suricata/rust/src/nfs/log.rs

/* Copyright (C) 2017-2020 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

use crate::jsonbuilder::{JsonBuilder, JsonError};
use crate::nfs::nfs::*;
use crate::nfs::types::*;
use crc::crc32;
use std::string::String;
use crate::detect::EnumString;

#[no_mangle]
pub extern "C" fn SCNfsTxLoggingIsFiltered(state: &mut NFSState, tx: &NFSTransaction) -> u8 {
    // TODO probably best to make this configurable

    if state.nfs_version <= 3 && tx.procedure == NFSPROC3_GETATTR {
        return 1;
    }

    return 0;
}

fn nfs_rename_object(tx: &NFSTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
    let from_str = String::from_utf8_lossy(&tx.file_name);
    js.set_string("from", &from_str)?;

    let to_vec = match tx.type_data {
        Some(NFSTransactionTypeData::RENAME(ref x)) => x.to_vec(),
        _ => Vec::new(),
    };

    let to_str = String::from_utf8_lossy(&to_vec);
    js.set_string("to", &to_str)?;
    Ok(())
}

fn nfs_creds_object(tx: &NFSTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
    let mach_name = String::from_utf8_lossy(&tx.request_machine_name);
    js.set_string("machine_name", &mach_name)?;
    js.set_uint("uid", tx.request_uid as u64)?;
    js.set_uint("gid", tx.request_gid as u64)?;
    Ok(())
}

fn nfs_file_object(tx: &NFSTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
    js.set_bool("first", tx.is_first)?;
    js.set_bool("last", tx.is_last)?;

    if let Some(NFSTransactionTypeData::FILE(ref tdf)) = tx.type_data {
        js.set_uint("last_xid", tdf.file_last_xid as u64)?;
        js.set_uint("chunks", tdf.chunk_count as u64)?;
    }
    Ok(())
}
/*
fn nfs_handle2hex(bytes: &Vec<u8>) -> String {
    let strings: Vec<String> = bytes.iter()
        .map(|b| format!("{:02x}", b))
        .collect();
    strings.join("")
}
*/
fn nfs_handle2crc(bytes: &[u8]) -> u32 {
    let c = crc32::checksum_ieee(bytes);
    c
}

fn nfs_common_header(
    state: &NFSState, tx: &NFSTransaction, js: &mut JsonBuilder,
) -> Result<(), JsonError> {
    js.set_uint("version", state.nfs_version as u64)?;
    if state.nfs_version == 3 {
        if let Some(proc) = NfsProc3::from_u(tx.procedure) {
            js.set_string("procedure", &proc.to_str().to_uppercase())?;
        } else {
            js.set_string("procedure", &format!("{}", tx.procedure))?;
        }
    } else if state.nfs_version <= 2 {
        if let Some(proc) = NfsProc2::from_u(tx.procedure) {
            js.set_string("procedure", &proc.to_str().to_uppercase())?;
        } else {
            js.set_string("procedure", &format!("{}", tx.procedure))?;
        }
    } else if let Some(proc) = NfsProc4::from_u(tx.procedure) {
        js.set_string("procedure", &proc.to_str().to_uppercase())?;
    } else {
        js.set_string("procedure", &format!("{}", tx.procedure))?;
    }
    let file_name = String::from_utf8_lossy(&tx.file_name);
    js.set_string("filename", &file_name)?;

    if !tx.file_handle.is_empty() {
        //js.set_string("handle", &nfs_handle2hex(&tx.file_handle));
        let c = nfs_handle2crc(&tx.file_handle);
        let s = format!("{:x}", c);
        js.set_string("hhash", &s)?;
    }
    js.set_uint("id", tx.id)?;
    js.set_bool("file_tx", tx.is_file_tx)?;
    Ok(())
}

fn nfs_log_response(
    state: &NFSState, tx: &NFSTransaction, js: &mut JsonBuilder,
) -> Result<(), JsonError> {
    nfs_common_header(state, tx, js)?;
    js.set_string("type", "response")?;

    js.set_string("status", &nfs3_status_string(tx.nfs_response_status))?;

    if state.nfs_version <= 3 {
        if tx.procedure == NFSPROC3_READ {
            js.open_object("read")?;
            nfs_file_object(tx, js)?;
            js.close()?;
        } else if tx.procedure == NFSPROC3_WRITE {
            js.open_object("write")?;
            nfs_file_object(tx, js)?;
            js.close()?;
        } else if tx.procedure == NFSPROC3_RENAME {
            js.open_object("rename")?;
            nfs_rename_object(tx, js)?;
            js.close()?;
        }
    }
    Ok(())
}

#[no_mangle]
pub extern "C" fn SCNfsLogJsonResponse(
    state: &mut NFSState, tx: &NFSTransaction, js: &mut JsonBuilder,
) -> bool {
    nfs_log_response(state, tx, js).is_ok()
}

fn rpc_log_response(tx: &NFSTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
    js.set_uint("xid", tx.xid as u64)?;
    js.set_string("status", &rpc_status_string(tx.rpc_response_status))?;
    js.set_string("auth_type", &rpc_auth_type_string(tx.auth_type))?;
    if tx.auth_type == RPCAUTH_UNIX {
        js.open_object("creds")?;
        nfs_creds_object(tx, js)?;
        js.close()?;
    }
    Ok(())
}

#[no_mangle]
pub extern "C" fn SCNfsRpcLogJsonResponse(tx: &NFSTransaction, js: &mut JsonBuilder) -> bool {
    rpc_log_response(tx, js).is_ok()
}