Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

app-layer: track modified/processed txs 7087 v11 #11781

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+123 −16
Open

app-layer: track modified/processed txs 7087 v11 #11781

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
95c8be6
app-layer: track modified/processed txs
catenacyber May 31, 2024
dc9d1a4
rust/ftp: handle NULL inputs
catenacyber Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions rust/src/applayer.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,10 @@ pub struct AppLayerTxData {
/// STREAM_TOCLIENT: file tx , files only in toclient dir
/// STREAM_TOSERVER|STREAM_TOCLIENT: files possible in both dirs
pub file_tx: u8,
/// The tx has been processed : detection, logging, cleaning
/// It can be skipped until new data arrives.
/// There is a boolean for both directions : to server and to client
pub processed_until_update: [bool; 2],

/// detection engine flags for use by detection engine
detect_flags_ts: u64,
Expand Down Expand Up @@ -152,6 +156,7 @@ impl AppLayerTxData {
files_stored: 0,
file_flags: 0,
file_tx: 0,
processed_until_update: [false; 2],
detect_flags_ts: 0,
detect_flags_tc: 0,
de_state: std::ptr::null_mut(),
Expand All @@ -174,6 +179,7 @@ impl AppLayerTxData {
files_stored: 0,
file_flags: 0,
file_tx: 0,
processed_until_update: [false; 2],
detect_flags_ts,
detect_flags_tc,
de_state: std::ptr::null_mut(),
Expand Down
1 change: 1 addition & 0 deletions rust/src/applayertemplate/template.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,7 @@ impl TemplateState {
start = rem;

if let Some(tx) = self.find_request() {
tx.tx_data.processed_until_update = [false; 2];
tx.response = Some(response);
SCLogNotice!("Found response for request:");
SCLogNotice!("- Request: {:?}", tx.request);
Expand Down
2 changes: 2 additions & 0 deletions rust/src/dcerpc/dcerpc.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,6 +357,7 @@ impl DCERPCState {
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
index += 1;
if !tx_old.req_done || !tx_old.resp_done {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.req_done = true;
tx_old.resp_done = true;
break;
Expand Down Expand Up @@ -533,6 +534,7 @@ impl DCERPCState {
}
}
}
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down
2 changes: 2 additions & 0 deletions rust/src/dcerpc/dcerpc_udp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@ impl DCERPCUDPState {
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
index += 1;
if !tx_old.req_done || !tx_old.resp_done {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.req_done = true;
tx_old.resp_done = true;
break;
Expand Down Expand Up @@ -164,6 +165,7 @@ impl DCERPCUDPState {
}

if let Some(tx) = otx {
tx.tx_data.processed_until_update = [false; 2];
let done = (hdr.flags1 & PFCL1_FRAG) == 0 || (hdr.flags1 & PFCL1_LASTFRAG) != 0;

match hdr.pkt_type {
Expand Down
2 changes: 2 additions & 0 deletions rust/src/enip/enip.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,7 @@ impl EnipState {
fn purge_tx_flood(&mut self) {
let mut event_set = false;
for tx in self.transactions.iter_mut() {
tx.tx_data.processed_until_update = [false; 2];
tx.done = true;
if !event_set {
tx.tx_data.set_event(EnipEvent::TooManyTransactions as u8);
Expand All @@ -216,6 +217,7 @@ impl EnipState {
if let Some(req) = &tx.request {
if tx.response.is_none() {
tx.done = true;
tx.tx_data.processed_until_update = [false; 2];
if response_matches_request(req, pdu) {
return Some(tx);
}
Expand Down
16 changes: 14 additions & 2 deletions rust/src/ftp/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,9 @@ pub fn ftp_pasv_response(i: &[u8]) -> IResult<&[u8], u16> {

#[no_mangle]
pub unsafe extern "C" fn rs_ftp_active_port(input: *const u8, len: u32) -> u16 {
if input.is_null() {
return 0;
}
let buf = build_slice!(input, len as usize);
match ftp_active_port(buf) {
Ok((_, dport)) => {
Expand All @@ -105,7 +108,10 @@ pub unsafe extern "C" fn rs_ftp_active_port(input: *const u8, len: u32) -> u16 {

#[no_mangle]
pub unsafe extern "C" fn rs_ftp_pasv_response(input: *const u8, len: u32) -> u16 {
let buf = std::slice::from_raw_parts(input, len as usize);
if input.is_null() {
return 0;
}
let buf = build_slice!(input, len as usize);
match ftp_pasv_response(buf) {
Ok((_, dport)) => {
return dport;
Expand Down Expand Up @@ -147,6 +153,9 @@ pub fn ftp_active_eprt(i: &[u8]) -> IResult<&[u8], u16> {

#[no_mangle]
pub unsafe extern "C" fn rs_ftp_active_eprt(input: *const u8, len: u32) -> u16 {
if input.is_null() {
return 0;
}
let buf = build_slice!(input, len as usize);
match ftp_active_eprt(buf) {
Ok((_, dport)) => {
Expand All @@ -163,7 +172,10 @@ pub unsafe extern "C" fn rs_ftp_active_eprt(input: *const u8, len: u32) -> u16 {
}
#[no_mangle]
pub unsafe extern "C" fn rs_ftp_epsv_response(input: *const u8, len: u32) -> u16 {
let buf = std::slice::from_raw_parts(input, len as usize);
if input.is_null() {
return 0;
}
let buf = build_slice!(input, len as usize);
match ftp_epsv_response(buf) {
Ok((_, dport)) => {
return dport;
Expand Down
2 changes: 2 additions & 0 deletions rust/src/http2/http2.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -752,6 +752,7 @@ impl HTTP2State {
let tx = &mut self.transactions[index - 1];
tx.tx_data.update_file_flags(self.state_data.file_flags);
tx.update_file_flags(tx.tx_data.file_flags);
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
} else {
// do not use SETTINGS_MAX_CONCURRENT_STREAMS as it can grow too much
Expand All @@ -764,6 +765,7 @@ impl HTTP2State {
tx_old.set_event(HTTP2Event::TooManyStreams);
// use a distinct state, even if we do not log it
tx_old.state = HTTP2TransactionState::HTTP2StateTodrop;
tx_old.tx_data.processed_until_update = [false; 2];
}
return None;
}
Expand Down
2 changes: 2 additions & 0 deletions rust/src/ldap/ldap.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,7 @@ impl LdapState {
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
index += 1;
if !tx_old.complete {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.complete = true;
tx_old
.tx_data
Expand Down Expand Up @@ -278,6 +279,7 @@ impl LdapState {
if let Some(tx) = self.find_request(response.message_id) {
tx.complete = tx_is_complete(&response.protocol_op, Direction::ToClient);
let tx_id = tx.id();
tx.tx_data.processed_until_update = [false; 2];
tx.responses.push_back(response);
let consumed = start.len() - rem.len();
self.set_frame_tc(flow, tx_id, consumed as i64);
Expand Down
4 changes: 4 additions & 0 deletions rust/src/modbus/modbus.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ impl ModbusState {
for tx in &mut self.transactions {
if let Some(req) = &tx.request {
if tx.response.is_none() && resp.matches(req) {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand All @@ -139,6 +140,7 @@ impl ModbusState {
for tx in &mut self.transactions {
if let Some(resp) = &tx.response {
if tx.request.is_none() && req.matches(resp) {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down Expand Up @@ -184,6 +186,7 @@ impl ModbusState {
match self.find_response_and_validate(&mut msg) {
Some(tx) => {
tx.set_events_from_flags(&msg.error_flags);
tx.tx_data.processed_until_update = [false; 2];
tx.request = Some(msg);
}
None => {
Expand All @@ -210,6 +213,7 @@ impl ModbusState {
} else {
tx.set_events_from_flags(&msg.error_flags);
}
tx.tx_data.processed_until_update = [false; 2];
tx.response = Some(msg);
}
None => {
Expand Down
2 changes: 2 additions & 0 deletions rust/src/mqtt/mqtt.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,7 @@ impl MQTTState {
if !tx.complete {
if let Some(mpktid) = tx.pkt_id {
if mpktid == pkt_id {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand All @@ -196,6 +197,7 @@ impl MQTTState {
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
index += 1;
if !tx_old.complete {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.complete = true;
MQTTState::set_event(tx_old, MQTTEvent::TooManyTransactions);
break;
Expand Down
3 changes: 3 additions & 0 deletions rust/src/nfs/nfs.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -431,6 +431,7 @@ impl NFSState {
// set at least one another transaction to the drop state
for tx_old in &mut self.transactions {
if !tx_old.request_done || !tx_old.response_done {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.request_done = true;
tx_old.response_done = true;
tx_old.is_file_closed = true;
Expand Down Expand Up @@ -484,6 +485,7 @@ impl NFSState {
pub fn mark_response_tx_done(&mut self, xid: u32, rpc_status: u32, nfs_status: u32, resp_handle: &[u8])
{
if let Some(mytx) = self.get_tx_by_xid(xid) {
mytx.tx_data.processed_until_update = [false; 2];
mytx.response_done = true;
mytx.rpc_response_status = rpc_status;
mytx.nfs_response_status = nfs_status;
Expand Down Expand Up @@ -736,6 +738,7 @@ impl NFSState {
tx.tx_data.update_file_flags(self.state_data.file_flags);
d.update_file_flags(tx.tx_data.file_flags);
SCLogDebug!("Found NFS file TX with ID {} XID {:04X}", tx.id, tx.xid);
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down
3 changes: 3 additions & 0 deletions rust/src/pgsql/pgsql.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,7 @@ impl PgsqlState {
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
index += 1;
if tx_old.tx_state < PgsqlTransactionState::ResponseDone {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.tx_state = PgsqlTransactionState::FlushedOut;
//TODO set event
break;
Expand Down Expand Up @@ -348,6 +349,7 @@ impl PgsqlState {
};
let tx_completed = self.is_tx_completed();
if let Some(tx) = self.find_or_create_tx() {
tx.tx_data.processed_until_update = [false; 2];
tx.request = Some(request);
if tx_completed {
tx.tx_state = PgsqlTransactionState::ResponseDone;
Expand Down Expand Up @@ -480,6 +482,7 @@ impl PgsqlState {
let tx_completed = self.is_tx_completed();
let curr_state = self.state_progress;
if let Some(tx) = self.find_or_create_tx() {
tx.tx_data.processed_until_update = [false; 2];
if curr_state == PgsqlStateProgress::DataRowReceived {
tx.incr_row_cnt();
} else if curr_state == PgsqlStateProgress::CommandCompletedReceived
Expand Down
7 changes: 6 additions & 1 deletion rust/src/rfb/rfb.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,12 @@ impl RFBState {

fn get_current_tx(&mut self) -> Option<&mut RFBTransaction> {
let tx_id = self.tx_id;
self.transactions.iter_mut().find(|tx| tx.tx_id == tx_id)
let r = self.transactions.iter_mut().find(|tx| tx.tx_id == tx_id);
if let Some(tx) = r {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
return None;
}

fn parse_request(&mut self, flow: *const Flow, stream_slice: StreamSlice) -> AppLayerResult {
Expand Down
1 change: 1 addition & 0 deletions rust/src/smb/dcerpc.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,7 @@ impl SMBState {
_ => { false },
};
if found {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down
2 changes: 2 additions & 0 deletions rust/src/smb/files.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ impl SMBState {
tx.tx_data.update_file_flags(self.state_data.file_flags);
d.update_file_flags(tx.tx_data.file_flags);
}
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand All @@ -152,6 +153,7 @@ impl SMBState {
tx.tx_data.update_file_flags(self.state_data.file_flags);
d.update_file_flags(tx.tx_data.file_flags);
}
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down
1 change: 1 addition & 0 deletions rust/src/smb/session.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ impl SMBState {
_ => { false },
};
if hit {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down
5 changes: 5 additions & 0 deletions rust/src/smb/smb.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -805,6 +805,7 @@ impl SMBState {
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
index += 1;
if !tx_old.request_done || !tx_old.response_done {
tx_old.tx_data.processed_until_update = [false; 2];
tx_old.request_done = true;
tx_old.response_done = true;
tx_old.set_event(SMBEvent::TooManyTransactions);
Expand Down Expand Up @@ -923,6 +924,7 @@ impl SMBState {
false
};
if found {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand All @@ -947,6 +949,7 @@ impl SMBState {
false
};
if found {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down Expand Up @@ -985,6 +988,7 @@ impl SMBState {
_ => { false },
};
if found {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down Expand Up @@ -1018,6 +1022,7 @@ impl SMBState {
_ => { false },
};
if hit {
tx.tx_data.processed_until_update = [false; 2];
return Some(tx);
}
}
Expand Down
2 changes: 2 additions & 0 deletions rust/src/ssh/ssh.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,6 +415,7 @@ pub unsafe extern "C" fn rs_ssh_parse_request(
let state = &mut cast_pointer!(state, SSHState);
let buf = stream_slice.as_slice();
let hdr = &mut state.transaction.cli_hdr;
state.transaction.tx_data.processed_until_update = [false; 2];
if hdr.flags < SSHConnectionState::SshStateBannerDone {
return state.parse_banner(buf, false, pstate, flow, &stream_slice);
} else {
Expand All @@ -431,6 +432,7 @@ pub unsafe extern "C" fn rs_ssh_parse_response(
let state = &mut cast_pointer!(state, SSHState);
let buf = stream_slice.as_slice();
let hdr = &mut state.transaction.srv_hdr;
state.transaction.tx_data.processed_until_update = [false; 2];
if hdr.flags < SSHConnectionState::SshStateBannerDone {
return state.parse_banner(buf, true, pstate, flow, &stream_slice);
} else {
Expand Down
4 changes: 4 additions & 0 deletions src/app-layer-dnp3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -886,6 +886,8 @@ static void DNP3HandleUserDataRequest(DNP3State *dnp3, const uint8_t *input,
/* Update the saved transport header so subsequent segments
* will be matched to this sequence number. */
tx->th = th;
tx->tx_data.processed_until_update[0] = false;
tx->tx_data.processed_until_update[1] = false;
}
else {
ah = (DNP3ApplicationHeader *)(input + sizeof(DNP3LinkHeader) +
Expand Down Expand Up @@ -963,6 +965,8 @@ static void DNP3HandleUserDataResponse(DNP3State *dnp3, const uint8_t *input,
/* Replace the transport header in the transaction with this
* one in case there are more frames. */
tx->th = th;
tx->tx_data.processed_until_update[0] = false;
tx->tx_data.processed_until_update[1] = false;
}
else {
ah = (DNP3ApplicationHeader *)(input + offset);
Expand Down
2 changes: 2 additions & 0 deletions src/app-layer-ftp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -714,6 +714,8 @@ static AppLayerResult FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserS
SCReturnStruct(APP_LAYER_ERROR);
}
lasttx = tx;
tx->tx_data.processed_until_update[0] = false;
tx->tx_data.processed_until_update[1] = false;
if (state->command == FTP_COMMAND_UNKNOWN || tx->command_descriptor == NULL) {
/* unknown */
tx->command_descriptor = &FtpCommands[FTP_COMMAND_MAX - 1];
Expand Down
Loading
Loading