suricata

Author	SHA1	Message	Date
Haleema Khan	6b55e53ff5	rfb: add unittests to rfb.rs Task: #5741	4 years ago
Haleema Khan	cdc5ccd7f7	rfb: rustfmt parser.rs	4 years ago
Haleema Khan	b95d7efbd0	rfb: add unittests for nom7 parsers Task: #5741	4 years ago
Pierre Chifflier	3493537ec3	rust/rfb: convert parser to nom7 functions	5 years ago
Frank Honza	1c8943dedd	add RFB parser This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	6 years ago