Skip to content

Batch backports 6.0.x/1.1: Backports of 5550, 5604 #8975

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jlucovsky wants to merge 6 commits into from
Closed

Batch backports 6.0.x/1.1: Backports of 5550, 5604 #8975

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9cac5a7
stream: update no-flow checks
victorjulien Apr 25, 2023
cecea2e
counters: make tcp stats independent of flow, ssn
victorjulien Apr 25, 2023
3ec1aaf
dns: mark test buffers with rustfmt::skip
jasonish Dec 21, 2022
3566ec0
dns: parse and alert on invalid opcodes
jasonish Dec 21, 2022
c2ec63e
dns: validate header on every incoming message
jasonish Dec 21, 2022
01c7161
dns: split header and body parsing
jasonish Dec 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions rust/src/applayer.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,49 @@ use crate::filecontainer::FileContainer;
use crate::applayer;
use std::os::raw::{c_void,c_char,c_int};

#[repr(C)]
pub struct StreamSlice {
input: *const u8,
input_len: u32,
/// STREAM_* flags
flags: u8,
offset: u64,
}

impl StreamSlice {

/// Create a StreamSlice from a Rust slice. Useful in unit tests.
pub fn from_slice(slice: &[u8], flags: u8, offset: u64) -> Self {
Self {
input: slice.as_ptr() as *const u8,
input_len: slice.len() as u32,
flags,
offset
}
}

pub fn is_gap(&self) -> bool {
self.input.is_null() && self.input_len > 0
}
pub fn gap_size(&self) -> u32 {
self.input_len
}
pub fn as_slice(&self) -> &[u8] {
unsafe { std::slice::from_raw_parts(self.input, self.input_len as usize) }
}
pub fn is_empty(&self) -> bool {
self.input_len == 0
}
pub fn len(&self) -> u32 {
self.input_len
}
pub fn offset_from(&self, slice: &[u8]) -> u32 {
self.len() - slice.len() as u32
}
pub fn flags(&self) -> u8 {
self.flags
}
}
#[repr(C)]
#[derive(Debug,PartialEq)]
pub struct AppLayerTxConfig {
Expand Down
79 changes: 50 additions & 29 deletions rust/src/dns/dns.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -500,7 +500,17 @@ impl DNSState {
event as u8);
}

pub fn parse_request(&mut self, input: &[u8]) -> bool {
fn validate_header(&self, input: &[u8]) -> bool {
parser::dns_parse_header(input)
.map(|(_, header)| probe_header_validity(header, input.len()).0)
.unwrap_or(false)
}

fn parse_request(&mut self, input: &[u8], is_tcp: bool) -> bool {
if !self.validate_header(input) {
return !is_tcp;
}

match parser::dns_parse_request(input) {
Ok((_, request)) => {
if request.header.flags & 0x8000 != 0 {
Expand Down Expand Up @@ -543,7 +553,21 @@ impl DNSState {
}
}

pub fn parse_response(&mut self, input: &[u8]) -> bool {
fn parse_request_udp(&mut self, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
Comment thread
jlucovsky marked this conversation as resolved.
self.parse_request(input, false)
}

fn parse_response_udp(&mut self, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
self.parse_response(input, false)
}

pub fn parse_response(&mut self, input: &[u8], is_tcp: bool) -> bool {
if !self.validate_header(input) {
return !is_tcp;
}

match parser::dns_parse_response(input) {
Ok((_, response)) => {

Expand Down Expand Up @@ -620,8 +644,8 @@ impl DNSState {
SCLogDebug!("[request] Have {} bytes, need {} to parse",
cur_i.len(), size + 2);
if size > 0 && cur_i.len() >= size + 2 {
let msg = &cur_i[0..(size + 2)];
if self.parse_request(&msg[2..]) {
let msg = &cur_i[2..(size + 2)];
if self.parse_request(msg, true) {
cur_i = &cur_i[(size + 2)..];
consumed += size + 2;
} else {
Expand Down Expand Up @@ -667,8 +691,8 @@ impl DNSState {
SCLogDebug!("[response] Have {} bytes, need {} to parse",
cur_i.len(), size + 2);
if size > 0 && cur_i.len() >= size + 2 {
let msg = &cur_i[0..(size + 2)];
if self.parse_response(&msg[2..]) {
let msg = &cur_i[2..(size + 2)];
if self.parse_response(msg, true) {
cur_i = &cur_i[(size + 2)..];
consumed += size + 2;
} else {
Expand Down Expand Up @@ -706,16 +730,19 @@ impl DNSState {
const DNS_HEADER_SIZE: usize = 12;

fn probe_header_validity(header: DNSHeader, rlen: usize) -> (bool, bool, bool) {
if 2 * (header.additional_rr as usize
+ header.answer_rr as usize
+ header.authority_rr as usize
+ header.questions as usize)
+ DNS_HEADER_SIZE
> rlen
{
//not enough data for such a DNS record
let min_msg_size = 2
* (header.additional_rr as usize
+ header.answer_rr as usize
+ header.authority_rr as usize
+ header.questions as usize)
+ DNS_HEADER_SIZE;

if min_msg_size > rlen {
// Not enough data for records defined in the header, or
// impossibly large.
return (false, false, false);
}

let is_request = header.flags & 0x8000 == 0;
return (true, is_request, false);
}
Expand Down Expand Up @@ -812,11 +839,8 @@ pub extern "C" fn rs_dns_parse_request(_flow: *const core::Flow,
-> AppLayerResult {
let state = cast_pointer!(state, DNSState);
let buf = unsafe{std::slice::from_raw_parts(input, input_len as usize)};
if state.parse_request(buf) {
AppLayerResult::ok()
} else {
AppLayerResult::err()
}
state.parse_request_udp(StreamSlice::from_slice(buf, STREAM_TOSERVER, 0));
AppLayerResult::ok()
}

#[no_mangle]
Expand All @@ -830,11 +854,8 @@ pub extern "C" fn rs_dns_parse_response(_flow: *const core::Flow,
-> AppLayerResult {
let state = cast_pointer!(state, DNSState);
let buf = unsafe{std::slice::from_raw_parts(input, input_len as usize)};
if state.parse_response(buf) {
AppLayerResult::ok()
} else {
AppLayerResult::err()
}
state.parse_response_udp(StreamSlice::from_slice(buf, STREAM_TOCLIENT, 0));
AppLayerResult::ok()
}

/// C binding parse a DNS request. Returns 1 on success, -1 on failure.
Expand Down Expand Up @@ -1387,7 +1408,7 @@ mod tests {
0x80,
];
let mut state = DNSState::new();
assert!(state.parse_response(buf));
assert!(state.parse_response(buf, false));
}

// Port of the C RustDNSUDPParserTest02 unit test.
Expand All @@ -1407,7 +1428,7 @@ mod tests {
0x10,0x00,0x02,0xC0,0x85,0x00,0x00,0x29,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
];
let mut state = DNSState::new();
assert!(state.parse_response(buf));
assert!(state.parse_response(buf, false));
}

// Port of the C RustDNSUDPParserTest03 unit test.
Expand All @@ -1427,7 +1448,7 @@ mod tests {
0x29,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00
];
let mut state = DNSState::new();
assert!(state.parse_response(buf));
assert!(state.parse_response(buf, false));
}

// Port of the C RustDNSUDPParserTest04 unit test.
Expand All @@ -1451,7 +1472,7 @@ mod tests {
0x6b,0x00,0x01,0x00,0x01,0x00,0x09,0x3a,0x80,0x00,0x04,0x0a,0x1e,0x1c,0x5f
];
let mut state = DNSState::new();
assert!(state.parse_response(buf));
assert!(state.parse_response(buf, false));
}

// Port of the C RustDNSUDPParserTest05 unit test.
Expand All @@ -1475,7 +1496,7 @@ mod tests {
0x6b,0x00,0x01,0x00,0x01,0x00,0x09,0x3a,0x80,0x00,0x04,0x0a,0x1e,0x1c,0x5f
];
let mut state = DNSState::new();
assert!(!state.parse_response(buf));
assert!(!state.parse_response(buf, false));
}

// Port of the C RustDNSTCPParserTestMultiRecord unit test.
Expand Down