rust/src/dhcp/dhcp.rs

   1 /* Copyright (C) 2018-2020 Open Information Security Foundation
   2  *
   3  * You can copy, redistribute or modify this Program under the terms of
   4  * the GNU General Public License version 2 as published by the Free
   5  * Software Foundation.
   6  *
   7  * This program is distributed in the hope that it will be useful,
   8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
   9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  10  * GNU General Public License for more details.
  11  *
  12  * You should have received a copy of the GNU General Public License
  13  * version 2 along with this program; if not, write to the Free Software
  14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  15  * 02110-1301, USA.
  16  */
  17
  18 use crate::applayer::{self, *};
  19 use crate::core;
  20 use crate::core::{ALPROTO_UNKNOWN, AppProto, Flow, IPPROTO_UDP};
  21 use crate::core::sc_app_layer_decoder_events_free_events;
  22 use crate::dhcp::parser::*;
  23 use std;
  24 use std::ffi::CString;
  25
  26 static mut ALPROTO_DHCP: AppProto = ALPROTO_UNKNOWN;
  27
  28 static DHCP_MIN_FRAME_LEN: u32 = 232;
  29
  30 pub const BOOTP_REQUEST: u8 = 1;
  31 pub const BOOTP_REPLY: u8 = 2;
  32
  33 // DHCP option types. Names based on IANA naming:
  34 // https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml
  35 pub const DHCP_OPT_SUBNET_MASK: u8 = 1;
  36 pub const DHCP_OPT_ROUTERS: u8 = 3;
  37 pub const DHCP_OPT_DNS_SERVER: u8 = 6;
  38 pub const DHCP_OPT_HOSTNAME: u8 = 12;
  39 pub const DHCP_OPT_REQUESTED_IP: u8 = 50;
  40 pub const DHCP_OPT_ADDRESS_TIME: u8 = 51;
  41 pub const DHCP_OPT_TYPE: u8 = 53;
  42 pub const DHCP_OPT_SERVER_ID: u8 = 54;
  43 pub const DHCP_OPT_PARAMETER_LIST: u8 = 55;
  44 pub const DHCP_OPT_RENEWAL_TIME: u8 = 58;
  45 pub const DHCP_OPT_REBINDING_TIME: u8 = 59;
  46 pub const DHCP_OPT_CLIENT_ID: u8 = 61;
  47 pub const DHCP_OPT_END: u8 = 255;
  48
  49 /// DHCP message types.
  50 pub const DHCP_TYPE_DISCOVER: u8 = 1;
  51 pub const DHCP_TYPE_OFFER: u8 = 2;
  52 pub const DHCP_TYPE_REQUEST: u8 = 3;
  53 pub const DHCP_TYPE_DECLINE: u8 = 4;
  54 pub const DHCP_TYPE_ACK: u8 = 5;
  55 pub const DHCP_TYPE_NAK: u8 = 6;
  56 pub const DHCP_TYPE_RELEASE: u8 = 7;
  57 pub const DHCP_TYPE_INFORM: u8 = 8;
  58
  59 /// DHCP parameter types.
  60 /// https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.txt
  61 pub const DHCP_PARAM_SUBNET_MASK: u8 = 1;
  62 pub const DHCP_PARAM_ROUTER: u8 = 3;
  63 pub const DHCP_PARAM_DNS_SERVER: u8 = 6;
  64 pub const DHCP_PARAM_DOMAIN: u8 = 15;
  65 pub const DHCP_PARAM_ARP_TIMEOUT: u8 = 35;
  66 pub const DHCP_PARAM_NTP_SERVER: u8 = 42;
  67 pub const DHCP_PARAM_TFTP_SERVER_NAME: u8 = 66;
  68 pub const DHCP_PARAM_TFTP_SERVER_IP: u8 = 150;
  69
  70 #[derive(AppLayerEvent)]
  71 pub enum DHCPEvent {
  72     TruncatedOptions,
  73     MalformedOptions,
  74 }
  75
  76 /// The concept of a transaction is more to satisfy the Suricata
  77 /// app-layer. This DHCP parser is actually stateless where each
  78 /// message is its own transaction.
  79 pub struct DHCPTransaction {
  80     tx_id: u64,
  81     pub message: DHCPMessage,
  82     events: *mut core::AppLayerDecoderEvents,
  83     tx_data: applayer::AppLayerTxData,
  84 }
  85
  86 impl DHCPTransaction {
  87     pub fn new(id: u64, message: DHCPMessage) -> DHCPTransaction {
  88         DHCPTransaction {
  89             tx_id: id,
  90             message: message,
  91             events: std::ptr::null_mut(),
  92             tx_data: applayer::AppLayerTxData::new(),
  93         }
  94     }
  95
  96     pub fn free(&mut self) {
  97         if !self.events.is_null() {
  98             sc_app_layer_decoder_events_free_events(&mut self.events);
  99         }
 100     }
 101
 102 }
 103
 104 impl Transaction for DHCPTransaction {
 105     fn id(&self) -> u64 {
 106         self.tx_id
 107     }
 108 }
 109
 110 impl Drop for DHCPTransaction {
 111     fn drop(&mut self) {
 112         self.free();
 113     }
 114 }
 115
 116 #[derive(Default)]
 117 pub struct DHCPState {
 118     // Internal transaction ID.
 119     tx_id: u64,
 120
 121     // List of transactions.
 122     transactions: Vec<DHCPTransaction>,
 123
 124     events: u16,
 125 }
 126
 127 impl State<DHCPTransaction> for DHCPState {
 128     fn get_transactions(&self) -> &[DHCPTransaction] {
 129         &self.transactions
 130     }
 131 }
 132
 133 impl DHCPState {
 134     pub fn new() -> Self {
 135         Default::default()
 136     }
 137
 138     pub fn parse(&mut self, input: &[u8]) -> bool {
 139         match dhcp_parse(input) {
 140             Ok((_, message)) => {
 141                 let malformed_options = message.malformed_options;
 142                 let truncated_options = message.truncated_options;
 143                 self.tx_id += 1;
 144                 let transaction = DHCPTransaction::new(self.tx_id, message);
 145                 self.transactions.push(transaction);
 146                 if malformed_options {
 147                     self.set_event(DHCPEvent::MalformedOptions);
 148                 }
 149                 if truncated_options {
 150                     self.set_event(DHCPEvent::TruncatedOptions);
 151                 }
 152                 return true;
 153             }
 154             _ => {
 155                 return false;
 156             }
 157         }
 158     }
 159
 160     pub fn get_tx(&mut self, tx_id: u64) -> Option<&DHCPTransaction> {
 161         for tx in &mut self.transactions {
 162             if tx.tx_id == tx_id + 1 {
 163                 return Some(tx);
 164             }
 165         }
 166         return None;
 167     }
 168
 169     fn free_tx(&mut self, tx_id: u64) {
 170         let len = self.transactions.len();
 171         let mut found = false;
 172         let mut index = 0;
 173         for i in 0..len {
 174             let tx = &self.transactions[i];
 175             if tx.tx_id == tx_id + 1 {
 176                 found = true;
 177                 index = i;
 178                 break;
 179             }
 180         }
 181         if found {
 182             self.transactions.remove(index);
 183         }
 184     }
 185
 186     fn set_event(&mut self, event: DHCPEvent) {
 187         if let Some(tx) = self.transactions.last_mut() {
 188             core::sc_app_layer_decoder_events_set_event_raw(
 189                 &mut tx.events, event as u8);
 190             self.events += 1;
 191         }
 192     }
 193 }
 194
 195 #[no_mangle]
 196 pub unsafe extern "C" fn rs_dhcp_probing_parser(_flow: *const Flow,
 197                                          _direction: u8,
 198                                          input: *const u8,
 199                                          input_len: u32,
 200                                          _rdir: *mut u8) -> AppProto
 201 {
 202     if input_len < DHCP_MIN_FRAME_LEN {
 203         return ALPROTO_UNKNOWN;
 204     }
 205
 206     let slice = build_slice!(input, input_len as usize);
 207     match parse_header(slice) {
 208         Ok((_, _)) => {
 209             return ALPROTO_DHCP;
 210         }
 211         _ => {
 212             return ALPROTO_UNKNOWN;
 213         }
 214     }
 215 }
 216
 217 #[no_mangle]
 218 pub extern "C" fn rs_dhcp_tx_get_alstate_progress(_tx: *mut std::os::raw::c_void,
 219                                                   _direction: u8) -> std::os::raw::c_int {
 220     // As this is a stateless parser, simply use 1.
 221     return 1;
 222 }
 223
 224 #[no_mangle]
 225 pub unsafe extern "C" fn rs_dhcp_state_get_tx(state: *mut std::os::raw::c_void,
 226                                        tx_id: u64) -> *mut std::os::raw::c_void {
 227     let state = cast_pointer!(state, DHCPState);
 228     match state.get_tx(tx_id) {
 229         Some(tx) => {
 230             return tx as *const _ as *mut _;
 231         }
 232         None => {
 233             return std::ptr::null_mut();
 234         }
 235     }
 236 }
 237
 238 #[no_mangle]
 239 pub unsafe extern "C" fn rs_dhcp_state_get_tx_count(state: *mut std::os::raw::c_void) -> u64 {
 240     let state = cast_pointer!(state, DHCPState);
 241     return state.tx_id;
 242 }
 243
 244 #[no_mangle]
 245 pub unsafe extern "C" fn rs_dhcp_parse(_flow: *const core::Flow,
 246                                 state: *mut std::os::raw::c_void,
 247                                 _pstate: *mut std::os::raw::c_void,
 248                                 input: *const u8,
 249                                 input_len: u32,
 250                                 _data: *const std::os::raw::c_void,
 251                                 _flags: u8) -> AppLayerResult {
 252     let state = cast_pointer!(state, DHCPState);
 253     let buf = build_slice!(input, input_len as usize);
 254     if state.parse(buf) {
 255         return AppLayerResult::ok();
 256     }
 257     return AppLayerResult::err();
 258 }
 259
 260 #[no_mangle]
 261 pub unsafe extern "C" fn rs_dhcp_state_tx_free(
 262     state: *mut std::os::raw::c_void,
 263     tx_id: u64)
 264 {
 265     let state = cast_pointer!(state, DHCPState);
 266     state.free_tx(tx_id);
 267 }
 268
 269 #[no_mangle]
 270 pub extern "C" fn rs_dhcp_state_new(_orig_state: *mut std::os::raw::c_void, _orig_proto: AppProto) -> *mut std::os::raw::c_void {
 271     let state = DHCPState::new();
 272     let boxed = Box::new(state);
 273     return Box::into_raw(boxed) as *mut _;
 274 }
 275
 276 #[no_mangle]
 277 pub unsafe extern "C" fn rs_dhcp_state_free(state: *mut std::os::raw::c_void) {
 278     std::mem::drop(Box::from_raw(state as *mut DHCPState));
 279 }
 280
 281 #[no_mangle]
 282 pub unsafe extern "C" fn rs_dhcp_state_get_events(tx: *mut std::os::raw::c_void)
 283                                            -> *mut core::AppLayerDecoderEvents
 284 {
 285     let tx = cast_pointer!(tx, DHCPTransaction);
 286     return tx.events;
 287 }
 288
 289 export_tx_data_get!(rs_dhcp_get_tx_data, DHCPTransaction);
 290
 291 const PARSER_NAME: &'static [u8] = b"dhcp\0";
 292
 293 #[no_mangle]
 294 pub unsafe extern "C" fn rs_dhcp_register_parser() {
 295     SCLogDebug!("Registering DHCP parser.");
 296     let ports = CString::new("[67,68]").unwrap();
 297     let parser = RustParser {
 298         name: PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
 299         default_port       : ports.as_ptr(),
 300         ipproto            : IPPROTO_UDP,
 301         probe_ts           : Some(rs_dhcp_probing_parser),
 302         probe_tc           : Some(rs_dhcp_probing_parser),
 303         min_depth          : 0,
 304         max_depth          : 16,
 305         state_new          : rs_dhcp_state_new,
 306         state_free         : rs_dhcp_state_free,
 307         tx_free            : rs_dhcp_state_tx_free,
 308         parse_ts           : rs_dhcp_parse,
 309         parse_tc           : rs_dhcp_parse,
 310         get_tx_count       : rs_dhcp_state_get_tx_count,
 311         get_tx             : rs_dhcp_state_get_tx,
 312         tx_comp_st_ts      : 1,
 313         tx_comp_st_tc      : 1,
 314         tx_get_progress    : rs_dhcp_tx_get_alstate_progress,
 315         get_events         : Some(rs_dhcp_state_get_events),
 316         get_eventinfo      : Some(DHCPEvent::get_event_info),
 317         get_eventinfo_byid : Some(DHCPEvent::get_event_info_by_id),
 318         localstorage_new   : None,
 319         localstorage_free  : None,
 320         get_files          : None,
 321         get_tx_iterator    : Some(applayer::state_get_tx_iterator::<DHCPState, DHCPTransaction>),
 322         get_tx_data        : rs_dhcp_get_tx_data,
 323         apply_tx_config    : None,
 324         flags              : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
 325         truncate           : None,
 326     };
 327
 328     let ip_proto_str = CString::new("udp").unwrap();
 329
 330     if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
 331         let alproto = AppLayerRegisterProtocolDetection(&parser, 1);
 332         ALPROTO_DHCP = alproto;
 333         if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
 334             let _ = AppLayerRegisterParser(&parser, alproto);
 335         }
 336     } else {
 337         SCLogDebug!("Protocol detector and parser disabled for DHCP.");
 338     }
 339 }