94 Commits (4be8334c9e95cc520c9c6a63a98d6b160915d07f)

Author	SHA1	Message	Date
Victor Julien	4be8334c9e	smb2: allow limiting in-flight data size/cnt ... Allow limiting in-flight out or order data chunks per size or count. Implemented for read and writes separately: app-layer.protocols.smb.max-write-queue-size app-layer.protocols.smb.max-write-queue-cnt app-layer.protocols.smb.max-read-queue-size app-layer.protocols.smb.max-read-queue-cnt	4 years ago
Victor Julien	5bcc4162f7	smb2: add options for max read/write size ... Add options for the max read/write size accepted by the parser.	4 years ago
Victor Julien	f28888513a	smb2: track max read/write size and enforce its values	4 years ago
Jason Ish	2341f47755	smb: handle records in the wrong direction ... If an SMB record is seen in the wrong direction, set an event on the PDU frame and don't process the record in the state. No error is returned, so the next record will be processed.	4 years ago
Jason Ish	3cdefd5f8b	smb: use derive AppLayerFrameType	4 years ago
Victor Julien	0c9fdf8f4f	smb: implement frames ... SMB1 record parsing code simplification. Frames: nbss.pdu nbss.hdr nbss.data smb1.pdu smb1.hdr smb1.data smb2.pdu smb2.hdr smb2.data smb3.pdu smb3.hdr smb3.data The smb* frames are created for valid SMB records.	4 years ago
Victor Julien	e6f49e5a05	app/frames: implement name to id API for frames	4 years ago
Victor Julien	c073d5cfbf	app-layer: use StreamSlice as input to parsers ... Remove input, input_len and flags in favor of stream slice.	4 years ago
Victor Julien	6466296b32	app-layer: add StreamSlice to pass data to parsers ... Since object to contain relevant pointer, length, offset, flags to make it easy to pass these to the parsers.	4 years ago
Pierre Chifflier	d67f8f9196	rust/smb: convert parser to nom7 functions (SMB1)	4 years ago
Pierre Chifflier	3da816eb23	rust/smb: convert parser to nom7 functions (NBSS records)	4 years ago
Jason Ish	7732efbec2	app-layer: include decoder events in app-layer tx data ... As most parsers use an events structure we can include it in the tx_data structure to reduce some boilerplate/housekeeping code in app-layer parsers.	4 years ago
Jason Ish	9c67c634c1	app-layer: include DetectEngineState in AppLayerTxData ... Every transaction has an existing mandatory field, tx_data. As DetectEngineState is also mandatory, include it in tx_data. This allows us to remove the boilerplate every app-layer has for managing detect engine state.	4 years ago
Jason Ish	fcfc9876ce	smb: use generic tx iterator	4 years ago
Shivani Bhardwaj	89cb337930	smb: use Direction enum	4 years ago
Shivani Bhardwaj	0c6e9ac931	files: use Direction enum	4 years ago
Sam Muhammed	922a453da5	rust(lint): use is_null() instead of ptr::null_mut() ... Bug: #4594	4 years ago
Shivani Bhardwaj	42da0fb5c5	smb: fix broken stream depth setting ... The stream depth setting was broken since it was moved to Rust because of a missing parser for memory values in configuration. Use get_memval fn from conf.rs to calculate and fetch the correct values.	4 years ago
Shivani Bhardwaj	1f48714e75	smb: remove futile default port setting	4 years ago
Victor Julien	c9cee7af49	smb: add debug validation on file counts	4 years ago
Jason Ish	b9f10ba22f	smb: use derived get_event_info/get_event_info_by_id	4 years ago
Jason Ish	69cf5c9eea	rust(lint): remove needless borrows ... These are needless borrows (references) as the item is already a reference.	4 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe ... Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	4 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute ... All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	4 years ago
Victor Julien	aa9d8658ef	smb: minor formatting fixup	4 years ago
Shivani Bhardwaj	e5c948df87	smb: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	27af4bb002	smb: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	6420df84b7	smb: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	4d6b6b5dfe	smb: add constants	4 years ago
Victor Julien	3587033d9e	files: construct with default, free on drop ... Update protocols.	4 years ago
Jeff Lucovsky	02dccb1529	smb: Rework constructs to use Self/Default ... This commit modifies the constructors to use Self and/or Default::default() when feasible	5 years ago
Philippe Antoine	8307010255	smb: relax probing parser to handle first NBSS message ... cf dcerpc-udp S-V test : First message is Message Type: Session request (0x81) Second message is SMB	5 years ago
Philippe Antoine	1b6e81cd72	smb: probing parser for start and midstream ... The probing parser is more strict at the start of the stream	5 years ago
Philippe Antoine	9dc5258a21	smb: split probing function for code style ... Introduces rs_smb_probe_tcp_midstream	5 years ago
Philippe Antoine	2d14606224	smb: andx support ... Add AndX support for SMB1. Finishes #3475. [Updated by Victor Julien to split functions]	5 years ago
Juliana Fajardini	5226ba1c15	Rust: generic files definition ... Issue: Optimization 3825 - filecontainer: add Files structure, to replace/unify SMBFiles, NFSFiles and HTTP2Files - smb/files: delete SMBFiles implementation - smb/smb: replace SMBFiles with Files - nfs/nfs: delete NFSFiles implementation, replace its former declarations with Files' ones - http2/http2: replace HTTP2Files with Files - http2/mod: Delete reference to file files.rs - http2/files: Delete	5 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	5 years ago
Philippe Antoine	6181459086	smb: do not rely on one valid NBSS byte for probing ... Need to have the SMB header so as to validate	5 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	5 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	5 years ago
Jason Ish	ac93ab281d	rust/logging: allow log macros to be used by plugins ... Fix plugin macros so they can be used by external Rust crates such as plugins.	5 years ago
Victor Julien	77a95eddd9	smb: support AppLayerTxData	5 years ago
Victor Julien	65e9a7c31c	smb: fix 'dangling' files in lossy sessions ... In case of lossy connections the SMB state would properly clean up transactions, including file transactions. However for files the state was never set to 'truncated', leading to files to stay 'active'. This would lead these files staying in the SMB's state. In long running sessions with lots of files this would lead to performance and memory use issues. This patch cleans truncates the file that was being transmitted when a file transaction is being closed.	5 years ago
Victor Julien	25f2efe977	smb: check post-gap timeouts once a second at most	5 years ago
Victor Julien	8aa380600d	smb: update ts only if it changed	5 years ago
Victor Julien	2f5834cdfa	rust: merge parser.rs into applayer.rs ... Both were serving the same purpose.	6 years ago
Victor Julien	5cd9cfb5a0	smb: update return type of GAP handling	6 years ago
Victor Julien	4bf87d30e4	smb: convert to return AppLayerResult ... Support returning 'incomplete' and remove the buffering code from the parser.	6 years ago
Victor Julien	3bcf948a75	app-layer: change return codes ... This patch simplifies the return codes app-layer parsers use, in preparation of a patch set for overhauling the return type. Introduce two macros: APP_LAYER_OK (value 0) APP_LAYER_ERROR (value -1) Update all parsers to use this.	6 years ago
Victor Julien	a729d266c3	smb: fix rustc 1.42 warnings	6 years ago