Commit Graph

99 Commits (6f339abdf01f972d213d1c9e76ff3d427e1eb183)

Author SHA1 Message Date
Pascal Delalande 80f2fbac6e rust/tftp: eve logging with rust 7 years ago
Clement Galland b9cf49e933 rust/tftp: add tftp parsing and logging
TFTP parsing and logging written in Rust.
Log on eve.json the type of request (read or write), the name of the file and
the mode.

Example of output:
    "tftp":{"packet":"read","file":"rfc1350.txt","mode":"octet"}
7 years ago
Victor Julien e8939335ea rust/nfs: explicitly handle GAPs from C
It seems that Rust optimizes this code in such a way that it
passes the null ptr along as real data.

    if buf.as_ptr().is_null() && input_len > 0 {
7 years ago
Victor Julien 2c3c8f8b85 rust/filetracker: if file API return error, trunc file 7 years ago
Victor Julien d27ed5957f rust/nfs: fix read reply handling
READ replies with large data chunks are processed partially to avoid
queuing too much data. When the final chunk was received however, the
start of the chunk would already tag the transaction as 'done'. The
more aggressive tx freeing that was recently merged would cause this
tx to be freed before the rest of the in-progress chunk was done.

This patch delays the tagging of the tx until the final data has been
received.
7 years ago
Victor Julien 3a2e4614d0 rust/file: handle file open errors 7 years ago
Victor Julien 45c5030ff0 rust/file: change return type for FileOpenFileWithId
Make it int so we can easily check it in Rust. No consumer used the
File pointer that was returned before anyway.
7 years ago
Victor Julien 288ddc95ac rust/core: comment cleanup 7 years ago
Victor Julien 8cda2a4351 rust/nfs: add support for detect_flags API 7 years ago
Victor Julien 98eca55241 rust/dns: implement detect_flags API 7 years ago
Pierre Chifflier 4b6555588f NTP: ensure parser name is not freed after registration 7 years ago
Pierre Chifflier ec62eedc87 Rust: remove deprecated functions LoggerFlags::get_logged/set_logged 7 years ago
Pierre Chifflier 5c6868b327 NTP: update logger to use new API 7 years ago
Victor Julien bca0cd71ae app-layer: use logger bits to avoid looping
Avoid looping in transaction output.

Update app-layer API to store the bits in one step
and retrieve the bits in a single step as well.

Update users of the API.
7 years ago
Victor Julien e1e9ada9df rust/nfs: improve file close handling 7 years ago
Nick Price 350b5d99ce rust/nfs: don't panic on malformed NFS traffic
Instead set events.
7 years ago
Pierre Chifflier f5b27ae767 Rust: fix probing function prototype: change sign and add Flow 7 years ago
Victor Julien 6c251b8576 rust: add --enable-rust-debug
Add option to put Rust code in non-'--release' mode, preserving
debug symbols.

Until now Suricata would have to be compiled with --enable-debug for
this.
7 years ago
Eric Leblond b0a6934431 app-layer-ftp: add ftp-data support
Use expectation to be able to identify connections that are
ftp data. It parses the PASV response, STOR message and the
RETR message to provide extraction of files.

Implementation in Rust of FTP messages parsing is available.

Also this patch changes some var name prefixed by ssh to ftp.
7 years ago
Jason Ish 5a8537fe4a rust/dns - convert more type values to text
Issue:
https://redmine.openinfosecfoundation.org/issues/2364

Convert more record type and errr code values to text.
Remove duplicate type declarations.
7 years ago
Clément Galland 3396747cd6 Dns logger display flags information 7 years ago
Victor Julien bb65a48edd rust: require at least libc 0.2.33
Required to be higher than 0.2.24 for IPPROTO_UDP. Upgraded to latest
version.
7 years ago
Pierre Chifflier 83808bbdad rust/ntp: convert parser to new registration method
Converting the NTP parser to the new registration method is a simple,
3-steps process:
- change the extern functions to use generic input parameters (functions
  in all parsers must share common types to be generic) and cast them
- declare the Parser structure
- remove the C code and call the registration function
7 years ago
Pierre Chifflier 0b07bdf5d9 rust: generate declaration for extern unsafe funcs 7 years ago
Pierre Chifflier e7c0a53cbf rust/applayer: add registration iface for parsers
Add Rust support for the common interface to declare and register all
parsers.

Add a common structure definition to contain all required elements
required for registering a parser, similar to the C interface.
This also reduces the risk of incorrectly registering a parser: the
compiler prevents omitting required functions from the structure, and
functions (even if external) are type-checked. Optional functions are
explicitly marked.
7 years ago
Jason Ish 7eead7dfbc autotools: fix distcheck with rust enabled 7 years ago
Victor Julien d9e5dfa1f0 rust/file: improve truncation handling 7 years ago
Victor Julien e023ce9aad rust/dns: fix new warning in rustc 1.21 7 years ago
Victor Julien fd38e5e82b rust/nfs: fix new warnings in rustc 1.21 7 years ago
Pierre Chifflier e4129c1568 Rust/Lua: cast value to arch-dependant type (fix build on x86, #2197) 8 years ago
Jason Ish 6cfabb7863 autogen: cleanup rust strict warning 8 years ago
Jason Ish 6a4cefb7c5 rust: --enable-rust-strict to turn warnings into errors 8 years ago
Jason Ish 3063851d85 rust/dns/tcp - probe even if payload is short
As the DNS probe just uses the query portion of a response, don't
require there to be as many bytes as specified in the TCP DNS
header. This can occur in large responses where probe is called
without all the data.

Fixes the cases where the app proto is recorded as failed.

Fixes issue:
https://redmine.openinfosecfoundation.org/issues/2169
8 years ago
Victor Julien a306ccfd34 rust/nfs: implement events
Remove lots of panic statements in favor of setting non-fatal events.

Bug #2175.
8 years ago
Victor Julien 82bd732f4e rust/nfs: improve proto detect 8 years ago
Victor Julien 6b4a04510a rust/nfs: remove debug rec_size check
Records larger than 40k are perfectly valid.

Bug #2162.
8 years ago
Jason Ish 40991cab82 rust/dns: handle multiple txt strings
Fix handling of TXT records when there are multiple strings
in a single TXT record. For now, conform to the C implementation
where an answer record is created for each string in a single
txt record.

Also removes the data_len field from the answer entry. In Rust,
the length is available from actual data, which after decoding
may actually be different than the encoded data length, so just
use the length from the actual data.
8 years ago
Pierre Chifflier 8a0549c42e NTP: change parse function to return the number of parsed messages 8 years ago
Pierre Chifflier efe11dc37e Add NTP parser (rust-experimental) 8 years ago
Pierre Chifflier 4f677fd157 Rust gen-c-headers: keep 'const' attribute 8 years ago
Pierre Chifflier 4fe9292ed8 Autotools: add switch to build experimental Rust parsers 8 years ago
Jason Ish 61d9f4bb0a rust: make distcheck fixes 8 years ago
Jason Ish f5a90e26a9 rust: for sclog*, strip nul bytes before logging 8 years ago
Jason Ish 717b826d25 rust: safe string handling in logging
In logging (SCLog*), safely convert strings to cstrings instead
of blindly unwrapping them.

Also implement a simple rust logger if the Suricata C context
is not available.
8 years ago
Jason Ish 14951e3f00 rust: save cargo and CARGO_HOME to variables
During configure, substitute the path of cargo, as well as the
value of CARGO_HOME as variables. This fixes the case where a
user might do:
  make
  sudo make install
Which will cause the cargo bits to be rebuilt, including
re-downloading external crates.

By saving these to variables we can be sure that the same
values are used during make install as were used during
make which prevents the Rust artifacts from being rebuild
during "sudo make install".
8 years ago
Victor Julien 7c119cc595 nfs: log number of chunks that xfer'd a file 8 years ago
Victor Julien e8dae2e093 nfs: add to fileinfo events 8 years ago
Victor Julien db2d928151 rust/nfs: add (file)handle to log as crc32 8 years ago
Jason Ish 829155b9d5 rust/dns: pass byte arrays directly to rust/json
Using the json.set_string_from_bytes which will
safely convert the bytes printable ascii string
before logging.
8 years ago
Jason Ish 96cc503026 rust/lua: use lua_pushlstring for strings
Lua strings can contain NULLs, and Rust strings are UTF8 which
can also contain NULLs. Use pushlstring so a NULL containing
string can be pushed.
8 years ago