any (msg:"SURICATA IKE unknown proposal selected"; flow:to_client; app-layer-event:ike.unknown_proposal; classtype:protocol-command-decode; sid:2224012; rev:2;)

4
rust/cbindgen.toml
Unescape Escape View File

@ -88,8 +88,8 @@ exclude = [
"Flow",
"FileContainer",
"JsonT",
"IKEV2State",
"IKEV2Transaction",
"IKEState",
"IKETransaction",
"KRB5State",
"KRB5Transaction",
"NTPState",

265
rust/src/ikev2/ikev2.rs → rust/src/ike/ike.rs
Unescape Escape View File

@ -17,8 +17,8 @@
// written by Pierre Chifflier <chifflier@wzdftpd.net>
use crate::ikev2::ipsec_parser::*;
use crate::ikev2::state::IKEV2ConnectionState;
use crate::ike::ipsec_parser::*;
use crate::ike::state::IKEConnectionState;
use crate::core;
use crate::core::{AppProto,Flow,ALPROTO_UNKNOWN,ALPROTO_FAILED,STREAM_TOSERVER,STREAM_TOCLIENT};
use crate::applayer::{self, *};
@ -28,7 +28,7 @@ use std::ffi::{CStr,CString};
use nom;
#[repr(u32)]
pub enum IKEV2Event {
pub enum IkeEvent {
MalformedData = 0,
NoEncryption,
WeakCryptoEnc,
@ -41,33 +41,33 @@ pub enum IKEV2Event {
UnknownProposal,
}
impl IKEV2Event {
fn from_i32(value: i32) -> Option<IKEV2Event> {
impl IkeEvent {
fn from_i32(value: i32) -> Option<IkeEvent> {
match value {
0 => Some(IKEV2Event::MalformedData),
1 => Some(IKEV2Event::NoEncryption),
2 => Some(IKEV2Event::WeakCryptoEnc),
3 => Some(IKEV2Event::WeakCryptoPRF),
4 => Some(IKEV2Event::WeakCryptoDH),
5 => Some(IKEV2Event::WeakCryptoAuth),
6 => Some(IKEV2Event::WeakCryptoNoDH),
7 => Some(IKEV2Event::WeakCryptoNoAuth),
8 => Some(IKEV2Event::InvalidProposal),
9 => Some(IKEV2Event::UnknownProposal),
0 => Some(IkeEvent::MalformedData),
1 => Some(IkeEvent::NoEncryption),
2 => Some(IkeEvent::WeakCryptoEnc),
3 => Some(IkeEvent::WeakCryptoPRF),
4 => Some(IkeEvent::WeakCryptoDH),
5 => Some(IkeEvent::WeakCryptoAuth),
6 => Some(IkeEvent::WeakCryptoNoDH),
7 => Some(IkeEvent::WeakCryptoNoAuth),
8 => Some(IkeEvent::InvalidProposal),
9 => Some(IkeEvent::UnknownProposal),
_ => None,
}
}
}
pub struct IKEV2State {
pub struct IKEState {
/// List of transactions for this session
transactions: Vec<IKEV2Transaction>,
transactions: Vec<IKETransaction>,
/// tx counter for assigning incrementing id's to tx's
tx_id: u64,
/// The connection state
connection_state: IKEV2ConnectionState,
connection_state: IKEConnectionState,
/// The transforms proposed by the initiator
pub client_transforms : Vec<Vec<IkeV2Transform>>,
@ -92,8 +92,8 @@ pub struct IKEV2State {
}
#[derive(Debug)]
pub struct IKEV2Transaction {
/// The IKEV2 reference ID
pub struct IKETransaction {
/// The IKE reference ID
pub xid: u64,
pub hdr: IkeV2Header,
@ -118,12 +118,12 @@ pub struct IKEV2Transaction {
impl IKEV2State {
pub fn new() -> IKEV2State {
IKEV2State{
impl IKEState {
pub fn new() -> IKEState {
IKEState{
transactions: Vec::new(),
tx_id: 0,
connection_state: IKEV2ConnectionState::Init,
connection_state: IKEConnectionState::Init,
dh_group: IkeTransformDHType::None,
client_transforms: Vec::new(),
server_transforms: Vec::new(),
@ -136,8 +136,8 @@ impl IKEV2State {
}
}
impl IKEV2State {
/// Parse an IKEV2 request message
impl IKEState {
/// Parse an IKE request message
///
/// Returns The number of messages parsed, or -1 on error
fn parse(&mut self, i: &[u8], direction: u8) -> i32 {
@ -148,11 +148,11 @@ impl IKEV2State {
}
// Rule 0: check version
if hdr.maj_ver != 2 || hdr.min_ver != 0 {
self.set_event(IKEV2Event::MalformedData);
self.set_event(IkeEvent::MalformedData);
return -1;
}
if hdr.init_spi == 0 {
self.set_event(IKEV2Event::MalformedData);
self.set_event(IkeEvent::MalformedData);
return -1;
}
// only analyse IKE_SA, other payloads are encrypted
@ -174,7 +174,7 @@ impl IKEV2State {
match payload.content {
IkeV2PayloadContent::Dummy => (),
IkeV2PayloadContent::SA(ref prop) => {
// if hdr.flags & IKEV2_FLAG_INITIATOR != 0 {
// if hdr.flags & IKE_FLAG_INITIATOR != 0 {
self.add_proposals(prop, direction);
// }
},
@ -213,18 +213,18 @@ impl IKEV2State {
}
};
},
e => { SCLogDebug!("parse_ikev2_payload_with_type: {:?}",e); () },
e => { SCLogDebug!("parse_ike_payload_with_type: {:?}",e); () },
}
1
},
Err(nom::Err::Incomplete(_)) => {
SCLogDebug!("Insufficient data while parsing IKEV2 data");
self.set_event(IKEV2Event::MalformedData);
SCLogDebug!("Insufficient data while parsing IKE data");
self.set_event(IkeEvent::MalformedData);
-1
},
Err(_) => {
SCLogDebug!("Error while parsing IKEV2 data");
self.set_event(IKEV2Event::MalformedData);
SCLogDebug!("Error while parsing IKE data");
self.set_event(IkeEvent::MalformedData);
-1
},
}
@ -236,12 +236,12 @@ impl IKEV2State {
self.transactions.clear();
}
fn new_tx(&mut self) -> IKEV2Transaction {
fn new_tx(&mut self) -> IKETransaction {
self.tx_id += 1;
IKEV2Transaction::new(self.tx_id)
IKETransaction::new(self.tx_id)
}
fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&IKEV2Transaction> {
fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&IKETransaction> {
self.transactions.iter().find(|&tx| tx.id == tx_id + 1)
}
@ -254,7 +254,7 @@ impl IKEV2State {
}
/// Set an event. The event is set on the most recent transaction.
fn set_event(&mut self, event: IKEV2Event) {
fn set_event(&mut self, event: IkeEvent) {
if let Some(tx) = self.transactions.last_mut() {
let ev = event as u8;
core::sc_app_layer_decoder_events_set_event_raw(&mut tx.events, ev);
@ -283,7 +283,7 @@ impl IKEV2State {
IkeTransformEncType::ENCR_NULL => {
SCLogDebug!("Weak Encryption: {:?}", enc);
// XXX send event only if direction == STREAM_TOCLIENT ?
self.set_event(IKEV2Event::WeakCryptoEnc);
self.set_event(IkeEvent::WeakCryptoEnc);
},
_ => (),
}
@ -292,12 +292,12 @@ impl IKEV2State {
match *prf {
IkeTransformPRFType::PRF_NULL => {
SCLogDebug!("'Null' PRF transform proposed");
self.set_event(IKEV2Event::InvalidProposal);
self.set_event(IkeEvent::InvalidProposal);
},
IkeTransformPRFType::PRF_HMAC_MD5 |
IkeTransformPRFType::PRF_HMAC_SHA1 => {
SCLogDebug!("Weak PRF: {:?}", prf);
self.set_event(IKEV2Event::WeakCryptoPRF);
self.set_event(IkeEvent::WeakCryptoPRF);
},
_ => (),
}
@ -317,7 +317,7 @@ impl IKEV2State {
IkeTransformAuthType::AUTH_HMAC_MD5_128 |
IkeTransformAuthType::AUTH_HMAC_SHA1_160 => {
SCLogDebug!("Weak auth: {:?}", auth);
self.set_event(IKEV2Event::WeakCryptoAuth);
self.set_event(IkeEvent::WeakCryptoAuth);
},
_ => (),
}
@ -326,21 +326,21 @@ impl IKEV2State {
match *dh {
IkeTransformDHType::None => {
SCLogDebug!("'None' DH transform proposed");
self.set_event(IKEV2Event::InvalidProposal);
self.set_event(IkeEvent::InvalidProposal);
},
IkeTransformDHType::Modp768 |
IkeTransformDHType::Modp1024 |
IkeTransformDHType::Modp1024s160 |
IkeTransformDHType::Modp1536 => {
SCLogDebug!("Weak DH: {:?}", dh);
self.set_event(IKEV2Event::WeakCryptoDH);
self.set_event(IkeEvent::WeakCryptoDH);
},
_ => (),
}
},
IkeV2Transform::Unknown(tx_type,tx_id) => {
SCLogDebug!("Unknown proposal: type={:?}, id={}", tx_type, tx_id);
self.set_event(IKEV2Event::UnknownProposal);
self.set_event(IkeEvent::UnknownProposal);
},
_ => (),
}
@ -354,12 +354,12 @@ impl IKEV2State {
})
{
SCLogDebug!("No DH transform found");
self.set_event(IKEV2Event::WeakCryptoNoDH);
self.set_event(IkeEvent::WeakCryptoNoDH);
}
// Rule 3: check if proposing AH ([RFC7296] section 3.3.1)
if p.protocol_id == ProtocolID::AH {
SCLogDebug!("Proposal uses protocol AH - no confidentiality");
self.set_event(IKEV2Event::NoEncryption);
self.set_event(IkeEvent::NoEncryption);
}
// Rule 4: lack of integrity is accepted only if using an AEAD proposal
// Look if no auth was proposed, including if proposal is Auth::None
@ -378,7 +378,7 @@ impl IKEV2State {
}
}) {
SCLogDebug!("No integrity transform found");
self.set_event(IKEV2Event::WeakCryptoNoAuth);
self.set_event(IkeEvent::WeakCryptoNoAuth);
}
}
// Finally
@ -402,9 +402,9 @@ impl IKEV2State {
}
}
impl IKEV2Transaction {
pub fn new(id: u64) -> IKEV2Transaction {
IKEV2Transaction {
impl IKETransaction {
pub fn new(id: u64) -> IKETransaction {
IKETransaction {
xid: 0,
hdr: IkeV2Header {
init_spi: 0,
@ -437,31 +437,31 @@ impl IKEV2Transaction {
}
}
impl Drop for IKEV2Transaction {
impl Drop for IKETransaction {
fn drop(&mut self) {
self.free();
}
}
/// Returns *mut IKEV2State
/// Returns *mut IKEState
#[no_mangle]
pub extern "C" fn rs_ikev2_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void {
let state = IKEV2State::new();
pub extern "C" fn rs_ike_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void {
let state = IKEState::new();
let boxed = Box::new(state);
return unsafe{std::mem::transmute(boxed)};
}
/// Params:
/// - state: *mut IKEV2State as void pointer
/// - state: *mut IKEState as void pointer
#[no_mangle]
pub extern "C" fn rs_ikev2_state_free(state: *mut std::os::raw::c_void) {
pub extern "C" fn rs_ike_state_free(state: *mut std::os::raw::c_void) {
// Just unbox...
let mut ikev2_state: Box<IKEV2State> = unsafe{std::mem::transmute(state)};
ikev2_state.free();
let mut ike_state: Box<IKEState> = unsafe{std::mem::transmute(state)};
ike_state.free();
}
#[no_mangle]
pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow,
pub extern "C" fn rs_ike_parse_request(_flow: *const core::Flow,
state: *mut std::os::raw::c_void,
_pstate: *mut std::os::raw::c_void,
input: *const u8,
@ -469,7 +469,7 @@ pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow,
_data: *const std::os::raw::c_void,
_flags: u8) -> AppLayerResult {
let buf = build_slice!(input,input_len as usize);
let state = cast_pointer!(state,IKEV2State);
let state = cast_pointer!(state,IKEState);
if state.parse(buf, STREAM_TOSERVER) < 0 {
return AppLayerResult::err();
}
@ -477,7 +477,7 @@ pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow,
}
#[no_mangle]
pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow,
pub extern "C" fn rs_ike_parse_response(_flow: *const core::Flow,
state: *mut std::os::raw::c_void,
pstate: *mut std::os::raw::c_void,
input: *const u8,
@ -485,9 +485,9 @@ pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow,
_data: *const std::os::raw::c_void,
_flags: u8) -> AppLayerResult {
let buf = build_slice!(input,input_len as usize);
let state = cast_pointer!(state,IKEV2State);
let state = cast_pointer!(state,IKEState);
let res = state.parse(buf, STREAM_TOCLIENT);
if state.connection_state == IKEV2ConnectionState::ParsingDone {
if state.connection_state == IKEConnectionState::ParsingDone {
unsafe{
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION |
APP_LAYER_PARSER_NO_REASSEMBLY |
@ -501,11 +501,11 @@ pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow,
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_get_tx(state: *mut std::os::raw::c_void,
pub extern "C" fn rs_ike_state_get_tx(state: *mut std::os::raw::c_void,
tx_id: u64)
-> *mut std::os::raw::c_void
{
let state = cast_pointer!(state,IKEV2State);
let state = cast_pointer!(state,IKEState);
match state.get_tx_by_id(tx_id) {
Some(tx) => unsafe{std::mem::transmute(tx)},
None => std::ptr::null_mut(),
@ -513,23 +513,31 @@ pub extern "C" fn rs_ikev2_state_get_tx(state: *mut std::os::raw::c_void,
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_get_tx_count(state: *mut std::os::raw::c_void)
pub extern "C" fn rs_ike_state_get_tx_count(state: *mut std::os::raw::c_void)
-> u64
{
let state = cast_pointer!(state,IKEV2State);
let state = cast_pointer!(state,IKEState);
state.tx_id
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_tx_free(state: *mut std::os::raw::c_void,
pub extern "C" fn rs_ike_state_tx_free(state: *mut std::os::raw::c_void,
tx_id: u64)
{
let state = cast_pointer!(state,IKEV2State);
let state = cast_pointer!(state,IKEState);
state.free_tx(tx_id);
}
#[no_mangle]
pub extern "C" fn rs_ikev2_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void,
pub extern "C" fn rs_ike_state_progress_completion_status(
_direction: u8)
-> std::os::raw::c_int
{
return 1;
}
#[no_mangle]
pub extern "C" fn rs_ike_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void,
_direction: u8)
-> std::os::raw::c_int
{
@ -537,21 +545,21 @@ pub extern "C" fn rs_ikev2_tx_get_alstate_progress(_tx: *mut std::os::raw::c_voi
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_set_tx_detect_state(
pub extern "C" fn rs_ike_state_set_tx_detect_state(
tx: *mut std::os::raw::c_void,
de_state: &mut core::DetectEngineState) -> std::os::raw::c_int
{
let tx = cast_pointer!(tx,IKEV2Transaction);
let tx = cast_pointer!(tx,IKETransaction);
tx.de_state = Some(de_state);
0
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_get_tx_detect_state(
pub extern "C" fn rs_ike_state_get_tx_detect_state(
tx: *mut std::os::raw::c_void)
-> *mut core::DetectEngineState
{
let tx = cast_pointer!(tx,IKEV2Transaction);
let tx = cast_pointer!(tx,IKETransaction);
match tx.de_state {
Some(ds) => ds,
None => std::ptr::null_mut(),
@ -560,31 +568,31 @@ pub extern "C" fn rs_ikev2_state_get_tx_detect_state(
#[no_mangle]
pub extern "C" fn rs_ikev2_state_get_events(tx: *mut std::os::raw::c_void)
pub extern "C" fn rs_ike_state_get_events(tx: *mut std::os::raw::c_void)
-> *mut core::AppLayerDecoderEvents
{
let tx = cast_pointer!(tx, IKEV2Transaction);
let tx = cast_pointer!(tx, IKETransaction);
return tx.events;
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_get_event_info_by_id(event_id: std::os::raw::c_int,
pub extern "C" fn rs_ike_state_get_event_info_by_id(event_id: std::os::raw::c_int,
event_name: *mut *const std::os::raw::c_char,
event_type: *mut core::AppLayerEventType)
-> i8
{
if let Some(e) = IKEV2Event::from_i32(event_id as i32) {
if let Some(e) = IkeEvent::from_i32(event_id as i32) {
let estr = match e {
IKEV2Event::MalformedData => { "malformed_data\0" },
IKEV2Event::NoEncryption => { "no_encryption\0" },
IKEV2Event::WeakCryptoEnc => { "weak_crypto_enc\0" },
IKEV2Event::WeakCryptoPRF => { "weak_crypto_prf\0" },
IKEV2Event::WeakCryptoDH => { "weak_crypto_dh\0" },
IKEV2Event::WeakCryptoAuth => { "weak_crypto_auth\0" },
IKEV2Event::WeakCryptoNoDH => { "weak_crypto_nodh\0" },
IKEV2Event::WeakCryptoNoAuth => { "weak_crypto_noauth\0" },
IKEV2Event::InvalidProposal => { "invalid_proposal\0" },
IKEV2Event::UnknownProposal => { "unknown_proposal\0" },
IkeEvent::MalformedData => { "malformed_data\0" },
IkeEvent::NoEncryption => { "no_encryption\0" },
IkeEvent::WeakCryptoEnc => { "weak_crypto_enc\0" },
IkeEvent::WeakCryptoPRF => { "weak_crypto_prf\0" },
IkeEvent::WeakCryptoDH => { "weak_crypto_dh\0" },
IkeEvent::WeakCryptoAuth => { "weak_crypto_auth\0" },
IkeEvent::WeakCryptoNoDH => { "weak_crypto_nodh\0" },
IkeEvent::WeakCryptoNoAuth => { "weak_crypto_noauth\0" },
IkeEvent::InvalidProposal => { "invalid_proposal\0" },
IkeEvent::UnknownProposal => { "unknown_proposal\0" },
};
unsafe{
*event_name = estr.as_ptr() as *const std::os::raw::c_char;
@ -597,7 +605,7 @@ pub extern "C" fn rs_ikev2_state_get_event_info_by_id(event_id: std::os::raw::c_
}
#[no_mangle]
pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw::c_char,
pub extern "C" fn rs_ike_state_get_event_info(event_name: *const std::os::raw::c_char,
event_id: *mut std::os::raw::c_int,
event_type: *mut core::AppLayerEventType)
-> std::os::raw::c_int
@ -607,16 +615,16 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw:
let event = match c_event_name.to_str() {
Ok(s) => {
match s {
"malformed_data" => IKEV2Event::MalformedData as i32,
"no_encryption" => IKEV2Event::NoEncryption as i32,
"weak_crypto_enc" => IKEV2Event::WeakCryptoEnc as i32,
"weak_crypto_prf" => IKEV2Event::WeakCryptoPRF as i32,
"weak_crypto_auth" => IKEV2Event::WeakCryptoAuth as i32,
"weak_crypto_dh" => IKEV2Event::WeakCryptoDH as i32,
"weak_crypto_nodh" => IKEV2Event::WeakCryptoNoDH as i32,
"weak_crypto_noauth" => IKEV2Event::WeakCryptoNoAuth as i32,
"invalid_proposal" => IKEV2Event::InvalidProposal as i32,
"unknown_proposal" => IKEV2Event::UnknownProposal as i32,
"malformed_data" => IkeEvent::MalformedData as i32,
"no_encryption" => IkeEvent::NoEncryption as i32,
"weak_crypto_enc" => IkeEvent::WeakCryptoEnc as i32,
"weak_crypto_prf" => IkeEvent::WeakCryptoPRF as i32,
"weak_crypto_auth" => IkeEvent::WeakCryptoAuth as i32,
"weak_crypto_dh" => IkeEvent::WeakCryptoDH as i32,
"weak_crypto_nodh" => IkeEvent::WeakCryptoNoDH as i32,
"weak_crypto_noauth" => IkeEvent::WeakCryptoNoAuth as i32,
"invalid_proposal" => IkeEvent::InvalidProposal as i32,
"unknown_proposal" => IkeEvent::UnknownProposal as i32,
_ => -1, // unknown event
}
},
@ -629,17 +637,16 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw:
0
}
static mut ALPROTO_IKEV2 : AppProto = ALPROTO_UNKNOWN;
static mut ALPROTO_IKE : AppProto = ALPROTO_UNKNOWN;
#[no_mangle]
pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow,
pub extern "C" fn rs_ike_probing_parser(_flow: *const Flow,
_direction: u8,
input:*const u8, input_len: u32,
_rdir: *mut u8) -> AppProto
{
let slice = build_slice!(input,input_len as usize);
let alproto = unsafe{ ALPROTO_IKEV2 };
let alproto = unsafe{ ALPROTO_IKE };
match parse_ikev2_header(slice) {
Ok((_, ref hdr)) => {
if hdr.maj_ver != 2 || hdr.min_ver != 0 {
@ -667,41 +674,41 @@ pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow,
}
}
export_tx_data_get!(rs_ikev2_get_tx_data, IKEV2Transaction);
export_tx_data_get!(rs_ike_get_tx_data, IKETransaction);
const PARSER_NAME : &'static [u8] = b"ikev2\0";
const PARSER_NAME : &'static [u8] = b"ike\0";
#[no_mangle]
pub unsafe extern "C" fn rs_register_ikev2_parser() {
pub unsafe extern "C" fn rs_register_ike_parser() {
let default_port = CString::new("500").unwrap();
let parser = RustParser {
name : PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
default_port : default_port.as_ptr(),
ipproto : core::IPPROTO_UDP,
probe_ts : Some(rs_ikev2_probing_parser),
probe_tc : Some(rs_ikev2_probing_parser),
probe_ts : Some(rs_ike_probing_parser),
probe_tc : Some(rs_ike_probing_parser),
min_depth : 0,
max_depth : 16,
state_new : rs_ikev2_state_new,
state_free : rs_ikev2_state_free,
tx_free : rs_ikev2_state_tx_free,
parse_ts : rs_ikev2_parse_request,
parse_tc : rs_ikev2_parse_response,
get_tx_count : rs_ikev2_state_get_tx_count,
get_tx : rs_ikev2_state_get_tx,
state_new : rs_ike_state_new,
state_free : rs_ike_state_free,
tx_free : rs_ike_state_tx_free,
parse_ts : rs_ike_parse_request,
parse_tc : rs_ike_parse_response,
get_tx_count : rs_ike_state_get_tx_count,
get_tx : rs_ike_state_get_tx,
tx_comp_st_ts : 1,
tx_comp_st_tc : 1,
tx_get_progress : rs_ikev2_tx_get_alstate_progress,
get_de_state : rs_ikev2_state_get_tx_detect_state,
set_de_state : rs_ikev2_state_set_tx_detect_state,
get_events : Some(rs_ikev2_state_get_events),
get_eventinfo : Some(rs_ikev2_state_get_event_info),
get_eventinfo_byid : Some(rs_ikev2_state_get_event_info_by_id),
tx_get_progress : rs_ike_tx_get_alstate_progress,
get_de_state : rs_ike_state_get_tx_detect_state,
set_de_state : rs_ike_state_set_tx_detect_state,
get_events : Some(rs_ike_state_get_events),
get_eventinfo : Some(rs_ike_state_get_event_info),
get_eventinfo_byid : Some(rs_ike_state_get_event_info_by_id),
localstorage_new : None,
localstorage_free : None,
get_files : None,
get_tx_iterator : None,
get_tx_data : rs_ikev2_get_tx_data,
get_tx_data : rs_ike_get_tx_data,
apply_tx_config : None,
flags : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
truncate : None,
@ -711,23 +718,23 @@ pub unsafe extern "C" fn rs_register_ikev2_parser() {
if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let alproto = AppLayerRegisterProtocolDetection(&parser, 1);
// store the allocated ID for the probe function
ALPROTO_IKEV2 = alproto;
ALPROTO_IKE = alproto;
if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, alproto);
}
} else {
SCLogDebug!("Protocol detector and parser disabled for IKEV2.");
SCLogDebug!("Protocol detector and parser disabled for IKE.");
}
}
#[cfg(test)]
mod tests {
use super::IKEV2State;
use super::IKEState;
#[test]
fn test_ikev2_parse_request_valid() {
// A UDP IKEV2 v4 request, in client mode
fn test_ike_parse_request_valid() {
// A UDP IKE v4 request, in client mode
const REQ : &[u8] = &[
0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@ -737,7 +744,7 @@ mod tests {
0x18, 0x57, 0xab, 0xc3, 0x4a, 0x5f, 0x2c, 0xfe
];
let mut state = IKEV2State::new();
let mut state = IKEState::new();
assert_eq!(1, state.parse(REQ, 0));
}
}

14
rust/src/ikev2/log.rs → rust/src/ike/log.rs
Unescape Escape View File

@ -18,12 +18,12 @@
// written by Pierre Chifflier <chifflier@wzdftpd.net>
use crate::jsonbuilder::{JsonBuilder, JsonError};
use crate::ikev2::ikev2::{IKEV2State,IKEV2Transaction};
use crate::ike::ike::{IKEState,IKETransaction};
use crate::ikev2::ipsec_parser::IKEV2_FLAG_INITIATOR;
use crate::ike::ipsec_parser::IKEV2_FLAG_INITIATOR;
fn ikev2_log_response(state: &mut IKEV2State,
tx: &mut IKEV2Transaction,
fn ike_log_response(state: &mut IKEState,
tx: &mut IKETransaction,
jb: &mut JsonBuilder)
-> Result<(), JsonError>
{
@ -58,10 +58,10 @@ fn ikev2_log_response(state: &mut IKEV2State,
}
#[no_mangle]
pub extern "C" fn rs_ikev2_log_json_response(state: &mut IKEV2State,
tx: &mut IKEV2Transaction,
pub extern "C" fn rs_ike_log_json_response(state: &mut IKEState,
tx: &mut IKETransaction,
jb: &mut JsonBuilder)
-> bool
{
ikev2_log_response(state, tx, jb).is_ok()
ike_log_response(state, tx, jb).is_ok()
}

2
rust/src/ikev2/mod.rs → rust/src/ike/mod.rs
Unescape Escape View File

@ -19,6 +19,6 @@
extern crate ipsec_parser;
pub mod ikev2;
pub mod ike;
pub mod state;
pub mod log;

8
rust/src/ikev2/state.rs → rust/src/ike/state.rs
Unescape Escape View File

@ -22,7 +22,7 @@ use self::ipsec_parser::*;
#[derive(Clone, Debug, PartialEq)]
#[repr(u8)]
pub enum IKEV2ConnectionState {
pub enum IKEConnectionState {
Init,
InitSASent,
InitKESent,
@ -37,9 +37,9 @@ pub enum IKEV2ConnectionState {
Invalid,
}
impl IKEV2ConnectionState {
pub fn advance(&self, payload: &IkeV2Payload) -> IKEV2ConnectionState {
use self::IKEV2ConnectionState::*;
impl IKEConnectionState {
pub fn advance(&self, payload: &IkeV2Payload) -> IKEConnectionState {
use self::IKEConnectionState::*;
match (self, &payload.content) {
(&Init, &IkeV2PayloadContent::SA(_)) => InitSASent,
(&InitSASent, &IkeV2PayloadContent::KE(_)) => InitKESent,

2
rust/src/lib.rs
Unescape Escape View File

@ -67,7 +67,7 @@ pub mod smb;
pub mod krb;
pub mod dcerpc;
pub mod ikev2;
pub mod ike;
pub mod snmp;
pub mod ntp;

8
src/Makefile.am
Unescape Escape View File

@ -31,7 +31,7 @@ noinst_HEADERS = \
app-layer-htp-mem.h \
app-layer-htp-xff.h \
app-layer-http2.h \
app-layer-ikev2.h \
app-layer-ike.h \
app-layer-krb5.h \
app-layer-modbus.h \
app-layer-mqtt.h \
@ -383,7 +383,7 @@ noinst_HEADERS = \
output-json.h \
output-json-http2.h \
output-json-http.h \
output-json-ikev2.h \
output-json-ike.h \
output-json-krb5.h \
output-json-metadata.h \
output-json-mqtt.h \
@ -605,7 +605,7 @@ libsuricata_c_a_SOURCES = \
app-layer-htp-mem.c \
app-layer-htp-xff.c \
app-layer-http2.c \
app-layer-ikev2.c \
app-layer-ike.c \
app-layer-krb5.c \
app-layer-modbus.c \
app-layer-mqtt.c \
@ -951,7 +951,7 @@ libsuricata_c_a_SOURCES = \
output-json-ftp.c \
output-json-http2.c \
output-json-http.c \
output-json-ikev2.c \
output-json-ike.c \
output-json-krb5.c \
output-json-metadata.c \
output-json-mqtt.c \

8
src/app-layer-detect-proto.c
Unescape Escape View File

@ -890,8 +890,8 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar
printf(" alproto: ALPROTO_NTP\n");
else if (pp_pe->alproto == ALPROTO_TFTP)
printf(" alproto: ALPROTO_TFTP\n");
else if (pp_pe->alproto == ALPROTO_IKEV2)
printf(" alproto: ALPROTO_IKEV2\n");
else if (pp_pe->alproto == ALPROTO_IKE)
printf(" alproto: ALPROTO_IKE\n");
else if (pp_pe->alproto == ALPROTO_KRB5)
printf(" alproto: ALPROTO_KRB5\n");
else if (pp_pe->alproto == ALPROTO_DHCP)
@ -967,8 +967,8 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar
printf(" alproto: ALPROTO_NTP\n");
else if (pp_pe->alproto == ALPROTO_TFTP)
printf(" alproto: ALPROTO_TFTP\n");
else if (pp_pe->alproto == ALPROTO_IKEV2)
printf(" alproto: ALPROTO_IKEV2\n");
else if (pp_pe->alproto == ALPROTO_IKE)
printf(" alproto: ALPROTO_IKE\n");
else if (pp_pe->alproto == ALPROTO_KRB5)
printf(" alproto: ALPROTO_KRB5\n");
else if (pp_pe->alproto == ALPROTO_DHCP)

8
src/app-layer-ikev2.c → src/app-layer-ike.c
Unescape Escape View File

@ -20,7 +20,7 @@
*
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*
* Parser for IKEv2 application layer running on UDP port 500.
* Parser for IKE application layer running on UDP port 500.
*/
#include "suricata-common.h"
@ -32,10 +32,10 @@
#include "app-layer-detect-proto.h"
#include "app-layer-parser.h"
#include "app-layer-ikev2.h"
#include "app-layer-ike.h"
#include "rust.h"
void RegisterIKEV2Parsers(void)
void RegisterIKEParsers(void)
{
rs_register_ikev2_parser();
rs_register_ike_parser();
}

12
src/app-layer-ikev2.h → src/app-layer-ike.h
Unescape Escape View File

@ -21,13 +21,13 @@
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*/
#ifndef __APP_LAYER_IKEV2_H__
#define __APP_LAYER_IKEV2_H__
#ifndef __APP_LAYER_IKE_H__
#define __APP_LAYER_IKE_H__
void RegisterIKEV2Parsers(void);
void RegisterIKEParsers(void);
/** Opaque Rust types. */
typedef struct IKEV2State_ IKEV2State;
typedef struct IKEV2Transaction_ IKEV2Transaction;
typedef struct IKEState_ IKEState;
typedef struct IKETransaction_ IKETransaction;
#endif /* __APP_LAYER_IKEV2_H__ */
#endif /* __APP_LAYER_IKE_H__ */

4
src/app-layer-parser.c
Unescape Escape View File

@ -61,7 +61,7 @@
#include "app-layer-nfs-udp.h"
#include "app-layer-ntp.h"
#include "app-layer-tftp.h"
#include "app-layer-ikev2.h"
#include "app-layer-ike.h"
#include "app-layer-krb5.h"
#include "app-layer-snmp.h"
#include "app-layer-sip.h"
@ -1629,7 +1629,7 @@ void AppLayerParserRegisterProtocolParsers(void)
RegisterNFSUDPParsers();
RegisterNTPParsers();
RegisterTFTPParsers();
RegisterIKEV2Parsers();
RegisterIKEParsers();
RegisterKRB5Parsers();
rs_dhcp_register_parser();
RegisterSNMPParsers();

7
src/app-layer-protos.c
Unescape Escape View File

@ -87,8 +87,8 @@ const char *AppProtoToString(AppProto alproto)
case ALPROTO_TFTP:
proto_name = "tftp";
break;
case ALPROTO_IKEV2:
proto_name = "ikev2";
case ALPROTO_IKE:
proto_name = "ike";
break;
case ALPROTO_KRB5:
proto_name = "krb5";
@ -162,7 +162,8 @@ AppProto StringToAppProto(const char *proto_name)
if (strcmp(proto_name,"dnp3")==0) return ALPROTO_DNP3;
if (strcmp(proto_name,"nfs")==0) return ALPROTO_NFS;
if (strcmp(proto_name,"ntp")==0) return ALPROTO_NTP;
if (strcmp(proto_name,"ikev2")==0) return ALPROTO_IKEV2;
if (strcmp(proto_name, "ike") == 0)
return ALPROTO_IKE;
if (strcmp(proto_name,"krb5")==0) return ALPROTO_KRB5;
if (strcmp(proto_name,"dhcp")==0) return ALPROTO_DHCP;
if (strcmp(proto_name,"snmp")==0) return ALPROTO_SNMP;

2
src/app-layer-protos.h
Unescape Escape View File

@ -46,7 +46,7 @@ enum AppProtoEnum {
ALPROTO_NTP,
ALPROTO_FTPDATA,
ALPROTO_TFTP,
ALPROTO_IKEV2,
ALPROTO_IKE,
ALPROTO_KRB5,
ALPROTO_DHCP,
ALPROTO_SNMP,

86
src/output-json-ikev2.c → src/output-json-ike.c
Unescape Escape View File

@ -20,7 +20,7 @@
*
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*
* Implement JSON/eve logging app-layer IKEv2.
* Implement JSON/eve logging app-layer IKE.
*/
#include "suricata-common.h"
@ -44,37 +44,37 @@
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-ikev2.h"
#include "output-json-ikev2.h"
#include "app-layer-ike.h"
#include "output-json-ike.h"
#include "rust.h"
typedef struct LogIKEv2FileCtx_ {
typedef struct LogIKEFileCtx_ {
LogFileCtx *file_ctx;
OutputJsonCommonSettings cfg;
} LogIKEv2FileCtx;
} LogIKEFileCtx;
typedef struct LogIKEv2LogThread_ {
typedef struct LogIKELogThread_ {
LogFileCtx *file_ctx;
LogIKEv2FileCtx *ikev2log_ctx;
MemBuffer *buffer;
} LogIKEv2LogThread;
LogIKEFileCtx *ikelog_ctx;
MemBuffer *buffer;
} LogIKELogThread;
static int JsonIKEv2Logger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state,
void *tx, uint64_t tx_id)
{
IKEV2Transaction *ikev2tx = tx;
LogIKEv2LogThread *thread = thread_data;
IKETransaction *iketx = tx;
LogIKELogThread *thread = thread_data;
JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ikev2", NULL);
JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ike", NULL);
if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED;
}
EveAddCommonOptions(&thread->ikev2log_ctx->cfg, p, f, jb);
EveAddCommonOptions(&thread->ikelog_ctx->cfg, p, f, jb);
jb_open_object(jb, "ikev2");
if (unlikely(!rs_ikev2_log_json_response(state, ikev2tx, jb))) {
jb_open_object(jb, "ike");
if (unlikely(!rs_ike_log_json_response(state, iketx, jb))) {
goto error;
}
jb_close(jb);
@ -90,52 +90,51 @@ error:
return TM_ECODE_FAILED;
}
static void OutputIKEv2LogDeInitCtxSub(OutputCtx *output_ctx)
static void OutputIKELogDeInitCtxSub(OutputCtx *output_ctx)
{
LogIKEv2FileCtx *ikev2log_ctx = (LogIKEv2FileCtx *)output_ctx->data;
SCFree(ikev2log_ctx);
LogIKEFileCtx *ikelog_ctx = (LogIKEFileCtx *)output_ctx->data;
SCFree(ikelog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputIKEv2LogInitSub(ConfNode *conf,
OutputCtx *parent_ctx)
static OutputInitResult OutputIKELogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
{
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogIKEv2FileCtx *ikev2log_ctx = SCCalloc(1, sizeof(*ikev2log_ctx));
if (unlikely(ikev2log_ctx == NULL)) {
LogIKEFileCtx *ikelog_ctx = SCCalloc(1, sizeof(*ikelog_ctx));
if (unlikely(ikelog_ctx == NULL)) {
return result;
}
ikev2log_ctx->file_ctx = ajt->file_ctx;
ikev2log_ctx->cfg = ajt->cfg;
ikelog_ctx->file_ctx = ajt->file_ctx;
ikelog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(ikev2log_ctx);
SCFree(ikelog_ctx);
return result;
}
output_ctx->data = ikev2log_ctx;
output_ctx->DeInit = OutputIKEv2LogDeInitCtxSub;
output_ctx->data = ikelog_ctx;
output_ctx->DeInit = OutputIKELogDeInitCtxSub;
SCLogDebug("IKEv2 log sub-module initialized.");
SCLogDebug("IKE log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_IKEV2);
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_IKE);
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonIKEv2LogThreadInit(ThreadVars *t, const void *initdata, void **data)
static TmEcode JsonIKELogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogIKEv2LogThread *thread = SCCalloc(1, sizeof(*thread));
LogIKELogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogIKEv2. \"initdata\" is NULL.");
SCLogDebug("Error getting context for EveLogIKE. \"initdata\" is NULL.");
goto error_exit;
}
@ -144,8 +143,8 @@ static TmEcode JsonIKEv2LogThreadInit(ThreadVars *t, const void *initdata, void
goto error_exit;
}
thread->ikev2log_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->ikev2log_ctx->file_ctx, t->id);
thread->ikelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->ikelog_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
@ -161,9 +160,9 @@ error_exit:
return TM_ECODE_FAILED;
}
static TmEcode JsonIKEv2LogThreadDeinit(ThreadVars *t, void *data)
static TmEcode JsonIKELogThreadDeinit(ThreadVars *t, void *data)
{
LogIKEv2LogThread *thread = (LogIKEv2LogThread *)data;
LogIKELogThread *thread = (LogIKELogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
@ -174,13 +173,12 @@ static TmEcode JsonIKEv2LogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
void JsonIKEv2LogRegister(void)
void JsonIKELogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_IKEV2, "eve-log", "JsonIKEv2Log",
"eve-log.ikev2", OutputIKEv2LogInitSub, ALPROTO_IKEV2,
JsonIKEv2Logger, JsonIKEv2LogThreadInit,
JsonIKEv2LogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_IKE, "eve-log", "JsonIKELog", "eve-log.ike",
OutputIKELogInitSub, ALPROTO_IKE, JsonIKELogger, JsonIKELogThreadInit,
JsonIKELogThreadDeinit, NULL);
SCLogDebug("IKEv2 JSON logger registered.");
SCLogDebug("IKE JSON logger registered.");
}

8
src/output-json-ikev2.h → src/output-json-ike.h
Unescape Escape View File

@ -21,9 +21,9 @@
* \author Pierre Chifflier <chifflier@wzdftpd.net>
*/
#ifndef __OUTPUT_JSON_IKEV2_H__
#define __OUTPUT_JSON_IKEV2_H__
#ifndef __OUTPUT_JSON_IKE_H__
#define __OUTPUT_JSON_IKE_H__
void JsonIKEv2LogRegister(void);
void JsonIKELogRegister(void);
#endif /* __OUTPUT_JSON_IKEV2_H__ */
#endif /* __OUTPUT_JSON_IKE_H__ */

6
src/output.c
Unescape Escape View File

@ -69,7 +69,7 @@
#include "output-json-ftp.h"
#include "output-json-tftp.h"
#include "output-json-smb.h"
#include "output-json-ikev2.h"
#include "output-json-ike.h"
#include "output-json-krb5.h"
#include "output-json-dhcp.h"
#include "output-json-snmp.h"
@ -1096,8 +1096,8 @@ void OutputRegisterLoggers(void)
JsonFTPLogRegister();
/* SMB JSON logger. */
JsonSMBLogRegister();
/* IKEv2 JSON logger. */
JsonIKEv2LogRegister();
/* IKE JSON logger. */
JsonIKELogRegister();
/* KRB5 JSON logger. */
JsonKRB5LogRegister();
/* DHCP JSON logger. */

2
src/rust-context.h
Unescape Escape View File

@ -20,7 +20,7 @@
#include "detect-engine-state.h" //DetectEngineState
#include "app-layer-krb5.h" //KRB5State, KRB5Transaction
#include "app-layer-ikev2.h" //IKEV2State, IKEV2Transaction
#include "app-layer-ike.h" //IKEState, IKETransaction
#include "app-layer-ntp.h" //NTPState, NTPTransaction
#include "app-layer-snmp.h" //SNMPState, SNMPTransaction
#include "app-layer-tftp.h" //TFTPState, TFTPTransaction

2
src/suricata-common.h
Unescape Escape View File

@ -454,7 +454,7 @@ typedef enum {
LOGGER_JSON_DNP3_TC,
LOGGER_JSON_SSH,
LOGGER_JSON_SMB,
LOGGER_JSON_IKEV2,
LOGGER_JSON_IKE,
LOGGER_JSON_KRB5,
LOGGER_JSON_DHCP,
LOGGER_JSON_SNMP,

2
src/tests/fuzz/confyaml.c
Unescape Escape View File

@ -53,7 +53,7 @@ outputs:\n\
- nfs\n\
- smb\n\
- tftp\n\
- ikev2\n\
- ike\n\
- krb5\n\
- snmp\n\
- rfb\n\

2
src/util-profiling.c
Unescape Escape View File

@ -1309,7 +1309,7 @@ const char * PacketProfileLoggertIdToString(LoggerId id)
CASE_CODE (LOGGER_JSON_HTTP);
CASE_CODE (LOGGER_JSON_DHCP);
CASE_CODE (LOGGER_JSON_KRB5);
CASE_CODE (LOGGER_JSON_IKEV2);
CASE_CODE(LOGGER_JSON_IKE);
CASE_CODE (LOGGER_JSON_FTP);
CASE_CODE (LOGGER_JSON_TFTP);
CASE_CODE (LOGGER_JSON_SMTP);

4
suricata.yaml.in
Unescape Escape View File

@ -266,7 +266,7 @@ outputs:
- nfs
- smb
- tftp
- ikev2
- ike
- dcerpc
- krb5
- snmp
@ -726,7 +726,7 @@ app-layer:
enabled: yes
snmp:
enabled: yes
ikev2:
ike:
enabled: yes
tls:
enabled: yes

Write Preview
Loading…
Cancel
Save