From ecdf9f6b0ba497704d22b585469a5b18e653b256 Mon Sep 17 00:00:00 2001 From: frank honza Date: Sun, 18 Oct 2020 21:38:06 +0200 Subject: [PATCH] ikev1: rename ikev2 to common ike Renaming was done with shell commands, git mv for moving the files and content like find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case. --- doc/userguide/partials/eve-log.yaml | 4 +- doc/userguide/rules/intro.rst | 2 +- rules/ipsec-events.rules | 26 +- rust/cbindgen.toml | 4 +- rust/src/{ikev2/ikev2.rs => ike/ike.rs} | 265 +++++++++--------- rust/src/{ikev2 => ike}/log.rs | 14 +- rust/src/{ikev2 => ike}/mod.rs | 2 +- rust/src/{ikev2 => ike}/state.rs | 8 +- rust/src/lib.rs | 2 +- src/Makefile.am | 8 +- src/app-layer-detect-proto.c | 8 +- src/{app-layer-ikev2.c => app-layer-ike.c} | 8 +- src/{app-layer-ikev2.h => app-layer-ike.h} | 12 +- src/app-layer-parser.c | 4 +- src/app-layer-protos.c | 7 +- src/app-layer-protos.h | 2 +- ...{output-json-ikev2.c => output-json-ike.c} | 86 +++--- ...{output-json-ikev2.h => output-json-ike.h} | 8 +- src/output.c | 6 +- src/rust-context.h | 2 +- src/suricata-common.h | 2 +- src/tests/fuzz/confyaml.c | 2 +- src/util-profiling.c | 2 +- suricata.yaml.in | 4 +- 24 files changed, 247 insertions(+), 241 deletions(-) rename rust/src/{ikev2/ikev2.rs => ike/ike.rs} (75%) rename rust/src/{ikev2 => ike}/log.rs (85%) rename rust/src/{ikev2 => ike}/mod.rs (98%) rename rust/src/{ikev2 => ike}/state.rs (92%) rename src/{app-layer-ikev2.c => app-layer-ike.c} (86%) rename src/{app-layer-ikev2.h => app-layer-ike.h} (78%) rename src/{output-json-ikev2.c => output-json-ike.c} (56%) rename src/{output-json-ikev2.h => output-json-ike.h} (85%) diff --git a/doc/userguide/partials/eve-log.yaml b/doc/userguide/partials/eve-log.yaml index ee491c32b8..e664f92b37 100644 --- a/doc/userguide/partials/eve-log.yaml +++ b/doc/userguide/partials/eve-log.yaml @@ -160,8 +160,8 @@ outputs: # NFS logging. Requires Rust. - nfs - # IKEv2 logging. Requires Rust. - - ikev2 + # IKE logging. Requires Rust. + - ike - ssh - stats: totals: yes # stats for all threads merged together diff --git a/doc/userguide/rules/intro.rst b/doc/userguide/rules/intro.rst index bb071144b5..80fbf99db4 100644 --- a/doc/userguide/rules/intro.rst +++ b/doc/userguide/rules/intro.rst @@ -89,7 +89,7 @@ you can pick from. These are: * dnp3 (disabled by default) * enip (disabled by default) * nfs -* ikev2 +* ike * krb5 * ntp * dhcp diff --git a/rules/ipsec-events.rules b/rules/ipsec-events.rules index 07fc4c46d3..1ae6edffe6 100644 --- a/rules/ipsec-events.rules +++ b/rules/ipsec-events.rules @@ -4,16 +4,16 @@ # # These sigs fire at most once per connection. # -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 malformed request data"; flow:to_server; app-layer-event:ikev2.malformed_data; classtype:protocol-command-decode; sid:2224000; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 malformed response data"; flow:to_client; app-layer-event:ikev2.malformed_data; classtype:protocol-command-decode; sid:2224001; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Encryption)"; flow:to_client; app-layer-event:ikev2.weak_crypto_enc; classtype:protocol-command-decode; sid:2224002; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (PRF)"; flow:to_client; app-layer-event:ikev2.weak_crypto_prf; classtype:protocol-command-decode; sid:2224003; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Auth)"; flow:to_client; app-layer-event:ikev2.weak_crypto_auth; classtype:protocol-command-decode; sid:2224004; rev:2;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman)"; flow:to_client; app-layer-event:ikev2.weak_crypto_dh; classtype:protocol-command-decode; sid:2224005; rev:2;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no Diffie-Hellman exchange parameters"; flow:to_client; app-layer-event:ikev2.weak_crypto_nodh; classtype:protocol-command-decode; sid:2224006; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no authentication"; flow:to_client; app-layer-event:ikev2.weak_crypto_noauth; classtype:protocol-command-decode; sid:2224007; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no encryption (AH)"; flow:to_client; app-layer-event:ikev2.no_encryption; classtype:protocol-command-decode; sid:2224008; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 invalid proposal"; flow:to_server; app-layer-event:ikev2.invalid_proposal; classtype:protocol-command-decode; sid:2224009; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 invalid proposal selected"; flow:to_client; app-layer-event:ikev2.invalid_proposal; classtype:protocol-command-decode; sid:2224010; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 unknown proposal"; flow:to_server; app-layer-event:ikev2.unknown_proposal; classtype:protocol-command-decode; sid:2224011; rev:1;) -alert ikev2 any any -> any any (msg:"SURICATA IKEv2 unknown proposal selected"; flow:to_client; app-layer-event:ikev2.unknown_proposal; classtype:protocol-command-decode; sid:2224012; rev:1;) +alert ike any any -> any any (msg:"SURICATA IKE malformed request data"; flow:to_server; app-layer-event:ike.malformed_data; classtype:protocol-command-decode; sid:2224000; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE malformed response data"; flow:to_client; app-layer-event:ike.malformed_data; classtype:protocol-command-decode; sid:2224001; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Encryption)"; flow:to_client; app-layer-event:ike.weak_crypto_enc; classtype:protocol-command-decode; sid:2224002; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (PRF)"; flow:to_client; app-layer-event:ike.weak_crypto_prf; classtype:protocol-command-decode; sid:2224003; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Auth)"; flow:to_client; app-layer-event:ike.weak_crypto_auth; classtype:protocol-command-decode; sid:2224004; rev:3;) +alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Diffie-Hellman)"; flow:to_client; app-layer-event:ike.weak_crypto_dh; classtype:protocol-command-decode; sid:2224005; rev:3;) +alert ike any any -> any any (msg:"SURICATA IKE no Diffie-Hellman exchange parameters"; flow:to_client; app-layer-event:ike.weak_crypto_nodh; classtype:protocol-command-decode; sid:2224006; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE no authentication"; flow:to_client; app-layer-event:ike.weak_crypto_noauth; classtype:protocol-command-decode; sid:2224007; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE no encryption (AH)"; flow:to_client; app-layer-event:ike.no_encryption; classtype:protocol-command-decode; sid:2224008; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE invalid proposal"; flow:to_server; app-layer-event:ike.invalid_proposal; classtype:protocol-command-decode; sid:2224009; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE invalid proposal selected"; flow:to_client; app-layer-event:ike.invalid_proposal; classtype:protocol-command-decode; sid:2224010; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE unknown proposal"; flow:to_server; app-layer-event:ike.unknown_proposal; classtype:protocol-command-decode; sid:2224011; rev:2;) +alert ike any any -> any any (msg:"SURICATA IKE unknown proposal selected"; flow:to_client; app-layer-event:ike.unknown_proposal; classtype:protocol-command-decode; sid:2224012; rev:2;) diff --git a/rust/cbindgen.toml b/rust/cbindgen.toml index d33d7f2374..71609d4dc1 100644 --- a/rust/cbindgen.toml +++ b/rust/cbindgen.toml @@ -88,8 +88,8 @@ exclude = [ "Flow", "FileContainer", "JsonT", - "IKEV2State", - "IKEV2Transaction", + "IKEState", + "IKETransaction", "KRB5State", "KRB5Transaction", "NTPState", diff --git a/rust/src/ikev2/ikev2.rs b/rust/src/ike/ike.rs similarity index 75% rename from rust/src/ikev2/ikev2.rs rename to rust/src/ike/ike.rs index c3e3693303..2cae016044 100644 --- a/rust/src/ikev2/ikev2.rs +++ b/rust/src/ike/ike.rs @@ -17,8 +17,8 @@ // written by Pierre Chifflier -use crate::ikev2::ipsec_parser::*; -use crate::ikev2::state::IKEV2ConnectionState; +use crate::ike::ipsec_parser::*; +use crate::ike::state::IKEConnectionState; use crate::core; use crate::core::{AppProto,Flow,ALPROTO_UNKNOWN,ALPROTO_FAILED,STREAM_TOSERVER,STREAM_TOCLIENT}; use crate::applayer::{self, *}; @@ -28,7 +28,7 @@ use std::ffi::{CStr,CString}; use nom; #[repr(u32)] -pub enum IKEV2Event { +pub enum IkeEvent { MalformedData = 0, NoEncryption, WeakCryptoEnc, @@ -41,33 +41,33 @@ pub enum IKEV2Event { UnknownProposal, } -impl IKEV2Event { - fn from_i32(value: i32) -> Option { +impl IkeEvent { + fn from_i32(value: i32) -> Option { match value { - 0 => Some(IKEV2Event::MalformedData), - 1 => Some(IKEV2Event::NoEncryption), - 2 => Some(IKEV2Event::WeakCryptoEnc), - 3 => Some(IKEV2Event::WeakCryptoPRF), - 4 => Some(IKEV2Event::WeakCryptoDH), - 5 => Some(IKEV2Event::WeakCryptoAuth), - 6 => Some(IKEV2Event::WeakCryptoNoDH), - 7 => Some(IKEV2Event::WeakCryptoNoAuth), - 8 => Some(IKEV2Event::InvalidProposal), - 9 => Some(IKEV2Event::UnknownProposal), + 0 => Some(IkeEvent::MalformedData), + 1 => Some(IkeEvent::NoEncryption), + 2 => Some(IkeEvent::WeakCryptoEnc), + 3 => Some(IkeEvent::WeakCryptoPRF), + 4 => Some(IkeEvent::WeakCryptoDH), + 5 => Some(IkeEvent::WeakCryptoAuth), + 6 => Some(IkeEvent::WeakCryptoNoDH), + 7 => Some(IkeEvent::WeakCryptoNoAuth), + 8 => Some(IkeEvent::InvalidProposal), + 9 => Some(IkeEvent::UnknownProposal), _ => None, } } } -pub struct IKEV2State { +pub struct IKEState { /// List of transactions for this session - transactions: Vec, + transactions: Vec, /// tx counter for assigning incrementing id's to tx's tx_id: u64, /// The connection state - connection_state: IKEV2ConnectionState, + connection_state: IKEConnectionState, /// The transforms proposed by the initiator pub client_transforms : Vec>, @@ -92,8 +92,8 @@ pub struct IKEV2State { } #[derive(Debug)] -pub struct IKEV2Transaction { - /// The IKEV2 reference ID +pub struct IKETransaction { + /// The IKE reference ID pub xid: u64, pub hdr: IkeV2Header, @@ -118,12 +118,12 @@ pub struct IKEV2Transaction { -impl IKEV2State { - pub fn new() -> IKEV2State { - IKEV2State{ +impl IKEState { + pub fn new() -> IKEState { + IKEState{ transactions: Vec::new(), tx_id: 0, - connection_state: IKEV2ConnectionState::Init, + connection_state: IKEConnectionState::Init, dh_group: IkeTransformDHType::None, client_transforms: Vec::new(), server_transforms: Vec::new(), @@ -136,8 +136,8 @@ impl IKEV2State { } } -impl IKEV2State { - /// Parse an IKEV2 request message +impl IKEState { + /// Parse an IKE request message /// /// Returns The number of messages parsed, or -1 on error fn parse(&mut self, i: &[u8], direction: u8) -> i32 { @@ -148,11 +148,11 @@ impl IKEV2State { } // Rule 0: check version if hdr.maj_ver != 2 || hdr.min_ver != 0 { - self.set_event(IKEV2Event::MalformedData); + self.set_event(IkeEvent::MalformedData); return -1; } if hdr.init_spi == 0 { - self.set_event(IKEV2Event::MalformedData); + self.set_event(IkeEvent::MalformedData); return -1; } // only analyse IKE_SA, other payloads are encrypted @@ -174,7 +174,7 @@ impl IKEV2State { match payload.content { IkeV2PayloadContent::Dummy => (), IkeV2PayloadContent::SA(ref prop) => { - // if hdr.flags & IKEV2_FLAG_INITIATOR != 0 { + // if hdr.flags & IKE_FLAG_INITIATOR != 0 { self.add_proposals(prop, direction); // } }, @@ -213,18 +213,18 @@ impl IKEV2State { } }; }, - e => { SCLogDebug!("parse_ikev2_payload_with_type: {:?}",e); () }, + e => { SCLogDebug!("parse_ike_payload_with_type: {:?}",e); () }, } 1 }, Err(nom::Err::Incomplete(_)) => { - SCLogDebug!("Insufficient data while parsing IKEV2 data"); - self.set_event(IKEV2Event::MalformedData); + SCLogDebug!("Insufficient data while parsing IKE data"); + self.set_event(IkeEvent::MalformedData); -1 }, Err(_) => { - SCLogDebug!("Error while parsing IKEV2 data"); - self.set_event(IKEV2Event::MalformedData); + SCLogDebug!("Error while parsing IKE data"); + self.set_event(IkeEvent::MalformedData); -1 }, } @@ -236,12 +236,12 @@ impl IKEV2State { self.transactions.clear(); } - fn new_tx(&mut self) -> IKEV2Transaction { + fn new_tx(&mut self) -> IKETransaction { self.tx_id += 1; - IKEV2Transaction::new(self.tx_id) + IKETransaction::new(self.tx_id) } - fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&IKEV2Transaction> { + fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&IKETransaction> { self.transactions.iter().find(|&tx| tx.id == tx_id + 1) } @@ -254,7 +254,7 @@ impl IKEV2State { } /// Set an event. The event is set on the most recent transaction. - fn set_event(&mut self, event: IKEV2Event) { + fn set_event(&mut self, event: IkeEvent) { if let Some(tx) = self.transactions.last_mut() { let ev = event as u8; core::sc_app_layer_decoder_events_set_event_raw(&mut tx.events, ev); @@ -283,7 +283,7 @@ impl IKEV2State { IkeTransformEncType::ENCR_NULL => { SCLogDebug!("Weak Encryption: {:?}", enc); // XXX send event only if direction == STREAM_TOCLIENT ? - self.set_event(IKEV2Event::WeakCryptoEnc); + self.set_event(IkeEvent::WeakCryptoEnc); }, _ => (), } @@ -292,12 +292,12 @@ impl IKEV2State { match *prf { IkeTransformPRFType::PRF_NULL => { SCLogDebug!("'Null' PRF transform proposed"); - self.set_event(IKEV2Event::InvalidProposal); + self.set_event(IkeEvent::InvalidProposal); }, IkeTransformPRFType::PRF_HMAC_MD5 | IkeTransformPRFType::PRF_HMAC_SHA1 => { SCLogDebug!("Weak PRF: {:?}", prf); - self.set_event(IKEV2Event::WeakCryptoPRF); + self.set_event(IkeEvent::WeakCryptoPRF); }, _ => (), } @@ -317,7 +317,7 @@ impl IKEV2State { IkeTransformAuthType::AUTH_HMAC_MD5_128 | IkeTransformAuthType::AUTH_HMAC_SHA1_160 => { SCLogDebug!("Weak auth: {:?}", auth); - self.set_event(IKEV2Event::WeakCryptoAuth); + self.set_event(IkeEvent::WeakCryptoAuth); }, _ => (), } @@ -326,21 +326,21 @@ impl IKEV2State { match *dh { IkeTransformDHType::None => { SCLogDebug!("'None' DH transform proposed"); - self.set_event(IKEV2Event::InvalidProposal); + self.set_event(IkeEvent::InvalidProposal); }, IkeTransformDHType::Modp768 | IkeTransformDHType::Modp1024 | IkeTransformDHType::Modp1024s160 | IkeTransformDHType::Modp1536 => { SCLogDebug!("Weak DH: {:?}", dh); - self.set_event(IKEV2Event::WeakCryptoDH); + self.set_event(IkeEvent::WeakCryptoDH); }, _ => (), } }, IkeV2Transform::Unknown(tx_type,tx_id) => { SCLogDebug!("Unknown proposal: type={:?}, id={}", tx_type, tx_id); - self.set_event(IKEV2Event::UnknownProposal); + self.set_event(IkeEvent::UnknownProposal); }, _ => (), } @@ -354,12 +354,12 @@ impl IKEV2State { }) { SCLogDebug!("No DH transform found"); - self.set_event(IKEV2Event::WeakCryptoNoDH); + self.set_event(IkeEvent::WeakCryptoNoDH); } // Rule 3: check if proposing AH ([RFC7296] section 3.3.1) if p.protocol_id == ProtocolID::AH { SCLogDebug!("Proposal uses protocol AH - no confidentiality"); - self.set_event(IKEV2Event::NoEncryption); + self.set_event(IkeEvent::NoEncryption); } // Rule 4: lack of integrity is accepted only if using an AEAD proposal // Look if no auth was proposed, including if proposal is Auth::None @@ -378,7 +378,7 @@ impl IKEV2State { } }) { SCLogDebug!("No integrity transform found"); - self.set_event(IKEV2Event::WeakCryptoNoAuth); + self.set_event(IkeEvent::WeakCryptoNoAuth); } } // Finally @@ -402,9 +402,9 @@ impl IKEV2State { } } -impl IKEV2Transaction { - pub fn new(id: u64) -> IKEV2Transaction { - IKEV2Transaction { +impl IKETransaction { + pub fn new(id: u64) -> IKETransaction { + IKETransaction { xid: 0, hdr: IkeV2Header { init_spi: 0, @@ -437,31 +437,31 @@ impl IKEV2Transaction { } } -impl Drop for IKEV2Transaction { +impl Drop for IKETransaction { fn drop(&mut self) { self.free(); } } -/// Returns *mut IKEV2State +/// Returns *mut IKEState #[no_mangle] -pub extern "C" fn rs_ikev2_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void { - let state = IKEV2State::new(); +pub extern "C" fn rs_ike_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void { + let state = IKEState::new(); let boxed = Box::new(state); return unsafe{std::mem::transmute(boxed)}; } /// Params: -/// - state: *mut IKEV2State as void pointer +/// - state: *mut IKEState as void pointer #[no_mangle] -pub extern "C" fn rs_ikev2_state_free(state: *mut std::os::raw::c_void) { +pub extern "C" fn rs_ike_state_free(state: *mut std::os::raw::c_void) { // Just unbox... - let mut ikev2_state: Box = unsafe{std::mem::transmute(state)}; - ikev2_state.free(); + let mut ike_state: Box = unsafe{std::mem::transmute(state)}; + ike_state.free(); } #[no_mangle] -pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow, +pub extern "C" fn rs_ike_parse_request(_flow: *const core::Flow, state: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void, input: *const u8, @@ -469,7 +469,7 @@ pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow, _data: *const std::os::raw::c_void, _flags: u8) -> AppLayerResult { let buf = build_slice!(input,input_len as usize); - let state = cast_pointer!(state,IKEV2State); + let state = cast_pointer!(state,IKEState); if state.parse(buf, STREAM_TOSERVER) < 0 { return AppLayerResult::err(); } @@ -477,7 +477,7 @@ pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow, } #[no_mangle] -pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow, +pub extern "C" fn rs_ike_parse_response(_flow: *const core::Flow, state: *mut std::os::raw::c_void, pstate: *mut std::os::raw::c_void, input: *const u8, @@ -485,9 +485,9 @@ pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow, _data: *const std::os::raw::c_void, _flags: u8) -> AppLayerResult { let buf = build_slice!(input,input_len as usize); - let state = cast_pointer!(state,IKEV2State); + let state = cast_pointer!(state,IKEState); let res = state.parse(buf, STREAM_TOCLIENT); - if state.connection_state == IKEV2ConnectionState::ParsingDone { + if state.connection_state == IKEConnectionState::ParsingDone { unsafe{ AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION | APP_LAYER_PARSER_NO_REASSEMBLY | @@ -501,11 +501,11 @@ pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow, } #[no_mangle] -pub extern "C" fn rs_ikev2_state_get_tx(state: *mut std::os::raw::c_void, +pub extern "C" fn rs_ike_state_get_tx(state: *mut std::os::raw::c_void, tx_id: u64) -> *mut std::os::raw::c_void { - let state = cast_pointer!(state,IKEV2State); + let state = cast_pointer!(state,IKEState); match state.get_tx_by_id(tx_id) { Some(tx) => unsafe{std::mem::transmute(tx)}, None => std::ptr::null_mut(), @@ -513,23 +513,31 @@ pub extern "C" fn rs_ikev2_state_get_tx(state: *mut std::os::raw::c_void, } #[no_mangle] -pub extern "C" fn rs_ikev2_state_get_tx_count(state: *mut std::os::raw::c_void) +pub extern "C" fn rs_ike_state_get_tx_count(state: *mut std::os::raw::c_void) -> u64 { - let state = cast_pointer!(state,IKEV2State); + let state = cast_pointer!(state,IKEState); state.tx_id } #[no_mangle] -pub extern "C" fn rs_ikev2_state_tx_free(state: *mut std::os::raw::c_void, +pub extern "C" fn rs_ike_state_tx_free(state: *mut std::os::raw::c_void, tx_id: u64) { - let state = cast_pointer!(state,IKEV2State); + let state = cast_pointer!(state,IKEState); state.free_tx(tx_id); } #[no_mangle] -pub extern "C" fn rs_ikev2_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void, +pub extern "C" fn rs_ike_state_progress_completion_status( + _direction: u8) + -> std::os::raw::c_int +{ + return 1; +} + +#[no_mangle] +pub extern "C" fn rs_ike_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void, _direction: u8) -> std::os::raw::c_int { @@ -537,21 +545,21 @@ pub extern "C" fn rs_ikev2_tx_get_alstate_progress(_tx: *mut std::os::raw::c_voi } #[no_mangle] -pub extern "C" fn rs_ikev2_state_set_tx_detect_state( +pub extern "C" fn rs_ike_state_set_tx_detect_state( tx: *mut std::os::raw::c_void, de_state: &mut core::DetectEngineState) -> std::os::raw::c_int { - let tx = cast_pointer!(tx,IKEV2Transaction); + let tx = cast_pointer!(tx,IKETransaction); tx.de_state = Some(de_state); 0 } #[no_mangle] -pub extern "C" fn rs_ikev2_state_get_tx_detect_state( +pub extern "C" fn rs_ike_state_get_tx_detect_state( tx: *mut std::os::raw::c_void) -> *mut core::DetectEngineState { - let tx = cast_pointer!(tx,IKEV2Transaction); + let tx = cast_pointer!(tx,IKETransaction); match tx.de_state { Some(ds) => ds, None => std::ptr::null_mut(), @@ -560,31 +568,31 @@ pub extern "C" fn rs_ikev2_state_get_tx_detect_state( #[no_mangle] -pub extern "C" fn rs_ikev2_state_get_events(tx: *mut std::os::raw::c_void) +pub extern "C" fn rs_ike_state_get_events(tx: *mut std::os::raw::c_void) -> *mut core::AppLayerDecoderEvents { - let tx = cast_pointer!(tx, IKEV2Transaction); + let tx = cast_pointer!(tx, IKETransaction); return tx.events; } #[no_mangle] -pub extern "C" fn rs_ikev2_state_get_event_info_by_id(event_id: std::os::raw::c_int, +pub extern "C" fn rs_ike_state_get_event_info_by_id(event_id: std::os::raw::c_int, event_name: *mut *const std::os::raw::c_char, event_type: *mut core::AppLayerEventType) -> i8 { - if let Some(e) = IKEV2Event::from_i32(event_id as i32) { + if let Some(e) = IkeEvent::from_i32(event_id as i32) { let estr = match e { - IKEV2Event::MalformedData => { "malformed_data\0" }, - IKEV2Event::NoEncryption => { "no_encryption\0" }, - IKEV2Event::WeakCryptoEnc => { "weak_crypto_enc\0" }, - IKEV2Event::WeakCryptoPRF => { "weak_crypto_prf\0" }, - IKEV2Event::WeakCryptoDH => { "weak_crypto_dh\0" }, - IKEV2Event::WeakCryptoAuth => { "weak_crypto_auth\0" }, - IKEV2Event::WeakCryptoNoDH => { "weak_crypto_nodh\0" }, - IKEV2Event::WeakCryptoNoAuth => { "weak_crypto_noauth\0" }, - IKEV2Event::InvalidProposal => { "invalid_proposal\0" }, - IKEV2Event::UnknownProposal => { "unknown_proposal\0" }, + IkeEvent::MalformedData => { "malformed_data\0" }, + IkeEvent::NoEncryption => { "no_encryption\0" }, + IkeEvent::WeakCryptoEnc => { "weak_crypto_enc\0" }, + IkeEvent::WeakCryptoPRF => { "weak_crypto_prf\0" }, + IkeEvent::WeakCryptoDH => { "weak_crypto_dh\0" }, + IkeEvent::WeakCryptoAuth => { "weak_crypto_auth\0" }, + IkeEvent::WeakCryptoNoDH => { "weak_crypto_nodh\0" }, + IkeEvent::WeakCryptoNoAuth => { "weak_crypto_noauth\0" }, + IkeEvent::InvalidProposal => { "invalid_proposal\0" }, + IkeEvent::UnknownProposal => { "unknown_proposal\0" }, }; unsafe{ *event_name = estr.as_ptr() as *const std::os::raw::c_char; @@ -597,7 +605,7 @@ pub extern "C" fn rs_ikev2_state_get_event_info_by_id(event_id: std::os::raw::c_ } #[no_mangle] -pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw::c_char, +pub extern "C" fn rs_ike_state_get_event_info(event_name: *const std::os::raw::c_char, event_id: *mut std::os::raw::c_int, event_type: *mut core::AppLayerEventType) -> std::os::raw::c_int @@ -607,16 +615,16 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw: let event = match c_event_name.to_str() { Ok(s) => { match s { - "malformed_data" => IKEV2Event::MalformedData as i32, - "no_encryption" => IKEV2Event::NoEncryption as i32, - "weak_crypto_enc" => IKEV2Event::WeakCryptoEnc as i32, - "weak_crypto_prf" => IKEV2Event::WeakCryptoPRF as i32, - "weak_crypto_auth" => IKEV2Event::WeakCryptoAuth as i32, - "weak_crypto_dh" => IKEV2Event::WeakCryptoDH as i32, - "weak_crypto_nodh" => IKEV2Event::WeakCryptoNoDH as i32, - "weak_crypto_noauth" => IKEV2Event::WeakCryptoNoAuth as i32, - "invalid_proposal" => IKEV2Event::InvalidProposal as i32, - "unknown_proposal" => IKEV2Event::UnknownProposal as i32, + "malformed_data" => IkeEvent::MalformedData as i32, + "no_encryption" => IkeEvent::NoEncryption as i32, + "weak_crypto_enc" => IkeEvent::WeakCryptoEnc as i32, + "weak_crypto_prf" => IkeEvent::WeakCryptoPRF as i32, + "weak_crypto_auth" => IkeEvent::WeakCryptoAuth as i32, + "weak_crypto_dh" => IkeEvent::WeakCryptoDH as i32, + "weak_crypto_nodh" => IkeEvent::WeakCryptoNoDH as i32, + "weak_crypto_noauth" => IkeEvent::WeakCryptoNoAuth as i32, + "invalid_proposal" => IkeEvent::InvalidProposal as i32, + "unknown_proposal" => IkeEvent::UnknownProposal as i32, _ => -1, // unknown event } }, @@ -629,17 +637,16 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw: 0 } - -static mut ALPROTO_IKEV2 : AppProto = ALPROTO_UNKNOWN; +static mut ALPROTO_IKE : AppProto = ALPROTO_UNKNOWN; #[no_mangle] -pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow, +pub extern "C" fn rs_ike_probing_parser(_flow: *const Flow, _direction: u8, input:*const u8, input_len: u32, _rdir: *mut u8) -> AppProto { let slice = build_slice!(input,input_len as usize); - let alproto = unsafe{ ALPROTO_IKEV2 }; + let alproto = unsafe{ ALPROTO_IKE }; match parse_ikev2_header(slice) { Ok((_, ref hdr)) => { if hdr.maj_ver != 2 || hdr.min_ver != 0 { @@ -667,41 +674,41 @@ pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow, } } -export_tx_data_get!(rs_ikev2_get_tx_data, IKEV2Transaction); +export_tx_data_get!(rs_ike_get_tx_data, IKETransaction); -const PARSER_NAME : &'static [u8] = b"ikev2\0"; +const PARSER_NAME : &'static [u8] = b"ike\0"; #[no_mangle] -pub unsafe extern "C" fn rs_register_ikev2_parser() { +pub unsafe extern "C" fn rs_register_ike_parser() { let default_port = CString::new("500").unwrap(); let parser = RustParser { name : PARSER_NAME.as_ptr() as *const std::os::raw::c_char, default_port : default_port.as_ptr(), ipproto : core::IPPROTO_UDP, - probe_ts : Some(rs_ikev2_probing_parser), - probe_tc : Some(rs_ikev2_probing_parser), + probe_ts : Some(rs_ike_probing_parser), + probe_tc : Some(rs_ike_probing_parser), min_depth : 0, max_depth : 16, - state_new : rs_ikev2_state_new, - state_free : rs_ikev2_state_free, - tx_free : rs_ikev2_state_tx_free, - parse_ts : rs_ikev2_parse_request, - parse_tc : rs_ikev2_parse_response, - get_tx_count : rs_ikev2_state_get_tx_count, - get_tx : rs_ikev2_state_get_tx, + state_new : rs_ike_state_new, + state_free : rs_ike_state_free, + tx_free : rs_ike_state_tx_free, + parse_ts : rs_ike_parse_request, + parse_tc : rs_ike_parse_response, + get_tx_count : rs_ike_state_get_tx_count, + get_tx : rs_ike_state_get_tx, tx_comp_st_ts : 1, tx_comp_st_tc : 1, - tx_get_progress : rs_ikev2_tx_get_alstate_progress, - get_de_state : rs_ikev2_state_get_tx_detect_state, - set_de_state : rs_ikev2_state_set_tx_detect_state, - get_events : Some(rs_ikev2_state_get_events), - get_eventinfo : Some(rs_ikev2_state_get_event_info), - get_eventinfo_byid : Some(rs_ikev2_state_get_event_info_by_id), + tx_get_progress : rs_ike_tx_get_alstate_progress, + get_de_state : rs_ike_state_get_tx_detect_state, + set_de_state : rs_ike_state_set_tx_detect_state, + get_events : Some(rs_ike_state_get_events), + get_eventinfo : Some(rs_ike_state_get_event_info), + get_eventinfo_byid : Some(rs_ike_state_get_event_info_by_id), localstorage_new : None, localstorage_free : None, get_files : None, get_tx_iterator : None, - get_tx_data : rs_ikev2_get_tx_data, + get_tx_data : rs_ike_get_tx_data, apply_tx_config : None, flags : APP_LAYER_PARSER_OPT_UNIDIR_TXS, truncate : None, @@ -711,23 +718,23 @@ pub unsafe extern "C" fn rs_register_ikev2_parser() { if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 { let alproto = AppLayerRegisterProtocolDetection(&parser, 1); // store the allocated ID for the probe function - ALPROTO_IKEV2 = alproto; + ALPROTO_IKE = alproto; if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 { let _ = AppLayerRegisterParser(&parser, alproto); } } else { - SCLogDebug!("Protocol detector and parser disabled for IKEV2."); + SCLogDebug!("Protocol detector and parser disabled for IKE."); } } #[cfg(test)] mod tests { - use super::IKEV2State; + use super::IKEState; #[test] - fn test_ikev2_parse_request_valid() { - // A UDP IKEV2 v4 request, in client mode + fn test_ike_parse_request_valid() { + // A UDP IKE v4 request, in client mode const REQ : &[u8] = &[ 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, @@ -737,7 +744,7 @@ mod tests { 0x18, 0x57, 0xab, 0xc3, 0x4a, 0x5f, 0x2c, 0xfe ]; - let mut state = IKEV2State::new(); + let mut state = IKEState::new(); assert_eq!(1, state.parse(REQ, 0)); } } diff --git a/rust/src/ikev2/log.rs b/rust/src/ike/log.rs similarity index 85% rename from rust/src/ikev2/log.rs rename to rust/src/ike/log.rs index 879f58d9d0..d1654e565e 100644 --- a/rust/src/ikev2/log.rs +++ b/rust/src/ike/log.rs @@ -18,12 +18,12 @@ // written by Pierre Chifflier use crate::jsonbuilder::{JsonBuilder, JsonError}; -use crate::ikev2::ikev2::{IKEV2State,IKEV2Transaction}; +use crate::ike::ike::{IKEState,IKETransaction}; -use crate::ikev2::ipsec_parser::IKEV2_FLAG_INITIATOR; +use crate::ike::ipsec_parser::IKEV2_FLAG_INITIATOR; -fn ikev2_log_response(state: &mut IKEV2State, - tx: &mut IKEV2Transaction, +fn ike_log_response(state: &mut IKEState, + tx: &mut IKETransaction, jb: &mut JsonBuilder) -> Result<(), JsonError> { @@ -58,10 +58,10 @@ fn ikev2_log_response(state: &mut IKEV2State, } #[no_mangle] -pub extern "C" fn rs_ikev2_log_json_response(state: &mut IKEV2State, - tx: &mut IKEV2Transaction, +pub extern "C" fn rs_ike_log_json_response(state: &mut IKEState, + tx: &mut IKETransaction, jb: &mut JsonBuilder) -> bool { - ikev2_log_response(state, tx, jb).is_ok() + ike_log_response(state, tx, jb).is_ok() } diff --git a/rust/src/ikev2/mod.rs b/rust/src/ike/mod.rs similarity index 98% rename from rust/src/ikev2/mod.rs rename to rust/src/ike/mod.rs index 6de5b65004..2601e27cbe 100644 --- a/rust/src/ikev2/mod.rs +++ b/rust/src/ike/mod.rs @@ -19,6 +19,6 @@ extern crate ipsec_parser; -pub mod ikev2; +pub mod ike; pub mod state; pub mod log; diff --git a/rust/src/ikev2/state.rs b/rust/src/ike/state.rs similarity index 92% rename from rust/src/ikev2/state.rs rename to rust/src/ike/state.rs index 22f074b05c..282b7fed3a 100644 --- a/rust/src/ikev2/state.rs +++ b/rust/src/ike/state.rs @@ -22,7 +22,7 @@ use self::ipsec_parser::*; #[derive(Clone, Debug, PartialEq)] #[repr(u8)] -pub enum IKEV2ConnectionState { +pub enum IKEConnectionState { Init, InitSASent, InitKESent, @@ -37,9 +37,9 @@ pub enum IKEV2ConnectionState { Invalid, } -impl IKEV2ConnectionState { - pub fn advance(&self, payload: &IkeV2Payload) -> IKEV2ConnectionState { - use self::IKEV2ConnectionState::*; +impl IKEConnectionState { + pub fn advance(&self, payload: &IkeV2Payload) -> IKEConnectionState { + use self::IKEConnectionState::*; match (self, &payload.content) { (&Init, &IkeV2PayloadContent::SA(_)) => InitSASent, (&InitSASent, &IkeV2PayloadContent::KE(_)) => InitKESent, diff --git a/rust/src/lib.rs b/rust/src/lib.rs index 4d054abad1..10ed302d47 100644 --- a/rust/src/lib.rs +++ b/rust/src/lib.rs @@ -67,7 +67,7 @@ pub mod smb; pub mod krb; pub mod dcerpc; -pub mod ikev2; +pub mod ike; pub mod snmp; pub mod ntp; diff --git a/src/Makefile.am b/src/Makefile.am index 04bd251367..a272d0a61e 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -31,7 +31,7 @@ noinst_HEADERS = \ app-layer-htp-mem.h \ app-layer-htp-xff.h \ app-layer-http2.h \ - app-layer-ikev2.h \ + app-layer-ike.h \ app-layer-krb5.h \ app-layer-modbus.h \ app-layer-mqtt.h \ @@ -383,7 +383,7 @@ noinst_HEADERS = \ output-json.h \ output-json-http2.h \ output-json-http.h \ - output-json-ikev2.h \ + output-json-ike.h \ output-json-krb5.h \ output-json-metadata.h \ output-json-mqtt.h \ @@ -605,7 +605,7 @@ libsuricata_c_a_SOURCES = \ app-layer-htp-mem.c \ app-layer-htp-xff.c \ app-layer-http2.c \ - app-layer-ikev2.c \ + app-layer-ike.c \ app-layer-krb5.c \ app-layer-modbus.c \ app-layer-mqtt.c \ @@ -951,7 +951,7 @@ libsuricata_c_a_SOURCES = \ output-json-ftp.c \ output-json-http2.c \ output-json-http.c \ - output-json-ikev2.c \ + output-json-ike.c \ output-json-krb5.c \ output-json-metadata.c \ output-json-mqtt.c \ diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c index 41ff5673d5..3c7f3c95bb 100644 --- a/src/app-layer-detect-proto.c +++ b/src/app-layer-detect-proto.c @@ -890,8 +890,8 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar printf(" alproto: ALPROTO_NTP\n"); else if (pp_pe->alproto == ALPROTO_TFTP) printf(" alproto: ALPROTO_TFTP\n"); - else if (pp_pe->alproto == ALPROTO_IKEV2) - printf(" alproto: ALPROTO_IKEV2\n"); + else if (pp_pe->alproto == ALPROTO_IKE) + printf(" alproto: ALPROTO_IKE\n"); else if (pp_pe->alproto == ALPROTO_KRB5) printf(" alproto: ALPROTO_KRB5\n"); else if (pp_pe->alproto == ALPROTO_DHCP) @@ -967,8 +967,8 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar printf(" alproto: ALPROTO_NTP\n"); else if (pp_pe->alproto == ALPROTO_TFTP) printf(" alproto: ALPROTO_TFTP\n"); - else if (pp_pe->alproto == ALPROTO_IKEV2) - printf(" alproto: ALPROTO_IKEV2\n"); + else if (pp_pe->alproto == ALPROTO_IKE) + printf(" alproto: ALPROTO_IKE\n"); else if (pp_pe->alproto == ALPROTO_KRB5) printf(" alproto: ALPROTO_KRB5\n"); else if (pp_pe->alproto == ALPROTO_DHCP) diff --git a/src/app-layer-ikev2.c b/src/app-layer-ike.c similarity index 86% rename from src/app-layer-ikev2.c rename to src/app-layer-ike.c index bc34d426db..f6a5c19333 100644 --- a/src/app-layer-ikev2.c +++ b/src/app-layer-ike.c @@ -20,7 +20,7 @@ * * \author Pierre Chifflier * - * Parser for IKEv2 application layer running on UDP port 500. + * Parser for IKE application layer running on UDP port 500. */ #include "suricata-common.h" @@ -32,10 +32,10 @@ #include "app-layer-detect-proto.h" #include "app-layer-parser.h" -#include "app-layer-ikev2.h" +#include "app-layer-ike.h" #include "rust.h" -void RegisterIKEV2Parsers(void) +void RegisterIKEParsers(void) { - rs_register_ikev2_parser(); + rs_register_ike_parser(); } diff --git a/src/app-layer-ikev2.h b/src/app-layer-ike.h similarity index 78% rename from src/app-layer-ikev2.h rename to src/app-layer-ike.h index ea64d6bf75..d8eff7a5c0 100644 --- a/src/app-layer-ikev2.h +++ b/src/app-layer-ike.h @@ -21,13 +21,13 @@ * \author Pierre Chifflier */ -#ifndef __APP_LAYER_IKEV2_H__ -#define __APP_LAYER_IKEV2_H__ +#ifndef __APP_LAYER_IKE_H__ +#define __APP_LAYER_IKE_H__ -void RegisterIKEV2Parsers(void); +void RegisterIKEParsers(void); /** Opaque Rust types. */ -typedef struct IKEV2State_ IKEV2State; -typedef struct IKEV2Transaction_ IKEV2Transaction; +typedef struct IKEState_ IKEState; +typedef struct IKETransaction_ IKETransaction; -#endif /* __APP_LAYER_IKEV2_H__ */ +#endif /* __APP_LAYER_IKE_H__ */ diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index cf17f012c2..5545568817 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -61,7 +61,7 @@ #include "app-layer-nfs-udp.h" #include "app-layer-ntp.h" #include "app-layer-tftp.h" -#include "app-layer-ikev2.h" +#include "app-layer-ike.h" #include "app-layer-krb5.h" #include "app-layer-snmp.h" #include "app-layer-sip.h" @@ -1629,7 +1629,7 @@ void AppLayerParserRegisterProtocolParsers(void) RegisterNFSUDPParsers(); RegisterNTPParsers(); RegisterTFTPParsers(); - RegisterIKEV2Parsers(); + RegisterIKEParsers(); RegisterKRB5Parsers(); rs_dhcp_register_parser(); RegisterSNMPParsers(); diff --git a/src/app-layer-protos.c b/src/app-layer-protos.c index f554bf5740..cd5df04faf 100644 --- a/src/app-layer-protos.c +++ b/src/app-layer-protos.c @@ -87,8 +87,8 @@ const char *AppProtoToString(AppProto alproto) case ALPROTO_TFTP: proto_name = "tftp"; break; - case ALPROTO_IKEV2: - proto_name = "ikev2"; + case ALPROTO_IKE: + proto_name = "ike"; break; case ALPROTO_KRB5: proto_name = "krb5"; @@ -162,7 +162,8 @@ AppProto StringToAppProto(const char *proto_name) if (strcmp(proto_name,"dnp3")==0) return ALPROTO_DNP3; if (strcmp(proto_name,"nfs")==0) return ALPROTO_NFS; if (strcmp(proto_name,"ntp")==0) return ALPROTO_NTP; - if (strcmp(proto_name,"ikev2")==0) return ALPROTO_IKEV2; + if (strcmp(proto_name, "ike") == 0) + return ALPROTO_IKE; if (strcmp(proto_name,"krb5")==0) return ALPROTO_KRB5; if (strcmp(proto_name,"dhcp")==0) return ALPROTO_DHCP; if (strcmp(proto_name,"snmp")==0) return ALPROTO_SNMP; diff --git a/src/app-layer-protos.h b/src/app-layer-protos.h index 29e21b0226..b84698a1ba 100644 --- a/src/app-layer-protos.h +++ b/src/app-layer-protos.h @@ -46,7 +46,7 @@ enum AppProtoEnum { ALPROTO_NTP, ALPROTO_FTPDATA, ALPROTO_TFTP, - ALPROTO_IKEV2, + ALPROTO_IKE, ALPROTO_KRB5, ALPROTO_DHCP, ALPROTO_SNMP, diff --git a/src/output-json-ikev2.c b/src/output-json-ike.c similarity index 56% rename from src/output-json-ikev2.c rename to src/output-json-ike.c index 3b4577ee62..adba6d7a47 100644 --- a/src/output-json-ikev2.c +++ b/src/output-json-ike.c @@ -20,7 +20,7 @@ * * \author Pierre Chifflier * - * Implement JSON/eve logging app-layer IKEv2. + * Implement JSON/eve logging app-layer IKE. */ #include "suricata-common.h" @@ -44,37 +44,37 @@ #include "app-layer.h" #include "app-layer-parser.h" -#include "app-layer-ikev2.h" -#include "output-json-ikev2.h" +#include "app-layer-ike.h" +#include "output-json-ike.h" #include "rust.h" -typedef struct LogIKEv2FileCtx_ { +typedef struct LogIKEFileCtx_ { LogFileCtx *file_ctx; OutputJsonCommonSettings cfg; -} LogIKEv2FileCtx; +} LogIKEFileCtx; -typedef struct LogIKEv2LogThread_ { +typedef struct LogIKELogThread_ { LogFileCtx *file_ctx; - LogIKEv2FileCtx *ikev2log_ctx; - MemBuffer *buffer; -} LogIKEv2LogThread; + LogIKEFileCtx *ikelog_ctx; + MemBuffer *buffer; +} LogIKELogThread; -static int JsonIKEv2Logger(ThreadVars *tv, void *thread_data, - const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) +static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, + void *tx, uint64_t tx_id) { - IKEV2Transaction *ikev2tx = tx; - LogIKEv2LogThread *thread = thread_data; + IKETransaction *iketx = tx; + LogIKELogThread *thread = thread_data; - JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ikev2", NULL); + JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ike", NULL); if (unlikely(jb == NULL)) { return TM_ECODE_FAILED; } - EveAddCommonOptions(&thread->ikev2log_ctx->cfg, p, f, jb); + EveAddCommonOptions(&thread->ikelog_ctx->cfg, p, f, jb); - jb_open_object(jb, "ikev2"); - if (unlikely(!rs_ikev2_log_json_response(state, ikev2tx, jb))) { + jb_open_object(jb, "ike"); + if (unlikely(!rs_ike_log_json_response(state, iketx, jb))) { goto error; } jb_close(jb); @@ -90,52 +90,51 @@ error: return TM_ECODE_FAILED; } -static void OutputIKEv2LogDeInitCtxSub(OutputCtx *output_ctx) +static void OutputIKELogDeInitCtxSub(OutputCtx *output_ctx) { - LogIKEv2FileCtx *ikev2log_ctx = (LogIKEv2FileCtx *)output_ctx->data; - SCFree(ikev2log_ctx); + LogIKEFileCtx *ikelog_ctx = (LogIKEFileCtx *)output_ctx->data; + SCFree(ikelog_ctx); SCFree(output_ctx); } -static OutputInitResult OutputIKEv2LogInitSub(ConfNode *conf, - OutputCtx *parent_ctx) +static OutputInitResult OutputIKELogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { OutputInitResult result = { NULL, false }; OutputJsonCtx *ajt = parent_ctx->data; - LogIKEv2FileCtx *ikev2log_ctx = SCCalloc(1, sizeof(*ikev2log_ctx)); - if (unlikely(ikev2log_ctx == NULL)) { + LogIKEFileCtx *ikelog_ctx = SCCalloc(1, sizeof(*ikelog_ctx)); + if (unlikely(ikelog_ctx == NULL)) { return result; } - ikev2log_ctx->file_ctx = ajt->file_ctx; - ikev2log_ctx->cfg = ajt->cfg; + ikelog_ctx->file_ctx = ajt->file_ctx; + ikelog_ctx->cfg = ajt->cfg; OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); if (unlikely(output_ctx == NULL)) { - SCFree(ikev2log_ctx); + SCFree(ikelog_ctx); return result; } - output_ctx->data = ikev2log_ctx; - output_ctx->DeInit = OutputIKEv2LogDeInitCtxSub; + output_ctx->data = ikelog_ctx; + output_ctx->DeInit = OutputIKELogDeInitCtxSub; - SCLogDebug("IKEv2 log sub-module initialized."); + SCLogDebug("IKE log sub-module initialized."); - AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_IKEV2); + AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_IKE); result.ctx = output_ctx; result.ok = true; return result; } -static TmEcode JsonIKEv2LogThreadInit(ThreadVars *t, const void *initdata, void **data) +static TmEcode JsonIKELogThreadInit(ThreadVars *t, const void *initdata, void **data) { - LogIKEv2LogThread *thread = SCCalloc(1, sizeof(*thread)); + LogIKELogThread *thread = SCCalloc(1, sizeof(*thread)); if (unlikely(thread == NULL)) { return TM_ECODE_FAILED; } if (initdata == NULL) { - SCLogDebug("Error getting context for EveLogIKEv2. \"initdata\" is NULL."); + SCLogDebug("Error getting context for EveLogIKE. \"initdata\" is NULL."); goto error_exit; } @@ -144,8 +143,8 @@ static TmEcode JsonIKEv2LogThreadInit(ThreadVars *t, const void *initdata, void goto error_exit; } - thread->ikev2log_ctx = ((OutputCtx *)initdata)->data; - thread->file_ctx = LogFileEnsureExists(thread->ikev2log_ctx->file_ctx, t->id); + thread->ikelog_ctx = ((OutputCtx *)initdata)->data; + thread->file_ctx = LogFileEnsureExists(thread->ikelog_ctx->file_ctx, t->id); if (!thread->file_ctx) { goto error_exit; } @@ -161,9 +160,9 @@ error_exit: return TM_ECODE_FAILED; } -static TmEcode JsonIKEv2LogThreadDeinit(ThreadVars *t, void *data) +static TmEcode JsonIKELogThreadDeinit(ThreadVars *t, void *data) { - LogIKEv2LogThread *thread = (LogIKEv2LogThread *)data; + LogIKELogThread *thread = (LogIKELogThread *)data; if (thread == NULL) { return TM_ECODE_OK; } @@ -174,13 +173,12 @@ static TmEcode JsonIKEv2LogThreadDeinit(ThreadVars *t, void *data) return TM_ECODE_OK; } -void JsonIKEv2LogRegister(void) +void JsonIKELogRegister(void) { /* Register as an eve sub-module. */ - OutputRegisterTxSubModule(LOGGER_JSON_IKEV2, "eve-log", "JsonIKEv2Log", - "eve-log.ikev2", OutputIKEv2LogInitSub, ALPROTO_IKEV2, - JsonIKEv2Logger, JsonIKEv2LogThreadInit, - JsonIKEv2LogThreadDeinit, NULL); + OutputRegisterTxSubModule(LOGGER_JSON_IKE, "eve-log", "JsonIKELog", "eve-log.ike", + OutputIKELogInitSub, ALPROTO_IKE, JsonIKELogger, JsonIKELogThreadInit, + JsonIKELogThreadDeinit, NULL); - SCLogDebug("IKEv2 JSON logger registered."); + SCLogDebug("IKE JSON logger registered."); } diff --git a/src/output-json-ikev2.h b/src/output-json-ike.h similarity index 85% rename from src/output-json-ikev2.h rename to src/output-json-ike.h index 2f54860e66..d02c89608e 100644 --- a/src/output-json-ikev2.h +++ b/src/output-json-ike.h @@ -21,9 +21,9 @@ * \author Pierre Chifflier */ -#ifndef __OUTPUT_JSON_IKEV2_H__ -#define __OUTPUT_JSON_IKEV2_H__ +#ifndef __OUTPUT_JSON_IKE_H__ +#define __OUTPUT_JSON_IKE_H__ -void JsonIKEv2LogRegister(void); +void JsonIKELogRegister(void); -#endif /* __OUTPUT_JSON_IKEV2_H__ */ +#endif /* __OUTPUT_JSON_IKE_H__ */ diff --git a/src/output.c b/src/output.c index ca6f538505..a58ac7ab74 100644 --- a/src/output.c +++ b/src/output.c @@ -69,7 +69,7 @@ #include "output-json-ftp.h" #include "output-json-tftp.h" #include "output-json-smb.h" -#include "output-json-ikev2.h" +#include "output-json-ike.h" #include "output-json-krb5.h" #include "output-json-dhcp.h" #include "output-json-snmp.h" @@ -1096,8 +1096,8 @@ void OutputRegisterLoggers(void) JsonFTPLogRegister(); /* SMB JSON logger. */ JsonSMBLogRegister(); - /* IKEv2 JSON logger. */ - JsonIKEv2LogRegister(); + /* IKE JSON logger. */ + JsonIKELogRegister(); /* KRB5 JSON logger. */ JsonKRB5LogRegister(); /* DHCP JSON logger. */ diff --git a/src/rust-context.h b/src/rust-context.h index e9ebad210f..4c07423aa2 100644 --- a/src/rust-context.h +++ b/src/rust-context.h @@ -20,7 +20,7 @@ #include "detect-engine-state.h" //DetectEngineState #include "app-layer-krb5.h" //KRB5State, KRB5Transaction -#include "app-layer-ikev2.h" //IKEV2State, IKEV2Transaction +#include "app-layer-ike.h" //IKEState, IKETransaction #include "app-layer-ntp.h" //NTPState, NTPTransaction #include "app-layer-snmp.h" //SNMPState, SNMPTransaction #include "app-layer-tftp.h" //TFTPState, TFTPTransaction diff --git a/src/suricata-common.h b/src/suricata-common.h index 160cde8173..56baedac56 100644 --- a/src/suricata-common.h +++ b/src/suricata-common.h @@ -454,7 +454,7 @@ typedef enum { LOGGER_JSON_DNP3_TC, LOGGER_JSON_SSH, LOGGER_JSON_SMB, - LOGGER_JSON_IKEV2, + LOGGER_JSON_IKE, LOGGER_JSON_KRB5, LOGGER_JSON_DHCP, LOGGER_JSON_SNMP, diff --git a/src/tests/fuzz/confyaml.c b/src/tests/fuzz/confyaml.c index c558b3d0c4..0eee2a5873 100644 --- a/src/tests/fuzz/confyaml.c +++ b/src/tests/fuzz/confyaml.c @@ -53,7 +53,7 @@ outputs:\n\ - nfs\n\ - smb\n\ - tftp\n\ - - ikev2\n\ + - ike\n\ - krb5\n\ - snmp\n\ - rfb\n\ diff --git a/src/util-profiling.c b/src/util-profiling.c index cc6d5c0856..7967e98d75 100644 --- a/src/util-profiling.c +++ b/src/util-profiling.c @@ -1309,7 +1309,7 @@ const char * PacketProfileLoggertIdToString(LoggerId id) CASE_CODE (LOGGER_JSON_HTTP); CASE_CODE (LOGGER_JSON_DHCP); CASE_CODE (LOGGER_JSON_KRB5); - CASE_CODE (LOGGER_JSON_IKEV2); + CASE_CODE(LOGGER_JSON_IKE); CASE_CODE (LOGGER_JSON_FTP); CASE_CODE (LOGGER_JSON_TFTP); CASE_CODE (LOGGER_JSON_SMTP); diff --git a/suricata.yaml.in b/suricata.yaml.in index 728d3e340f..657c29fa2a 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -266,7 +266,7 @@ outputs: - nfs - smb - tftp - - ikev2 + - ike - dcerpc - krb5 - snmp @@ -726,7 +726,7 @@ app-layer: enabled: yes snmp: enabled: yes - ikev2: + ike: enabled: yes tls: enabled: yes