Feat/sslproxy/v15

etc/schema.json

@@ -5786,6 +5786,10 @@
                                     "description": "Errors encountered parsing SIP/UDP protocol",
                                     "$ref": "#/$defs/stats_applayer_error"
                                 },
+                                "sslproxy": {
+                                    "description": "Errors encountered parsing SSLproxy protocol",
+                                    "$ref": "#/$defs/stats_applayer_error"
+                                },
                                 "smb": {
                                     "description": "Errors encountered parsing SMB protocol",
                                     "$ref": "#/$defs/stats_applayer_error"
@@ -5969,6 +5973,10 @@
                                     "type": "integer",
                                     "description": "Number of flows for SIP/UDP protocol"
                                 },
+                                "sslproxy": {
+                                    "type": "integer",
+                                    "description": "Number of flows for SSLproxy protocol"
+                                },
                                 "smb": {
                                     "type": "integer",
                                     "description": "Number of flows for SMB protocol"
@@ -6143,6 +6151,10 @@
                                     "type": "integer",
                                     "description": "Number of transactions for SIP/UDP protocol"
                                 },
+                                "sslproxy": {
+                                    "type": "integer",
+                                    "description": "Number of transactions for SSLproxy protocol"
+                                },
                                 "smb": {
                                     "type": "integer",
                                     "description": "Number of transactions for SMB protocol"

rust/src/applayer.rs

@@ -346,6 +346,15 @@ impl AppLayerResult {
     pub fn ok() -> Self {
         Default::default()
     }
+    /// parser has successfully processed input, but not all. The rest should be
+    /// immediately be processed.
+    pub fn ok_partial_continue(consumed: u32) -> Self {
+        return Self {
+            status: 2,
+            consumed,
+            needed: 0,
+        };
+    }
     /// parser has hit an unrecoverable error. Returning this to the API
     /// leads to no further calls to the parser.
     pub fn err() -> Self {

rust/src/lib.rs

@@ -120,6 +120,7 @@ pub mod telnet;
 pub mod websocket;
 pub mod enip;
 pub mod pop3;
+pub mod sslproxy;
 pub mod applayertemplate;
 pub mod rdp;
 pub mod x509;

rust/src/sslproxy/mod.rs

@@ -0,0 +1,21 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+//! Application layer sslproxy parser and logger module.
+
+mod parser;
+pub mod sslproxy;

rust/src/sslproxy/parser.rs

@@ -0,0 +1,69 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use nom7::{
+    bytes::streaming::{tag, take_until},
+    number::streaming::{le_u8},
+    character::complete::{digit1},
+    combinator::map_res,
+    IResult,
+};
+use std;
+use std::str;
+use std::str::FromStr;
+use std::net::IpAddr;
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct SSLproxyHeader<> {
+    pub ip1: IpAddr,
+    pub port1: u16,
+    pub ip2: IpAddr,
+    pub port2: u16,
+    pub ip3: IpAddr,
+    pub port3: u16,
+    pub opt: u8,
+}
+
+// SSLproxy: [127.0.0.1]:44627,[192.168.0.30]:54116,[83.215.238.28]:465,s
+pub fn parse_message(i: &[u8]) -> IResult<&[u8], SSLproxyHeader<>> {
+    let (i, _hdr) = tag(b"SSLproxy: [")(i)?;
+    let (i, body) = take_until("\r\n")(i)?;
+    let (x, ip1) = map_res(map_res(take_until("]:"), std::str::from_utf8), IpAddr::from_str,)(body)?;
+    let (x, _) = tag(b"]:")(x)?;
+    let (x, port1) = map_res(map_res(digit1, str::from_utf8), u16::from_str)(x)?;
+    let (x, _) = tag(b",[")(x)?;
+    let (x, ip2) = map_res(map_res(take_until("]:"), std::str::from_utf8), IpAddr::from_str,)(x)?;
+    let (x, _) = tag(b"]:")(x)?;
+    let (x, port2) = map_res(map_res(digit1, str::from_utf8), u16::from_str)(x)?;
+    let (x, _) = tag(b",[")(x)?;
+    let (x, ip3) = map_res(map_res(take_until("]:"), std::str::from_utf8), IpAddr::from_str,)(x)?;
+    let (x, _) = tag(b"]:")(x)?;
+    let (x, port3) = map_res(map_res(digit1, str::from_utf8), u16::from_str)(x)?;
+    let (x, _) = tag(b",")(x)?;
+    let (_, opt) = le_u8(x)?;
+
+    let r = SSLproxyHeader {
+        ip1,
+        port1,
+        ip2,
+        port2,
+        ip3,
+        port3,
+        opt,
+    };
+    Ok((i, r))
+}