aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ikev1: rename ikev2 to common ike

Browse Source 
Renaming was done with shell commands, git mv for moving the files and content like
find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
pull/5961/head
frank honza 5 years ago committed by Victor Julien
parent ab6171c429
commit ecdf9f6b0b
24 changed files with 247 additions and 241 deletions
Show Stats Download Patch File Download Diff File

4
doc/userguide/partials/eve-log.yaml
Unescape Escape View File

@ -160,8 +160,8 @@ outputs:
# NFS logging. Requires Rust. # NFS logging. Requires Rust.
- nfs - nfs
# IKEv2 logging. Requires Rust. # IKE logging. Requires Rust.
- ikev2 - ike
- ssh - ssh
- stats: - stats:
totals: yes # stats for all threads merged together totals: yes # stats for all threads merged together

2
doc/userguide/rules/intro.rst
Unescape Escape View File

@ -89,7 +89,7 @@ you can pick from. These are:
* dnp3 (disabled by default) * dnp3 (disabled by default)
* enip (disabled by default) * enip (disabled by default)
* nfs * nfs
* ikev2 * ike
* krb5 * krb5
* ntp * ntp
* dhcp * dhcp

26
rules/ipsec-events.rules
Unescape Escape View File

@ -4,16 +4,16 @@
# #
# These sigs fire at most once per connection. # These sigs fire at most once per connection.
# #
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 malformed request data"; flow:to_server; app-layer-event:ikev2.malformed_data; classtype:protocol-command-decode; sid:2224000; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE malformed request data"; flow:to_server; app-layer-event:ike.malformed_data; classtype:protocol-command-decode; sid:2224000; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 malformed response data"; flow:to_client; app-layer-event:ikev2.malformed_data; classtype:protocol-command-decode; sid:2224001; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE malformed response data"; flow:to_client; app-layer-event:ike.malformed_data; classtype:protocol-command-decode; sid:2224001; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Encryption)"; flow:to_client; app-layer-event:ikev2.weak_crypto_enc; classtype:protocol-command-decode; sid:2224002; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Encryption)"; flow:to_client; app-layer-event:ike.weak_crypto_enc; classtype:protocol-command-decode; sid:2224002; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (PRF)"; flow:to_client; app-layer-event:ikev2.weak_crypto_prf; classtype:protocol-command-decode; sid:2224003; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (PRF)"; flow:to_client; app-layer-event:ike.weak_crypto_prf; classtype:protocol-command-decode; sid:2224003; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Auth)"; flow:to_client; app-layer-event:ikev2.weak_crypto_auth; classtype:protocol-command-decode; sid:2224004; rev:2;) alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Auth)"; flow:to_client; app-layer-event:ike.weak_crypto_auth; classtype:protocol-command-decode; sid:2224004; rev:3;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman)"; flow:to_client; app-layer-event:ikev2.weak_crypto_dh; classtype:protocol-command-decode; sid:2224005; rev:2;) alert ike any any -> any any (msg:"SURICATA IKE weak cryptographic parameters (Diffie-Hellman)"; flow:to_client; app-layer-event:ike.weak_crypto_dh; classtype:protocol-command-decode; sid:2224005; rev:3;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no Diffie-Hellman exchange parameters"; flow:to_client; app-layer-event:ikev2.weak_crypto_nodh; classtype:protocol-command-decode; sid:2224006; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE no Diffie-Hellman exchange parameters"; flow:to_client; app-layer-event:ike.weak_crypto_nodh; classtype:protocol-command-decode; sid:2224006; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no authentication"; flow:to_client; app-layer-event:ikev2.weak_crypto_noauth; classtype:protocol-command-decode; sid:2224007; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE no authentication"; flow:to_client; app-layer-event:ike.weak_crypto_noauth; classtype:protocol-command-decode; sid:2224007; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 no encryption (AH)"; flow:to_client; app-layer-event:ikev2.no_encryption; classtype:protocol-command-decode; sid:2224008; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE no encryption (AH)"; flow:to_client; app-layer-event:ike.no_encryption; classtype:protocol-command-decode; sid:2224008; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 invalid proposal"; flow:to_server; app-layer-event:ikev2.invalid_proposal; classtype:protocol-command-decode; sid:2224009; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE invalid proposal"; flow:to_server; app-layer-event:ike.invalid_proposal; classtype:protocol-command-decode; sid:2224009; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 invalid proposal selected"; flow:to_client; app-layer-event:ikev2.invalid_proposal; classtype:protocol-command-decode; sid:2224010; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE invalid proposal selected"; flow:to_client; app-layer-event:ike.invalid_proposal; classtype:protocol-command-decode; sid:2224010; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 unknown proposal"; flow:to_server; app-layer-event:ikev2.unknown_proposal; classtype:protocol-command-decode; sid:2224011; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE unknown proposal"; flow:to_server; app-layer-event:ike.unknown_proposal; classtype:protocol-command-decode; sid:2224011; rev:2;)
alert ikev2 any any -> any any (msg:"SURICATA IKEv2 unknown proposal selected"; flow:to_client; app-layer-event:ikev2.unknown_proposal; classtype:protocol-command-decode; sid:2224012; rev:1;) alert ike any any -> any any (msg:"SURICATA IKE unknown proposal selected"; flow:to_client; app-layer-event:ike.unknown_proposal; classtype:protocol-command-decode; sid:2224012; rev:2;)

4
rust/cbindgen.toml
Unescape Escape View File

@ -88,8 +88,8 @@ exclude = [
"Flow", "Flow",
"FileContainer", "FileContainer",
"JsonT", "JsonT",
"IKEV2State", "IKEState",
"IKEV2Transaction", "IKETransaction",
"KRB5State", "KRB5State",
"KRB5Transaction", "KRB5Transaction",
"NTPState", "NTPState",

265
rust/src/ikev2/ikev2.rs → rust/src/ike/ike.rs
Unescape Escape View File

@ -17,8 +17,8 @@
// written by Pierre Chifflier <chifflier@wzdftpd.net> // written by Pierre Chifflier <chifflier@wzdftpd.net>
use crate::ikev2::ipsec_parser::*; use crate::ike::ipsec_parser::*;
use crate::ikev2::state::IKEV2ConnectionState; use crate::ike::state::IKEConnectionState;
use crate::core; use crate::core;
use crate::core::{AppProto,Flow,ALPROTO_UNKNOWN,ALPROTO_FAILED,STREAM_TOSERVER,STREAM_TOCLIENT}; use crate::core::{AppProto,Flow,ALPROTO_UNKNOWN,ALPROTO_FAILED,STREAM_TOSERVER,STREAM_TOCLIENT};
use crate::applayer::{self, *}; use crate::applayer::{self, *};
@ -28,7 +28,7 @@ use std::ffi::{CStr,CString};
use nom; use nom;
#[repr(u32)] #[repr(u32)]
pub enum IKEV2Event { pub enum IkeEvent {
MalformedData = 0, MalformedData = 0,
NoEncryption, NoEncryption,
WeakCryptoEnc, WeakCryptoEnc,
@ -41,33 +41,33 @@ pub enum IKEV2Event {
UnknownProposal, UnknownProposal,
} }
impl IKEV2Event { impl IkeEvent {
fn from_i32(value: i32) -> Option<IKEV2Event> { fn from_i32(value: i32) -> Option<IkeEvent> {
match value { match value {
0 => Some(IKEV2Event::MalformedData), 0 => Some(IkeEvent::MalformedData),
1 => Some(IKEV2Event::NoEncryption), 1 => Some(IkeEvent::NoEncryption),
2 => Some(IKEV2Event::WeakCryptoEnc), 2 => Some(IkeEvent::WeakCryptoEnc),
3 => Some(IKEV2Event::WeakCryptoPRF), 3 => Some(IkeEvent::WeakCryptoPRF),
4 => Some(IKEV2Event::WeakCryptoDH), 4 => Some(IkeEvent::WeakCryptoDH),
5 => Some(IKEV2Event::WeakCryptoAuth), 5 => Some(IkeEvent::WeakCryptoAuth),
6 => Some(IKEV2Event::WeakCryptoNoDH), 6 => Some(IkeEvent::WeakCryptoNoDH),
7 => Some(IKEV2Event::WeakCryptoNoAuth), 7 => Some(IkeEvent::WeakCryptoNoAuth),
8 => Some(IKEV2Event::InvalidProposal), 8 => Some(IkeEvent::InvalidProposal),
9 => Some(IKEV2Event::UnknownProposal), 9 => Some(IkeEvent::UnknownProposal),
_ => None, _ => None,
} }
} }
} }
pub struct IKEV2State { pub struct IKEState {
/// List of transactions for this session /// List of transactions for this session
transactions: Vec<IKEV2Transaction>, transactions: Vec<IKETransaction>,
/// tx counter for assigning incrementing id's to tx's /// tx counter for assigning incrementing id's to tx's
tx_id: u64, tx_id: u64,
/// The connection state /// The connection state
connection_state: IKEV2ConnectionState, connection_state: IKEConnectionState,
/// The transforms proposed by the initiator /// The transforms proposed by the initiator
pub client_transforms : Vec<Vec<IkeV2Transform>>, pub client_transforms : Vec<Vec<IkeV2Transform>>,
@ -92,8 +92,8 @@ pub struct IKEV2State {
} }
#[derive(Debug)] #[derive(Debug)]
pub struct IKEV2Transaction { pub struct IKETransaction {
/// The IKEV2 reference ID /// The IKE reference ID
pub xid: u64, pub xid: u64,
pub hdr: IkeV2Header, pub hdr: IkeV2Header,
@ -118,12 +118,12 @@ pub struct IKEV2Transaction {
impl IKEV2State { impl IKEState {
pub fn new() -> IKEV2State { pub fn new() -> IKEState {
IKEV2State{ IKEState{
transactions: Vec::new(), transactions: Vec::new(),
tx_id: 0, tx_id: 0,
connection_state: IKEV2ConnectionState::Init, connection_state: IKEConnectionState::Init,
dh_group: IkeTransformDHType::None, dh_group: IkeTransformDHType::None,
client_transforms: Vec::new(), client_transforms: Vec::new(),
server_transforms: Vec::new(), server_transforms: Vec::new(),
@ -136,8 +136,8 @@ impl IKEV2State {
} }
} }
impl IKEV2State { impl IKEState {
/// Parse an IKEV2 request message /// Parse an IKE request message
/// ///
/// Returns The number of messages parsed, or -1 on error /// Returns The number of messages parsed, or -1 on error
fn parse(&mut self, i: &[u8], direction: u8) -> i32 { fn parse(&mut self, i: &[u8], direction: u8) -> i32 {
@ -148,11 +148,11 @@ impl IKEV2State {
} }
// Rule 0: check version // Rule 0: check version
if hdr.maj_ver != 2 || hdr.min_ver != 0 { if hdr.maj_ver != 2 || hdr.min_ver != 0 {
self.set_event(IKEV2Event::MalformedData); self.set_event(IkeEvent::MalformedData);
return -1; return -1;
} }
if hdr.init_spi == 0 { if hdr.init_spi == 0 {
self.set_event(IKEV2Event::MalformedData); self.set_event(IkeEvent::MalformedData);
return -1; return -1;
} }
// only analyse IKE_SA, other payloads are encrypted // only analyse IKE_SA, other payloads are encrypted
@ -174,7 +174,7 @@ impl IKEV2State {
match payload.content { match payload.content {
IkeV2PayloadContent::Dummy => (), IkeV2PayloadContent::Dummy => (),
IkeV2PayloadContent::SA(ref prop) => { IkeV2PayloadContent::SA(ref prop) => {
// if hdr.flags & IKEV2_FLAG_INITIATOR != 0 { // if hdr.flags & IKE_FLAG_INITIATOR != 0 {
self.add_proposals(prop, direction); self.add_proposals(prop, direction);
// } // }
}, },
@ -213,18 +213,18 @@ impl IKEV2State {
} }
}; };
}, },
e => { SCLogDebug!("parse_ikev2_payload_with_type: {:?}",e); () }, e => { SCLogDebug!("parse_ike_payload_with_type: {:?}",e); () },
} }
1 1
}, },
Err(nom::Err::Incomplete(_)) => { Err(nom::Err::Incomplete(_)) => {
SCLogDebug!("Insufficient data while parsing IKEV2 data"); SCLogDebug!("Insufficient data while parsing IKE data");
self.set_event(IKEV2Event::MalformedData); self.set_event(IkeEvent::MalformedData);
-1 -1
}, },
Err(_) => { Err(_) => {
SCLogDebug!("Error while parsing IKEV2 data"); SCLogDebug!("Error while parsing IKE data");
self.set_event(IKEV2Event::MalformedData); self.set_event(IkeEvent::MalformedData);
-1 -1
}, },
} }
@ -236,12 +236,12 @@ impl IKEV2State {
self.transactions.clear(); self.transactions.clear();
} }
fn new_tx(&mut self) -> IKEV2Transaction { fn new_tx(&mut self) -> IKETransaction {
self.tx_id += 1; self.tx_id += 1;
IKEV2Transaction::new(self.tx_id) IKETransaction::new(self.tx_id)
} }
fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&IKEV2Transaction> { fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&IKETransaction> {
self.transactions.iter().find(|&tx| tx.id == tx_id + 1) self.transactions.iter().find(|&tx| tx.id == tx_id + 1)
} }
@ -254,7 +254,7 @@ impl IKEV2State {
} }
/// Set an event. The event is set on the most recent transaction. /// Set an event. The event is set on the most recent transaction.
fn set_event(&mut self, event: IKEV2Event) { fn set_event(&mut self, event: IkeEvent) {
if let Some(tx) = self.transactions.last_mut() { if let Some(tx) = self.transactions.last_mut() {
let ev = event as u8; let ev = event as u8;
core::sc_app_layer_decoder_events_set_event_raw(&mut tx.events, ev); core::sc_app_layer_decoder_events_set_event_raw(&mut tx.events, ev);
@ -283,7 +283,7 @@ impl IKEV2State {
IkeTransformEncType::ENCR_NULL => { IkeTransformEncType::ENCR_NULL => {
SCLogDebug!("Weak Encryption: {:?}", enc); SCLogDebug!("Weak Encryption: {:?}", enc);
// XXX send event only if direction == STREAM_TOCLIENT ? // XXX send event only if direction == STREAM_TOCLIENT ?
self.set_event(IKEV2Event::WeakCryptoEnc); self.set_event(IkeEvent::WeakCryptoEnc);
}, },
_ => (), _ => (),
} }
@ -292,12 +292,12 @@ impl IKEV2State {
match *prf { match *prf {
IkeTransformPRFType::PRF_NULL => { IkeTransformPRFType::PRF_NULL => {
SCLogDebug!("'Null' PRF transform proposed"); SCLogDebug!("'Null' PRF transform proposed");
self.set_event(IKEV2Event::InvalidProposal); self.set_event(IkeEvent::InvalidProposal);
}, },
IkeTransformPRFType::PRF_HMAC_MD5 | IkeTransformPRFType::PRF_HMAC_MD5 |
IkeTransformPRFType::PRF_HMAC_SHA1 => { IkeTransformPRFType::PRF_HMAC_SHA1 => {
SCLogDebug!("Weak PRF: {:?}", prf); SCLogDebug!("Weak PRF: {:?}", prf);
self.set_event(IKEV2Event::WeakCryptoPRF); self.set_event(IkeEvent::WeakCryptoPRF);
}, },
_ => (), _ => (),
} }
@ -317,7 +317,7 @@ impl IKEV2State {
IkeTransformAuthType::AUTH_HMAC_MD5_128 | IkeTransformAuthType::AUTH_HMAC_MD5_128 |
IkeTransformAuthType::AUTH_HMAC_SHA1_160 => { IkeTransformAuthType::AUTH_HMAC_SHA1_160 => {
SCLogDebug!("Weak auth: {:?}", auth); SCLogDebug!("Weak auth: {:?}", auth);
self.set_event(IKEV2Event::WeakCryptoAuth); self.set_event(IkeEvent::WeakCryptoAuth);
}, },
_ => (), _ => (),
} }
@ -326,21 +326,21 @@ impl IKEV2State {
match *dh { match *dh {
IkeTransformDHType::None => { IkeTransformDHType::None => {
SCLogDebug!("'None' DH transform proposed"); SCLogDebug!("'None' DH transform proposed");
self.set_event(IKEV2Event::InvalidProposal); self.set_event(IkeEvent::InvalidProposal);
}, },
IkeTransformDHType::Modp768 | IkeTransformDHType::Modp768 |
IkeTransformDHType::Modp1024 | IkeTransformDHType::Modp1024 |
IkeTransformDHType::Modp1024s160 | IkeTransformDHType::Modp1024s160 |
IkeTransformDHType::Modp1536 => { IkeTransformDHType::Modp1536 => {
SCLogDebug!("Weak DH: {:?}", dh); SCLogDebug!("Weak DH: {:?}", dh);
self.set_event(IKEV2Event::WeakCryptoDH); self.set_event(IkeEvent::WeakCryptoDH);
}, },
_ => (), _ => (),
} }
}, },
IkeV2Transform::Unknown(tx_type,tx_id) => { IkeV2Transform::Unknown(tx_type,tx_id) => {
SCLogDebug!("Unknown proposal: type={:?}, id={}", tx_type, tx_id); SCLogDebug!("Unknown proposal: type={:?}, id={}", tx_type, tx_id);
self.set_event(IKEV2Event::UnknownProposal); self.set_event(IkeEvent::UnknownProposal);
}, },
_ => (), _ => (),
} }
@ -354,12 +354,12 @@ impl IKEV2State {
}) })
{ {
SCLogDebug!("No DH transform found"); SCLogDebug!("No DH transform found");
self.set_event(IKEV2Event::WeakCryptoNoDH); self.set_event(IkeEvent::WeakCryptoNoDH);
} }
// Rule 3: check if proposing AH ([RFC7296] section 3.3.1) // Rule 3: check if proposing AH ([RFC7296] section 3.3.1)
if p.protocol_id == ProtocolID::AH { if p.protocol_id == ProtocolID::AH {
SCLogDebug!("Proposal uses protocol AH - no confidentiality"); SCLogDebug!("Proposal uses protocol AH - no confidentiality");
self.set_event(IKEV2Event::NoEncryption); self.set_event(IkeEvent::NoEncryption);
} }
// Rule 4: lack of integrity is accepted only if using an AEAD proposal // Rule 4: lack of integrity is accepted only if using an AEAD proposal
// Look if no auth was proposed, including if proposal is Auth::None // Look if no auth was proposed, including if proposal is Auth::None
@ -378,7 +378,7 @@ impl IKEV2State {
} }
}) { }) {
SCLogDebug!("No integrity transform found"); SCLogDebug!("No integrity transform found");
self.set_event(IKEV2Event::WeakCryptoNoAuth); self.set_event(IkeEvent::WeakCryptoNoAuth);
} }
} }
// Finally // Finally
@ -402,9 +402,9 @@ impl IKEV2State {
} }
} }
impl IKEV2Transaction { impl IKETransaction {
pub fn new(id: u64) -> IKEV2Transaction { pub fn new(id: u64) -> IKETransaction {
IKEV2Transaction { IKETransaction {
xid: 0, xid: 0,
hdr: IkeV2Header { hdr: IkeV2Header {
init_spi: 0, init_spi: 0,
@ -437,31 +437,31 @@ impl IKEV2Transaction {
} }
} }
impl Drop for IKEV2Transaction { impl Drop for IKETransaction {
fn drop(&mut self) { fn drop(&mut self) {
self.free(); self.free();
} }
} }
/// Returns *mut IKEV2State /// Returns *mut IKEState
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void { pub extern "C" fn rs_ike_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void {
let state = IKEV2State::new(); let state = IKEState::new();
let boxed = Box::new(state); let boxed = Box::new(state);
return unsafe{std::mem::transmute(boxed)}; return unsafe{std::mem::transmute(boxed)};
} }
/// Params: /// Params:
/// - state: *mut IKEV2State as void pointer /// - state: *mut IKEState as void pointer
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_free(state: *mut std::os::raw::c_void) { pub extern "C" fn rs_ike_state_free(state: *mut std::os::raw::c_void) {
// Just unbox... // Just unbox...
let mut ikev2_state: Box<IKEV2State> = unsafe{std::mem::transmute(state)}; let mut ike_state: Box<IKEState> = unsafe{std::mem::transmute(state)};
ikev2_state.free(); ike_state.free();
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow, pub extern "C" fn rs_ike_parse_request(_flow: *const core::Flow,
state: *mut std::os::raw::c_void, state: *mut std::os::raw::c_void,
_pstate: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void,
input: *const u8, input: *const u8,
@ -469,7 +469,7 @@ pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow,
_data: *const std::os::raw::c_void, _data: *const std::os::raw::c_void,
_flags: u8) -> AppLayerResult { _flags: u8) -> AppLayerResult {
let buf = build_slice!(input,input_len as usize); let buf = build_slice!(input,input_len as usize);
let state = cast_pointer!(state,IKEV2State); let state = cast_pointer!(state,IKEState);
if state.parse(buf, STREAM_TOSERVER) < 0 { if state.parse(buf, STREAM_TOSERVER) < 0 {
return AppLayerResult::err(); return AppLayerResult::err();
} }
@ -477,7 +477,7 @@ pub extern "C" fn rs_ikev2_parse_request(_flow: *const core::Flow,
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow, pub extern "C" fn rs_ike_parse_response(_flow: *const core::Flow,
state: *mut std::os::raw::c_void, state: *mut std::os::raw::c_void,
pstate: *mut std::os::raw::c_void, pstate: *mut std::os::raw::c_void,
input: *const u8, input: *const u8,
@ -485,9 +485,9 @@ pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow,
_data: *const std::os::raw::c_void, _data: *const std::os::raw::c_void,
_flags: u8) -> AppLayerResult { _flags: u8) -> AppLayerResult {
let buf = build_slice!(input,input_len as usize); let buf = build_slice!(input,input_len as usize);
let state = cast_pointer!(state,IKEV2State); let state = cast_pointer!(state,IKEState);
let res = state.parse(buf, STREAM_TOCLIENT); let res = state.parse(buf, STREAM_TOCLIENT);
if state.connection_state == IKEV2ConnectionState::ParsingDone { if state.connection_state == IKEConnectionState::ParsingDone {
unsafe{ unsafe{
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION | AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_NO_INSPECTION |
APP_LAYER_PARSER_NO_REASSEMBLY | APP_LAYER_PARSER_NO_REASSEMBLY |
@ -501,11 +501,11 @@ pub extern "C" fn rs_ikev2_parse_response(_flow: *const core::Flow,
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_get_tx(state: *mut std::os::raw::c_void, pub extern "C" fn rs_ike_state_get_tx(state: *mut std::os::raw::c_void,
tx_id: u64) tx_id: u64)
-> *mut std::os::raw::c_void -> *mut std::os::raw::c_void
{ {
let state = cast_pointer!(state,IKEV2State); let state = cast_pointer!(state,IKEState);
match state.get_tx_by_id(tx_id) { match state.get_tx_by_id(tx_id) {
Some(tx) => unsafe{std::mem::transmute(tx)}, Some(tx) => unsafe{std::mem::transmute(tx)},
None => std::ptr::null_mut(), None => std::ptr::null_mut(),
@ -513,23 +513,31 @@ pub extern "C" fn rs_ikev2_state_get_tx(state: *mut std::os::raw::c_void,
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_get_tx_count(state: *mut std::os::raw::c_void) pub extern "C" fn rs_ike_state_get_tx_count(state: *mut std::os::raw::c_void)
-> u64 -> u64
{ {
let state = cast_pointer!(state,IKEV2State); let state = cast_pointer!(state,IKEState);
state.tx_id state.tx_id
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_tx_free(state: *mut std::os::raw::c_void, pub extern "C" fn rs_ike_state_tx_free(state: *mut std::os::raw::c_void,
tx_id: u64) tx_id: u64)
{ {
let state = cast_pointer!(state,IKEV2State); let state = cast_pointer!(state,IKEState);
state.free_tx(tx_id); state.free_tx(tx_id);
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void, pub extern "C" fn rs_ike_state_progress_completion_status(
_direction: u8)
-> std::os::raw::c_int
{
return 1;
}
#[no_mangle]
pub extern "C" fn rs_ike_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void,
_direction: u8) _direction: u8)
-> std::os::raw::c_int -> std::os::raw::c_int
{ {
@ -537,21 +545,21 @@ pub extern "C" fn rs_ikev2_tx_get_alstate_progress(_tx: *mut std::os::raw::c_voi
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_set_tx_detect_state( pub extern "C" fn rs_ike_state_set_tx_detect_state(
tx: *mut std::os::raw::c_void, tx: *mut std::os::raw::c_void,
de_state: &mut core::DetectEngineState) -> std::os::raw::c_int de_state: &mut core::DetectEngineState) -> std::os::raw::c_int
{ {
let tx = cast_pointer!(tx,IKEV2Transaction); let tx = cast_pointer!(tx,IKETransaction);
tx.de_state = Some(de_state); tx.de_state = Some(de_state);
0 0
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_get_tx_detect_state( pub extern "C" fn rs_ike_state_get_tx_detect_state(
tx: *mut std::os::raw::c_void) tx: *mut std::os::raw::c_void)
-> *mut core::DetectEngineState -> *mut core::DetectEngineState
{ {
let tx = cast_pointer!(tx,IKEV2Transaction); let tx = cast_pointer!(tx,IKETransaction);
match tx.de_state { match tx.de_state {
Some(ds) => ds, Some(ds) => ds,
None => std::ptr::null_mut(), None => std::ptr::null_mut(),
@ -560,31 +568,31 @@ pub extern "C" fn rs_ikev2_state_get_tx_detect_state(
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_get_events(tx: *mut std::os::raw::c_void) pub extern "C" fn rs_ike_state_get_events(tx: *mut std::os::raw::c_void)
-> *mut core::AppLayerDecoderEvents -> *mut core::AppLayerDecoderEvents
{ {
let tx = cast_pointer!(tx, IKEV2Transaction); let tx = cast_pointer!(tx, IKETransaction);
return tx.events; return tx.events;
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_get_event_info_by_id(event_id: std::os::raw::c_int, pub extern "C" fn rs_ike_state_get_event_info_by_id(event_id: std::os::raw::c_int,
event_name: *mut *const std::os::raw::c_char, event_name: *mut *const std::os::raw::c_char,
event_type: *mut core::AppLayerEventType) event_type: *mut core::AppLayerEventType)
-> i8 -> i8
{ {
if let Some(e) = IKEV2Event::from_i32(event_id as i32) { if let Some(e) = IkeEvent::from_i32(event_id as i32) {
let estr = match e { let estr = match e {
IKEV2Event::MalformedData => { "malformed_data\0" }, IkeEvent::MalformedData => { "malformed_data\0" },
IKEV2Event::NoEncryption => { "no_encryption\0" }, IkeEvent::NoEncryption => { "no_encryption\0" },
IKEV2Event::WeakCryptoEnc => { "weak_crypto_enc\0" }, IkeEvent::WeakCryptoEnc => { "weak_crypto_enc\0" },
IKEV2Event::WeakCryptoPRF => { "weak_crypto_prf\0" }, IkeEvent::WeakCryptoPRF => { "weak_crypto_prf\0" },
IKEV2Event::WeakCryptoDH => { "weak_crypto_dh\0" }, IkeEvent::WeakCryptoDH => { "weak_crypto_dh\0" },
IKEV2Event::WeakCryptoAuth => { "weak_crypto_auth\0" }, IkeEvent::WeakCryptoAuth => { "weak_crypto_auth\0" },
IKEV2Event::WeakCryptoNoDH => { "weak_crypto_nodh\0" }, IkeEvent::WeakCryptoNoDH => { "weak_crypto_nodh\0" },
IKEV2Event::WeakCryptoNoAuth => { "weak_crypto_noauth\0" }, IkeEvent::WeakCryptoNoAuth => { "weak_crypto_noauth\0" },
IKEV2Event::InvalidProposal => { "invalid_proposal\0" }, IkeEvent::InvalidProposal => { "invalid_proposal\0" },
IKEV2Event::UnknownProposal => { "unknown_proposal\0" }, IkeEvent::UnknownProposal => { "unknown_proposal\0" },
}; };
unsafe{ unsafe{
*event_name = estr.as_ptr() as *const std::os::raw::c_char; *event_name = estr.as_ptr() as *const std::os::raw::c_char;
@ -597,7 +605,7 @@ pub extern "C" fn rs_ikev2_state_get_event_info_by_id(event_id: std::os::raw::c_
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw::c_char, pub extern "C" fn rs_ike_state_get_event_info(event_name: *const std::os::raw::c_char,
event_id: *mut std::os::raw::c_int, event_id: *mut std::os::raw::c_int,
event_type: *mut core::AppLayerEventType) event_type: *mut core::AppLayerEventType)
-> std::os::raw::c_int -> std::os::raw::c_int
@ -607,16 +615,16 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw:
let event = match c_event_name.to_str() { let event = match c_event_name.to_str() {
Ok(s) => { Ok(s) => {
match s { match s {
"malformed_data" => IKEV2Event::MalformedData as i32, "malformed_data" => IkeEvent::MalformedData as i32,
"no_encryption" => IKEV2Event::NoEncryption as i32, "no_encryption" => IkeEvent::NoEncryption as i32,
"weak_crypto_enc" => IKEV2Event::WeakCryptoEnc as i32, "weak_crypto_enc" => IkeEvent::WeakCryptoEnc as i32,
"weak_crypto_prf" => IKEV2Event::WeakCryptoPRF as i32, "weak_crypto_prf" => IkeEvent::WeakCryptoPRF as i32,
"weak_crypto_auth" => IKEV2Event::WeakCryptoAuth as i32, "weak_crypto_auth" => IkeEvent::WeakCryptoAuth as i32,
"weak_crypto_dh" => IKEV2Event::WeakCryptoDH as i32, "weak_crypto_dh" => IkeEvent::WeakCryptoDH as i32,
"weak_crypto_nodh" => IKEV2Event::WeakCryptoNoDH as i32, "weak_crypto_nodh" => IkeEvent::WeakCryptoNoDH as i32,
"weak_crypto_noauth" => IKEV2Event::WeakCryptoNoAuth as i32, "weak_crypto_noauth" => IkeEvent::WeakCryptoNoAuth as i32,
"invalid_proposal" => IKEV2Event::InvalidProposal as i32, "invalid_proposal" => IkeEvent::InvalidProposal as i32,
"unknown_proposal" => IKEV2Event::UnknownProposal as i32, "unknown_proposal" => IkeEvent::UnknownProposal as i32,
_ => -1, // unknown event _ => -1, // unknown event
} }
}, },
@ -629,17 +637,16 @@ pub extern "C" fn rs_ikev2_state_get_event_info(event_name: *const std::os::raw:
0 0
} }
static mut ALPROTO_IKE : AppProto = ALPROTO_UNKNOWN;
static mut ALPROTO_IKEV2 : AppProto = ALPROTO_UNKNOWN;
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow, pub extern "C" fn rs_ike_probing_parser(_flow: *const Flow,
_direction: u8, _direction: u8,
input:*const u8, input_len: u32, input:*const u8, input_len: u32,
_rdir: *mut u8) -> AppProto _rdir: *mut u8) -> AppProto
{ {
let slice = build_slice!(input,input_len as usize); let slice = build_slice!(input,input_len as usize);
let alproto = unsafe{ ALPROTO_IKEV2 }; let alproto = unsafe{ ALPROTO_IKE };
match parse_ikev2_header(slice) { match parse_ikev2_header(slice) {
Ok((_, ref hdr)) => { Ok((_, ref hdr)) => {
if hdr.maj_ver != 2 || hdr.min_ver != 0 { if hdr.maj_ver != 2 || hdr.min_ver != 0 {
@ -667,41 +674,41 @@ pub extern "C" fn rs_ikev2_probing_parser(_flow: *const Flow,
} }
} }
export_tx_data_get!(rs_ikev2_get_tx_data, IKEV2Transaction); export_tx_data_get!(rs_ike_get_tx_data, IKETransaction);
const PARSER_NAME : &'static [u8] = b"ikev2\0"; const PARSER_NAME : &'static [u8] = b"ike\0";
#[no_mangle] #[no_mangle]
pub unsafe extern "C" fn rs_register_ikev2_parser() { pub unsafe extern "C" fn rs_register_ike_parser() {
let default_port = CString::new("500").unwrap(); let default_port = CString::new("500").unwrap();
let parser = RustParser { let parser = RustParser {
name : PARSER_NAME.as_ptr() as *const std::os::raw::c_char, name : PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
default_port : default_port.as_ptr(), default_port : default_port.as_ptr(),
ipproto : core::IPPROTO_UDP, ipproto : core::IPPROTO_UDP,
probe_ts : Some(rs_ikev2_probing_parser), probe_ts : Some(rs_ike_probing_parser),
probe_tc : Some(rs_ikev2_probing_parser), probe_tc : Some(rs_ike_probing_parser),
min_depth : 0, min_depth : 0,
max_depth : 16, max_depth : 16,
state_new : rs_ikev2_state_new, state_new : rs_ike_state_new,
state_free : rs_ikev2_state_free, state_free : rs_ike_state_free,
tx_free : rs_ikev2_state_tx_free, tx_free : rs_ike_state_tx_free,
parse_ts : rs_ikev2_parse_request, parse_ts : rs_ike_parse_request,
parse_tc : rs_ikev2_parse_response, parse_tc : rs_ike_parse_response,
get_tx_count : rs_ikev2_state_get_tx_count, get_tx_count : rs_ike_state_get_tx_count,
get_tx : rs_ikev2_state_get_tx, get_tx : rs_ike_state_get_tx,
tx_comp_st_ts : 1, tx_comp_st_ts : 1,
tx_comp_st_tc : 1, tx_comp_st_tc : 1,
tx_get_progress : rs_ikev2_tx_get_alstate_progress, tx_get_progress : rs_ike_tx_get_alstate_progress,
get_de_state : rs_ikev2_state_get_tx_detect_state, get_de_state : rs_ike_state_get_tx_detect_state,
set_de_state : rs_ikev2_state_set_tx_detect_state, set_de_state : rs_ike_state_set_tx_detect_state,
get_events : Some(rs_ikev2_state_get_events), get_events : Some(rs_ike_state_get_events),
get_eventinfo : Some(rs_ikev2_state_get_event_info), get_eventinfo : Some(rs_ike_state_get_event_info),
get_eventinfo_byid : Some(rs_ikev2_state_get_event_info_by_id), get_eventinfo_byid : Some(rs_ike_state_get_event_info_by_id),
localstorage_new : None, localstorage_new : None,
localstorage_free : None, localstorage_free : None,
get_files : None, get_files : None,
get_tx_iterator : None, get_tx_iterator : None,
get_tx_data : rs_ikev2_get_tx_data, get_tx_data : rs_ike_get_tx_data,
apply_tx_config : None, apply_tx_config : None,
flags : APP_LAYER_PARSER_OPT_UNIDIR_TXS, flags : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
truncate : None, truncate : None,
@ -711,23 +718,23 @@ pub unsafe extern "C" fn rs_register_ikev2_parser() {
if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 { if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let alproto = AppLayerRegisterProtocolDetection(&parser, 1); let alproto = AppLayerRegisterProtocolDetection(&parser, 1);
// store the allocated ID for the probe function // store the allocated ID for the probe function
ALPROTO_IKEV2 = alproto; ALPROTO_IKE = alproto;
if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 { if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, alproto); let _ = AppLayerRegisterParser(&parser, alproto);
} }
} else { } else {
SCLogDebug!("Protocol detector and parser disabled for IKEV2."); SCLogDebug!("Protocol detector and parser disabled for IKE.");
} }
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use super::IKEV2State; use super::IKEState;
#[test] #[test]
fn test_ikev2_parse_request_valid() { fn test_ike_parse_request_valid() {
// A UDP IKEV2 v4 request, in client mode // A UDP IKE v4 request, in client mode
const REQ : &[u8] = &[ const REQ : &[u8] = &[
0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@ -737,7 +744,7 @@ mod tests {
0x18, 0x57, 0xab, 0xc3, 0x4a, 0x5f, 0x2c, 0xfe 0x18, 0x57, 0xab, 0xc3, 0x4a, 0x5f, 0x2c, 0xfe
]; ];
let mut state = IKEV2State::new(); let mut state = IKEState::new();
assert_eq!(1, state.parse(REQ, 0)); assert_eq!(1, state.parse(REQ, 0));
} }
} }

14
rust/src/ikev2/log.rs → rust/src/ike/log.rs
Unescape Escape View File

@ -18,12 +18,12 @@
// written by Pierre Chifflier <chifflier@wzdftpd.net> // written by Pierre Chifflier <chifflier@wzdftpd.net>
use crate::jsonbuilder::{JsonBuilder, JsonError}; use crate::jsonbuilder::{JsonBuilder, JsonError};
use crate::ikev2::ikev2::{IKEV2State,IKEV2Transaction}; use crate::ike::ike::{IKEState,IKETransaction};
use crate::ikev2::ipsec_parser::IKEV2_FLAG_INITIATOR; use crate::ike::ipsec_parser::IKEV2_FLAG_INITIATOR;
fn ikev2_log_response(state: &mut IKEV2State, fn ike_log_response(state: &mut IKEState,
tx: &mut IKEV2Transaction, tx: &mut IKETransaction,
jb: &mut JsonBuilder) jb: &mut JsonBuilder)
-> Result<(), JsonError> -> Result<(), JsonError>
{ {
@ -58,10 +58,10 @@ fn ikev2_log_response(state: &mut IKEV2State,
} }
#[no_mangle] #[no_mangle]
pub extern "C" fn rs_ikev2_log_json_response(state: &mut IKEV2State, pub extern "C" fn rs_ike_log_json_response(state: &mut IKEState,
tx: &mut IKEV2Transaction, tx: &mut IKETransaction,
jb: &mut JsonBuilder) jb: &mut JsonBuilder)
-> bool -> bool
{ {
ikev2_log_response(state, tx, jb).is_ok() ike_log_response(state, tx, jb).is_ok()
} }

2
rust/src/ikev2/mod.rs → rust/src/ike/mod.rs
Unescape Escape View File

@ -19,6 +19,6 @@
extern crate ipsec_parser; extern crate ipsec_parser;
pub mod ikev2; pub mod ike;
pub mod state; pub mod state;
pub mod log; pub mod log;

8
rust/src/ikev2/state.rs → rust/src/ike/state.rs
Unescape Escape View File

@ -22,7 +22,7 @@ use self::ipsec_parser::*;
#[derive(Clone, Debug, PartialEq)] #[derive(Clone, Debug, PartialEq)]
#[repr(u8)] #[repr(u8)]
pub enum IKEV2ConnectionState { pub enum IKEConnectionState {
Init, Init,
InitSASent, InitSASent,
InitKESent, InitKESent,
@ -37,9 +37,9 @@ pub enum IKEV2ConnectionState {
Invalid, Invalid,
} }
impl IKEV2ConnectionState { impl IKEConnectionState {
pub fn advance(&self, payload: &IkeV2Payload) -> IKEV2ConnectionState { pub fn advance(&self, payload: &IkeV2Payload) -> IKEConnectionState {
use self::IKEV2ConnectionState::*; use self::IKEConnectionState::*;
match (self, &payload.content) { match (self, &payload.content) {
(&Init, &IkeV2PayloadContent::SA(_)) => InitSASent, (&Init, &IkeV2PayloadContent::SA(_)) => InitSASent,
(&InitSASent, &IkeV2PayloadContent::KE(_)) => InitKESent, (&InitSASent, &IkeV2PayloadContent::KE(_)) => InitKESent,

2
rust/src/lib.rs
Unescape Escape View File

@ -67,7 +67,7 @@ pub mod smb;
pub mod krb; pub mod krb;
pub mod dcerpc; pub mod dcerpc;
pub mod ikev2; pub mod ike;
pub mod snmp; pub mod snmp;
pub mod ntp; pub mod ntp;

8
src/Makefile.am
Unescape Escape View File

@ -31,7 +31,7 @@ noinst_HEADERS = \
app-layer-htp-mem.h \ app-layer-htp-mem.h \
app-layer-htp-xff.h \ app-layer-htp-xff.h \
app-layer-http2.h \ app-layer-http2.h \
app-layer-ikev2.h \ app-layer-ike.h \
app-layer-krb5.h \ app-layer-krb5.h \
app-layer-modbus.h \ app-layer-modbus.h \
app-layer-mqtt.h \ app-layer-mqtt.h \
@ -383,7 +383,7 @@ noinst_HEADERS = \
output-json.h \ output-json.h \
output-json-http2.h \ output-json-http2.h \
output-json-http.h \ output-json-http.h \
output-json-ikev2.h \ output-json-ike.h \
output-json-krb5.h \ output-json-krb5.h \
output-json-metadata.h \ output-json-metadata.h \
output-json-mqtt.h \ output-json-mqtt.h \
@ -605,7 +605,7 @@ libsuricata_c_a_SOURCES = \
app-layer-htp-mem.c \ app-layer-htp-mem.c \
app-layer-htp-xff.c \ app-layer-htp-xff.c \
app-layer-http2.c \ app-layer-http2.c \
app-layer-ikev2.c \ app-layer-ike.c \
app-layer-krb5.c \ app-layer-krb5.c \
app-layer-modbus.c \ app-layer-modbus.c \
app-layer-mqtt.c \ app-layer-mqtt.c \
@ -951,7 +951,7 @@ libsuricata_c_a_SOURCES = \
output-json-ftp.c \ output-json-ftp.c \
output-json-http2.c \ output-json-http2.c \
output-json-http.c \ output-json-http.c \
output-json-ikev2.c \ output-json-ike.c \
output-json-krb5.c \ output-json-krb5.c \
output-json-metadata.c \ output-json-metadata.c \
output-json-mqtt.c \ output-json-mqtt.c \

8
src/app-layer-detect-proto.c
Unescape Escape View File

@ -890,8 +890,8 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar
printf(" alproto: ALPROTO_NTP\n"); printf(" alproto: ALPROTO_NTP\n");
else if (pp_pe->alproto == ALPROTO_TFTP) else if (pp_pe->alproto == ALPROTO_TFTP)
printf(" alproto: ALPROTO_TFTP\n"); printf(" alproto: ALPROTO_TFTP\n");
else if (pp_pe->alproto == ALPROTO_IKEV2) else if (pp_pe->alproto == ALPROTO_IKE)
printf(" alproto: ALPROTO_IKEV2\n"); printf(" alproto: ALPROTO_IKE\n");
else if (pp_pe->alproto == ALPROTO_KRB5) else if (pp_pe->alproto == ALPROTO_KRB5)
printf(" alproto: ALPROTO_KRB5\n"); printf(" alproto: ALPROTO_KRB5\n");
else if (pp_pe->alproto == ALPROTO_DHCP) else if (pp_pe->alproto == ALPROTO_DHCP)
@ -967,8 +967,8 @@ static void AppLayerProtoDetectPrintProbingParsers(AppLayerProtoDetectProbingPar
printf(" alproto: ALPROTO_NTP\n"); printf(" alproto: ALPROTO_NTP\n");
else if (pp_pe->alproto == ALPROTO_TFTP) else if (pp_pe->alproto == ALPROTO_TFTP)
printf(" alproto: ALPROTO_TFTP\n"); printf(" alproto: ALPROTO_TFTP\n");
else if (pp_pe->alproto == ALPROTO_IKEV2) else if (pp_pe->alproto == ALPROTO_IKE)
printf(" alproto: ALPROTO_IKEV2\n"); printf(" alproto: ALPROTO_IKE\n");
else if (pp_pe->alproto == ALPROTO_KRB5) else if (pp_pe->alproto == ALPROTO_KRB5)
printf(" alproto: ALPROTO_KRB5\n"); printf(" alproto: ALPROTO_KRB5\n");
else if (pp_pe->alproto == ALPROTO_DHCP) else if (pp_pe->alproto == ALPROTO_DHCP)

8
src/app-layer-ikev2.c → src/app-layer-ike.c
Unescape Escape View File

@ -20,7 +20,7 @@
* *
* \author Pierre Chifflier <chifflier@wzdftpd.net> * \author Pierre Chifflier <chifflier@wzdftpd.net>
* *
* Parser for IKEv2 application layer running on UDP port 500. * Parser for IKE application layer running on UDP port 500.
*/ */
#include "suricata-common.h" #include "suricata-common.h"
@ -32,10 +32,10 @@
#include "app-layer-detect-proto.h" #include "app-layer-detect-proto.h"
#include "app-layer-parser.h" #include "app-layer-parser.h"
#include "app-layer-ikev2.h" #include "app-layer-ike.h"
#include "rust.h" #include "rust.h"
void RegisterIKEV2Parsers(void) void RegisterIKEParsers(void)
{ {
rs_register_ikev2_parser(); rs_register_ike_parser();
} }

12
src/app-layer-ikev2.h → src/app-layer-ike.h
Unescape Escape View File

@ -21,13 +21,13 @@
* \author Pierre Chifflier <chifflier@wzdftpd.net> * \author Pierre Chifflier <chifflier@wzdftpd.net>
*/ */
#ifndef __APP_LAYER_IKEV2_H__ #ifndef __APP_LAYER_IKE_H__
#define __APP_LAYER_IKEV2_H__ #define __APP_LAYER_IKE_H__
void RegisterIKEV2Parsers(void); void RegisterIKEParsers(void);
/** Opaque Rust types. */ /** Opaque Rust types. */
typedef struct IKEV2State_ IKEV2State; typedef struct IKEState_ IKEState;
typedef struct IKEV2Transaction_ IKEV2Transaction; typedef struct IKETransaction_ IKETransaction;
#endif /* __APP_LAYER_IKEV2_H__ */ #endif /* __APP_LAYER_IKE_H__ */

4
src/app-layer-parser.c
Unescape Escape View File

@ -61,7 +61,7 @@
#include "app-layer-nfs-udp.h" #include "app-layer-nfs-udp.h"
#include "app-layer-ntp.h" #include "app-layer-ntp.h"
#include "app-layer-tftp.h" #include "app-layer-tftp.h"
#include "app-layer-ikev2.h" #include "app-layer-ike.h"
#include "app-layer-krb5.h" #include "app-layer-krb5.h"
#include "app-layer-snmp.h" #include "app-layer-snmp.h"
#include "app-layer-sip.h" #include "app-layer-sip.h"
@ -1629,7 +1629,7 @@ void AppLayerParserRegisterProtocolParsers(void)
RegisterNFSUDPParsers(); RegisterNFSUDPParsers();
RegisterNTPParsers(); RegisterNTPParsers();
RegisterTFTPParsers(); RegisterTFTPParsers();
RegisterIKEV2Parsers(); RegisterIKEParsers();
RegisterKRB5Parsers(); RegisterKRB5Parsers();
rs_dhcp_register_parser(); rs_dhcp_register_parser();
RegisterSNMPParsers(); RegisterSNMPParsers();

7
src/app-layer-protos.c
Unescape Escape View File

@ -87,8 +87,8 @@ const char *AppProtoToString(AppProto alproto)
case ALPROTO_TFTP: case ALPROTO_TFTP:
proto_name = "tftp"; proto_name = "tftp";
break; break;
case ALPROTO_IKEV2: case ALPROTO_IKE:
proto_name = "ikev2"; proto_name = "ike";
break; break;
case ALPROTO_KRB5: case ALPROTO_KRB5:
proto_name = "krb5"; proto_name = "krb5";
@ -162,7 +162,8 @@ AppProto StringToAppProto(const char *proto_name)
if (strcmp(proto_name,"dnp3")==0) return ALPROTO_DNP3; if (strcmp(proto_name,"dnp3")==0) return ALPROTO_DNP3;
if (strcmp(proto_name,"nfs")==0) return ALPROTO_NFS; if (strcmp(proto_name,"nfs")==0) return ALPROTO_NFS;
if (strcmp(proto_name,"ntp")==0) return ALPROTO_NTP; if (strcmp(proto_name,"ntp")==0) return ALPROTO_NTP;
if (strcmp(proto_name,"ikev2")==0) return ALPROTO_IKEV2; if (strcmp(proto_name, "ike") == 0)
return ALPROTO_IKE;
if (strcmp(proto_name,"krb5")==0) return ALPROTO_KRB5; if (strcmp(proto_name,"krb5")==0) return ALPROTO_KRB5;
if (strcmp(proto_name,"dhcp")==0) return ALPROTO_DHCP; if (strcmp(proto_name,"dhcp")==0) return ALPROTO_DHCP;
if (strcmp(proto_name,"snmp")==0) return ALPROTO_SNMP; if (strcmp(proto_name,"snmp")==0) return ALPROTO_SNMP;

2
src/app-layer-protos.h
Unescape Escape View File

@ -46,7 +46,7 @@ enum AppProtoEnum {
ALPROTO_NTP, ALPROTO_NTP,
ALPROTO_FTPDATA, ALPROTO_FTPDATA,
ALPROTO_TFTP, ALPROTO_TFTP,
ALPROTO_IKEV2, ALPROTO_IKE,
ALPROTO_KRB5, ALPROTO_KRB5,
ALPROTO_DHCP, ALPROTO_DHCP,
ALPROTO_SNMP, ALPROTO_SNMP,

86
src/output-json-ikev2.c → src/output-json-ike.c
Unescape Escape View File

@ -20,7 +20,7 @@
* *
* \author Pierre Chifflier <chifflier@wzdftpd.net> * \author Pierre Chifflier <chifflier@wzdftpd.net>
* *
* Implement JSON/eve logging app-layer IKEv2. * Implement JSON/eve logging app-layer IKE.
*/ */
#include "suricata-common.h" #include "suricata-common.h"
@ -44,37 +44,37 @@
#include "app-layer.h" #include "app-layer.h"
#include "app-layer-parser.h" #include "app-layer-parser.h"
#include "app-layer-ikev2.h" #include "app-layer-ike.h"
#include "output-json-ikev2.h" #include "output-json-ike.h"
#include "rust.h" #include "rust.h"
typedef struct LogIKEv2FileCtx_ { typedef struct LogIKEFileCtx_ {
LogFileCtx *file_ctx; LogFileCtx *file_ctx;
OutputJsonCommonSettings cfg; OutputJsonCommonSettings cfg;
} LogIKEv2FileCtx; } LogIKEFileCtx;
typedef struct LogIKEv2LogThread_ { typedef struct LogIKELogThread_ {
LogFileCtx *file_ctx; LogFileCtx *file_ctx;
LogIKEv2FileCtx *ikev2log_ctx; LogIKEFileCtx *ikelog_ctx;
MemBuffer *buffer; MemBuffer *buffer;
} LogIKEv2LogThread; } LogIKELogThread;
static int JsonIKEv2Logger(ThreadVars *tv, void *thread_data, static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) void *tx, uint64_t tx_id)
{ {
IKEV2Transaction *ikev2tx = tx; IKETransaction *iketx = tx;
LogIKEv2LogThread *thread = thread_data; LogIKELogThread *thread = thread_data;
JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ikev2", NULL); JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ike", NULL);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->ikev2log_ctx->cfg, p, f, jb); EveAddCommonOptions(&thread->ikelog_ctx->cfg, p, f, jb);
jb_open_object(jb, "ikev2"); jb_open_object(jb, "ike");
if (unlikely(!rs_ikev2_log_json_response(state, ikev2tx, jb))) { if (unlikely(!rs_ike_log_json_response(state, iketx, jb))) {
goto error; goto error;
} }
jb_close(jb); jb_close(jb);
@ -90,52 +90,51 @@ error:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static void OutputIKEv2LogDeInitCtxSub(OutputCtx *output_ctx) static void OutputIKELogDeInitCtxSub(OutputCtx *output_ctx)
{ {
LogIKEv2FileCtx *ikev2log_ctx = (LogIKEv2FileCtx *)output_ctx->data; LogIKEFileCtx *ikelog_ctx = (LogIKEFileCtx *)output_ctx->data;
SCFree(ikev2log_ctx); SCFree(ikelog_ctx);
SCFree(output_ctx); SCFree(output_ctx);
} }
static OutputInitResult OutputIKEv2LogInitSub(ConfNode *conf, static OutputInitResult OutputIKELogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false }; OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data; OutputJsonCtx *ajt = parent_ctx->data;
LogIKEv2FileCtx *ikev2log_ctx = SCCalloc(1, sizeof(*ikev2log_ctx)); LogIKEFileCtx *ikelog_ctx = SCCalloc(1, sizeof(*ikelog_ctx));
if (unlikely(ikev2log_ctx == NULL)) { if (unlikely(ikelog_ctx == NULL)) {
return result; return result;
} }
ikev2log_ctx->file_ctx = ajt->file_ctx; ikelog_ctx->file_ctx = ajt->file_ctx;
ikev2log_ctx->cfg = ajt->cfg; ikelog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
SCFree(ikev2log_ctx); SCFree(ikelog_ctx);
return result; return result;
} }
output_ctx->data = ikev2log_ctx; output_ctx->data = ikelog_ctx;
output_ctx->DeInit = OutputIKEv2LogDeInitCtxSub; output_ctx->DeInit = OutputIKELogDeInitCtxSub;
SCLogDebug("IKEv2 log sub-module initialized."); SCLogDebug("IKE log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_IKEV2); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_IKE);
result.ctx = output_ctx; result.ctx = output_ctx;
result.ok = true; result.ok = true;
return result; return result;
} }
static TmEcode JsonIKEv2LogThreadInit(ThreadVars *t, const void *initdata, void **data) static TmEcode JsonIKELogThreadInit(ThreadVars *t, const void *initdata, void **data)
{ {
LogIKEv2LogThread *thread = SCCalloc(1, sizeof(*thread)); LogIKELogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) { if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
if (initdata == NULL) { if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogIKEv2. \"initdata\" is NULL."); SCLogDebug("Error getting context for EveLogIKE. \"initdata\" is NULL.");
goto error_exit; goto error_exit;
} }
@ -144,8 +143,8 @@ static TmEcode JsonIKEv2LogThreadInit(ThreadVars *t, const void *initdata, void
goto error_exit; goto error_exit;
} }
thread->ikev2log_ctx = ((OutputCtx *)initdata)->data; thread->ikelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->ikev2log_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->ikelog_ctx->file_ctx, t->id);
if (!thread->file_ctx) { if (!thread->file_ctx) {
goto error_exit; goto error_exit;
} }
@ -161,9 +160,9 @@ error_exit:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static TmEcode JsonIKEv2LogThreadDeinit(ThreadVars *t, void *data) static TmEcode JsonIKELogThreadDeinit(ThreadVars *t, void *data)
{ {
LogIKEv2LogThread *thread = (LogIKEv2LogThread *)data; LogIKELogThread *thread = (LogIKELogThread *)data;
if (thread == NULL) { if (thread == NULL) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
@ -174,13 +173,12 @@ static TmEcode JsonIKEv2LogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK; return TM_ECODE_OK;
} }
void JsonIKEv2LogRegister(void) void JsonIKELogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_IKEV2, "eve-log", "JsonIKEv2Log", OutputRegisterTxSubModule(LOGGER_JSON_IKE, "eve-log", "JsonIKELog", "eve-log.ike",
"eve-log.ikev2", OutputIKEv2LogInitSub, ALPROTO_IKEV2, OutputIKELogInitSub, ALPROTO_IKE, JsonIKELogger, JsonIKELogThreadInit,
JsonIKEv2Logger, JsonIKEv2LogThreadInit, JsonIKELogThreadDeinit, NULL);
JsonIKEv2LogThreadDeinit, NULL);
SCLogDebug("IKEv2 JSON logger registered."); SCLogDebug("IKE JSON logger registered.");
} }

8
src/output-json-ikev2.h → src/output-json-ike.h
Unescape Escape View File

@ -21,9 +21,9 @@
* \author Pierre Chifflier <chifflier@wzdftpd.net> * \author Pierre Chifflier <chifflier@wzdftpd.net>
*/ */
#ifndef __OUTPUT_JSON_IKEV2_H__ #ifndef __OUTPUT_JSON_IKE_H__
#define __OUTPUT_JSON_IKEV2_H__ #define __OUTPUT_JSON_IKE_H__
void JsonIKEv2LogRegister(void); void JsonIKELogRegister(void);
#endif /* __OUTPUT_JSON_IKEV2_H__ */ #endif /* __OUTPUT_JSON_IKE_H__ */

6
src/output.c
Unescape Escape View File

@ -69,7 +69,7 @@
#include "output-json-ftp.h" #include "output-json-ftp.h"
#include "output-json-tftp.h" #include "output-json-tftp.h"
#include "output-json-smb.h" #include "output-json-smb.h"
#include "output-json-ikev2.h" #include "output-json-ike.h"
#include "output-json-krb5.h" #include "output-json-krb5.h"
#include "output-json-dhcp.h" #include "output-json-dhcp.h"
#include "output-json-snmp.h" #include "output-json-snmp.h"
@ -1096,8 +1096,8 @@ void OutputRegisterLoggers(void)
JsonFTPLogRegister(); JsonFTPLogRegister();
/* SMB JSON logger. */ /* SMB JSON logger. */
JsonSMBLogRegister(); JsonSMBLogRegister();
/* IKEv2 JSON logger. */ /* IKE JSON logger. */
JsonIKEv2LogRegister(); JsonIKELogRegister();
/* KRB5 JSON logger. */ /* KRB5 JSON logger. */
JsonKRB5LogRegister(); JsonKRB5LogRegister();
/* DHCP JSON logger. */ /* DHCP JSON logger. */

2
src/rust-context.h
Unescape Escape View File

@ -20,7 +20,7 @@
#include "detect-engine-state.h" //DetectEngineState #include "detect-engine-state.h" //DetectEngineState
#include "app-layer-krb5.h" //KRB5State, KRB5Transaction #include "app-layer-krb5.h" //KRB5State, KRB5Transaction
#include "app-layer-ikev2.h" //IKEV2State, IKEV2Transaction #include "app-layer-ike.h" //IKEState, IKETransaction
#include "app-layer-ntp.h" //NTPState, NTPTransaction #include "app-layer-ntp.h" //NTPState, NTPTransaction
#include "app-layer-snmp.h" //SNMPState, SNMPTransaction #include "app-layer-snmp.h" //SNMPState, SNMPTransaction
#include "app-layer-tftp.h" //TFTPState, TFTPTransaction #include "app-layer-tftp.h" //TFTPState, TFTPTransaction

2
src/suricata-common.h
Unescape Escape View File

@ -454,7 +454,7 @@ typedef enum {
LOGGER_JSON_DNP3_TC, LOGGER_JSON_DNP3_TC,
LOGGER_JSON_SSH, LOGGER_JSON_SSH,
LOGGER_JSON_SMB, LOGGER_JSON_SMB,
LOGGER_JSON_IKEV2, LOGGER_JSON_IKE,
LOGGER_JSON_KRB5, LOGGER_JSON_KRB5,
LOGGER_JSON_DHCP, LOGGER_JSON_DHCP,
LOGGER_JSON_SNMP, LOGGER_JSON_SNMP,

2
src/tests/fuzz/confyaml.c
Unescape Escape View File

@ -53,7 +53,7 @@ outputs:\n\
- nfs\n\ - nfs\n\
- smb\n\ - smb\n\
- tftp\n\ - tftp\n\
- ikev2\n\ - ike\n\
- krb5\n\ - krb5\n\
- snmp\n\ - snmp\n\
- rfb\n\ - rfb\n\

2
src/util-profiling.c
Unescape Escape View File

@ -1309,7 +1309,7 @@ const char * PacketProfileLoggertIdToString(LoggerId id)
CASE_CODE (LOGGER_JSON_HTTP); CASE_CODE (LOGGER_JSON_HTTP);
CASE_CODE (LOGGER_JSON_DHCP); CASE_CODE (LOGGER_JSON_DHCP);
CASE_CODE (LOGGER_JSON_KRB5); CASE_CODE (LOGGER_JSON_KRB5);
CASE_CODE (LOGGER_JSON_IKEV2); CASE_CODE(LOGGER_JSON_IKE);
CASE_CODE (LOGGER_JSON_FTP); CASE_CODE (LOGGER_JSON_FTP);
CASE_CODE (LOGGER_JSON_TFTP); CASE_CODE (LOGGER_JSON_TFTP);
CASE_CODE (LOGGER_JSON_SMTP); CASE_CODE (LOGGER_JSON_SMTP);

4
suricata.yaml.in
Unescape Escape View File

@ -266,7 +266,7 @@ outputs:
- nfs - nfs
- smb - smb
- tftp - tftp
- ikev2 - ike
- dcerpc - dcerpc
- krb5 - krb5
- snmp - snmp
@ -726,7 +726,7 @@ app-layer:
enabled: yes enabled: yes
snmp: snmp:
enabled: yes enabled: yes
ikev2: ike:
enabled: yes enabled: yes
tls: tls:
enabled: yes enabled: yes

Write Preview
Loading…
Cancel
Save