Applayer plugin 5053 v3.14

.github/workflows/builds.yml

@@ -186,6 +186,15 @@ jobs:
           cat eve.json | jq -c 'select(.dns)'
           test $(cat eve.json | jq -c 'select(.dns)' | wc -l) = "1"
 
+      - name: Test app-layer plugin
+        working-directory: examples/plugins/zabbix
+        run: |
+          RUSTFLAGS=-Clink-args=-Wl,-undefined,dynamic_lookup cargo build
+          ../../../src/suricata -S zabbix.rules --set plugins.0=./target/debug/libsuricata_zabbix.so --runmode=single -l . -c zabbix.yaml -k none -r ndpi_zabbix.pcap
+          cat eve.json | jq -c 'select(.zabbix)'
+          test $(cat eve.json | jq -c 'select(.zabbix)' | wc -l) = "6"
+        # we get 4 alerts and 2 zabbix events
+
       - name: Test library build in tree
         working-directory: examples/lib/simple
         run: make clean all

examples/plugins/README.md

@@ -9,3 +9,7 @@ is useful if you want to send EVE output to custom destinations.
 
 A minimal capture plugin that can be used as a template, but also used
 for testing capture plugin loading and registration in CI.
+
+## zabbix
+
+An app-layer plugin for Zabbix protocol.

examples/plugins/zabbix/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "suricata-zabbix"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+nom7 = { version="7.0", package="nom" }
+libc = "~0.2.82"
+flate2 = "1.0.34"
+
+[features]
+default = ["suricata8"]
+suricata7 = []
+suricata8 = []

examples/plugins/zabbix/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Catena cyber
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

examples/plugins/zabbix/src/detect.rs

@@ -0,0 +1,160 @@
+use crate::suricata::{
+    rs_detect_u8_match, rs_detect_u8_parse, DetectBufferSetActiveList,
+    DetectHelperBufferMpmRegister, DetectHelperBufferRegister, DetectHelperGetData,
+    DetectHelperKeywordRegister, DetectHelperKeywordSetup, DetectSignatureSetAppProto,
+    DetectUintData, Level, SCSigTableElmt, SIGMATCH_INFO_STICKY_BUFFER, SIGMATCH_NOOPT,
+};
+use crate::util::ctor_pointer;
+use crate::util::SCLog;
+use crate::zabbix::{ZabbixTransaction, ALPROTO_ZABBIX};
+use std::os::raw::{c_int, c_void};
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_keywords_register() {
+    SCLog!(Level::Info, "registering Zabbix keywords");
+    zabbix_register_flags_keyword();
+    zabbix_register_data_keyword();
+}
+
+static mut G_ZABBIX_FLAGS_KWID: c_int = 0;
+static mut G_ZABBIX_FLAGS_BUFFER_ID: c_int = 0;
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_flags_setup(
+    de: *mut c_void,
+    s: *mut c_void,
+    raw: *const std::os::raw::c_char,
+) -> c_int {
+    let ctx = rs_detect_u8_parse(raw) as *mut std::os::raw::c_void;
+    if ctx.is_null() {
+        return -1;
+    }
+    let r = DetectHelperKeywordSetup(
+        de,
+        ALPROTO_ZABBIX,
+        G_ZABBIX_FLAGS_KWID,
+        G_ZABBIX_FLAGS_BUFFER_ID,
+        s,
+        ctx,
+    );
+    if r < 0 {
+        rs_zabbix_flags_free(std::ptr::null_mut(), ctx);
+    }
+    r
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_flags_match(
+    _de: *mut c_void,
+    _f: *mut c_void,
+    _flags: u8,
+    _state: *mut c_void,
+    tx: *mut c_void,
+    _sig: *const c_void,
+    ctx: *const c_void,
+) -> c_int {
+    let tx = ctor_pointer!(tx, ZabbixTransaction);
+    rs_detect_u8_match(tx.zabbix.flags, ctx)
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_flags_free(_de: *mut c_void, ctx: *mut c_void) {
+    // Just unbox...
+    let ctx = ctor_pointer!(ctx, DetectUintData<u8>);
+    std::mem::drop(Box::from_raw(ctx));
+}
+
+fn zabbix_register_flags_keyword() {
+    let kw = SCSigTableElmt {
+        name: b"zabbix.flags\0".as_ptr() as *const libc::c_char,
+        desc: b"match on zabbix header flags\0".as_ptr() as *const libc::c_char,
+        url: b"\0".as_ptr() as *const libc::c_char,
+        flags: 0,
+        AppLayerTxMatch: Some(rs_zabbix_flags_match),
+        Setup: rs_zabbix_flags_setup,
+        Free: Some(rs_zabbix_flags_free),
+    };
+    unsafe {
+        G_ZABBIX_FLAGS_KWID = DetectHelperKeywordRegister(&kw);
+        G_ZABBIX_FLAGS_BUFFER_ID = DetectHelperBufferRegister(
+            b"zabbix_flags\0".as_ptr() as *const libc::c_char,
+            ALPROTO_ZABBIX,
+            true,
+            true,
+        );
+    }
+}
+
+static mut G_ZABBIX_DATA_BUFID: c_int = 0;
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_data_setup(
+    de: *mut c_void,
+    s: *mut c_void,
+    _raw: *const std::os::raw::c_char,
+) -> c_int {
+    if DetectBufferSetActiveList(de, s, G_ZABBIX_DATA_BUFID) < 0 {
+        return -1;
+    }
+    if DetectSignatureSetAppProto(s, ALPROTO_ZABBIX) != 0 {
+        return -1;
+    }
+
+    0
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_data(
+    tx: *const c_void,
+    _flow_flags: u8,
+    buffer: *mut *const u8,
+    buffer_len: *mut u32,
+) -> bool {
+    let tx = ctor_pointer!(tx, ZabbixTransaction);
+    *buffer = tx.zabbix.data.as_ptr();
+    *buffer_len = tx.zabbix.data.len() as u32;
+    true
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_get_data(
+    de: *mut c_void,
+    transforms: *const c_void,
+    flow: *const c_void,
+    flow_flags: u8,
+    tx: *const c_void,
+    list_id: c_int,
+) -> *mut c_void {
+    DetectHelperGetData(
+        de,
+        transforms,
+        flow,
+        flow_flags,
+        tx,
+        list_id,
+        rs_zabbix_data,
+    )
+}
+
+pub(super) fn zabbix_register_data_keyword() {
+    let kw = SCSigTableElmt {
+        name: b"zabbix.data\0".as_ptr() as *const libc::c_char,
+        desc: b"match on zabbix data\0".as_ptr() as *const libc::c_char,
+        url: b"\0".as_ptr() as *const libc::c_char,
+        Setup: rs_zabbix_data_setup,
+        flags: SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER,
+        AppLayerTxMatch: None,
+        Free: None,
+    };
+    unsafe {
+        DetectHelperKeywordRegister(&kw);
+        G_ZABBIX_DATA_BUFID = DetectHelperBufferMpmRegister(
+            b"zabbix_data\0".as_ptr() as *const libc::c_char,
+            b"zabbix data\0".as_ptr() as *const libc::c_char,
+            ALPROTO_ZABBIX,
+            true,
+            true,
+            rs_zabbix_get_data,
+        );
+    }
+}

examples/plugins/zabbix/src/lib.rs

@@ -0,0 +1,7 @@
+mod detect;
+mod log;
+mod parser;
+pub mod plugin;
+mod suricata;
+mod util;
+mod zabbix;

examples/plugins/zabbix/src/log.rs

@@ -0,0 +1,76 @@
+use crate::suricata::JsonBuilder;
+use crate::suricata::{jb_close, jb_open_object, jb_set_string, jb_set_uint};
+use crate::util::ctor_pointer;
+use crate::zabbix::ZabbixTransaction;
+
+use std::ffi::CString;
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum JsonError {
+    SuricataError,
+}
+
+impl std::error::Error for JsonError {}
+
+impl std::fmt::Display for JsonError {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        match self {
+            JsonError::SuricataError => write!(f, "suricata returned error"),
+        }
+    }
+}
+
+fn jb_set_string_sc(jb: &mut JsonBuilder, key: &str, val: &str) -> Result<(), JsonError> {
+    let keyc = CString::new(key).unwrap();
+    let valc = CString::new(val.escape_default().to_string()).unwrap();
+    if unsafe { !jb_set_string(jb, keyc.as_ptr(), valc.as_ptr()) } {
+        return Err(JsonError::SuricataError);
+    }
+    Ok(())
+}
+
+fn jb_close_sc(jb: &mut JsonBuilder) -> Result<(), JsonError> {
+    if unsafe { !jb_close(jb) } {
+        return Err(JsonError::SuricataError);
+    }
+    Ok(())
+}
+
+fn jb_open_object_sc(jb: &mut JsonBuilder, key: &str) -> Result<(), JsonError> {
+    let keyc = CString::new(key).unwrap();
+    if unsafe { !jb_open_object(jb, keyc.as_ptr()) } {
+        return Err(JsonError::SuricataError);
+    }
+    Ok(())
+}
+
+fn jb_set_uint_sc(jb: &mut JsonBuilder, key: &str, val: u64) -> Result<(), JsonError> {
+    let keyc = CString::new(key).unwrap();
+    if unsafe { !jb_set_uint(jb, keyc.as_ptr(), val) } {
+        return Err(JsonError::SuricataError);
+    }
+    Ok(())
+}
+
+fn log_zabbix(tx: &ZabbixTransaction, jb: &mut JsonBuilder) -> Result<(), JsonError> {
+    jb_open_object_sc(jb, "zabbix")?;
+    jb_set_uint_sc(jb, "flags", tx.zabbix.flags.into())?;
+    //TODO make configurable
+    if tx.zabbix.data.len() < 256 {
+        jb_set_string_sc(jb, "data", &String::from_utf8_lossy(&tx.zabbix.data))?;
+    } else {
+        jb_set_string_sc(jb, "data", &String::from_utf8_lossy(&tx.zabbix.data[..256]))?;
+    }
+    jb_close_sc(jb)?;
+    Ok(())
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_zabbix_log(
+    tx: *mut std::os::raw::c_void,
+    jb: *mut std::os::raw::c_void,
+) -> bool {
+    let tx = ctor_pointer!(tx, ZabbixTransaction);
+    let jb = ctor_pointer!(jb, JsonBuilder);
+    log_zabbix(tx, jb).is_ok()
+}

examples/plugins/zabbix/src/parser.rs

@@ -0,0 +1,68 @@
+use flate2::bufread::ZlibDecoder;
+use nom7::bytes::streaming::take as takes;
+use nom7::combinator::verify;
+use nom7::number::streaming::{le_u32, le_u64, le_u8};
+use nom7::IResult;
+use std::io::Read;
+
+#[derive(Clone, Debug, Default)]
+pub struct ZabbixPdu {
+    pub flags: u8,
+    pub data: Vec<u8>,
+    pub wrong_decompressed_len: bool,
+    pub error_decompression: bool,
+    pub rem_len: u64,
+}
+
+pub fn check_zabbix(i: &[u8]) -> bool {
+    let r = verify(le_u32::<&[u8], nom7::error::Error<&[u8]>>, |&v| {
+        v == 0x4458425a
+    })(i);
+    r.is_ok()
+}
+
+pub fn parse_zabbix(i: &[u8]) -> IResult<&[u8], ZabbixPdu> {
+    let (i, _magic) = le_u32(i)?;
+    let (i, flags) = le_u8(i)?;
+    let large = (flags & 4) != 0;
+    let (i, (pdu_len, decompressed_len)) = if large {
+        let (i2, pdu_len) = le_u64(i)?;
+        let (i2, decompressed_len) = le_u64(i2)?;
+        Ok((i2, (pdu_len, decompressed_len)))
+    } else {
+        let (i2, pdu_len) = le_u32(i)?;
+        let (i2, decompressed_len) = le_u32(i2)?;
+        Ok((i2, (pdu_len as u64, decompressed_len as u64)))
+    }?;
+    let mut wrong_decompressed_len = false;
+    let mut error_decompression = false;
+    //TODO make configurable
+    let take_len = std::cmp::min(pdu_len, 4096);
+    let (i, data) = takes(pdu_len as usize)(i)?;
+    let rem_len = take_len - pdu_len;
+    let data = if (flags & 2) != 0 {
+        let mut z = ZlibDecoder::new(data);
+        let mut dec_data = Vec::new();
+        if let Ok(n) = z.read_to_end(&mut dec_data) {
+            if n as u64 != decompressed_len {
+                wrong_decompressed_len = true;
+            }
+            dec_data
+        } else {
+            error_decompression = true;
+            data.to_vec()
+        }
+    } else {
+        data.to_vec()
+    };
+    Ok((
+        i,
+        ZabbixPdu {
+            flags,
+            data,
+            wrong_decompressed_len,
+            error_decompression,
+            rem_len,
+        },
+    ))
+}