358 Commits (2f5834cdfab8157a0f8700bd7ac56d9b271b6d6d)

Author	SHA1	Message	Date
Victor Julien	2f5834cdfa	rust: merge parser.rs into applayer.rs ... Both were serving the same purpose.	5 years ago
Victor Julien	21e6f1f063	app-layer: document return macros	5 years ago
Victor Julien	5b9b0b7226	nfs: switch to new 'incomplete' logic ... Remove buffering code in favor of using incomplete API.	5 years ago
Victor Julien	66598f9ce7	nfs: switch to AppLayerResult	5 years ago
Victor Julien	5cd9cfb5a0	smb: update return type of GAP handling	5 years ago
Victor Julien	4bf87d30e4	smb: convert to return AppLayerResult ... Support returning 'incomplete' and remove the buffering code from the parser.	5 years ago
Victor Julien	674b8dc0fb	app-layer: add 'incomplete' return logic ... Allow app-layer parsers to indicate how much data they need before being called again.	5 years ago
Victor Julien	44d3f264bf	app-layer: update API to return more details ... Add AppLayerResult struct as the Parser return type in preparation of allowing returning 'Incomplete(size)' similar to what nom in Rust allows.	5 years ago
Victor Julien	3bcf948a75	app-layer: change return codes ... This patch simplifies the return codes app-layer parsers use, in preparation of a patch set for overhauling the return type. Introduce two macros: APP_LAYER_OK (value 0) APP_LAYER_ERROR (value -1) Update all parsers to use this.	5 years ago
Victor Julien	6ae66cb2bb	nfs: code cleanups ... Use 'if let' to replace simple 'match' statements. Use explicit returns to easy code review.	5 years ago
Victor Julien	a729d266c3	smb: fix rustc 1.42 warnings	5 years ago
Jason Ish	a0e3e2d7b4	dns: register parsers from Rust ... And port the C DNS tests to Rust.	5 years ago
Jason Ish	0af9a3a5f7	dns: remove C wrapper functions to Rust ... Remove registration of C wrapper functions and register the Rust functions directly for UDP.	5 years ago
Jason Ish	1b44f839e6	dns: cleanup: move event callbacks into Rust ... Remove app-layer-dns-common.c as its no longer needed.	5 years ago
Jason Ish	ca5a3f0f04	dns: cleanup: remove unused events ... Removed events that are no longer used since the Rust implementation of DNS: - UnsolicitedResponse - StateMemCapReached - Flooded	5 years ago
Jason Ish	d809b0959b	dns: cleanup: move DnsGetRcode (Lua) to rust ... Move the implementation of Lua DnsGetRcode to Rust.	5 years ago
Philippe Antoine	23f796a021	kerberos: fix against packet split in record size	5 years ago
Victor Julien	76dd951523	krb5/tcp: remove notice logging on failed records	5 years ago
Sascha Steinbiss	11912bd715	sip: address trailing space parsing	5 years ago
Victor Julien	74305c0486	rust/nfs: minor code cleanups	5 years ago
Victor Julien	576e92983e	rust/rpc: add partial data tests	5 years ago
Pierre Chifflier	442500678b	rust: use the streaming version of combinators to fix incomplete reads	5 years ago
Pierre Chifflier	df9a4fd635	rust/rdp: use the streaming version of combinators to fix incomplete reads	5 years ago
Pierre Chifflier	2561da89c0	rust/rdp: fix regression introduced during nom 5 upgrade	5 years ago
Pierre Chifflier	f3ddd7127c	rust: Add types annotation when required ... Unfortunately, the transition to nom 5 (and functions instead of macros) has side-effects, one of them being requiring lots of types annotations when using a parsing, for ex in a match instruction.	5 years ago
Pierre Chifflier	62e31396ae	rust/ftp: upgrade to nom 5 ... CompleteByteSlice type has been removed, and replaced by combinators under the nom::character::complete namespace.	5 years ago
Pierre Chifflier	1a505ccd11	rust/rdp: add custom error handling	5 years ago
Pierre Chifflier	d1bf34a427	rust/smb: add custom error handling	5 years ago
Pierre Chifflier	1ab8c5763c	rust: add SecBlobError custom error type for the Kerberos parser	5 years ago
Pierre Chifflier	030c9a3d86	rust: add take_until_and_consume replacement function	5 years ago
Pierre Chifflier	8664a55ee7	rust/dns: remove unneeded calls to closure!	5 years ago
Pierre Chifflier	5b809f77f1	rust: upgrade all parsers to nom 5	5 years ago
Philippe Antoine	6663246563	parser: make rust probing parsers optional	6 years ago
Victor Julien	f68c255f09	nfs: implement post-GAP transaction cleanup ... Close all prior transactions in the direction of the GAP, except the file xfers. Those use their own logic described below. After a GAP all normal transactions are closed. File transactions are left open as they can handle GAPs in principle. However, the GAP might have contained the closing of a file and therefore it may remain active until the end of the flow. This patch introduces a time based heuristic for these transactions. After the GAP all file transactions are stamped with the current timestamp. If 60 seconds later a file has seen no update, its marked as closed. This is meant to fix resource starvation issues observed in long running SMB sessions where packet loss was causing GAPs. Due to the similarity of the NFS and SMB parsers, this issue is fixed for NFS as well in this patch. Bug #3424. Bug #3425.	6 years ago
Victor Julien	d41aeccea4	smb: handle file transactions post-GAP ... After a GAP all normal transactions are closed. File transactions are left open as they can handle GAPs in principle. However, the GAP might have contained the closing of a file and therefore it may remain active until the end of the flow. This patch introduces a time based heuristic for these transactions. After the GAP all file transactions are stamped with the current timestamp. If 60 seconds later a file has seen no update, its marked as closed. This is meant to fix resource starvation issues observed in long running SMB sessions where packet loss was causing GAPs.	6 years ago
Jason Ish	80cafb2979	flow: expose last time as a function ... This function returns the individual components of the timeval in output pointers making it suitable for use over Rust FFI.	6 years ago
Jason Ish	e68dfa46a6	rust: cargo fix for Rust 2018 edition	6 years ago
Jason Ish	5ee8323028	rust: remove unnecessary parentheses (Rust 1.40 fixup) ... Rust 1.40 in strict mode will now fail the build on the presence of unnecessary parentheses. warning: unnecessary parentheses around type --> src/smb/smb2_ioctl.rs:41:12 | 41 | -> (&mut SMBTransaction) | ^^^^^^^^^^^^^^^^^^^^^ help: remove these parentheses | = note: `#[warn(unused_parens)]` on by default	6 years ago
Victor Julien	f5b33a070a	smb1: allow empty trans records	6 years ago
Victor Julien	40fe29de96	smb1: fix 'event' txs not getting closed ... If the only reason we created a request side TX was to set an event, we would not close it. This patch always looks up the TX from the response side.	6 years ago
Victor Julien	129cd28058	smb/dcerpc: close request tx sooner	6 years ago
Victor Julien	44ac3e30dd	smb: post-GAP handling update ... Close all prior transactions in the direction of the GAP, except the file xfers. Those use their own logic.	6 years ago
Victor Julien	a7ee2ffbde	smb: winreg is a DCERPC facility	6 years ago
Jason Ish	e2c846d01f	snmp: add tx detect flags	6 years ago
Jason Ish	fa4b9d37c2	krb5: register tx detect flags ... Related ticker #3345: https://redmine.openinfosecfoundation.org/issues/3345	6 years ago
Jason Ish	8a232be77e	rust: define TxDetectFlag struct and binding macros ... Define a TxDetectFlag type and macros to generating C bindings for getting and settings the tx detect flags.	6 years ago
Jason Ish	cde49ec246	rust: add tx detect flags function to registration struct	6 years ago
Victor Julien	f9155aa121	files: simplify pruning logic ... Since ebcc4db84a the flow worker runs file pruning after parsing, detection and loging. This means we can simplify the pruning logic. If a file is in state >= CLOSED, we can prune it. Detection and outputs will have had a final chance to process it. Remove the calls to the pruning code from Rust. They are no longer needed.	6 years ago
Jason Ish	f9c9548b74	configure: detect lua integer size ... Lua 5.1 and 5.3 use a different integer size. Run a test program to set the integer size used in the Rust FFI layer to Rust.	6 years ago
Jeff Lucovsky	bd691778eb	rust/ftp: add parser for active mode port handling	6 years ago