|
|
|
/* Copyright (C) 2017-2021 Open Information Security Foundation
|
|
|
|
*
|
|
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
|
|
* the GNU General Public License version 2 as published by the Free
|
|
|
|
* Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
|
|
* 02110-1301, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
//! Suricata is a network intrusion prevention and monitoring engine.
|
|
|
|
//!
|
|
|
|
//! Suricata is a hybrid C and Rust application. What is found here are
|
|
|
|
//! the components written in Rust.
|
|
|
|
|
|
|
|
#![cfg_attr(feature = "strict", deny(warnings))]
|
|
|
|
|
|
|
|
// Allow these patterns as its a style we like.
|
|
|
|
#![allow(clippy::needless_return)]
|
|
|
|
#![allow(clippy::let_and_return)]
|
|
|
|
#![allow(clippy::uninlined_format_args)]
|
|
|
|
|
|
|
|
// We find this is beyond what the linter should flag.
|
|
|
|
#![allow(clippy::items_after_test_module)]
|
|
|
|
|
|
|
|
// We find this makes sense at time.
|
|
|
|
#![allow(clippy::module_inception)]
|
|
|
|
|
|
|
|
// The match macro is not always more clear. But its use is
|
|
|
|
// recommended where it makes sense.
|
|
|
|
#![allow(clippy::match_like_matches_macro)]
|
|
|
|
|
|
|
|
// Something we should be conscious of, but due to interfacing with C
|
|
|
|
// is unavoidable at this time.
|
|
|
|
#![allow(clippy::too_many_arguments)]
|
|
|
|
|
|
|
|
// This would be nice, but having this lint enables causes
|
|
|
|
// clippy --fix to make changes that don't meet our MSRV.
|
|
|
|
#![allow(clippy::derivable_impls)]
|
|
|
|
|
|
|
|
// TODO: All unsafe functions should have a safety doc, even if its
|
|
|
|
// just due to FFI.
|
|
|
|
#![allow(clippy::missing_safety_doc)]
|
|
|
|
|
|
|
|
// Allow /// cbindgen:ignore comments on extern blocks
|
|
|
|
// cf https://github.com/mozilla/cbindgen/issues/709
|
|
|
|
#![allow(unused_doc_comments)]
|
|
|
|
|
|
|
|
// Allow unknown lints, our MSRV doesn't know them all, for
|
|
|
|
// example static_mut_refs.
|
|
|
|
#![allow(unknown_lints)]
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
extern crate bitflags;
|
|
|
|
extern crate byteorder;
|
|
|
|
extern crate crc;
|
|
|
|
extern crate memchr;
|
|
|
|
extern crate lru;
|
|
|
|
#[macro_use]
|
|
|
|
extern crate num_derive;
|
|
|
|
extern crate widestring;
|
|
|
|
|
|
|
|
extern crate der_parser;
|
|
|
|
extern crate kerberos_parser;
|
|
|
|
extern crate tls_parser;
|
|
|
|
extern crate x509_parser;
|
|
|
|
extern crate ldap_parser;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
extern crate suricata_derive;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
pub mod core;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
pub mod debug;
|
|
|
|
|
|
|
|
pub mod common;
|
|
|
|
pub mod conf;
|
|
|
|
pub mod jsonbuilder;
|
|
|
|
#[macro_use]
|
|
|
|
pub mod applayer;
|
|
|
|
pub mod frames;
|
|
|
|
pub mod filecontainer;
|
|
|
|
pub mod filetracker;
|
|
|
|
pub mod kerberos;
|
|
|
|
pub mod detect;
|
|
|
|
pub mod utils;
|
|
|
|
|
|
|
|
pub mod ja4;
|
|
|
|
pub mod tls_version;
|
|
|
|
pub mod handshake;
|
|
|
|
|
|
|
|
pub mod lua;
|
|
|
|
|
|
|
|
pub mod dns;
|
mdns: add mdns parser, logger and detection
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
2 months ago
|
|
|
pub mod mdns;
|
|
|
|
pub mod nfs;
|
|
|
|
pub mod ftp;
|
|
|
|
pub mod smb;
|
|
|
|
pub mod krb;
|
|
|
|
pub mod dcerpc;
|
|
|
|
pub mod modbus;
|
|
|
|
|
|
|
|
pub mod ike;
|
|
|
|
pub mod snmp;
|
|
|
|
|
|
|
|
pub mod ntp;
|
|
|
|
pub mod tftp;
|
|
|
|
pub mod dhcp;
|
|
|
|
pub mod sip;
|
add RFB parser
This commit adds support for the Remote Framebuffer Protocol (RFB) as
used, for example, by various VNC implementations. It targets the
official versions 3.3, 3.7 and 3.8 of the protocol and provides logging
for the RFB handshake communication for now. Logged events include
endpoint versions, details of the security (i.e. authentication)
exchange as well as metadata about the image transfer parameters.
Detection is enabled using keywords for:
- rfb.name: Session name as sticky buffer
- rfb.sectype: Security type, e.g. VNC-style challenge-response
- rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ...
The latter could be used, for example, to detect brute-force attempts
on open VNC servers, while the name could be used to map unwanted VNC
sessions to the desktop owners or machines.
We also ship example EVE-JSON output and keyword docs as part of the
Sphinx source for Suricata's RTD documentation.
6 years ago
|
|
|
pub mod rfb;
|
|
|
|
pub mod mqtt;
|
|
|
|
pub mod pgsql;
|
|
|
|
pub mod telnet;
|
|
|
|
pub mod websocket;
|
enip: convert to rust
Ticket: 3958
- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
enip.product_name, enip.protocol_version, enip.revision,
enip.identity_status, enip.state, enip.serial, enip.product_code,
enip.device_type, enip.vendor_id, enip.capabilities,
enip.cip_attribute, enip.cip_class, enip.cip_instance,
enip.cip_status, enip.cip_extendedstatus
2 years ago
|
|
|
pub mod enip;
|
|
|
|
pub mod pop3;
|
|
|
|
pub mod applayertemplate;
|
|
|
|
pub mod rdp;
|
|
|
|
pub mod x509;
|
|
|
|
pub mod asn1;
|
|
|
|
pub mod mime;
|
|
|
|
pub mod ssh;
|
|
|
|
pub mod http2;
|
|
|
|
pub mod quic;
|
|
|
|
pub mod bittorrent_dht;
|
|
|
|
pub mod plugin;
|
|
|
|
pub mod lzma;
|
|
|
|
pub mod util;
|
|
|
|
pub mod ffi;
|
|
|
|
pub mod feature;
|
|
|
|
pub mod sdp;
|
|
|
|
pub mod ldap;
|
|
|
|
pub mod flow;
|
|
|
|
pub mod direction;
|
|
|
|
|
|
|
|
#[allow(unused_imports)]
|
|
|
|
pub use suricata_lua_sys;
|
|
|
|
//Re-export htp symbols
|
|
|
|
pub use htp::c_api::*;
|