Commit Graph

745 Commits (1378b2f45144676d98f3430728dcca3e09540921)

Author SHA1 Message Date
Philippe Antoine 1378b2f451 http2: support deflate decompression
cf #4556
5 years ago
Victor Julien c9cee7af49 smb: add debug validation on file counts 5 years ago
Victor Julien 114d3ba730 smb: count files in tx 5 years ago
Victor Julien c1dfb619c4 http2: support per-tx file accounting 5 years ago
Victor Julien 1b3c3225cd nfs: add debug validation on file counts 5 years ago
Victor Julien 1d48601c25 nfs: support per-tx file accounting 5 years ago
Victor Julien 67759795c6 nfs: don't reuse file transactions
After a file has been closed (CLOSE, COMMIT command or EOF/SYNC part of
READ/WRITE data block) mark it as such so that new file commands on that
file do not reuse the transaction.

When a file transfer is completed it will be flagged as such and not be
found anymore by the NFSState::get_file_tx_by_handle() method. This forces
a new transaction to be created.
5 years ago
Victor Julien 56d3e28a3a filestore: track files getting stored per tx
Avoid evicting a tx before the filedata logger has decided it is
done.
5 years ago
Victor Julien c78f5ac316 app-layer/transactions: track files opens and logs
To make sure a transaction is not evicted before all file logging is complete.
5 years ago
Philippe Antoine 9b8be5a650 smb: get file name in case of chained commands 5 years ago
Philippe Antoine 3e5f59e2cb smb: fix parsing of file deletion over SMB1 5 years ago
Philippe Antoine fde753d9d2 smb: recognizes file deletion over SMB2
using set_info_level == SMB2_FILE_DISPOSITION_INFO
5 years ago
Jason Ish 71679c6ad0 ike: use derive macro from app-layer events 5 years ago
Jason Ish eb55297876 modbus: use derive macro from app-layer events 5 years ago
Jason Ish d3bd008e33 app-layer template: use derived app-layer event 5 years ago
Jason Ish cef2832dcf http2: use derived app-layer event 5 years ago
Jason Ish e92cb36bb8 krb5: use derived app-layer event 5 years ago
Jason Ish 92561837f8 ntp: use derived app-layer event 5 years ago
Jason Ish 1f71fb2cde rfb: register None for get_event_info/get_event_info_by_id
Implementations are not required if they're just going to return
-1. We allow None to be registered for that.
5 years ago
Jason Ish 4fd6aa866f sip: use derived app-layer event 5 years ago
Jason Ish 18448f6ed6 snmp: use derived app-layer event 5 years ago
Jason Ish bb094b17db ssh: use derived app-layer event 5 years ago
Jason Ish 9c3f06d9b5 dhcp: use derived app-layer event 5 years ago
Jason Ish b9f10ba22f smb: use derived get_event_info/get_event_info_by_id 5 years ago
Jason Ish 8eac5fc221 mqtt: derive AppLayerEvent for MQTTEvent 5 years ago
Jason Ish 6ed827a4ef dns: use derive macro for DNSEvent 5 years ago
Jason Ish 9221f1d9d5 applayerevent: derive get_event_info and get_event_info_by_id
Add generation of wrapper functions for get_event_info
and get_event_info_by_id to the derive macro. Eliminates
the need for the wrapper method to be created by the parser
author.
5 years ago
Jason Ish 0fa7b5c2a2 rust/applayer: provide generic event info functions
Provide generic functions for get_event_info and
get_event_info_by_id. These functions can be used by any app-layer
event enum that implements AppLayerEvent.

Unfortunately the parser registration cannot use these functions
directly as generic functions cannot be #[no_mangle]. So they
do need small extern "C" wrappers around them.
5 years ago
Jason Ish 27d1ee98ce rust: derive crate: for custom derives
Currently has one derive, AppLayerEvent to be used like:

  #[derive(AppLayerEvent)]
  pub enum DNSEvent {
      MalformedData,
      NotRequest,
      NotResponse,
      ZFlagSet,
  }

Code will be generated to:
- Convert enum to a c type string
- Convert string to enum variant
- Convert id to enum variant
5 years ago
Jason Ish dbea7d636f rust/applayer: define AppLayerEvent trait
The derive macro will implement this trait for app-layer
event enums.
5 years ago
Jason Ish cf21694ba6 rust(lint): suppress clippy lints that we should fix
Suppress all remaining clippy lints that we trip. This can be
fixed on a per-lint basis.
5 years ago
Jason Ish 91402f9fba rust(lint): remove manual implement of map method
Using `if let` expressions in these cases is better expressed
by the map method, and considered idiomatic Rust for this usage.
5 years ago
Jason Ish b021726a0d rust(lint): map the error instead of using or_else
This is the preffered style and easier to understand the meaning
of the code.
5 years ago
Jason Ish dcf57ecd96 rust(lint): replace push_str of single char to push(<char>) 5 years ago
Jason Ish d5c0962299 rust(lint): fix some usages of references
- ref is discouraged for top level variables
- the other borrow is not required
5 years ago
Jason Ish d0772e04b1 rust(lint): replace checked_mul with saturating_mul
When defaulting checked_mul to u64::max, Rust has a method
that does the same thing called saturating_mul.
5 years ago
Jason Ish d0be7541e9 rust(lint): removed unused unit () return
This is code that is not needed and is a bit confusing to see.
5 years ago
Jason Ish 4abbfd0d97 rust(lint): remove extra parens around bitwise or
This is a readability fix, as on first look they almost look
like a Rust tuple.
5 years ago
Jason Ish ac3a20b6e0 rust(lint): remove useless conversions and clones
These add complexity and may not be optimized out by the compiler.
5 years ago
Jason Ish 8bb6dab69d rust(lint): remove useless format calls
In these simple cases to_string() is recommended and likely
performs better as the formatter is not called.
5 years ago
Jason Ish 5bf5de3350 rust(lint): don't use unwrap_or for function calls
Calling a function in unwrap_or causes that function to always
be called even when not needed. Instead use unwrap_or_else with
a closure which will only be called when needed.
5 years ago
Jason Ish 602bb05e75 rust(lint): fix redundant closures
This lint checks for a closure where a function can be directly
supplied.  Runtime performance is unchanged, but this makes
less work for the compiler.
5 years ago
Jason Ish 69cf5c9eea rust(lint): remove needless borrows
These are needless borrows (references) as the item is already
a reference.
5 years ago
Jason Ish 363b5f99c3 rust: functions that reference raw pointers are unsafe
Based on the Rust clippy lint that recommends that any public
function that dereferences a raw pointer, mark all FFI functions
that reference raw pointers with build_slice and cast_pointer
as unsafe.

This commits starts by removing the unsafe wrapper inside
the build_slice and cast_pointer macros then marks all
functions that use these macros as unsafe.

Then fix all not_unsafe_ptr_arg_deref warnings from clippy.

Fixes clippy lint:
https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref
5 years ago
Jason Ish 53413f2d7a rust: remove all usage of transmute
All cases of our transmute can be replaced with more idiomatic
solutions and do no require the power of transmute.

When returning an object to C for life-time management, use
Box::into_raw to convert the boxed object to pointer and use
Box::from_raw to convert back.

For cases where we're just returning a pointer to Rust managed
data, use a cast.
5 years ago
Victor Julien 9d24a53c53 nfs: minor code cleanup 5 years ago
Victor Julien aa9d8658ef smb: minor formatting fixup 5 years ago
Victor Julien 094208823b smb: minor code cleanup 5 years ago
Shivani Bhardwaj 0a1747c1ba nfs: fix comment 5 years ago
Shivani Bhardwaj 58ac9b0f38 nfs: Add rust registration function
Get rid of the C glue code and move registration completely to Rust.
5 years ago