rust/ldap: udp and frames support v2

[glongo]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues
  (if applicable)

Link to ticket: https://redmine.openinfosecfoundation.org/issues/1199

Describe changes:

• Enable parser and logger for LDAP traffic over UDP
• Add PDU frames
• Fix comments in rust/ldap: udp and frames support v1 #11522

SV_BRANCH=OISF/suricata-verify#1984

[suricata-qa]

ERROR:

ERROR: QA failed on ASAN_TLPR1_suri.

Pipeline 21667

[victorjulien]

suricata: app-layer-parser.c:1373: int AppLayerParserParse(ThreadVars *, AppLayerParserThreadCtx *, Flow *, AppProto, uint8_t, const uint8_t *, uint32_t): Assertion `!((f->proto != IPPROTO_TCP))' failed.
Error: suricata: stacktrace:sig 6:pthread_kill+0x0000012c;raise+0x00000016;abort+0x000000d3;__libc_freeres+0x000000d3;__assert_fail+0x00000046;AppLayerParserParse+0x000012e9;AppLayerHandleUdp+0x0000113c;FlowWorker+0x00000ff1;TmThreadsSlotVarRun+0x00000226;TmThreadsSlotVar+0x00000f56;pthread_condattr_setpshared+0x00000513;__xmknodat+0x00000230 [SignalHandlerUnexpected:suricata.c:327]

[victorjulien]

With a protocol like dns, yaml looks like this:

    dns:
      tcp:                                                                                
        enabled: yes             
        detection-ports:           
          dp: 53                                        
      udp:                                                                         
        enabled: yes                                                          
        detection-ports:                                         
          dp: 53                         

Why is this not similar for ldap here?

[glongo]

With a protocol like dns, yaml looks like this:

    dns:
      tcp:                                                                                
        enabled: yes             
        detection-ports:           
          dp: 53                                        
      udp:                                                                         
        enabled: yes                                                          
        detection-ports:                                         
          dp: 53                         

Why is this not similar for ldap here?

This configuration seems to be used only for DNS, whereas other protocols (such as SIP and KRB) are not.
How should this be handled?

[glongo]

suricata: app-layer-parser.c:1373: int AppLayerParserParse(ThreadVars *, AppLayerParserThreadCtx *, Flow *, AppProto, uint8_t, const uint8_t *, uint32_t): Assertion `!((f->proto != IPPROTO_TCP))' failed.
Error: suricata: stacktrace:sig 6:pthread_kill+0x0000012c;raise+0x00000016;abort+0x000000d3;__libc_freeres+0x000000d3;__assert_fail+0x00000046;AppLayerParserParse+0x000012e9;AppLayerHandleUdp+0x0000113c;FlowWorker+0x00000ff1;TmThreadsSlotVarRun+0x00000226;TmThreadsSlotVar+0x00000f56;pthread_condattr_setpshared+0x00000513;__xmknodat+0x00000230 [SignalHandlerUnexpected:suricata.c:327]

Is there a way to reproduce this issue?

[victorjulien]

suricata: app-layer-parser.c:1373: int AppLayerParserParse(ThreadVars *, AppLayerParserThreadCtx *, Flow *, AppProto, uint8_t, const uint8_t *, uint32_t): Assertion `!((f->proto != IPPROTO_TCP))' failed.
Error: suricata: stacktrace:sig 6:pthread_kill+0x0000012c;raise+0x00000016;abort+0x000000d3;__libc_freeres+0x000000d3;__assert_fail+0x00000046;AppLayerParserParse+0x000012e9;AppLayerHandleUdp+0x0000113c;FlowWorker+0x00000ff1;TmThreadsSlotVarRun+0x00000226;TmThreadsSlotVar+0x00000f56;pthread_condattr_setpshared+0x00000513;__xmknodat+0x00000230 [SignalHandlerUnexpected:suricata.c:327]

Is there a way to reproduce this issue?

I don't have a reproducer to share, sorry. Private data.

[victorjulien]

With a protocol like dns, yaml looks like this:

    dns:
      tcp:                                                                                
        enabled: yes             
        detection-ports:           
          dp: 53                                        
      udp:                                                                         
        enabled: yes                                                          
        detection-ports:                                         
          dp: 53                         

Why is this not similar for ldap here?

This configuration seems to be used only for DNS, whereas other protocols (such as SIP and KRB) are not. How should this be handled?

I think we need the dns approach.

[glongo]

With a protocol like dns, yaml looks like this:

    dns:
      tcp:                                                                                
        enabled: yes             
        detection-ports:           
          dp: 53                                        
      udp:                                                                         
        enabled: yes                                                          
        detection-ports:                                         
          dp: 53                         

Why is this not similar for ldap here?

This configuration seems to be used only for DNS, whereas other protocols (such as SIP and KRB) are not. How should this be handled?

I think we need the dns approach.

Yep, already implemented that approach. PR coming.

[glongo]

Replaced with #11558