Jeff Lucovsky
aa8871a5be
rust/default: Enable Default usage
4 years ago
Jeff Lucovsky
6028ca7827
nfs: Rework constructs to use Self/Default
4 years ago
Jeff Lucovsky
aafb0a60b7
dhcp: Rework constructs to use Self/Default
4 years ago
Jeff Lucovsky
1ef0bd580b
dcerpc: Rework constructs to use Self/Default
4 years ago
Jeff Lucovsky
00167121dc
dns: Rework constructs to use Self/Default
4 years ago
Jeff Lucovsky
02dccb1529
smb: Rework constructs to use Self/Default
...
This commit modifies the constructors to use Self and/or
Default::default() when feasible
4 years ago
Jeff Lucovsky
f502f21f9e
rust/default: Enable Default usage in SMB
4 years ago
Shivani Bhardwaj
581cb6223d
dcerpc/udp: Add rust registration function
...
Get rid of the C glue code and move registration completely to Rust.
4 years ago
Shivani Bhardwaj
d7007424bd
dcerpc/udp: Change fn sign as per rust registration requirement
...
Registering parsers in Rust requires signatures to be a certain way and
compatible with C. Change signatures of all the functions.
4 years ago
Shivani Bhardwaj
bac69af7e4
dcerpc: Add rust registration function
...
Get rid of the C glue code and move registration completely to Rust.
4 years ago
Shivani Bhardwaj
a0a09a102b
dcerpc: Change fn sign as per rust registration requirement
...
Registering parsers in Rust requires signatures to be a certain way and
compatible with C. Change signatures of all the functions.
4 years ago
Shivani Bhardwaj
dee972b863
rust/core: Make AppProto type u16
4 years ago
Shivani Bhardwaj
d66ad96f0d
applayer/rust: add extern AppLayerProtoDetectPMRegisterPatternCSwPP
4 years ago
Victor Julien
d7c3ecb6f9
http2: remove dead code
4 years ago
Philippe Antoine
b3c502d572
http2: remove assertion which can be wrong
...
Brotli decoder stops consuming input it it reaches the
end of its input
4 years ago
Simon Dugas
c2720fc2fb
modbus: fix quantity and count calculation
...
The [Modbus Spec S6.11](https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf )
clearly states that the `count = quantity / 8` and not the other way
around. This is fixed in sawp-0.5.0.
4 years ago
Philippe Antoine
999327ba1f
http2: http.cookie keyword now works for HTTP2
4 years ago
Philippe Antoine
df039555bc
http2: http.host.raw keyword now works for HTTP2
4 years ago
Philippe Antoine
1e82d0b3c8
http2: http.method keyword now works for HTTP2
4 years ago
Philippe Antoine
017e39d8fd
http2: makes all HTTP1 header keywords work
4 years ago
Simon Dugas
a8a51dc004
modbus: add eve logging
4 years ago
Simon Dugas
8342641477
modbus: move tests from c to rust
...
Move tests in a seperate commit so that we can use the previous one for
regression testing. This also gets rid of the temporary glue that made
the C tests work with the rust implementation.
4 years ago
Simon Dugas
a458a94dca
modbus: move from C to rust
...
Adds a new rust modbus app layer parser and detection module.
Moves the C module to rust but leaves the test cases in place to
regression test the new rust module.
4 years ago
frank honza
f83d51d0cb
ike: set event for multiple server proposals
4 years ago
Philippe Antoine
ca6e434e0b
ftp: completely parses pasv and epsv responses
4 years ago
Philippe Antoine
6fe8bce3b0
http2: have filecontainer for both directions
4 years ago
Jason Ish
c7f44447c9
dns: remove flood protection purging
...
It doesn't look like flood protection is required with the
stateless parser anymore. It actually can get in the way of TCP
DNS when a large number of requests end-up in the same segment
where a TX can get purged before it has a chance to go through
the normal TX life-cycle.
4 years ago
Shivani Bhardwaj
c663ac6ddd
dcerpc/tcp: improve detection
...
Lately, some of the TLS data was misdetected as DCERPC/TCP because of
the pattern |05 00|. Add more checks in DCERPC probe function to ensure
that it is in fact DCERPC/TCP.
4 years ago
Philippe Antoine
d2d0e0adc9
rust: remove exported unused functions
4 years ago
Philippe Antoine
6da9a37285
rdp: correctly returns incomplete in parse_tc
...
Adding the already consumed bytes
In case an incomplete tls handshake is handled with/after
a refular rdp t123_tpkt
4 years ago
Philippe Antoine
3de0123ffb
http2: adds check about dynamic headers table size
4 years ago
Philippe Antoine
1ca4f041bb
http2: pass data through when decompression fails
...
as is done for HTTP1
4 years ago
Juliana Fajardini
c6a35d09b7
templates: fix typos
...
- *template*files[ch][rs]: fix typos
- scripts/setup-app-layer: fix typos
4 years ago
Jason Ish
6853bf98fb
dns: only register a single logger
...
DNS no longer requires a logger to be registered for to-client and
to-server directions. This has not been required with the stateless
design of the Rust DNS parser.
4 years ago
Philippe Antoine
0105d4f017
rust: bump bitflags dependency version
...
So that lexical-core, needed by nom, and using bitflags
is used with version 0.7.5 instead of version 0.7.0
which fixed the fact that BITS is now a reserved keyword
in nightly version
4 years ago
Philippe Antoine
cb150e97d0
kerberos: fix probing parser tag condition
...
according to the comment
4 years ago
Sascha Steinbiss
e2dbdd7fd5
ikev1: add ikev1 parser
4 years ago
frank honza
ecdf9f6b0b
ikev1: rename ikev2 to common ike
...
Renaming was done with shell commands, git mv for moving the files and content like
find -iname '*.c' | xargs sed -i 's/ikev1/ike/g' respecting the different mixes of upper/lower case.
4 years ago
frank honza
ab6171c429
detect: added support for protocol-aliases
4 years ago
frank honza
e9494ddd8f
util: add function converting u8-array into a hex-String
4 years ago
Philippe Antoine
8307010255
smb: relax probing parser to handle first NBSS message
...
cf dcerpc-udp S-V test :
First message is Message Type: Session request (0x81)
Second message is SMB
4 years ago
Philippe Antoine
1b6e81cd72
smb: probing parser for start and midstream
...
The probing parser is more strict at the start of the stream
4 years ago
Philippe Antoine
9dc5258a21
smb: split probing function for code style
...
Introduces rs_smb_probe_tcp_midstream
4 years ago
Shivani Bhardwaj
0ac5c5376a
dcerpc: trigger raw assembly on record completion
4 years ago
Shivani Bhardwaj
c77c8e7005
rust/context: add AppLayerParserTriggerRawStreamReassembly
4 years ago
Philippe Antoine
2d14606224
smb: andx support
...
Add AndX support for SMB1. Finishes #3475 .
[Updated by Victor Julien to split functions]
4 years ago
Shivani Bhardwaj
f967a49104
dcerpc/udp: improve detection
...
Lately, Wireguard proto starting w pattern |04 00| is misdetected as
DCERPC/UDP which also starts with the same pattern, add more checks
to make sure that it is the best guess for packet to be dcerpc/udp.
5 years ago
Shivani Bhardwaj
3641f1b522
dcerpc: add probe function
5 years ago
Shivani Bhardwaj
d7a3523b12
rust/applayer: split EOF flag per direction
5 years ago
Shivani Bhardwaj
0ca8591994
dcerpc/udp: remove transmute
...
The book defines transmute as "This is really, truly, the most horribly unsafe
thing you can do in Rust. The guardrails here are dental floss."
Transmute can result into mind boggling undefined behaviors. Get rid of
it wherever possible.
5 years ago