MySQL protocol parser v1

etc/schema.json

@@ -2383,6 +2383,28 @@
             },
             "additionalProperties": false
         },
+        "mysql": {
+            "type": "object",
+            "optional": true,
+            "properties": {
+                "tx_id": {
+                    "type": "integer"
+                },
+                "version": {
+                    "type": "string"
+                },
+                "tls": {
+                    "type": "boolean"
+                },
+                "command": {
+                    "type": "string"
+                },
+                "affected_rows": {
+                    "type": "integer"
+                },
+            },
+            "additionalProperties": false
+        },
         "ldap": {
             "type": "object",
             "optional": true,

rust/src/lib.rs

@@ -130,6 +130,7 @@ pub mod ffi;
 pub mod feature;
 pub mod sdp;
 pub mod ldap;
+pub mod mysql;
 
 #[allow(unused_imports)]
 pub use suricata_lua_sys;

rust/src/mysql/logger.rs

@@ -0,0 +1,117 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+// written by linqiankai <[email protected]>
+//
+use crate::jsonbuilder::{JsonBuilder, JsonError};
+use crate::mysql::mysql::*;
+
+fn log_mysql(tx: &MysqlTransaction, _flags: u32, js: &mut JsonBuilder) -> Result<(), JsonError> {
+    js.open_object("mysql")?;
+    js.set_uint("tx_id", tx.tx_id)?;
+    if let Some(version) = &tx.version {
+        js.set_string("version", version)?;
+    }
+    if let Some(tls) = &tx.tls {
+        js.set_bool("tls", *tls)?;
+    } else {
+        js.set_bool("tls", false)?;
+    }
+
+    if tx.command.is_some() {
+        let command = tx.command.clone().unwrap();
+        js.set_string("command", &command)?;
+    }
+    if tx.affected_rows.is_some() {
+        let affected_rows = tx.affected_rows.unwrap();
+        js.set_uint("affected_rows", affected_rows)?;
+    }
+
+    js.close()?;
+
+    Ok(())
+}
+
+fn log_mysql_alert(
+    tx: &MysqlTransaction, _flags: u32, js: &mut JsonBuilder,
+) -> Result<(), JsonError> {
+    js.open_object("mysql")?;
+    js.set_uint("tx_id", tx.tx_id)?;
+    if let Some(version) = &tx.version {
+        js.set_string("version", version)?;
+    }
+    if let Some(tls) = &tx.tls {
+        js.set_bool("tls", *tls)?;
+    } else {
+        js.set_bool("tls", false)?;
+    }
+
+    if tx.command.is_some() {
+        let command = tx.command.clone().unwrap();
+        js.set_string("command", &command)?;
+    }
+    if tx.affected_rows.is_some() {
+        let affected_rows = tx.affected_rows.unwrap();
+        js.set_uint("affected_rows", affected_rows)?;
+    }
+    if let Some(rows) = &tx.rows {
+        js.open_array("rows")?;
+        for row in rows {
+            js.append_string(row)?;
+        }
+        js.close()?;
+    }
+
+    js.close()?;
+
+    Ok(())
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_mysql_logger(
+    tx: *mut std::os::raw::c_void, flags: u32, js: &mut JsonBuilder,
+) -> bool {
+    let tx_mysql = cast_pointer!(tx, MysqlTransaction);
+    SCLogDebug!(
+        "----------- MySQL rs_mysql_logger call. Tx is {:?}",
+        tx_mysql
+    );
+    let result = log_mysql(tx_mysql, flags, js);
+    if let Err(ref err) = result {
+        SCLogError!("----------- MySQL rs_mysql_logger failed. err is {:?}", err);
+    }
+    return result.is_ok();
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_mysql_logger_alert(
+    tx: *mut std::os::raw::c_void, flags: u32, js: &mut JsonBuilder,
+) -> bool {
+    let tx_mysql = cast_pointer!(tx, MysqlTransaction);
+    SCLogDebug!(
+        "----------- MySQL rs_mysql_logger_alert call. Tx is {:?}",
+        tx_mysql
+    );
+    let result = log_mysql_alert(tx_mysql, flags, js);
+    if let Err(ref err) = result {
+        SCLogError!(
+            "----------- MySQL rs_mysql_logger_alert failed. err is {:?}",
+            err
+        );
+    }
+    return result.is_ok();
+}

rust/src/mysql/mod.rs

@@ -0,0 +1,23 @@
+/* Copyright (C) 2022 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+//! MySQL parser, logger and application layer module.
+//!
+//! written by Kotodian <[email protected]>
+pub mod logger;
+pub mod mysql;
+pub mod parser;