34 #define YAML_VERSION_MAJOR 1
35 #define YAML_VERSION_MINOR 1
39 #define RECURSION_LIMIT 128
44 #define DEFAULT_NAME_LEN 16
46 #define MANGLE_ERRORS_MAX 10
47 static int mangle_errors = 0;
49 static char *conf_dirname = NULL;
51 static int ConfYamlParse(yaml_parser_t *parser,
ConfNode *parent,
int inseq,
int rlevel,
int state);
72 while ((c = strchr(
string,
'_')))
84 ConfYamlSetConfDirname(
const char *filename)
88 ep = strrchr(filename,
'\\');
90 ep = strrchr(filename,
'/');
94 if (conf_dirname == NULL) {
95 FatalError(
"ERROR: Failed to allocate memory while loading configuration.");
100 if (conf_dirname == NULL) {
101 FatalError(
"ERROR: Failed to allocate memory while loading configuration.");
103 conf_dirname[ep - filename] =
'\0';
118 yaml_parser_t parser;
119 char include_filename[PATH_MAX];
123 if (yaml_parser_initialize(&parser) != 1) {
124 SCLogError(
"Failed to initialize YAML parser");
129 strlcpy(include_filename, filename,
sizeof(include_filename));
132 snprintf(include_filename,
sizeof(include_filename),
"%s/%s",
133 conf_dirname, filename);
136 file = fopen(include_filename,
"r");
138 SCLogError(
"Failed to open configuration include file %s: %s", include_filename,
143 yaml_parser_set_input_file(&parser, file);
145 if (ConfYamlParse(&parser, parent, 0, 0, 0) != 0) {
146 SCLogError(
"Failed to include configuration file %s", filename);
153 yaml_parser_delete(&parser);
169 static int ConfYamlParse(yaml_parser_t *parser,
ConfNode *parent,
int inseq,
int rlevel,
int state)
173 memset(&event, 0,
sizeof(event));
178 int include_count = 0;
181 SCLogError(
"Recursion limit reached while parsing "
182 "configuration file, aborting.");
187 if (!yaml_parser_parse(parser, &event)) {
188 SCLogError(
"Failed to parse configuration file at line %" PRIuMAX
": %s\n",
189 (uintmax_t)parser->problem_mark.line, parser->problem);
194 if (event.type == YAML_DOCUMENT_START_EVENT) {
195 SCLogDebug(
"event.type=YAML_DOCUMENT_START_EVENT; state=%d", state);
199 yaml_version_directive_t *ver =
200 event.data.document_start.version_directive;
202 SCLogError(
"ERROR: Invalid configuration file.");
203 SCLogError(
"The configuration file must begin with the following two lines: %%YAML "
207 int major = ver->major;
208 int minor = ver->minor;
210 SCLogError(
"ERROR: Invalid YAML version. Must be 1.1");
214 else if (event.type == YAML_SCALAR_EVENT) {
215 char *value = (
char *)event.data.scalar.value;
216 char *
tag = (
char *)
event.data.scalar.tag;
217 SCLogDebug(
"event.type=YAML_SCALAR_EVENT; state=%d; value=%s; "
218 "tag=%s; inseq=%d", state, value,
tag, inseq);
223 if (state ==
CONF_KEY && strlen(value) == 0) {
229 event.data.scalar.style == YAML_PLAIN_SCALAR_STYLE) {
230 if (strlen(value) == 0 || strcmp(value,
"~") == 0 || strcmp(value,
"null") == 0 ||
231 strcmp(value,
"Null") == 0 || strcmp(value,
"NULL") == 0) {
239 SCLogInfo(
"Including configuration file %s.", value);
258 if (was_empty == 0) {
261 if (seq_node != NULL) {
285 seq_node->
val = NULL;
292 SCLogInfo(
"Including configuration file %s.", value);
300 if (strcmp(value,
"include") == 0) {
302 if (++include_count > 1) {
303 SCLogWarning(
"Multipline \"include\" fields at the same level are "
304 "deprecated and will not work in Suricata 8, please move "
305 "to an array of include files: line: %zu",
312 if (parent->
val == NULL) {
314 if (parent->
val && strchr(parent->
val,
'_'))
319 if (strchr(value,
'.') != NULL) {
327 if (existing != NULL) {
328 if (!existing->
final) {
329 SCLogInfo(
"Configuration node '%s' redefined.", existing->
name);
337 if (node->
name && strchr(node->
name,
'_')) {
338 if (!(parent->
name &&
339 ((strcmp(parent->
name,
"address-groups") == 0) ||
340 (strcmp(parent->
name,
"port-groups") == 0)))) {
344 "%s is deprecated. Please use %s on line %" PRIuMAX
347 (uintmax_t)parser->mark.line + 1);
351 "parameter name warnings.");
361 if (value != NULL && (
tag != NULL) && (strcmp(
tag,
"!include") == 0)) {
362 SCLogInfo(
"Including configuration file %s at "
363 "parent node %s.", value, node->
name);
366 }
else if (!node->
final && value != NULL) {
367 if (node->
val != NULL)
375 else if (event.type == YAML_SEQUENCE_START_EVENT) {
376 SCLogDebug(
"event.type=YAML_SEQUENCE_START_EVENT; state=%d", state);
383 else if (event.type == YAML_SEQUENCE_END_EVENT) {
384 SCLogDebug(
"event.type=YAML_SEQUENCE_END_EVENT; state=%d", state);
387 else if (event.type == YAML_MAPPING_START_EVENT) {
388 SCLogDebug(
"event.type=YAML_MAPPING_START_EVENT; state=%d", state);
390 SCLogError(
"Include fields cannot be a mapping: line %zu", parser->mark.line);
398 if (seq_node != NULL) {
418 if (ConfYamlParse(parser, seq_node, 0, rlevel, 0) != 0)
422 if (ConfYamlParse(parser, node, inseq, rlevel, 0) != 0)
427 else if (event.type == YAML_MAPPING_END_EVENT) {
428 SCLogDebug(
"event.type=YAML_MAPPING_END_EVENT; state=%d", state);
431 else if (event.type == YAML_STREAM_END_EVENT) {
432 SCLogDebug(
"event.type=YAML_STREAM_END_EVENT; state=%d", state);
437 yaml_event_delete(&event);
441 yaml_event_delete(&event);
466 yaml_parser_t parser;
470 if (yaml_parser_initialize(&parser) != 1) {
471 SCLogError(
"failed to initialize yaml parser.");
475 struct stat stat_buf;
476 if (stat(filename, &stat_buf) == 0) {
477 if (stat_buf.st_mode & S_IFDIR) {
478 SCLogError(
"yaml argument is not a file but a directory: %s. "
479 "Please specify the yaml file in your -c option.",
481 yaml_parser_delete(&parser);
487 infile = fopen(filename,
"r");
488 if (infile == NULL) {
489 SCLogError(
"failed to open file: %s: %s", filename, strerror(errno));
490 yaml_parser_delete(&parser);
494 if (conf_dirname == NULL) {
495 ConfYamlSetConfDirname(filename);
498 yaml_parser_set_input_file(&parser, infile);
499 ret = ConfYamlParse(&parser, root, 0, 0, 0);
500 yaml_parser_delete(&parser);
513 yaml_parser_t parser;
516 if (yaml_parser_initialize(&parser) != 1) {
517 fprintf(stderr,
"Failed to initialize yaml parser.\n");
520 yaml_parser_set_input_string(&parser, (
const unsigned char *)
string,
len);
521 ret = ConfYamlParse(&parser, root, 0, 0, 0);
522 yaml_parser_delete(&parser);
544 yaml_parser_t parser;
548 if (yaml_parser_initialize(&parser) != 1) {
549 SCLogError(
"failed to initialize yaml parser.");
553 struct stat stat_buf;
555 if (stat(filename, &stat_buf) == 0) {
556 if (stat_buf.st_mode & S_IFDIR) {
557 SCLogError(
"yaml argument is not a file but a directory: %s. "
558 "Please specify the yaml file in your -c option.",
565 infile = fopen(filename,
"r");
566 if (infile == NULL) {
567 SCLogError(
"failed to open file: %s: %s", filename, strerror(errno));
568 yaml_parser_delete(&parser);
572 if (conf_dirname == NULL) {
573 ConfYamlSetConfDirname(filename);
578 ConfSet(prefix,
"<prefix root node>");
582 yaml_parser_delete(&parser);
586 yaml_parser_set_input_file(&parser, infile);
587 ret = ConfYamlParse(&parser, root, 0, 0, 0);
588 yaml_parser_delete(&parser);
597 ConfYamlSequenceTest(
void)
606 default-log-dir: /tmp\n\
623 FAIL_IF(strcmp(filename->
val,
"netbios.rules") != 0);
628 FAIL_IF(strcmp(filename->
val,
"x11.rules") != 0);
641 ConfYamlLoggingOutputTest(
void)
648 - interface: console\n\
650 - interface: syslog\n\
673 FAIL_IF(strcmp(output_param->
name,
"interface") != 0);
674 FAIL_IF(strcmp(output_param->
val,
"console") != 0);
677 FAIL_IF(strcmp(output_param->
name,
"log-level") != 0);
678 FAIL_IF(strcmp(output_param->
val,
"error") != 0);
686 FAIL_IF(strcmp(output_param->
name,
"interface") != 0);
687 FAIL_IF(strcmp(output_param->
val,
"syslog") != 0);
690 FAIL_IF(strcmp(output_param->
name,
"facility") != 0);
691 FAIL_IF(strcmp(output_param->
val,
"local4") != 0);
694 FAIL_IF(strcmp(output_param->
name,
"log-level") != 0);
695 FAIL_IF(strcmp(output_param->
val,
"info") != 0);
707 ConfYamlNonYamlFileTest(
void)
721 ConfYamlBadYamlVersionTest(
void)
728 - interface: console\n\
730 - interface: syslog\n\
747 ConfYamlSecondLevelSequenceTest(
void)
755 address: [\"192.168.1.0/24\"]\n\
756 personality: [\"Apache_2_2\", \"PHP_5_3\"]\n\
757 path-parsing: [\"compress_separators\", \"lowercase\"]\n\
767 - compress_separators\n\
795 FAIL_IF(strcmp(node->
val,
"192.168.1.0/24") != 0);
807 ConfYamlFileIncludeTest(
void)
811 const char config_filename[] =
"ConfYamlFileIncludeTest-config.yaml";
812 const char config_file_contents[] =
815 "# Include something at the root level.\n"
816 "include: ConfYamlFileIncludeTest-include.yaml\n"
817 "# Test including under a mapping.\n"
818 "mapping: !include ConfYamlFileIncludeTest-include.yaml\n";
820 const char include_filename[] =
"ConfYamlFileIncludeTest-include.yaml";
821 const char include_file_contents[] =
832 FAIL_IF_NULL((config_file = fopen(config_filename,
"w")));
833 FAIL_IF(fwrite(config_file_contents, strlen(config_file_contents), 1, config_file) != 1);
836 FAIL_IF_NULL((config_file = fopen(include_filename,
"w")));
837 FAIL_IF(fwrite(include_file_contents, strlen(include_file_contents), 1, config_file) != 1);
841 if (conf_dirname != NULL) {
864 node =
ConfGetNode(
"mapping.unix-command.enabled");
871 unlink(config_filename);
872 unlink(include_filename);
882 ConfYamlOverrideTest(
void)
884 char config[] =
"%YAML 1.1\n"
886 "some-log-dir: /var/log\n"
887 "some-log-dir: /tmp\n"
897 " HOME_NET: \"[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]\"\n"
898 " EXTERNAL_NET: any\n"
899 "vars.address-groups.HOME_NET: \"10.10.10.10/32\"\n";
907 FAIL_IF(strcmp(value,
"/tmp") != 0);
912 FAIL_IF(strcmp(value,
"value") != 0);
920 ConfNode *vars_address_groups_external_net =
ConfGetNode(
"vars.address-groups.EXTERNAL_NET");
927 FAIL_IF(strcmp(vars_address_groups_home_net->
val,
"10.10.10.10/32") != 0);
943 ConfYamlOverrideFinalTest(
void)
951 "default-log-dir: /var/log\n";
957 const char *default_log_dir;
960 FAIL_IF(strcmp(default_log_dir,
"/tmp") != 0);
968 static int ConfYamlNull(
void)
973 char config[] =
"%YAML 1.1\n"
975 "quoted-tilde: \"~\"\n"
976 "unquoted-tilde: ~\n"
977 "quoted-null: \"null\"\n"
978 "unquoted-null: null\n"
979 "quoted-Null: \"Null\"\n"
980 "unquoted-Null: Null\n"
981 "quoted-NULL: \"NULL\"\n"
982 "unquoted-NULL: NULL\n"
983 "empty-quoted: \"\"\n"
985 "list: [\"null\", null, \"Null\", Null, \"NULL\", NULL, \"~\", ~]\n";
1048 UtRegisterTest(
"ConfYamlLoggingOutputTest", ConfYamlLoggingOutputTest);
1049 UtRegisterTest(
"ConfYamlNonYamlFileTest", ConfYamlNonYamlFileTest);
1050 UtRegisterTest(
"ConfYamlBadYamlVersionTest", ConfYamlBadYamlVersionTest);
1052 ConfYamlSecondLevelSequenceTest);
1053 UtRegisterTest(
"ConfYamlFileIncludeTest", ConfYamlFileIncludeTest);
1055 UtRegisterTest(
"ConfYamlOverrideFinalTest", ConfYamlOverrideFinalTest);