Skip to content

snmp: can not be set to detection-only #14045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

snmp: can not be set to detection-only #14045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7f6e248
snmp: can not be set to detection-only
liheng562653799 Oct 16, 2025
97efc00
format-check
liheng562653799 Oct 17, 2025
1432025
Merge branch 'OISF:main' into main
liheng562653799 Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 16 additions & 20 deletions rust/src/snmp/snmp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,14 +393,6 @@ const PARSER_NAME : &[u8] = b"snmp\0";
#[no_mangle]
pub unsafe extern "C" fn SCRegisterSnmpParser() {
let ip_proto_str = CString::new("udp").unwrap();
if SCAppLayerProtoDetectConfProtoDetectionEnabled(
ip_proto_str.as_ptr(),
PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
) == 0
{
SCLogDebug!("Protocol detector and parser disabled for SNMP.");
return;
}
let default_port = CString::new("161").unwrap();
let mut parser = RustParser {
name: PARSER_NAME.as_ptr() as *const std::os::raw::c_char,
Expand Down Expand Up @@ -445,17 +437,21 @@ pub unsafe extern "C" fn SCRegisterSnmpParser() {
};
SCOutputEvePreRegisterLogger(reg_data);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it mean that we should call SCOutputEvePreRegisterLogger even if SCAppLayerProtoDetectConfProtoDetectionEnabled returns 0 ?

I would not think so

SCSigTablePreRegister(Some(detect_snmp_register));
// port 161
_ = AppLayerRegisterProtocolDetection(&parser, 1);
if SCAppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, ALPROTO_SNMP);
}
// port 162
let default_port_traps = CString::new("162").unwrap();
parser.default_port = default_port_traps.as_ptr();
let _ = AppLayerRegisterProtocolDetection(&parser, 1);
if SCAppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, ALPROTO_SNMP);
if SCAppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
// port 161
_ = AppLayerRegisterProtocolDetection(&parser, 1);
if SCAppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, ALPROTO_SNMP);
}
// port 162
let default_port_traps = CString::new("162").unwrap();
parser.default_port = default_port_traps.as_ptr();
let _ = AppLayerRegisterProtocolDetection(&parser, 1);
if SCAppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
let _ = AppLayerRegisterParser(&parser, ALPROTO_SNMP);
}
SCAppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_SNMP);
} else {
SCLogDebug!("Protocol detector and parser disabled for SNMP.");
}
SCAppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_SNMP);
}
39 changes: 29 additions & 10 deletions src/app-layer-detect-proto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1658,6 +1658,35 @@ int SCAppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto,

/***** Setup/General Registration *****/

#define ARRAY_CAP_STEP 16
int SCAppLayerProtoDetectReallocCtx(AppProto alproto)
{
if (alpd_ctx.alproto_names_len <= alproto && alproto < g_alproto_max) {
/* Realloc alpd_ctx.alproto_names, so that dynamic alproto can be treated as real/normal
* ones. In case we need to turn off dynamic alproto. */
void *tmp = SCRealloc(alpd_ctx.alproto_names,
sizeof(char *) * (alpd_ctx.alproto_names_len + ARRAY_CAP_STEP));
if (unlikely(tmp == NULL)) {
FatalError("Unable to realloc alproto_names.");
}
alpd_ctx.alproto_names = tmp;
memset(&alpd_ctx.alproto_names[alpd_ctx.alproto_names_len], 0,
sizeof(char *) * ARRAY_CAP_STEP);
alpd_ctx.alproto_names_len += ARRAY_CAP_STEP;

uint8_t *tmp2 = SCRealloc(alpd_ctx.expectation_proto,
sizeof(uint8_t) * (alpd_ctx.expectation_proto_len + ARRAY_CAP_STEP));
if (unlikely(tmp2 == NULL)) {
FatalError("Unable to realloc expectation_proto.");
}
alpd_ctx.expectation_proto = tmp2;
memset(&alpd_ctx.expectation_proto[alpd_ctx.expectation_proto_len], 0,
sizeof(uint8_t) * ARRAY_CAP_STEP);
alpd_ctx.expectation_proto_len += ARRAY_CAP_STEP;
}
SCReturnInt(0);
}

int AppLayerProtoDetectSetup(void)
{
SCEnter();
Expand Down Expand Up @@ -1742,16 +1771,6 @@ void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_n
{
SCEnter();

if (alpd_ctx.alproto_names_len <= alproto && alproto < g_alproto_max) {
void *tmp = SCRealloc(alpd_ctx.alproto_names, sizeof(char *) * g_alproto_max);
if (unlikely(tmp == NULL)) {
FatalError("Unable to realloc alproto_names.");
}
alpd_ctx.alproto_names = tmp;
memset(&alpd_ctx.alproto_names[alpd_ctx.alproto_names_len], 0,
sizeof(char *) * (g_alproto_max - alpd_ctx.alproto_names_len));
alpd_ctx.alproto_names_len = g_alproto_max;
}
if (alpd_ctx.alproto_names[alproto] == NULL)
alpd_ctx.alproto_names[alproto] = alproto_name;

Expand Down
1 change: 1 addition & 0 deletions src/app-layer-detect-proto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,7 @@ void SCAppLayerForceProtocolChange(Flow *f, AppProto new_proto);
/**
* \brief Cleans up the app layer protocol detection phase.
*/
int SCAppLayerProtoDetectReallocCtx(AppProto alproto);
int AppLayerProtoDetectDeSetup(void);

/**
Expand Down
32 changes: 18 additions & 14 deletions src/app-layer-parser.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -437,20 +437,6 @@ void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
{
SCEnter();

if (alp_ctx.ctxs_len <= alproto && alproto < g_alproto_max) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure about the moving of this code to be called in AppProtoRegisterProtoString

Could you explain it in the commit message ?

// Realloc now as AppLayerParserRegisterStateFuncs is called first
void *tmp = SCRealloc(
alp_ctx.ctxs, sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) * g_alproto_max);
if (unlikely(tmp == NULL)) {
FatalError("Unable to realloc alp_ctx.ctxs.");
}
alp_ctx.ctxs = tmp;
memset(&alp_ctx.ctxs[alp_ctx.ctxs_len], 0,
sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) *
(g_alproto_max - alp_ctx.ctxs_len));
alp_ctx.ctxs_len = g_alproto_max;
}

alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateAlloc = StateAlloc;
alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateFree = StateFree;

Expand Down Expand Up @@ -1750,6 +1736,24 @@ static void (**PreRegisteredCallbacks)(void) = NULL;
static size_t preregistered_callbacks_nb = 0;
static size_t preregistered_callbacks_cap = 0;

int SCAppLayerParserReallocCtx(AppProto alproto)
{
if (alp_ctx.ctxs_len <= alproto && alproto < g_alproto_max) {
/* Realloc alp_ctx.ctxs, so that dynamic alproto can be treated as real/normal ones.
* In case we need to turn off dynamic alproto. */
void *tmp = SCRealloc(alp_ctx.ctxs, sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) *
(alp_ctx.ctxs_len + ARRAY_CAP_STEP));
if (unlikely(tmp == NULL)) {
FatalError("Unable to realloc alp_ctx.ctxs.");
}
alp_ctx.ctxs = tmp;
memset(&alp_ctx.ctxs[alp_ctx.ctxs_len], 0,
sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) * ARRAY_CAP_STEP);
alp_ctx.ctxs_len += ARRAY_CAP_STEP;
}
return 0;
}

int AppLayerParserPreRegister(void (*Register)(void))
{
if (preregistered_callbacks_nb == preregistered_callbacks_cap) {
Expand Down
1 change: 1 addition & 0 deletions src/app-layer-parser.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,7 @@ typedef const char *(*AppLayerParserGetStateNameByIdFn)(const int id, const uint
typedef int (*AppLayerParserGetFrameIdByNameFn)(const char *frame_name);
typedef const char *(*AppLayerParserGetFrameNameByIdFn)(const uint8_t id);

int SCAppLayerParserReallocCtx(AppProto alproto);
int AppLayerParserPreRegister(void (*Register)(void));
/**
* \brief Register app layer parser for the protocol.
Expand Down
4 changes: 4 additions & 0 deletions src/app-layer-protos.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@

#include "suricata-common.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-detect-proto.h"
#include "rust.h"

AppProto g_alproto_max = ALPROTO_MAX_STATIC;
Expand Down Expand Up @@ -97,6 +99,8 @@ void AppProtoRegisterProtoString(AppProto alproto, const char *proto_name)
g_alproto_strings = tmp;
}
g_alproto_max++;
SCAppLayerParserReallocCtx(alproto);
SCAppLayerProtoDetectReallocCtx(alproto);
}
g_alproto_strings[alproto].str = proto_name;
g_alproto_strings[alproto].alproto = alproto;
Expand Down