34 #define YAML_VERSION_MAJOR 1
35 #define YAML_VERSION_MINOR 1
39 #define RECURSION_LIMIT 128
44 #define DEFAULT_NAME_LEN 16
46 #define MANGLE_ERRORS_MAX 10
47 static int mangle_errors = 0;
49 static char *conf_dirname = NULL;
51 static int ConfYamlParse(yaml_parser_t *parser,
ConfNode *parent,
int inseq,
int rlevel,
int state);
72 while ((c = strchr(
string,
'_')))
84 ConfYamlSetConfDirname(
const char *filename)
88 ep = strrchr(filename,
'\\');
90 ep = strrchr(filename,
'/');
94 if (conf_dirname == NULL) {
95 FatalError(
"ERROR: Failed to allocate memory while loading configuration.");
100 if (conf_dirname == NULL) {
101 FatalError(
"ERROR: Failed to allocate memory while loading configuration.");
103 conf_dirname[ep - filename] =
'\0';
118 yaml_parser_t parser;
119 char include_filename[PATH_MAX];
123 if (yaml_parser_initialize(&parser) != 1) {
124 SCLogError(
"Failed to initialize YAML parser");
129 strlcpy(include_filename, filename,
sizeof(include_filename));
132 snprintf(include_filename,
sizeof(include_filename),
"%s/%s",
133 conf_dirname, filename);
136 file = fopen(include_filename,
"r");
138 SCLogError(
"Failed to open configuration include file %s: %s", include_filename,
143 yaml_parser_set_input_file(&parser, file);
145 if (ConfYamlParse(&parser, parent, 0, 0, 0) != 0) {
146 SCLogError(
"Failed to include configuration file %s", filename);
153 yaml_parser_delete(&parser);
169 static int ConfYamlParse(yaml_parser_t *parser,
ConfNode *parent,
int inseq,
int rlevel,
int state)
173 memset(&event, 0,
sizeof(event));
178 int include_count = 0;
181 SCLogError(
"Recursion limit reached while parsing "
182 "configuration file, aborting.");
187 if (!yaml_parser_parse(parser, &event)) {
188 SCLogError(
"Failed to parse configuration file at line %" PRIuMAX
": %s",
189 (uintmax_t)parser->problem_mark.line, parser->problem);
194 if (event.type == YAML_DOCUMENT_START_EVENT) {
195 SCLogDebug(
"event.type=YAML_DOCUMENT_START_EVENT; state=%d", state);
199 yaml_version_directive_t *ver =
200 event.data.document_start.version_directive;
202 SCLogError(
"ERROR: Invalid configuration file.");
203 SCLogError(
"The configuration file must begin with the following two lines: %%YAML "
207 int major = ver->major;
208 int minor = ver->minor;
210 SCLogError(
"ERROR: Invalid YAML version. Must be 1.1");
214 else if (event.type == YAML_SCALAR_EVENT) {
215 char *value = (
char *)event.data.scalar.value;
216 char *
tag = (
char *)
event.data.scalar.tag;
217 SCLogDebug(
"event.type=YAML_SCALAR_EVENT; state=%d; value=%s; "
218 "tag=%s; inseq=%d", state, value,
tag, inseq);
223 if (state ==
CONF_KEY && strlen(value) == 0) {
229 event.data.scalar.style == YAML_PLAIN_SCALAR_STYLE) {
230 if (strlen(value) == 0 || strcmp(value,
"~") == 0 || strcmp(value,
"null") == 0 ||
231 strcmp(value,
"Null") == 0 || strcmp(value,
"NULL") == 0) {
239 SCLogInfo(
"Including configuration file %s.", value);
258 if (was_empty == 0) {
261 if (seq_node != NULL) {
285 seq_node->
val = NULL;
292 SCLogInfo(
"Including configuration file %s.", value);
300 if (strcmp(value,
"include") == 0) {
302 if (++include_count > 1) {
303 SCLogWarning(
"Multipline \"include\" fields at the same level are "
304 "deprecated and will not work in Suricata 8, please move "
305 "to an array of include files: line: %zu",
312 if (parent->
val == NULL) {
314 if (parent->
val && strchr(parent->
val,
'_'))
319 if (strchr(value,
'.') != NULL) {
327 if (existing != NULL) {
328 if (!existing->
final) {
329 SCLogInfo(
"Configuration node '%s' redefined.", existing->
name);
337 if (node->
name && strchr(node->
name,
'_')) {
338 if (!(parent->
name &&
339 ((strcmp(parent->
name,
"address-groups") == 0) ||
340 (strcmp(parent->
name,
"port-groups") == 0)))) {
344 "%s is deprecated. Please use %s on line %" PRIuMAX
347 (uintmax_t)parser->mark.line + 1);
351 "parameter name warnings.");
361 if (value != NULL && (
tag != NULL) && (strcmp(
tag,
"!include") == 0)) {
362 SCLogInfo(
"Including configuration file %s at "
363 "parent node %s.", value, node->
name);
366 }
else if (!node->
final && value != NULL) {
367 if (node->
val != NULL)
375 else if (event.type == YAML_SEQUENCE_START_EVENT) {
376 SCLogDebug(
"event.type=YAML_SEQUENCE_START_EVENT; state=%d", state);
378 if (ConfYamlParse(parser, state ==
CONF_INCLUDE ? parent : node, 1, rlevel,
384 else if (event.type == YAML_SEQUENCE_END_EVENT) {
385 SCLogDebug(
"event.type=YAML_SEQUENCE_END_EVENT; state=%d", state);
388 else if (event.type == YAML_MAPPING_START_EVENT) {
389 SCLogDebug(
"event.type=YAML_MAPPING_START_EVENT; state=%d", state);
391 SCLogError(
"Include fields cannot be a mapping: line %zu", parser->mark.line);
407 if (was_empty == 0) {
410 if (seq_node != NULL) {
430 if (ConfYamlParse(parser, seq_node, 0, rlevel, 0) != 0)
434 if (ConfYamlParse(parser, node, inseq, rlevel, 0) != 0)
439 else if (event.type == YAML_MAPPING_END_EVENT) {
440 SCLogDebug(
"event.type=YAML_MAPPING_END_EVENT; state=%d", state);
443 else if (event.type == YAML_STREAM_END_EVENT) {
444 SCLogDebug(
"event.type=YAML_STREAM_END_EVENT; state=%d", state);
449 yaml_event_delete(&event);
453 yaml_event_delete(&event);
478 yaml_parser_t parser;
482 if (yaml_parser_initialize(&parser) != 1) {
483 SCLogError(
"failed to initialize yaml parser.");
487 struct stat stat_buf;
488 if (stat(filename, &stat_buf) == 0) {
489 if (stat_buf.st_mode & S_IFDIR) {
490 SCLogError(
"yaml argument is not a file but a directory: %s. "
491 "Please specify the yaml file in your -c option.",
493 yaml_parser_delete(&parser);
499 infile = fopen(filename,
"r");
500 if (infile == NULL) {
501 SCLogError(
"failed to open file: %s: %s", filename, strerror(errno));
502 yaml_parser_delete(&parser);
506 if (conf_dirname == NULL) {
507 ConfYamlSetConfDirname(filename);
510 yaml_parser_set_input_file(&parser, infile);
511 ret = ConfYamlParse(&parser, root, 0, 0, 0);
512 yaml_parser_delete(&parser);
525 yaml_parser_t parser;
528 if (yaml_parser_initialize(&parser) != 1) {
529 fprintf(stderr,
"Failed to initialize yaml parser.\n");
532 yaml_parser_set_input_string(&parser, (
const unsigned char *)
string,
len);
533 ret = ConfYamlParse(&parser, root, 0, 0, 0);
534 yaml_parser_delete(&parser);
556 yaml_parser_t parser;
560 if (yaml_parser_initialize(&parser) != 1) {
561 SCLogError(
"failed to initialize yaml parser.");
565 struct stat stat_buf;
567 if (stat(filename, &stat_buf) == 0) {
568 if (stat_buf.st_mode & S_IFDIR) {
569 SCLogError(
"yaml argument is not a file but a directory: %s. "
570 "Please specify the yaml file in your -c option.",
577 infile = fopen(filename,
"r");
578 if (infile == NULL) {
579 SCLogError(
"failed to open file: %s: %s", filename, strerror(errno));
580 yaml_parser_delete(&parser);
584 if (conf_dirname == NULL) {
585 ConfYamlSetConfDirname(filename);
590 ConfSet(prefix,
"<prefix root node>");
594 yaml_parser_delete(&parser);
598 yaml_parser_set_input_file(&parser, infile);
599 ret = ConfYamlParse(&parser, root, 0, 0, 0);
600 yaml_parser_delete(&parser);
609 ConfYamlSequenceTest(
void)
618 default-log-dir: /tmp\n\
635 FAIL_IF(strcmp(filename->
val,
"netbios.rules") != 0);
640 FAIL_IF(strcmp(filename->
val,
"x11.rules") != 0);
653 ConfYamlLoggingOutputTest(
void)
660 - interface: console\n\
662 - interface: syslog\n\
685 FAIL_IF(strcmp(output_param->
name,
"interface") != 0);
686 FAIL_IF(strcmp(output_param->
val,
"console") != 0);
689 FAIL_IF(strcmp(output_param->
name,
"log-level") != 0);
690 FAIL_IF(strcmp(output_param->
val,
"error") != 0);
698 FAIL_IF(strcmp(output_param->
name,
"interface") != 0);
699 FAIL_IF(strcmp(output_param->
val,
"syslog") != 0);
702 FAIL_IF(strcmp(output_param->
name,
"facility") != 0);
703 FAIL_IF(strcmp(output_param->
val,
"local4") != 0);
706 FAIL_IF(strcmp(output_param->
name,
"log-level") != 0);
707 FAIL_IF(strcmp(output_param->
val,
"info") != 0);
719 ConfYamlNonYamlFileTest(
void)
733 ConfYamlBadYamlVersionTest(
void)
740 - interface: console\n\
742 - interface: syslog\n\
759 ConfYamlSecondLevelSequenceTest(
void)
767 address: [\"192.168.1.0/24\"]\n\
768 personality: [\"Apache_2_2\", \"PHP_5_3\"]\n\
769 path-parsing: [\"compress_separators\", \"lowercase\"]\n\
779 - compress_separators\n\
807 FAIL_IF(strcmp(node->
val,
"192.168.1.0/24") != 0);
819 ConfYamlFileIncludeTest(
void)
823 const char config_filename[] =
"ConfYamlFileIncludeTest-config.yaml";
824 const char config_file_contents[] =
827 "# Include something at the root level.\n"
828 "include: ConfYamlFileIncludeTest-include.yaml\n"
829 "# Test including under a mapping.\n"
830 "mapping: !include ConfYamlFileIncludeTest-include.yaml\n";
832 const char include_filename[] =
"ConfYamlFileIncludeTest-include.yaml";
833 const char include_file_contents[] =
844 FAIL_IF_NULL((config_file = fopen(config_filename,
"w")));
845 FAIL_IF(fwrite(config_file_contents, strlen(config_file_contents), 1, config_file) != 1);
848 FAIL_IF_NULL((config_file = fopen(include_filename,
"w")));
849 FAIL_IF(fwrite(include_file_contents, strlen(include_file_contents), 1, config_file) != 1);
853 if (conf_dirname != NULL) {
876 node =
ConfGetNode(
"mapping.unix-command.enabled");
883 unlink(config_filename);
884 unlink(include_filename);
894 ConfYamlOverrideTest(
void)
896 char config[] =
"%YAML 1.1\n"
898 "some-log-dir: /var/log\n"
899 "some-log-dir: /tmp\n"
909 " HOME_NET: \"[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]\"\n"
910 " EXTERNAL_NET: any\n"
911 "vars.address-groups.HOME_NET: \"10.10.10.10/32\"\n";
919 FAIL_IF(strcmp(value,
"/tmp") != 0);
924 FAIL_IF(strcmp(value,
"value") != 0);
932 ConfNode *vars_address_groups_external_net =
ConfGetNode(
"vars.address-groups.EXTERNAL_NET");
939 FAIL_IF(strcmp(vars_address_groups_home_net->
val,
"10.10.10.10/32") != 0);
955 ConfYamlOverrideFinalTest(
void)
963 "default-log-dir: /var/log\n";
969 const char *default_log_dir;
972 FAIL_IF(strcmp(default_log_dir,
"/tmp") != 0);
980 static int ConfYamlNull(
void)
985 char config[] =
"%YAML 1.1\n"
987 "quoted-tilde: \"~\"\n"
988 "unquoted-tilde: ~\n"
989 "quoted-null: \"null\"\n"
990 "unquoted-null: null\n"
991 "quoted-Null: \"Null\"\n"
992 "unquoted-Null: Null\n"
993 "quoted-NULL: \"NULL\"\n"
994 "unquoted-NULL: NULL\n"
995 "empty-quoted: \"\"\n"
997 "list: [\"null\", null, \"Null\", Null, \"NULL\", NULL, \"~\", ~]\n";
1060 UtRegisterTest(
"ConfYamlLoggingOutputTest", ConfYamlLoggingOutputTest);
1061 UtRegisterTest(
"ConfYamlNonYamlFileTest", ConfYamlNonYamlFileTest);
1062 UtRegisterTest(
"ConfYamlBadYamlVersionTest", ConfYamlBadYamlVersionTest);
1064 ConfYamlSecondLevelSequenceTest);
1065 UtRegisterTest(
"ConfYamlFileIncludeTest", ConfYamlFileIncludeTest);
1067 UtRegisterTest(
"ConfYamlOverrideFinalTest", ConfYamlOverrideFinalTest);