mysql: fix register parser and logger bug and add document

Task #3446
OISF · Dec 11, 2024 · 17a8cad · 17a8cad
1 parent 773d170
commit 17a8cad
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/rust/src/mysql/mysql.rs b/rust/src/mysql/mysql.rs
@@ -1019,8 +1019,28 @@ pub unsafe extern "C" fn rs_mysql_probing_ts(
 ) -> AppProto {
     if input_len >= 1 && !input.is_null() {
         let slice: &[u8] = build_slice!(input, input_len as usize);
-        match parse_handshake_response(slice) {
-            Ok(_) => return ALPROTO_MYSQL,
+        match parse_handshake_capabilities(slice) {
+            Ok((_, client_flags)) => {
+                if client_flags & CLIENT_SSL != 0 {
+                    match parse_handshake_ssl_request(slice) {
+                        Ok(_) => return ALPROTO_MYSQL,
+                        Err(nom7::Err::Incomplete(_)) => return ALPROTO_UNKNOWN,
+                        Err(err) => {
+                            SCLogError!("failed to probe ssl request {:?}", err);
+                            return ALPROTO_FAILED;
+                        }
+                    }
+                } else {
+                    match parse_handshake_response(slice) {
+                        Ok(_) => return ALPROTO_MYSQL,
+                        Err(nom7::Err::Incomplete(_)) => return ALPROTO_UNKNOWN,
+                        Err(err) => {
+                            SCLogError!("failed to probe handshake response {:?}", err);
+                            return ALPROTO_FAILED;
+                        }
+                    }
+                }
+            }
             Err(nom7::Err::Incomplete(_)) => return ALPROTO_UNKNOWN,
             Err(_err) => {
                 SCLogDebug!("failed to probe request {:?}", _err);

diff --git a/src/app-layer-protos.h b/src/app-layer-protos.h
@@ -64,7 +64,6 @@ enum AppProtoEnum {
     ALPROTO_HTTP2,
     ALPROTO_BITTORRENT_DHT,
     ALPROTO_POP3,
-    ALPROTO_MYSQL,
 
     // signature-only (ie not seen in flow)
     // HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)