|
|
|
/* Copyright (C) 2017-2021 Open Information Security Foundation
|
|
|
|
*
|
|
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
|
|
* the GNU General Public License version 2 as published by the Free
|
|
|
|
* Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
|
|
* 02110-1301, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
//! Suricata is a network intrusion prevention and monitoring engine.
|
|
|
|
//!
|
|
|
|
//! Suricata is a hybrid C and Rust application. What is found here are
|
|
|
|
//! the components written in Rust.
|
|
|
|
|
|
|
|
#![cfg_attr(feature = "strict", deny(warnings))]
|
|
|
|
|
|
|
|
// Allow these patterns as its a style we like.
|
|
|
|
#![allow(clippy::needless_return)]
|
|
|
|
#![allow(clippy::let_and_return)]
|
|
|
|
#![allow(clippy::uninlined_format_args)]
|
|
|
|
|
|
|
|
// We find this is beyond what the linter should flag.
|
|
|
|
#![allow(clippy::items_after_test_module)]
|
|
|
|
|
|
|
|
// We find this makes sense at time.
|
|
|
|
#![allow(clippy::module_inception)]
|
|
|
|
|
|
|
|
// The match macro is not always more clear. But its use is
|
|
|
|
// recommended where it makes sense.
|
|
|
|
#![allow(clippy::match_like_matches_macro)]
|
|
|
|
|
|
|
|
// Something we should be conscious of, but due to interfacing with C
|
|
|
|
// is unavoidable at this time.
|
|
|
|
#![allow(clippy::too_many_arguments)]
|
|
|
|
|
|
|
|
// This would be nice, but having this lint enables causes
|
|
|
|
// clippy --fix to make changes that don't meet our MSRV.
|
|
|
|
#![allow(clippy::derivable_impls)]
|
|
|
|
|
|
|
|
// TODO: All unsafe functions should have a safety doc, even if its
|
|
|
|
// just due to FFI.
|
|
|
|
#![allow(clippy::missing_safety_doc)]
|
|
|
|
|
|
|
|
// Allow /// cbindgen:ignore comments on extern blocks
|
|
|
|
// cf https://github.com/mozilla/cbindgen/issues/709
|
|
|
|
#![allow(unused_doc_comments)]
|
|
|
|
|
|
|
|
// Allow unknown lints, our MSRV doesn't know them all, for
|
|
|
|
// example static_mut_refs.
|
|
|
|
#![allow(unknown_lints)]
|
|
|
|
|
|
|
|
// Allow for now, but need to be fixed.
|
|
|
|
#![allow(static_mut_refs)]
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
extern crate bitflags;
|
|
|
|
extern crate byteorder;
|
|
|
|
extern crate crc;
|
|
|
|
extern crate memchr;
|
|
|
|
extern crate lru;
|
|
|
|
#[macro_use]
|
|
|
|
extern crate num_derive;
|
|
|
|
extern crate widestring;
|
|
|
|
|
|
|
|
extern crate der_parser;
|
|
|
|
extern crate kerberos_parser;
|
|
|
|
extern crate tls_parser;
|
|
|
|
extern crate x509_parser;
|
|
|
|
extern crate ldap_parser;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
extern crate suricata_derive;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
pub mod log;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
pub mod core;
|
|
|
|
|
|
|
|
#[macro_use]
|
|
|
|
pub mod common;
|
|
|
|
pub mod conf;
|
|
|
|
pub mod jsonbuilder;
|
|
|
|
#[macro_use]
|
|
|
|
pub mod applayer;
|
|
|
|
pub mod frames;
|
|
|
|
pub mod filecontainer;
|
|
|
|
pub mod filetracker;
|
|
|
|
pub mod kerberos;
|
|
|
|
pub mod detect;
|
|
|
|
pub mod utils;
|
|
|
|
|
|
|
|
pub mod ja4;
|
|
|
|
|
|
|
|
pub mod lua;
|
|
|
|
|
|
|
|
pub mod dns;
|
|
|
|
pub mod nfs;
|
|
|
|
pub mod ftp;
|
|
|
|
pub mod smb;
|
|
|
|
pub mod krb;
|
|
|
|
pub mod dcerpc;
|
|
|
|
pub mod modbus;
|
|
|
|
|
|
|
|
pub mod ike;
|
|
|
|
pub mod snmp;
|
|
|
|
|
|
|
|
pub mod ntp;
|
|
|
|
pub mod tftp;
|
|
|
|
pub mod dhcp;
|
|
|
|
pub mod sip;
|
add RFB parser
This commit adds support for the Remote Framebuffer Protocol (RFB) as
used, for example, by various VNC implementations. It targets the
official versions 3.3, 3.7 and 3.8 of the protocol and provides logging
for the RFB handshake communication for now. Logged events include
endpoint versions, details of the security (i.e. authentication)
exchange as well as metadata about the image transfer parameters.
Detection is enabled using keywords for:
- rfb.name: Session name as sticky buffer
- rfb.sectype: Security type, e.g. VNC-style challenge-response
- rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ...
The latter could be used, for example, to detect brute-force attempts
on open VNC servers, while the name could be used to map unwanted VNC
sessions to the desktop owners or machines.
We also ship example EVE-JSON output and keyword docs as part of the
Sphinx source for Suricata's RTD documentation.
6 years ago
|
|
|
pub mod rfb;
|
|
|
|
pub mod mqtt;
|
|
|
|
pub mod pgsql;
|
|
|
|
pub mod telnet;
|
|
|
|
pub mod websocket;
|
enip: convert to rust
Ticket: 3958
- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
enip.product_name, enip.protocol_version, enip.revision,
enip.identity_status, enip.state, enip.serial, enip.product_code,
enip.device_type, enip.vendor_id, enip.capabilities,
enip.cip_attribute, enip.cip_class, enip.cip_instance,
enip.cip_status, enip.cip_extendedstatus
2 years ago
|
|
|
pub mod enip;
|
|
|
|
pub mod applayertemplate;
|
|
|
|
pub mod rdp;
|
|
|
|
pub mod x509;
|
|
|
|
pub mod asn1;
|
|
|
|
pub mod mime;
|
|
|
|
pub mod ssh;
|
|
|
|
pub mod http2;
|
|
|
|
pub mod quic;
|
|
|
|
pub mod bittorrent_dht;
|
|
|
|
pub mod plugin;
|
|
|
|
pub mod lzma;
|
|
|
|
pub mod util;
|
|
|
|
pub mod ffi;
|
|
|
|
pub mod feature;
|
|
|
|
pub mod sdp;
|
|
|
|
pub mod ldap;
|
|
|
|
pub mod flow;
|
|
|
|
pub mod direction;
|
|
|
|
|
|
|
|
#[allow(unused_imports)]
|
|
|
|
pub use suricata_lua_sys;
|