37 Commits (33c424f9ed60a93e0847c7cddac555a52fa92a6f)

Author	SHA1	Message	Date
Philippe Antoine	0c346af4a9	rust: bump up digest crates ... so that we can use hkdf crate for quic	3 years ago
Victor Julien	e6f49e5a05	app/frames: implement name to id API for frames	4 years ago
Victor Julien	c073d5cfbf	app-layer: use StreamSlice as input to parsers ... Remove input, input_len and flags in favor of stream slice.	4 years ago
Victor Julien	6466296b32	app-layer: add StreamSlice to pass data to parsers ... Since object to contain relevant pointer, length, offset, flags to make it easy to pass these to the parsers.	4 years ago
Jason Ish	7732efbec2	app-layer: include decoder events in app-layer tx data ... As most parsers use an events structure we can include it in the tx_data structure to reduce some boilerplate/housekeeping code in app-layer parsers.	4 years ago
Jason Ish	9c67c634c1	app-layer: include DetectEngineState in AppLayerTxData ... Every transaction has an existing mandatory field, tx_data. As DetectEngineState is also mandatory, include it in tx_data. This allows us to remove the boilerplate every app-layer has for managing detect engine state.	4 years ago
Shivani Bhardwaj	b5a123adb1	ssh: use Direction enum	4 years ago
Pierre Chifflier	74be8b94ec	rust/ssh: convert parser to nom7 functions	4 years ago
Sam Muhammed	922a453da5	rust(lint): use is_null() instead of ptr::null_mut() ... Bug: #4594	4 years ago
Shivani Bhardwaj	f3fcc39738	ssh: remove futile default port setting	4 years ago
Jason Ish	bb094b17db	ssh: use derived app-layer event	4 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe ... Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	4 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute ... All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	4 years ago
Philippe Antoine	ef5755338f	rust: SCLogDebug is real nop when built as release ... Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings	4 years ago
Jason Ish	ff37526c6b	rust: remove md5 crate, unalias md-5 ... Remove the md5 crate as a dependency as it is no longer removed. We now use md-5 from RustCrypto.	5 years ago
Jason Ish	0a2d8509c9	rust/ssh: use md-5 crate instead of md5 ... The "md-5" crate is part of the RustCrypto project that also uses the sha1 and sha256 crates we are using. These all implement the Digest trait for a common API.	5 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	5 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	5 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	5 years ago
Jason Ish	ac93ab281d	rust/logging: allow log macros to be used by plugins ... Fix plugin macros so they can be used by external Rust crates such as plugins.	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Philippe Antoine	eb5b927787	ssh: fixing incomplete kex parsing ... We use the record length from the ssh record header, and not the size of the parsed data, as is done in other places.	5 years ago
Jason Ish	53aa967e0b	applayer: add flags to parser registration struct ... This will allow Rust parsers to register for gap handing from Rust (some Rust parsers do handle gaps, but they set the flag from C).	5 years ago
Victor Julien	5dd4d948d9	app-layer: remove unused detect flags API	5 years ago
Victor Julien	c94a5e6392	app-layer/rust: don't use option for GetTxDataFn anymore	5 years ago
Victor Julien	9664f73f75	app-layer: remove logged API calls	5 years ago
Victor Julien	2aab1938d7	ssh: support AppLayerTxData	5 years ago
Victor Julien	5665fc8301	app-layer: add ApplyTxConfig API ... Optional callback a parser can register for applying configuration to the 'transaction'. Most parsers have a bidirectional tx. For those parsers that have different types of transaction handling, this new callback can be used to properly apply the config.	5 years ago
Victor Julien	411f428a38	app-layer: define AppLayerTxData and AppLayerTxConfig ... AppLayerTxData is a structure each tx should include that will contain the common fields the engine needs for tracking logging, detection and possibly other things. AppLayerTxConfig will be used by the detection engine to configure the transaction.	5 years ago
Philippe Antoine	ece29c4210	ssh: fix incomplete return for ssh kex ... In the case where we already parsed some records	5 years ago
Vadym Malakhatko	126597144c	eve: add Hassh fields to SSH JSON logger and add ssh log condition	5 years ago
Vadym Malakhatko	536cee3ba9	rust/ssh: add hassh generation ... Add generation of hassh fingerprints based on fields in the kexinit record	5 years ago
Victor Julien	79681bf655	app-layer: remove old MPMId API calls ... Had been deprecated and non-functional since 2017.	5 years ago
Philippe Antoine	baf5f52f22	ssh/eve: convert to jsonbuilder	5 years ago
Victor Julien	9fd326b6c0	ssh: minor cleanups in incomplete handling	5 years ago
Philippe Antoine	6373071aa3	ssh: handles incomplete record after banner ... To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	5 years ago
Philippe Antoine	69b4fffdae	parse: move SSH parser from C to Rust	5 years ago