Output alert applayer v17.2

rust/src/core.rs

@@ -253,6 +253,13 @@ pub extern "C" fn rs_init(context: &'static SuricataContext)
     init_ffi(context);
 }
 
+#[no_mangle]
+pub extern "C" fn rs_update_alproto_failed(alproto: AppProto) {
+    unsafe {
+        ALPROTO_FAILED = alproto;
+    }
+}
+
 /// DetectEngineStateFree wrapper.
 pub fn sc_detect_engine_state_free(state: *mut DetectEngineState)
 {

rust/src/mqtt/detect.rs

@@ -168,23 +168,23 @@ pub unsafe extern "C" fn rs_mqtt_tx_get_connect_username(
 
 #[no_mangle]
 pub unsafe extern "C" fn rs_mqtt_tx_get_connect_password(
-    tx: &MQTTTransaction, buffer: *mut *const u8, buffer_len: *mut u32,
-) -> u8 {
+    tx: &MQTTTransaction, _flow_flags: u8, buffer: *mut *const u8, buffer_len: *mut u32,
+) -> bool {
     for msg in tx.msg.iter() {
         if let MQTTOperation::CONNECT(ref cv) = msg.op {
             if let Some(p) = &cv.password {
                 if !p.is_empty() {
                     *buffer = p.as_ptr();
                     *buffer_len = p.len() as u32;
-                    return 1;
+                    return true;
                 }
             }
         }
     }
 
     *buffer = ptr::null();
     *buffer_len = 0;
-    return 0;
+    return false;
 }
 
 #[no_mangle]

scripts/setup-app-layer.py

@@ -200,43 +200,34 @@ def logger_patch_output_c(proto):
     output = io.StringIO()
     inlines = open(filename).readlines()
     for i, line in enumerate(inlines):
-        if line.find("ALPROTO_TEMPLATE") > -1:
-            new_line = line.replace("TEMPLATE", proto.upper()).replace(
-                    "template", proto.lower())
-            output.write(new_line)
-        if line.find("output-json-template.h") > -1:
-            output.write(line.replace("template", proto.lower()))
         if line.find("/* Template JSON logger.") > -1:
             output.write(inlines[i].replace("Template", proto))
             output.write(inlines[i+1].replace("Template", proto))
+            output.write(inlines[i+2].replace("TEMPLATE", proto.upper()).replace(
+                    "template", proto.lower()).replace("Template", proto))
+            output.write(inlines[i+3])
+        if line.find("rs_template_logger_log") > -1:
+            output.write(inlines[i].replace("TEMPLATE", proto.upper()).replace(
+                    "template", proto.lower()))
+        if line.find("OutputTemplateLogInitSub(") > -1:
+            output.write(inlines[i].replace("Template", proto))
+            output.write(inlines[i+1])
+            output.write(inlines[i+2].replace("TEMPLATE", proto.upper()))
+            output.write(inlines[i+3])
+            output.write(inlines[i+4])
         output.write(line)
     open(filename, "w").write(output.getvalue())
 
 def logger_copy_templates(proto):
     lower = proto.lower()
 
     pairs = (
-        ("src/output-json-template.h",
-         "src/output-json-%s.h" % (lower)),
-        ("src/output-json-template.c",
-         "src/output-json-%s.c" % (lower)),
         ("rust/src/applayertemplate/logger.rs",
          "rust/src/applayer%s/logger.rs" % (lower)),
     )
 
     common_copy_templates(proto, pairs)
 
-def logger_patch_makefile_am(protoname):
-    filename = "src/Makefile.am"
-    print("Patching %s." % (filename))
-    output = io.StringIO()
-    with open(filename) as infile:
-        for line in infile:
-            if line.lstrip().startswith("output-json-template."):
-                output.write(line.replace("template", protoname.lower()))
-            output.write(line)
-    open(filename, "w").write(output.getvalue())
-
 
 def detect_copy_templates(proto, buffername):
     lower = proto.lower()
@@ -398,7 +389,6 @@ def main():
             raise SetupError("no app-layer parser exists for %s" % (proto))
         logger_copy_templates(proto)
         patch_rust_applayer_mod_rs(proto)
-        logger_patch_makefile_am(proto)
         logger_patch_output_c(proto)
         logger_patch_suricata_yaml_in(proto)
 

src/Makefile.am

@@ -137,6 +137,7 @@ noinst_HEADERS = \
 	detect-engine-file.h \
 	detect-engine-frame.h \
 	detect-engine.h \
+	detect-engine-helper.h \
 	detect-engine-iponly.h \
 	detect-engine-loader.h \
 	detect-engine-mpm.h \
@@ -397,7 +398,6 @@ noinst_HEADERS = \
 	output.h \
 	output-json-alert.h \
 	output-json-anomaly.h \
-	output-json-bittorrent-dht.h \
 	output-json-dcerpc.h \
 	output-json-dhcp.h \
 	output-json-dnp3.h \
@@ -410,27 +410,16 @@ noinst_HEADERS = \
 	output-json-frame.h \
 	output-json-ftp.h \
 	output-json.h \
-	output-json-http2.h \
 	output-json-http.h \
 	output-json-ike.h \
-	output-json-krb5.h \
 	output-json-metadata.h \
-	output-json-modbus.h \
-	output-json-quic.h \
 	output-json-mqtt.h \
 	output-json-netflow.h \
 	output-json-nfs.h \
 	output-json-pgsql.h \
-	output-json-rdp.h \
-	output-json-rfb.h \
-	output-json-sip.h \
 	output-json-smb.h \
 	output-json-smtp.h \
-	output-json-snmp.h \
-	output-json-ssh.h \
 	output-json-stats.h \
-	output-json-template.h \
-	output-json-tftp.h \
 	output-json-tls.h \
 	output-eve-syslog.h \
 	output-lua.h \
@@ -753,6 +742,7 @@ libsuricata_c_a_SOURCES = \
 	detect-engine-event.c \
 	detect-engine-file.c \
 	detect-engine-frame.c \
+	detect-engine-helper.c \
 	detect-engine-iponly.c \
 	detect-engine-loader.c \
 	detect-engine-mpm.c \
@@ -1009,7 +999,6 @@ libsuricata_c_a_SOURCES = \
 	output-flow.c \
 	output-json-alert.c \
 	output-json-anomaly.c \
-	output-json-bittorrent-dht.c \
 	output-json.c \
 	output-json-common.c \
 	output-json-dcerpc.c \
@@ -1023,27 +1012,16 @@ libsuricata_c_a_SOURCES = \
 	output-json-flow.c \
 	output-json-frame.c \
 	output-json-ftp.c \
-	output-json-http2.c \
 	output-json-http.c \
 	output-json-ike.c \
-	output-json-krb5.c \
 	output-json-metadata.c \
-	output-json-modbus.c \
-	output-json-quic.c \
 	output-json-mqtt.c \
 	output-json-netflow.c \
 	output-json-nfs.c \
 	output-json-pgsql.c \
-	output-json-rdp.c \
-	output-json-rfb.c \
-	output-json-sip.c \
 	output-json-smb.c \
 	output-json-smtp.c \
-	output-json-snmp.c \
-	output-json-ssh.c \
 	output-json-stats.c \
-	output-json-template.c \
-	output-json-tftp.c \
 	output-json-tls.c \
 	output-eve-syslog.c \
 	output-eve-null.c \

src/app-layer-detect-proto.c

@@ -489,8 +489,8 @@ static inline AppProto PPGetProto(const AppLayerProtoDetectProbingParserElement
         if (AppProtoIsValid(alproto)) {
             SCReturnUInt(alproto);
         }
-        if (alproto == ALPROTO_FAILED ||
-            (pe->max_depth != 0 && buflen > pe->max_depth)) {
+        if (alproto == ALPROTO_FAILED || alproto == ALPROTO_INVALID ||
+                (pe->max_depth != 0 && buflen > pe->max_depth)) {
             alproto_masks[0] |= pe->alproto_mask;
         }
         pe = pe->next;

src/app-layer-parser.c

@@ -63,6 +63,10 @@
 #include "app-layer-rdp.h"
 #include "app-layer-http2.h"
 
+#ifdef ALPROTO_DYNAMIC_NB
+#include "util-plugin.h"
+#endif
+
 struct AppLayerParserThreadCtx_ {
     void *alproto_local_storage[FLOW_PROTO_MAX][ALPROTO_MAX];
 };
@@ -1786,6 +1790,16 @@ void AppLayerParserRegisterProtocolParsers(void)
                   "imap");
     }
 
+#ifdef ALPROTO_DYNAMIC_NB
+    for (size_t i = 0; i < ALPROTO_DYNAMIC_NB; i++) {
+        SCAppLayerPlugin *app_layer_plugin = SCPluginFindAppLayerByIndex(i);
+        if (app_layer_plugin == NULL) {
+            break;
+        }
+        app_layer_plugin->Register();
+    }
+#endif
+
     ValidateParsers();
     return;
 }

src/app-layer-protos.c

@@ -24,13 +24,16 @@
 
 #include "suricata-common.h"
 #include "app-layer-protos.h"
+#include "rust.h"
+
+AppProto ALPROTO_FAILED = ALPROTO_MAX_STATIC;
 
 typedef struct AppProtoStringTuple {
     AppProto alproto;
     const char *str;
 } AppProtoStringTuple;
 
-const AppProtoStringTuple AppProtoStrings[ALPROTO_MAX] = {
+AppProtoStringTuple AppProtoStrings[ALPROTO_MAX] = {
     { ALPROTO_UNKNOWN, "unknown" },
     { ALPROTO_HTTP1, "http1" },
     { ALPROTO_FTP, "ftp" },
@@ -65,10 +68,10 @@ const AppProtoStringTuple AppProtoStrings[ALPROTO_MAX] = {
     { ALPROTO_HTTP2, "http2" },
     { ALPROTO_BITTORRENT_DHT, "bittorrent-dht" },
     { ALPROTO_HTTP, "http" },
-    { ALPROTO_FAILED, "failed" },
 #ifdef UNITTESTS
     { ALPROTO_TEST, "test" },
 #endif
+    { ALPROTO_MAX_STATIC, "failed" },
 };
 
 const char *AppProtoToString(AppProto alproto)
@@ -98,9 +101,21 @@ AppProto StringToAppProto(const char *proto_name)
 
     // We could use a Multi Pattern Matcher
     for (size_t i = 0; i < ARRAY_SIZE(AppProtoStrings); i++) {
-        if (strcmp(proto_name, AppProtoStrings[i].str) == 0)
+        if (AppProtoStrings[i].str != NULL && strcmp(proto_name, AppProtoStrings[i].str) == 0)
             return AppProtoStrings[i].alproto;
     }
 
     return ALPROTO_UNKNOWN;
 }
+
+void RegisterAppProtoString(AppProto alproto, const char *proto_name)
+{
+    if (alproto == ALPROTO_FAILED && alproto + 1 < ALPROTO_MAX) {
+        AppProtoStrings[alproto].str = proto_name;
+        AppProtoStrings[alproto].alproto = alproto;
+        ALPROTO_FAILED++;
+        rs_update_alproto_failed(ALPROTO_FAILED);
+        AppProtoStrings[ALPROTO_FAILED].str = "failed";
+        AppProtoStrings[ALPROTO_FAILED].alproto = ALPROTO_FAILED;
+    }
+}

src/app-layer-protos.h

@@ -65,20 +65,24 @@ enum AppProtoEnum {
     // HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
     ALPROTO_HTTP,
 
-    /* used by the probing parser when alproto detection fails
-     * permanently for that particular stream */
-    ALPROTO_FAILED,
 #ifdef UNITTESTS
     ALPROTO_TEST,
 #endif /* UNITESTS */
     /* keep last */
-    ALPROTO_MAX,
+    ALPROTO_MAX_STATIC,
+    ALPROTO_INVALID = 0xffff,
 };
 // NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
 
 /* not using the enum as that is a unsigned int, so 4 bytes */
 typedef uint16_t AppProto;
+extern AppProto ALPROTO_FAILED;
 
+#ifdef ALPROTO_DYNAMIC_NB
+#define ALPROTO_MAX (ALPROTO_MAX_STATIC + 1 + ALPROTO_DYNAMIC_NB)
+#else
+#define ALPROTO_MAX (ALPROTO_MAX_STATIC + 1)
+#endif
 static inline bool AppProtoIsValid(AppProto a)
 {
     return ((a > ALPROTO_UNKNOWN && a < ALPROTO_FAILED));
@@ -115,4 +119,6 @@ const char *AppProtoToString(AppProto alproto);
  */
 AppProto StringToAppProto(const char *proto_name);
 
+void RegisterAppProtoString(AppProto alproto, const char *proto_name);
+
 #endif /* __APP_LAYER_PROTOS_H__ */

src/app-layer-register.c

@@ -58,7 +58,6 @@ AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int e
     AppLayerProtoDetectRegisterProtocol(alproto, p->name);
 
     if (p->ProbeTS == NULL && p->ProbeTC == NULL) {
-        BUG_ON(p->default_port != NULL);
         return alproto;
     }