suricata/rust/src/lib.rs

/* Copyright (C) 2017 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

#![cfg_attr(feature = "strict", deny(warnings))]

extern crate libc;

#[macro_use]
extern crate nom;

extern crate crc;

extern crate der_parser;
extern crate kerberos_parser;

#[macro_use]
pub mod log;

#[macro_use]
pub mod core;

pub mod conf;
pub mod json;
pub mod applayer;
pub mod filecontainer;
pub mod filetracker;
#[macro_use]
pub mod parser;
pub mod kerberos;

#[cfg(feature = "lua")]
pub mod lua;

pub mod dns;
pub mod nfs;
pub mod ftp;
pub mod smb;
pub mod krb;

pub mod ikev2;

pub mod ntp;
pub mod tftp;
rust: wrapper around C logging, and "context" Where the context is a struct passed from C with pointers to all the functions that may be called. Instead of referencing C functions directly, wrap them in function pointers so pure Rust unit tests can still run. 8 years ago			`/* Copyright (C) 2017 Open Information Security Foundation`
			`*`
			`* You can copy, redistribute or modify this Program under the terms of`
			`* the GNU General Public License version 2 as published by the Free`
			`* Software Foundation.`
			`*`
			`* This program is distributed in the hope that it will be useful,`
			`* but WITHOUT ANY WARRANTY; without even the implied warranty of`
			`* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the`
			`* GNU General Public License for more details.`
			`*`
			`* You should have received a copy of the GNU General Public License`
			`* version 2 along with this program; if not, write to the Free Software`
			`* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA`
			`* 02110-1301, USA.`
			`*/`

rust: --enable-rust-strict to turn warnings into errors 8 years ago			`#![cfg_attr(feature = "strict", deny(warnings))]`

rust: filecontainer API Wrapper around Suricata's File and FileContainer API. Built around assumption that a rust owned structure will have a 'SuricataFileContainer' member that is managed by the C-side of things. 8 years ago			`extern crate libc;`

rust: dns: nom DNS parsers 8 years ago			`#[macro_use]`
			`extern crate nom;`

rust/nfs: add (file)handle to log as crc32 8 years ago			`extern crate crc;`

rust/smb: initial support Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5) 8 years ago			`extern crate der_parser;`
auth/krb5: move kerberos5 wrapper to rust root Make it available outside of just the SMB parser. 7 years ago			`extern crate kerberos_parser;`
rust/smb: initial support Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5) 8 years ago
rust: stub out logging from rust 8 years ago			`#[macro_use]`
			`pub mod log;`
rust: stub out configuration access functions 8 years ago
rust: dns: add log filtering on rrtype While the filtering is still configured in C, the filtering flags are passed into Rust so it can determine if a record should be logged or not. 8 years ago			`#[macro_use]`
rust: wrapper around C logging, and "context" Where the context is a struct passed from C with pointers to all the functions that may be called. Instead of referencing C functions directly, wrap them in function pointers so pure Rust unit tests can still run. 8 years ago			`pub mod core;`
rust: dns: add log filtering on rrtype While the filtering is still configured in C, the filtering flags are passed into Rust so it can determine if a record should be logged or not. 8 years ago
rust: stub out configuration access functions 8 years ago			`pub mod conf;`
rust: add libjansson wrapper for rust 8 years ago			`pub mod json;`
rust: use LoggerFlags type to track logged state 8 years ago			`pub mod applayer;`
rust: filecontainer API Wrapper around Suricata's File and FileContainer API. Built around assumption that a rust owned structure will have a 'SuricataFileContainer' member that is managed by the C-side of things. 8 years ago			`pub mod filecontainer;`
rust: filetracker API Initial version of a filetracker API that depends on the filecontainer and wraps around the Suricata File API in C. The API expects chunk based transfers where chunks can be out of order. 8 years ago			`pub mod filetracker;`
rust/applayer: add registration iface for parsers Add Rust support for the common interface to declare and register all parsers. Add a common structure definition to contain all required elements required for registering a parser, similar to the C interface. This also reduces the risk of incorrectly registering a parser: the compiler prevents omitting required functions from the structure, and functions (even if external) are type-checked. Optional functions are explicitly marked. 8 years ago			`#[macro_use]`
			`pub mod parser;`
auth/krb5: move kerberos5 wrapper to rust root Make it available outside of just the SMB parser. 7 years ago			`pub mod kerberos;`
rust: lua wrapper Rust wrapper for working with lua state. 8 years ago
			`#[cfg(feature = "lua")]`
			`pub mod lua;`

rust: dns: nom DNS parsers 8 years ago			`pub mod dns;`
rust/nfs: NFSv3 parser, logger and detection 8 years ago			`pub mod nfs;`
app-layer-ftp: add ftp-data support Use expectation to be able to identify connections that are ftp data. It parses the PASV response, STOR message and the RETR message to provide extraction of files. Implementation in Rust of FTP messages parsing is available. Also this patch changes some var name prefixed by ssh to ftp. 8 years ago			`pub mod ftp;`
rust/smb: initial support Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5) 8 years ago			`pub mod smb;`
Add Kerberos 5 application layer 7 years ago			`pub mod krb;`
Add NTP parser (rust-experimental) 8 years ago
Add new parser: IKEv2 Add a new parser for Internet Key Exchange version (IKEv2), defined in RFC 7296. The IKEv2 parser itself is external. The embedded code includes the parser state and associated variables, the state machine, and the detection code. The parser looks the first two messages of a connection, and analyzes the client and server proposals to check the cryptographic parameters. 8 years ago			`pub mod ikev2;`

Add NTP parser (rust-experimental) 8 years ago			`pub mod ntp;`
rust/tftp: add tftp parsing and logging TFTP parsing and logging written in Rust. Log on eve.json the type of request (read or write), the name of the file and the mode. Example of output: "tftp":{"packet":"read","file":"rfc1350.txt","mode":"octet"} 8 years ago			`pub mod tftp;`