mirror of https://github.com/OISF/suricata
Add NTP parser (rust-experimental)
Pierre Chifflier
9 years ago
committed by
Victor Julien
parent
4f677fd157
commit
efe11dc37e
@ -0,0 +1,20 @@
|
|||||||
|
/* Copyright (C) 2017 Open Information Security Foundation
|
||||||
|
*
|
||||||
|
* You can copy, redistribute or modify this Program under the terms of
|
||||||
|
* the GNU General Public License version 2 as published by the Free
|
||||||
|
* Software Foundation.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* version 2 along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
* 02110-1301, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// written by Pierre Chifflier <chifflier@wzdftpd.net>
|
||||||
|
|
||||||
|
pub mod ntp;
|
||||||
@ -0,0 +1,369 @@
|
|||||||
|
/* Copyright (C) 2017 Open Information Security Foundation
|
||||||
|
*
|
||||||
|
* You can copy, redistribute or modify this Program under the terms of
|
||||||
|
* the GNU General Public License version 2 as published by the Free
|
||||||
|
* Software Foundation.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* version 2 along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
* 02110-1301, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// written by Pierre Chifflier <chifflier@wzdftpd.net>
|
||||||
|
|
||||||
|
extern crate ntp_parser;
|
||||||
|
use self::ntp_parser::*;
|
||||||
|
use core;
|
||||||
|
use applayer;
|
||||||
|
use libc;
|
||||||
|
use std;
|
||||||
|
use std::ffi::CStr;
|
||||||
|
|
||||||
|
use log::*;
|
||||||
|
|
||||||
|
use nom::IResult;
|
||||||
|
|
||||||
|
#[repr(u32)]
|
||||||
|
pub enum NTPEvent {
|
||||||
|
UnsolicitedResponse = 0,
|
||||||
|
MalformedData,
|
||||||
|
NotRequest,
|
||||||
|
NotResponse,
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
pub struct NTPState {
|
||||||
|
/// List of transactions for this session
|
||||||
|
transactions: Vec<NTPTransaction>,
|
||||||
|
|
||||||
|
/// Detection engine states counter
|
||||||
|
de_state_count: u64,
|
||||||
|
|
||||||
|
/// Events counter
|
||||||
|
events: u16,
|
||||||
|
|
||||||
|
/// tx counter for assigning incrementing id's to tx's
|
||||||
|
tx_id: u64,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug)]
|
||||||
|
pub struct NTPTransaction {
|
||||||
|
/// The NTP reference ID
|
||||||
|
pub xid: u32,
|
||||||
|
|
||||||
|
/// The internal transaction id
|
||||||
|
id: u64,
|
||||||
|
|
||||||
|
/// The detection engine state, if present
|
||||||
|
de_state: Option<*mut core::DetectEngineState>,
|
||||||
|
|
||||||
|
/// The events associated with this transaction
|
||||||
|
events: *mut core::AppLayerDecoderEvents,
|
||||||
|
|
||||||
|
logged: applayer::LoggerFlags,
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
impl NTPState {
|
||||||
|
pub fn new() -> NTPState {
|
||||||
|
NTPState{
|
||||||
|
transactions: Vec::new(),
|
||||||
|
de_state_count: 0,
|
||||||
|
events: 0,
|
||||||
|
tx_id: 0,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl NTPState {
|
||||||
|
fn parse(&mut self, i: &[u8], _direction: u8) -> i8 {
|
||||||
|
match parse_ntp(i) {
|
||||||
|
IResult::Done(_,ref msg) => {
|
||||||
|
// SCLogDebug!("parse_ntp: {:?}",msg);
|
||||||
|
if msg.mode == 1 || msg.mode == 3 {
|
||||||
|
let mut tx = self.new_tx();
|
||||||
|
// use the reference id as identifier
|
||||||
|
tx.xid = msg.ref_id;
|
||||||
|
self.transactions.push(tx);
|
||||||
|
}
|
||||||
|
0
|
||||||
|
},
|
||||||
|
IResult::Incomplete(_) => {
|
||||||
|
SCLogDebug!("Insufficient data while parsing NTP data");
|
||||||
|
self.set_event(NTPEvent::MalformedData);
|
||||||
|
-1
|
||||||
|
},
|
||||||
|
IResult::Error(_) => {
|
||||||
|
SCLogDebug!("Error while parsing NTP data");
|
||||||
|
self.set_event(NTPEvent::MalformedData);
|
||||||
|
-1
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn free(&mut self) {
|
||||||
|
// All transactions are freed when the `transactions` object is freed.
|
||||||
|
// But let's be explicit
|
||||||
|
self.transactions.clear();
|
||||||
|
}
|
||||||
|
|
||||||
|
fn new_tx(&mut self) -> NTPTransaction {
|
||||||
|
self.tx_id += 1;
|
||||||
|
NTPTransaction::new(self.tx_id)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn get_tx_by_id(&mut self, tx_id: u64) -> Option<&NTPTransaction> {
|
||||||
|
self.transactions.iter().find(|&tx| tx.id == tx_id + 1)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn free_tx(&mut self, tx_id: u64) {
|
||||||
|
let tx = self.transactions.iter().position(|ref tx| tx.id == tx_id + 1);
|
||||||
|
debug_assert!(tx != None);
|
||||||
|
if let Some(idx) = tx {
|
||||||
|
let _ = self.transactions.remove(idx);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Set an event. The event is set on the most recent transaction.
|
||||||
|
pub fn set_event(&mut self, event: NTPEvent) {
|
||||||
|
if let Some(tx) = self.transactions.last_mut() {
|
||||||
|
let ev = event as u8;
|
||||||
|
core::sc_app_layer_decoder_events_set_event_raw(&mut tx.events, ev);
|
||||||
|
self.events += 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl NTPTransaction {
|
||||||
|
pub fn new(id: u64) -> NTPTransaction {
|
||||||
|
NTPTransaction {
|
||||||
|
xid: 0,
|
||||||
|
id: id,
|
||||||
|
de_state: None,
|
||||||
|
events: std::ptr::null_mut(),
|
||||||
|
logged: applayer::LoggerFlags::new(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn free(&mut self) {
|
||||||
|
if self.events != std::ptr::null_mut() {
|
||||||
|
core::sc_app_layer_decoder_events_free_events(&mut self.events);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl Drop for NTPTransaction {
|
||||||
|
fn drop(&mut self) {
|
||||||
|
self.free();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/// TOSERVER probe function
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_probe(input: *const libc::uint8_t, len: libc::uint32_t)
|
||||||
|
-> libc::int8_t
|
||||||
|
{
|
||||||
|
let slice: &[u8] = unsafe {
|
||||||
|
std::slice::from_raw_parts(input as *mut u8, len as usize)
|
||||||
|
};
|
||||||
|
match parse_ntp(slice) {
|
||||||
|
IResult::Done(_, ref msg) => {
|
||||||
|
if msg.version == 3 || msg.version == 4 {
|
||||||
|
return 1;
|
||||||
|
} else {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
},
|
||||||
|
IResult::Incomplete(_) => {
|
||||||
|
return 0;
|
||||||
|
},
|
||||||
|
IResult::Error(_) => {
|
||||||
|
return -1;
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/// Returns *mut NTPState
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_new() -> *mut libc::c_void {
|
||||||
|
let state = NTPState::new();
|
||||||
|
let boxed = Box::new(state);
|
||||||
|
return unsafe{std::mem::transmute(boxed)};
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Params:
|
||||||
|
/// - state: *mut NTPState as void pointer
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_free(state: *mut libc::c_void) {
|
||||||
|
// Just unbox...
|
||||||
|
let mut ntp_state: Box<NTPState> = unsafe{std::mem::transmute(state)};
|
||||||
|
ntp_state.free();
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_parse_request(_flow: *const core::Flow,
|
||||||
|
state: &mut NTPState,
|
||||||
|
_pstate: *const libc::c_void,
|
||||||
|
input: *const libc::uint8_t,
|
||||||
|
input_len: u32,
|
||||||
|
_data: *const libc::c_void) -> i8 {
|
||||||
|
let buf = unsafe{std::slice::from_raw_parts(input, input_len as usize)};
|
||||||
|
state.parse(buf, 0)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_parse_response(_flow: *const core::Flow,
|
||||||
|
state: &mut NTPState,
|
||||||
|
_pstate: *const libc::c_void,
|
||||||
|
input: *const libc::uint8_t,
|
||||||
|
input_len: u32,
|
||||||
|
_data: *const libc::c_void) -> i8 {
|
||||||
|
let buf = unsafe{std::slice::from_raw_parts(input, input_len as usize)};
|
||||||
|
state.parse(buf, 1)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_get_tx(state: &mut NTPState,
|
||||||
|
tx_id: libc::uint64_t)
|
||||||
|
-> *mut NTPTransaction
|
||||||
|
{
|
||||||
|
match state.get_tx_by_id(tx_id) {
|
||||||
|
Some(tx) => unsafe{std::mem::transmute(tx)},
|
||||||
|
None => std::ptr::null_mut(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_get_tx_count(state: &mut NTPState)
|
||||||
|
-> libc::uint64_t
|
||||||
|
{
|
||||||
|
state.tx_id
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_tx_free(state: &mut NTPState,
|
||||||
|
tx_id: libc::uint64_t)
|
||||||
|
{
|
||||||
|
state.free_tx(tx_id);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_progress_completion_status(
|
||||||
|
_direction: libc::uint8_t)
|
||||||
|
-> libc::c_int
|
||||||
|
{
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_tx_get_alstate_progress(_tx: &mut NTPTransaction,
|
||||||
|
_direction: libc::uint8_t)
|
||||||
|
-> libc::uint8_t
|
||||||
|
{
|
||||||
|
1
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_tx_set_logged(_state: &mut NTPState,
|
||||||
|
tx: &mut NTPTransaction,
|
||||||
|
logger: libc::uint32_t)
|
||||||
|
{
|
||||||
|
tx.logged.set_logged(logger);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_tx_get_logged(_state: &mut NTPState,
|
||||||
|
tx: &mut NTPTransaction,
|
||||||
|
logger: libc::uint32_t)
|
||||||
|
-> i8
|
||||||
|
{
|
||||||
|
if tx.logged.is_logged(logger) {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_set_tx_detect_state(
|
||||||
|
state: &mut NTPState,
|
||||||
|
tx: &mut NTPTransaction,
|
||||||
|
de_state: &mut core::DetectEngineState)
|
||||||
|
{
|
||||||
|
state.de_state_count += 1;
|
||||||
|
tx.de_state = Some(de_state);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_get_tx_detect_state(
|
||||||
|
tx: &mut NTPTransaction)
|
||||||
|
-> *mut core::DetectEngineState
|
||||||
|
{
|
||||||
|
match tx.de_state {
|
||||||
|
Some(ds) => ds,
|
||||||
|
None => std::ptr::null_mut(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_has_events(state: &mut NTPState) -> u8 {
|
||||||
|
if state.events > 0 {
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_get_events(state: &mut NTPState,
|
||||||
|
tx_id: libc::uint64_t)
|
||||||
|
-> *mut core::AppLayerDecoderEvents
|
||||||
|
{
|
||||||
|
match state.get_tx_by_id(tx_id) {
|
||||||
|
Some(tx) => tx.events,
|
||||||
|
_ => std::ptr::null_mut(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[no_mangle]
|
||||||
|
pub extern "C" fn rs_ntp_state_get_event_info(event_name: *const libc::c_char,
|
||||||
|
event_id: *mut libc::c_int,
|
||||||
|
event_type: *mut core::AppLayerEventType)
|
||||||
|
-> i8
|
||||||
|
{
|
||||||
|
if event_name == std::ptr::null() { return -1; }
|
||||||
|
let c_event_name: &CStr = unsafe { CStr::from_ptr(event_name) };
|
||||||
|
let event = match c_event_name.to_str() {
|
||||||
|
Ok(s) => {
|
||||||
|
match s {
|
||||||
|
"malformed_data" => NTPEvent::MalformedData as i32,
|
||||||
|
_ => -1, // unknown event
|
||||||
|
}
|
||||||
|
},
|
||||||
|
Err(_) => -1, // UTF-8 conversion failed
|
||||||
|
};
|
||||||
|
unsafe{
|
||||||
|
*event_type = core::APP_LAYER_EVENT_TYPE_TRANSACTION;
|
||||||
|
*event_id = event as libc::c_int;
|
||||||
|
};
|
||||||
|
0
|
||||||
|
}
|
||||||
@ -0,0 +1,307 @@
|
|||||||
|
/* Copyright (C) 2017 Open Information Security Foundation
|
||||||
|
*
|
||||||
|
* You can copy, redistribute or modify this Program under the terms of
|
||||||
|
* the GNU General Public License version 2 as published by the Free
|
||||||
|
* Software Foundation.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* version 2 along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
* 02110-1301, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \file
|
||||||
|
*
|
||||||
|
* \author Pierre Chifflier <chifflier@wzdftpd.net>
|
||||||
|
*
|
||||||
|
* Parser for NTP application layer running on UDP port 123.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include "suricata-common.h"
|
||||||
|
#include "stream.h"
|
||||||
|
#include "conf.h"
|
||||||
|
|
||||||
|
#include "util-unittest.h"
|
||||||
|
|
||||||
|
#include "app-layer-detect-proto.h"
|
||||||
|
#include "app-layer-parser.h"
|
||||||
|
|
||||||
|
#include "app-layer-ntp.h"
|
||||||
|
|
||||||
|
#if defined(HAVE_RUST) && defined(HAVE_RUST_EXTERNAL)
|
||||||
|
|
||||||
|
#include "rust-ntp-ntp-gen.h"
|
||||||
|
|
||||||
|
/* The default port to probe for NTP traffic if not provided in the
|
||||||
|
* configuration file. */
|
||||||
|
#define NTP_DEFAULT_PORT "123"
|
||||||
|
|
||||||
|
/* The minimum size for an NTP message. */
|
||||||
|
#define NTP_MIN_FRAME_LEN 2
|
||||||
|
|
||||||
|
|
||||||
|
static void *NTPStateAlloc(void)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_new();
|
||||||
|
}
|
||||||
|
|
||||||
|
static void NTPStateFree(void *state)
|
||||||
|
{
|
||||||
|
rs_ntp_state_free(state);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \brief Callback from the application layer to have a transaction freed.
|
||||||
|
*
|
||||||
|
* \param state a void pointer to the NTPState object.
|
||||||
|
* \param tx_id the transaction ID to free.
|
||||||
|
*/
|
||||||
|
static void NTPStateTxFree(void *state, uint64_t tx_id)
|
||||||
|
{
|
||||||
|
rs_ntp_state_tx_free(state, tx_id);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int NTPStateGetEventInfo(const char *event_name, int *event_id,
|
||||||
|
AppLayerEventType *event_type)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_get_event_info(event_name, event_id, event_type);
|
||||||
|
}
|
||||||
|
|
||||||
|
static AppLayerDecoderEvents *NTPGetEvents(void *state, uint64_t tx_id)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_get_events(state, tx_id);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int NTPHasEvents(void *state)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_has_events(state);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \brief Probe the input to see if it looks like NTP.
|
||||||
|
*
|
||||||
|
* \retval ALPROTO_NTP if it looks like NTP, otherwise
|
||||||
|
* ALPROTO_UNKNOWN.
|
||||||
|
*/
|
||||||
|
static AppProto NTPProbingParser(uint8_t *input, uint32_t input_len,
|
||||||
|
uint32_t *offset)
|
||||||
|
{
|
||||||
|
if (input_len < NTP_MIN_FRAME_LEN) {
|
||||||
|
return ALPROTO_UNKNOWN;
|
||||||
|
}
|
||||||
|
|
||||||
|
int8_t r = rs_ntp_probe(input, input_len);
|
||||||
|
if (r == 1) {
|
||||||
|
return ALPROTO_NTP;
|
||||||
|
} else if (r == -1) {
|
||||||
|
return ALPROTO_FAILED;
|
||||||
|
}
|
||||||
|
|
||||||
|
SCLogDebug("Protocol not detected as ALPROTO_NTP.");
|
||||||
|
return ALPROTO_UNKNOWN;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int RustNTPParseRequest(Flow *f, void *state,
|
||||||
|
AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
|
||||||
|
void *local_data)
|
||||||
|
{
|
||||||
|
SCLogDebug("RustNTPParseRequest");
|
||||||
|
return rs_ntp_parse_request(f, state, pstate, input, input_len,
|
||||||
|
local_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int RustNTPParseResponse(Flow *f, void *state,
|
||||||
|
AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
|
||||||
|
void *local_data)
|
||||||
|
{
|
||||||
|
SCLogDebug("RustNTPParseResponse");
|
||||||
|
return rs_ntp_parse_response(f, state, pstate, input, input_len,
|
||||||
|
local_data);
|
||||||
|
}
|
||||||
|
|
||||||
|
static uint64_t NTPGetTxCnt(void *state)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_get_tx_count(state);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void *NTPGetTx(void *state, uint64_t tx_id)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_get_tx(state, tx_id);
|
||||||
|
}
|
||||||
|
|
||||||
|
// static void NTPSetTxLogged(void *state, void *vtx, uint32_t logger)
|
||||||
|
// {
|
||||||
|
// rs_ntp_tx_set_logged(state, vtx, logger);
|
||||||
|
// }
|
||||||
|
//
|
||||||
|
// static int NTPGetTxLogged(void *state, void *vtx, uint32_t logger)
|
||||||
|
// {
|
||||||
|
// return rs_ntp_tx_get_logged(state, vtx, logger);
|
||||||
|
// }
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \brief Called by the application layer.
|
||||||
|
*
|
||||||
|
* In most cases 1 can be returned here.
|
||||||
|
*/
|
||||||
|
static int NTPGetAlstateProgressCompletionStatus(uint8_t direction) {
|
||||||
|
return rs_ntp_state_progress_completion_status(direction);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \brief Return the state of a transaction in a given direction.
|
||||||
|
*/
|
||||||
|
static int NTPGetStateProgress(void *tx, uint8_t direction)
|
||||||
|
{
|
||||||
|
return rs_ntp_tx_get_alstate_progress(tx, direction);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \brief Get stored Tx detect state
|
||||||
|
*/
|
||||||
|
static DetectEngineState *NTPGetTxDetectState(void *vtx)
|
||||||
|
{
|
||||||
|
return rs_ntp_state_get_tx_detect_state(vtx);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \brief Set stored Tx detect state
|
||||||
|
*/
|
||||||
|
static int NTPSetTxDetectState(void *state, void *vtx,
|
||||||
|
DetectEngineState *s)
|
||||||
|
{
|
||||||
|
rs_ntp_state_set_tx_detect_state(state, vtx, s);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
void RegisterNTPParsers(void)
|
||||||
|
{
|
||||||
|
const char *proto_name = "ntp";
|
||||||
|
|
||||||
|
/* Check if NTP UDP detection is enabled. If it does not exist in
|
||||||
|
* the configuration file then it will be enabled by default. */
|
||||||
|
if (AppLayerProtoDetectConfProtoDetectionEnabled("udp", proto_name)) {
|
||||||
|
|
||||||
|
SCLogDebug("NTP UDP protocol detection enabled.");
|
||||||
|
|
||||||
|
AppLayerProtoDetectRegisterProtocol(ALPROTO_NTP, proto_name);
|
||||||
|
|
||||||
|
if (RunmodeIsUnittests()) {
|
||||||
|
|
||||||
|
SCLogDebug("Unittest mode, registeringd default configuration.");
|
||||||
|
AppLayerProtoDetectPPRegister(IPPROTO_UDP, NTP_DEFAULT_PORT,
|
||||||
|
ALPROTO_NTP, 0, NTP_MIN_FRAME_LEN, STREAM_TOSERVER,
|
||||||
|
NTPProbingParser, NULL);
|
||||||
|
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
|
||||||
|
if (!AppLayerProtoDetectPPParseConfPorts("udp", IPPROTO_UDP,
|
||||||
|
proto_name, ALPROTO_NTP, 0, NTP_MIN_FRAME_LEN,
|
||||||
|
NTPProbingParser, NULL)) {
|
||||||
|
SCLogDebug("No NTP app-layer configuration, enabling NTP"
|
||||||
|
" detection UDP detection on port %s.",
|
||||||
|
NTP_DEFAULT_PORT);
|
||||||
|
AppLayerProtoDetectPPRegister(IPPROTO_UDP,
|
||||||
|
NTP_DEFAULT_PORT, ALPROTO_NTP, 0,
|
||||||
|
NTP_MIN_FRAME_LEN, STREAM_TOSERVER,
|
||||||
|
NTPProbingParser, NULL);
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
else {
|
||||||
|
SCLogDebug("Protocol detecter and parser disabled for NTP.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (AppLayerParserConfParserEnabled("udp", proto_name)) {
|
||||||
|
|
||||||
|
SCLogDebug("Registering NTP protocol parser.");
|
||||||
|
|
||||||
|
/* Register functions for state allocation and freeing. A
|
||||||
|
* state is allocated for every new NTP flow. */
|
||||||
|
AppLayerParserRegisterStateFuncs(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPStateAlloc, NTPStateFree);
|
||||||
|
|
||||||
|
/* Register request parser for parsing frame from server to client. */
|
||||||
|
AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
STREAM_TOSERVER, RustNTPParseRequest);
|
||||||
|
|
||||||
|
/* Register response parser for parsing frames from server to client. */
|
||||||
|
AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
STREAM_TOCLIENT, RustNTPParseResponse);
|
||||||
|
|
||||||
|
/* Register a function to be called by the application layer
|
||||||
|
* when a transaction is to be freed. */
|
||||||
|
AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPStateTxFree);
|
||||||
|
|
||||||
|
// AppLayerParserRegisterLoggerFuncs(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
// NTPGetTxLogged, NTPSetTxLogged);
|
||||||
|
|
||||||
|
/* Register a function to return the current transaction count. */
|
||||||
|
AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPGetTxCnt);
|
||||||
|
|
||||||
|
/* Transaction handling. */
|
||||||
|
AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_NTP,
|
||||||
|
NTPGetAlstateProgressCompletionStatus);
|
||||||
|
AppLayerParserRegisterGetStateProgressFunc(IPPROTO_UDP,
|
||||||
|
ALPROTO_NTP, NTPGetStateProgress);
|
||||||
|
AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPGetTx);
|
||||||
|
|
||||||
|
/* Application layer event handling. */
|
||||||
|
AppLayerParserRegisterHasEventsFunc(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPHasEvents);
|
||||||
|
|
||||||
|
/* What is this being registered for? */
|
||||||
|
AppLayerParserRegisterDetectStateFuncs(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NULL, NTPGetTxDetectState, NTPSetTxDetectState);
|
||||||
|
|
||||||
|
AppLayerParserRegisterGetEventInfo(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPStateGetEventInfo);
|
||||||
|
AppLayerParserRegisterGetEventsFunc(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPGetEvents);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
SCLogDebug("NTP protocol parsing disabled.");
|
||||||
|
}
|
||||||
|
|
||||||
|
#ifdef UNITTESTS
|
||||||
|
AppLayerParserRegisterProtocolUnittests(IPPROTO_UDP, ALPROTO_NTP,
|
||||||
|
NTPParserRegisterTests);
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
#ifdef UNITTESTS
|
||||||
|
#endif
|
||||||
|
|
||||||
|
void NTPParserRegisterTests(void)
|
||||||
|
{
|
||||||
|
#ifdef UNITTESTS
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
#else /* HAVE_RUST */
|
||||||
|
|
||||||
|
void RegisterNTPParsers(void)
|
||||||
|
{
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif /* HAVE_RUST */
|
||||||
@ -0,0 +1,34 @@
|
|||||||
|
/* Copyright (C) 2017 Open Information Security Foundation
|
||||||
|
*
|
||||||
|
* You can copy, redistribute or modify this Program under the terms of
|
||||||
|
* the GNU General Public License version 2 as published by the Free
|
||||||
|
* Software Foundation.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* version 2 along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||||
|
* 02110-1301, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
* \file
|
||||||
|
*
|
||||||
|
* \author Pierre Chifflier <chifflier@wzdftpd.net>
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef __APP_LAYER_NTP_H__
|
||||||
|
#define __APP_LAYER_NTP_H__
|
||||||
|
|
||||||
|
void RegisterNTPParsers(void);
|
||||||
|
void NTPParserRegisterTests(void);
|
||||||
|
|
||||||
|
/** Opaque Rust types. */
|
||||||
|
typedef struct NTPState_ NTPState;
|
||||||
|
typedef struct NTPTransaction_ NTPTransaction;
|
||||||
|
|
||||||
|
#endif /* __APP_LAYER_NTP_H__ */
|
||||||
Loading…
Reference in New Issue