96 Commits (69c00a77b5a04c3b667e50a0e1125e37d0806492)

Author	SHA1	Message	Date
Victor Julien	f5b33a070a	smb1: allow empty trans records	7 years ago
Victor Julien	40fe29de96	smb1: fix 'event' txs not getting closed ... If the only reason we created a request side TX was to set an event, we would not close it. This patch always looks up the TX from the response side.	7 years ago
Victor Julien	129cd28058	smb/dcerpc: close request tx sooner	7 years ago
Victor Julien	44ac3e30dd	smb: post-GAP handling update ... Close all prior transactions in the direction of the GAP, except the file xfers. Those use their own logic.	7 years ago
Victor Julien	a7ee2ffbde	smb: winreg is a DCERPC facility	7 years ago
Jason Ish	42e5065ab8	rust: update to Rust 2018 with cargo fix ... Migrate to Rust 2018 edition. Credit to Danny Browning for first demontrating this: https://github.com/OISF/suricata/pull/3604/commits	7 years ago
Shivani Bhardwaj	8bebea5d4c	rust: Get rid of unneeded macros, fix warnings	7 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	7 years ago
Jeff Lucovsky	9ccc28baeb	rust/smb: Implement get event by id	7 years ago
Victor Julien	3f6624bf16	rust: remove libc crate dependency ... Use std::os::raw instead.	7 years ago
Jeff Lucovsky	d568e7fadd	eve/logging: 2991 Optimize logging by TX ... This changeset makes changes to the TX logging path. Since the txn is passed to the TX logger, the TX can be used directly instead of through the TX id.	7 years ago
Victor Julien	b1d4931842	rust: fix warnings about wrong type of comments ... "rustdoc does not generate documentation for macro expansions"	7 years ago
Victor Julien	bf1bd407dd	rust: fix libc deprecation warnings for int types	7 years ago
Victor Julien	422e4892cc	proto-detect: improve midstream support ... When Suricata picks up a flow it assumes the first packet is toserver. In a perfect world without packet loss and where all sessions neatly start after Suricata itself started, this would be true. However, in reality we have to account for packet loss and Suricata starting to get packets for flows already active be for Suricata is (re)started. The protocol records on the wire would often be able to tell us more though. For example in SMB1 and SMB2 records there is a flag that indicates whether the record is a request or a response. This patch is enabling the procotol detection engine to utilize this information to 'reverse' the flow. There are three ways in which this is supported in this patch: 1. patterns for detection are registered per direction. If the proto was not recognized in the traffic direction, and midstream is enabled, the pattern set for the opposing direction is also evaluated. If that matches, the flow is considered to be in the wrong direction and is reversed. 2. probing parsers now have a way to feed back their understanding of the flow direction. They are now passed the direction as Suricata sees the traffic when calling the probing parsers. The parser can then see if its own observation matches that, and pass back it's own view to the caller. 3. a new pattern + probing parser set up: probing parsers can now be registered with a pattern, so that when the pattern matches the probing parser is called as well. The probing parser can then provide the protocol detection engine with the direction of the traffic. The process of reversing takes a multi step approach as well: a. reverse the current packets direction b. reverse most of the flows direction sensitive flags c. tag the flow as 'reversed'. This is because the 5 tuple is *not* reversed, since it is immutable after the flows creation. Most of the currently registered parsers benefit already: - HTTP/SMTP/FTP/TLS patterns are registered per direction already so they will benefit from the pattern midstream logic in (1) above. - the Rust based SMB parser uses a mix of pattern + probing parser as described in (3) above. - the NFS detection is purely done by probing parser and is updated to consider the direction in that parser. Other protocols, such as DNS, are still to do. Ticket: #2572	7 years ago
Victor Julien	f7a41412d6	smb1: fix NT create andx records filename parsing ... Use file name parsing routines that take unicode into account and consider padding bytes as well.	7 years ago
Wesley van der Ree	cc50908f8d	smb: fix NT create filename parsing ... parse_smb_create_andx_request_record skipped 1 byte too much before the filename. Fixes: #2894	7 years ago
Victor Julien	25112ee7e3	rust/smb: fix and optimize record search ... Get rid of struct with just a slice reference as well.	8 years ago
Pierre Chifflier	f22695130b	rust: nom4 requires to add complete!() when using many! combinators	8 years ago
Pierre Chifflier	8c0cde36c6	rust: fix warnings for unused variables (add _)	8 years ago
Pierre Chifflier	13b7399790	rust: upgrade all parsers to nom4	8 years ago
Pierre Chifflier	2f08b3eabd	rust/nom4: error_code is superseded by error_position	8 years ago
Victor Julien	8b570c0293	smb: improve request/response mapping ... Only use ssn_id and msg_id for mapping a response to a request. By not using the tree_id it can always be included in the tx.hdr which means it can be logged properly in case of IOCTL and DCERPC.	8 years ago
Victor Julien	0e40231189	app-layer: improve transaction cleanup handling ... The app layers with a custom iterator would skip a tx if during the ..Cleanup() pass a transaction was removed. Address this by storing the current index instead of the next index. Also pass in the next "min_tx_id" to be incremented from the last TX. Update loops to do this increment. Also make sure that the min_id is properly updated if the last TX is removed when out of order. Finally add a SMB unittest to test this. Reported by: Ilya Bakhtin	8 years ago
Victor Julien	c62273f4fd	rust/smb: silence noisy debug messages	8 years ago
Victor Julien	4d5024255f	smb/dcerpc: remove now unused ssn2maxsize_map	8 years ago
Victor Julien	4d044483cf	smb/dcerpc: clean up and unify DCERPC probe logic	8 years ago
Victor Julien	ac4e888597	smb2/dcerpc: probe if response data is dcerpc ... If we missed the tree connect we can't know for sure if we're reading from a (DCERPC) PIPE or not. In this case probe the data to see if it looks like DCERPC. If the detection succeeds, use a special 'suricata::dcerpc' service in the TX. Simplify handling of DCERPC records that cross records Update logging for the response only TXs.	8 years ago
Victor Julien	9dd7c38113	smb2: skip rest of READ response if status is not success	8 years ago
Victor Julien	edd0c2246c	smb1: add SMB1_COMMAND_QUERY_INFO_DISK command mapping	8 years ago
Victor Julien	177966970a	smb: probing parser improvement	8 years ago
Victor Julien	2b581cd6db	smb: log trans2 that enable delete on close	8 years ago
Victor Julien	eefac0ef95	smb1: add support for trans2 set_path_info rename	8 years ago
Victor Julien	1b86d4e1a2	smb: improve dcerpc logic ... Detect whether a pipe is a dcerpc channel based on the name of the pipe.	8 years ago
Victor Julien	7c8a078a2c	smb1: improve NT Create response record parsing	8 years ago
Victor Julien	2e6014b15c	rust/smb: search for record on midstream start ... Calls with both START and MIDSTREAM mean the record might be cut and the start of it could be missing. For this case, enable the same logic as is used when catching up after a GAP. Search for the start of the record instead of assuming it sits exactly at the start of the input data.	8 years ago
Victor Julien	f40fc0293b	smb: minor optimizations	8 years ago
Victor Julien	b1e2783788	auth/krb5: move kerberos5 wrapper to rust root ... Make it available outside of just the SMB parser.	8 years ago
Victor Julien	4d58aaae90	smb: clean up partial read/write record handling	8 years ago
Victor Julien	aa8d64c2b8	smb: improve skip handling ... When skipping records the skip tracker could underflow if the record parsing had more data than expected. Enforce the calculation by moving it into a method and make the actual fields private.	8 years ago
Victor Julien	eac7a92200	smb2: improve read/write record parsing ... parse_smb2_response_read()/parse_smb2_response_write() can be called on incomplete data, so they didn't use the read/write length field to grab the data field. Instead it just used rest(). However in some cases SMB2 records have trailing data, which would be included in the READ/WRITE data. This patch addresses this by using the length field if enough data is available.	8 years ago
Victor Julien	ea1e13cb00	smb: suppress notice messages	9 years ago
Pierre Chifflier	576b8ef722	SMB: simplify code	9 years ago
Pierre Chifflier	cf5de0c58e	SMB: use String::from_utf8_lossy in logging functions	9 years ago
Pierre Chifflier	b5529e4ffb	SMB: use kerberos-parser to extract Real and PrincipalName	9 years ago
Victor Julien	0dfb3f0e7f	smb1: extract rename info from TRANS2 ... Exclude TRANS2 from generic TX lookup bypass.	9 years ago
Victor Julien	8eeda113c8	smb1: add parsing for RENAME command	9 years ago
Victor Julien	7b61f2c589	smb2: log renames	9 years ago
Victor Julien	15978d4e85	smb: if filename is missing, use '<unknown>'	9 years ago
Victor Julien	71742ed52b	smb: share can't be <share_root>	9 years ago
Victor Julien	bc193242ad	smb1: add OPEN_ANDX command name for logging	9 years ago