-/* Copyright (C) 2018 Open Information Security Foundation
+/* Copyright (C) 2018-2020 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
*/
use std;
-use core::{self, ALPROTO_UNKNOWN, AppProto, Flow, IPPROTO_TCP};
-use log::*;
-use std::mem::transmute;
-use applayer::{self, LoggerFlags};
-use parser::*;
+use crate::core::{ALPROTO_UNKNOWN, AppProto, Flow, IPPROTO_TCP};
+use crate::applayer::{self, *};
use std::ffi::CString;
use nom;
use super::parser;
static mut ALPROTO_TEMPLATE: AppProto = ALPROTO_UNKNOWN;
+#[derive(AppLayerEvent)]
+enum TemplateEvent {}
+
pub struct TemplateTransaction {
tx_id: u64,
pub request: Option<String>,
pub response: Option<String>,
- logged: LoggerFlags,
- de_state: Option<*mut core::DetectEngineState>,
- events: *mut core::AppLayerDecoderEvents,
+ tx_data: AppLayerTxData,
}
impl TemplateTransaction {
tx_id: 0,
request: None,
response: None,
- logged: LoggerFlags::new(),
- de_state: None,
- events: std::ptr::null_mut(),
- }
- }
-
- pub fn free(&mut self) {
- if self.events != std::ptr::null_mut() {
- core::sc_app_layer_decoder_events_free_events(&mut self.events);
- }
- if let Some(state) = self.de_state {
- core::sc_detect_engine_state_free(state);
+ tx_data: AppLayerTxData::new(),
}
}
}
-impl Drop for TemplateTransaction {
- fn drop(&mut self) {
- self.free();
+impl Transaction for TemplateTransaction {
+ fn id(&self) -> u64 {
+ self.tx_id
}
}
pub struct TemplateState {
tx_id: u64,
- request_buffer: Vec<u8>,
- response_buffer: Vec<u8>,
transactions: Vec<TemplateTransaction>,
+ request_gap: bool,
+ response_gap: bool,
+}
+
+impl State<TemplateTransaction> for TemplateState {
+ fn get_transactions(&self) -> &[TemplateTransaction] {
+ &self.transactions
+ }
}
impl TemplateState {
pub fn new() -> Self {
Self {
tx_id: 0,
- request_buffer: Vec::new(),
- response_buffer: Vec::new(),
transactions: Vec::new(),
+ request_gap: false,
+ response_gap: false,
}
}
None
}
- fn parse_request(&mut self, input: &[u8]) -> bool {
+ fn parse_request(&mut self, input: &[u8]) -> AppLayerResult {
// We're not interested in empty requests.
if input.len() == 0 {
- return true;
+ return AppLayerResult::ok();
}
- // For simplicity, always extend the buffer and work on it.
- self.request_buffer.extend(input);
+ // If there was gap, check we can sync up again.
+ if self.request_gap {
+ if probe(input).is_err() {
+ // The parser now needs to decide what to do as we are not in sync.
+ // For this template, we'll just try again next time.
+ return AppLayerResult::ok();
+ }
- let tmp: Vec<u8>;
- let mut current = {
- tmp = self.request_buffer.split_off(0);
- tmp.as_slice()
- };
+ // It looks like we're in sync with a message header, clear gap
+ // state and keep parsing.
+ self.request_gap = false;
+ }
- while current.len() > 0 {
- match parser::parse_message(current) {
+ let mut start = input;
+ while start.len() > 0 {
+ match parser::parse_message(start) {
Ok((rem, request)) => {
- current = rem;
+ start = rem;
SCLogNotice!("Request: {}", request);
let mut tx = self.new_tx();
tx.request = Some(request);
self.transactions.push(tx);
- }
+ },
Err(nom::Err::Incomplete(_)) => {
- self.request_buffer.extend_from_slice(current);
- break;
- }
+ // Not enough data. This parser doesn't give us a good indication
+ // of how much data is missing so just ask for one more byte so the
+ // parse is called as soon as more data is received.
+ let consumed = input.len() - start.len();
+ let needed = start.len() + 1;
+ return AppLayerResult::incomplete(consumed as u32, needed as u32);
+ },
Err(_) => {
- return false;
- }
+ return AppLayerResult::err();
+ },
}
}
- return true;
+ // Input was fully consumed.
+ return AppLayerResult::ok();
}
- fn parse_response(&mut self, input: &[u8]) -> bool {
+ fn parse_response(&mut self, input: &[u8]) -> AppLayerResult {
// We're not interested in empty responses.
if input.len() == 0 {
- return true;
+ return AppLayerResult::ok();
}
- // For simplicity, always extend the buffer and work on it.
- self.response_buffer.extend(input);
-
- let tmp: Vec<u8>;
- let mut current = {
- tmp = self.response_buffer.split_off(0);
- tmp.as_slice()
- };
+ if self.response_gap {
+ if probe(input).is_err() {
+ // The parser now needs to decide what to do as we are not in sync.
+ // For this template, we'll just try again next time.
+ return AppLayerResult::ok();
+ }
- while current.len() > 0 {
- match parser::parse_message(current) {
+ // It looks like we're in sync with a message header, clear gap
+ // state and keep parsing.
+ self.response_gap = false;
+ }
+ let mut start = input;
+ while start.len() > 0 {
+ match parser::parse_message(start) {
Ok((rem, response)) => {
- current = rem;
+ start = rem;
match self.find_request() {
Some(tx) => {
}
}
Err(nom::Err::Incomplete(_)) => {
- self.response_buffer.extend_from_slice(current);
- break;
+ let consumed = input.len() - start.len();
+ let needed = start.len() + 1;
+ return AppLayerResult::incomplete(consumed as u32, needed as u32);
}
Err(_) => {
- return false;
+ return AppLayerResult::err();
}
}
}
- return true;
+ // All input was fully consumed.
+ return AppLayerResult::ok();
}
- fn tx_iterator(
- &mut self,
- min_tx_id: u64,
- state: &mut u64,
- ) -> Option<(&TemplateTransaction, u64, bool)> {
- let mut index = *state as usize;
- let len = self.transactions.len();
-
- while index < len {
- let tx = &self.transactions[index];
- if tx.tx_id < min_tx_id + 1 {
- index += 1;
- continue;
- }
- *state = index as u64;
- return Some((tx, tx.tx_id - 1, (len - index) > 1));
- }
+ fn on_request_gap(&mut self, _size: u32) {
+ self.request_gap = true;
+ }
- return None;
+ fn on_response_gap(&mut self, _size: u32) {
+ self.response_gap = true;
}
}
-/// Probe to see if this input looks like a request or response.
+/// Probe for a valid header.
///
-/// For the purposes of this template things will be kept simple. The
-/// protocol is text based with the leading text being the length of
-/// the message in bytes. So simply make sure the first character is
-/// between "1" and "9".
-fn probe(input: &[u8]) -> bool {
- if input.len() > 1 && input[0] >= 49 && input[0] <= 57 {
- return true;
- }
- return false;
+/// As this template protocol uses messages prefixed with the size
+/// as a string followed by a ':', we look at up to the first 10
+/// characters for that pattern.
+fn probe(input: &[u8]) -> nom::IResult<&[u8], ()> {
+ let size = std::cmp::min(10, input.len());
+ let (rem, prefix) = nom::bytes::complete::take(size)(input)?;
+ nom::sequence::terminated(
+ nom::bytes::complete::take_while1(nom::character::is_digit),
+ nom::bytes::complete::tag(":"),
+ )(prefix)?;
+ Ok((rem, ()))
}
// C exports.
-export_tx_get_detect_state!(
- rs_template_tx_get_detect_state,
- TemplateTransaction
-);
-export_tx_set_detect_state!(
- rs_template_tx_set_detect_state,
- TemplateTransaction
-);
-
/// C entry point for a probing parser.
#[no_mangle]
-pub extern "C" fn rs_template_probing_parser(
+pub unsafe extern "C" fn rs_template_probing_parser(
_flow: *const Flow,
_direction: u8,
input: *const u8,
_rdir: *mut u8
) -> AppProto {
// Need at least 2 bytes.
- if input_len > 1 && input != std::ptr::null_mut() {
+ if input_len > 1 && !input.is_null() {
let slice = build_slice!(input, input_len as usize);
- if probe(slice) {
- return unsafe { ALPROTO_TEMPLATE };
+ if probe(slice).is_ok() {
+ return ALPROTO_TEMPLATE;
}
}
return ALPROTO_UNKNOWN;
}
#[no_mangle]
-pub extern "C" fn rs_template_state_new() -> *mut std::os::raw::c_void {
+pub extern "C" fn rs_template_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void {
let state = TemplateState::new();
let boxed = Box::new(state);
- return unsafe { transmute(boxed) };
+ return Box::into_raw(boxed) as *mut std::os::raw::c_void;
}
#[no_mangle]
-pub extern "C" fn rs_template_state_free(state: *mut std::os::raw::c_void) {
- // Just unbox...
- let _drop: Box<TemplateState> = unsafe { transmute(state) };
+pub unsafe extern "C" fn rs_template_state_free(state: *mut std::os::raw::c_void) {
+ std::mem::drop(Box::from_raw(state as *mut TemplateState));
}
#[no_mangle]
-pub extern "C" fn rs_template_state_tx_free(
+pub unsafe extern "C" fn rs_template_state_tx_free(
state: *mut std::os::raw::c_void,
tx_id: u64,
) {
}
#[no_mangle]
-pub extern "C" fn rs_template_parse_request(
+pub unsafe extern "C" fn rs_template_parse_request(
_flow: *const Flow,
state: *mut std::os::raw::c_void,
pstate: *mut std::os::raw::c_void,
input_len: u32,
_data: *const std::os::raw::c_void,
_flags: u8,
-) -> i32 {
- let eof = unsafe {
- if AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF) > 0 {
- true
- } else {
- false
- }
+) -> AppLayerResult {
+ let eof = if AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) > 0 {
+ true
+ } else {
+ false
};
if eof {
- // If needed, handled EOF, or pass it into the parser.
+ // If needed, handle EOF, or pass it into the parser.
+ return AppLayerResult::ok();
}
let state = cast_pointer!(state, TemplateState);
- let buf = build_slice!(input, input_len as usize);
- if state.parse_request(buf) {
- return 1;
+
+ if input.is_null() && input_len > 0 {
+ // Here we have a gap signaled by the input being null, but a greater
+ // than 0 input_len which provides the size of the gap.
+ state.on_request_gap(input_len);
+ AppLayerResult::ok()
+ } else {
+ let buf = build_slice!(input, input_len as usize);
+ state.parse_request(buf)
}
- return -1;
}
#[no_mangle]
-pub extern "C" fn rs_template_parse_response(
+pub unsafe extern "C" fn rs_template_parse_response(
_flow: *const Flow,
state: *mut std::os::raw::c_void,
pstate: *mut std::os::raw::c_void,
input_len: u32,
_data: *const std::os::raw::c_void,
_flags: u8,
-) -> i32 {
- let _eof = unsafe {
- if AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF) > 0 {
- true
- } else {
- false
- }
+) -> AppLayerResult {
+ let _eof = if AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC) > 0 {
+ true
+ } else {
+ false
};
let state = cast_pointer!(state, TemplateState);
- let buf = build_slice!(input, input_len as usize);
- if state.parse_response(buf) {
- return 1;
+
+ if input.is_null() && input_len > 0 {
+ // Here we have a gap signaled by the input being null, but a greater
+ // than 0 input_len which provides the size of the gap.
+ state.on_response_gap(input_len);
+ AppLayerResult::ok()
+ } else {
+ let buf = build_slice!(input, input_len as usize);
+ state.parse_response(buf)
}
- return -1;
}
#[no_mangle]
-pub extern "C" fn rs_template_state_get_tx(
+pub unsafe extern "C" fn rs_template_state_get_tx(
state: *mut std::os::raw::c_void,
tx_id: u64,
) -> *mut std::os::raw::c_void {
let state = cast_pointer!(state, TemplateState);
match state.get_tx(tx_id) {
Some(tx) => {
- return unsafe { transmute(tx) };
+ return tx as *const _ as *mut _;
}
None => {
return std::ptr::null_mut();
}
#[no_mangle]
-pub extern "C" fn rs_template_state_get_tx_count(
+pub unsafe extern "C" fn rs_template_state_get_tx_count(
state: *mut std::os::raw::c_void,
) -> u64 {
let state = cast_pointer!(state, TemplateState);
}
#[no_mangle]
-pub extern "C" fn rs_template_state_progress_completion_status(
- _direction: u8,
-) -> std::os::raw::c_int {
- // This parser uses 1 to signal transaction completion status.
- return 1;
-}
-
-#[no_mangle]
-pub extern "C" fn rs_template_tx_get_alstate_progress(
+pub unsafe extern "C" fn rs_template_tx_get_alstate_progress(
tx: *mut std::os::raw::c_void,
_direction: u8,
) -> std::os::raw::c_int {
return 0;
}
-#[no_mangle]
-pub extern "C" fn rs_template_tx_get_logged(
- _state: *mut std::os::raw::c_void,
- tx: *mut std::os::raw::c_void,
-) -> u32 {
- let tx = cast_pointer!(tx, TemplateTransaction);
- return tx.logged.get();
-}
-
-#[no_mangle]
-pub extern "C" fn rs_template_tx_set_logged(
- _state: *mut std::os::raw::c_void,
- tx: *mut std::os::raw::c_void,
- logged: u32,
-) {
- let tx = cast_pointer!(tx, TemplateTransaction);
- tx.logged.set(logged);
-}
-
-#[no_mangle]
-pub extern "C" fn rs_template_state_get_events(
- tx: *mut std::os::raw::c_void
-) -> *mut core::AppLayerDecoderEvents {
- let tx = cast_pointer!(tx, TemplateTransaction);
- return tx.events;
-}
-
-#[no_mangle]
-pub extern "C" fn rs_template_state_get_event_info(
- _event_name: *const std::os::raw::c_char,
- _event_id: *mut std::os::raw::c_int,
- _event_type: *mut core::AppLayerEventType,
-) -> std::os::raw::c_int {
- return -1;
-}
-
-#[no_mangle]
-pub extern "C" fn rs_template_state_get_tx_iterator(
- _ipproto: u8,
- _alproto: AppProto,
- state: *mut std::os::raw::c_void,
- min_tx_id: u64,
- _max_tx_id: u64,
- istate: &mut u64,
-) -> applayer::AppLayerGetTxIterTuple {
- let state = cast_pointer!(state, TemplateState);
- match state.tx_iterator(min_tx_id, istate) {
- Some((tx, out_tx_id, has_next)) => {
- let c_tx = unsafe { transmute(tx) };
- let ires = applayer::AppLayerGetTxIterTuple::with_values(
- c_tx,
- out_tx_id,
- has_next,
- );
- return ires;
- }
- None => {
- return applayer::AppLayerGetTxIterTuple::not_found();
- }
- }
-}
-
/// Get the request buffer for a transaction from C.
///
/// No required for parsing, but an example function for retrieving a
/// pointer to the request buffer from C for detection.
#[no_mangle]
-pub extern "C" fn rs_template_get_request_buffer(
+pub unsafe extern "C" fn rs_template_get_request_buffer(
tx: *mut std::os::raw::c_void,
buf: *mut *const u8,
len: *mut u32,
let tx = cast_pointer!(tx, TemplateTransaction);
if let Some(ref request) = tx.request {
if request.len() > 0 {
- unsafe {
- *len = request.len() as u32;
- *buf = request.as_ptr();
- }
+ *len = request.len() as u32;
+ *buf = request.as_ptr();
return 1;
}
}
/// Get the response buffer for a transaction from C.
#[no_mangle]
-pub extern "C" fn rs_template_get_response_buffer(
+pub unsafe extern "C" fn rs_template_get_response_buffer(
tx: *mut std::os::raw::c_void,
buf: *mut *const u8,
len: *mut u32,
let tx = cast_pointer!(tx, TemplateTransaction);
if let Some(ref response) = tx.response {
if response.len() > 0 {
- unsafe {
- *len = response.len() as u32;
- *buf = response.as_ptr();
- }
+ *len = response.len() as u32;
+ *buf = response.as_ptr();
return 1;
}
}
return 0;
}
+export_tx_data_get!(rs_template_get_tx_data, TemplateTransaction);
+
// Parser name as a C style string.
const PARSER_NAME: &'static [u8] = b"template-rust\0";
name: PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
default_port: default_port.as_ptr(),
ipproto: IPPROTO_TCP,
- probe_ts: rs_template_probing_parser,
- probe_tc: rs_template_probing_parser,
+ probe_ts: Some(rs_template_probing_parser),
+ probe_tc: Some(rs_template_probing_parser),
min_depth: 0,
max_depth: 16,
state_new: rs_template_state_new,
parse_tc: rs_template_parse_response,
get_tx_count: rs_template_state_get_tx_count,
get_tx: rs_template_state_get_tx,
- tx_get_comp_st: rs_template_state_progress_completion_status,
+ tx_comp_st_ts: 1,
+ tx_comp_st_tc: 1,
tx_get_progress: rs_template_tx_get_alstate_progress,
- get_tx_logged: Some(rs_template_tx_get_logged),
- set_tx_logged: Some(rs_template_tx_set_logged),
- get_de_state: rs_template_tx_get_detect_state,
- set_de_state: rs_template_tx_set_detect_state,
- get_events: Some(rs_template_state_get_events),
- get_eventinfo: Some(rs_template_state_get_event_info),
+ get_eventinfo: Some(TemplateEvent::get_event_info),
+ get_eventinfo_byid : Some(TemplateEvent::get_event_info_by_id),
localstorage_new: None,
localstorage_free: None,
- get_tx_mpm_id: None,
- set_tx_mpm_id: None,
get_files: None,
- get_tx_iterator: Some(rs_template_state_get_tx_iterator),
+ get_tx_iterator: Some(applayer::state_get_tx_iterator::<TemplateState, TemplateTransaction>),
+ get_tx_data: rs_template_get_tx_data,
+ apply_tx_config: None,
+ flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
+ truncate: None,
};
let ip_proto_str = CString::new("tcp").unwrap();
SCLogNotice!("Protocol detector and parser disabled for TEMPLATE.");
}
}
+
+#[cfg(test)]
+mod test {
+ use super::*;
+
+ #[test]
+ fn test_probe() {
+ assert!(probe(b"1").is_err());
+ assert!(probe(b"1:").is_ok());
+ assert!(probe(b"123456789:").is_ok());
+ assert!(probe(b"0123456789:").is_err());
+ }
+
+ #[test]
+ fn test_incomplete() {
+ let mut state = TemplateState::new();
+ let buf = b"5:Hello3:bye";
+
+ let r = state.parse_request(&buf[0..0]);
+ assert_eq!(r, AppLayerResult{ status: 0, consumed: 0, needed: 0});
+
+ let r = state.parse_request(&buf[0..1]);
+ assert_eq!(r, AppLayerResult{ status: 1, consumed: 0, needed: 2});
+
+ let r = state.parse_request(&buf[0..2]);
+ assert_eq!(r, AppLayerResult{ status: 1, consumed: 0, needed: 3});
+
+ // This is the first message and only the first message.
+ let r = state.parse_request(&buf[0..7]);
+ assert_eq!(r, AppLayerResult{ status: 0, consumed: 0, needed: 0});
+
+ // The first message and a portion of the second.
+ let r = state.parse_request(&buf[0..9]);
+ assert_eq!(r, AppLayerResult{ status: 1, consumed: 7, needed: 3});
+ }
+}
projects / people / ms / suricata.git / blobdiff