758 Commits (784a080201844f88c48893b74ac622e08e5b1cb3)

Author	SHA1	Message	Date
Philippe Antoine	8ac363c34d	rust: fix warning about unused values in smb tests	5 years ago
Jason Ish	0a3b9e0220	rust/hashing: add function to finalize md5 to hex string ... New function, SCMd5FinalizeToHex to finalize an md5 hash to a hex string.	5 years ago
Jason Ish	26c1321668	rust/hashing: function to md5 hash buffer to hex ... Add function SCMd5HashBufferToHex to hash a single buffer to an md5 hex string.	5 years ago
Jason Ish	0f714be9f3	rust/hashing: method to SHA256 and finalize in one call ... Add SCSha256HashBuffer to hash a single buffer returning the result.	5 years ago
Jason Ish	eb5cfd9b82	rust/hashing: new function to SHA1 hash a single buffer ... SCSha1HashBuffer will has a single buffer and compute the digest in one call.	5 years ago
Jason Ish	ff37526c6b	rust: remove md5 crate, unalias md-5 ... Remove the md5 crate as a dependency as it is no longer removed. We now use md-5 from RustCrypto.	5 years ago
Jason Ish	0a2d8509c9	rust/ssh: use md-5 crate instead of md5 ... The "md-5" crate is part of the RustCrypto project that also uses the sha1 and sha256 crates we are using. These all implement the Digest trait for a common API.	5 years ago
Jason Ish	1022b217ed	rust/hashing: a method to md5 hash a single buffer ... Add SCMd5HashBuffer as a replacement for NSS HASH_HashBuf as used in ja3 to hash a single buffer.	5 years ago
Jason Ish	46ceb13c08	rust: add ffi module for sha256, sha1 and md5 ... Add a Rust module that exposes Rust implementations of sha256, sha1 and md5 from the RustCrypto project. This is an experiment in replacing the libnss hash functions with pure Rust versions that will allow us to remove nss as a compile time option. Initial tests are good, even with a 10% or so performance improvement when being called from C. Also trying a module naming scheme where modules under the ffi modules are purely for exports to C, as it doesn't make any sense to use this new hashing module directly from Rust.	5 years ago
Jeff Lucovsky	8ce2078a38	tftp: Add test cases ... This commit adds test cases for the TFTP parser.	5 years ago
Jeff Lucovsky	e900b6d265	tftp: Improve parser ... This commit improves TFTP parsing by ensuring the mode and opcode are valid.	5 years ago
Jason Ish	f77fd0c0cb	rust: include file cleanup ... The cbindgen generated header should not include rust.h as rust.h already includes the generated binding. Fixup C source code that only pulled the generated include, it should instead pull in "rust.h" which includes the generated binding plus other misc. stuff.	5 years ago
Juliana Fajardini	e33bbee9b7	nbss: add parser tests ... Add tests to parse_nbss_record and parse_nbss_record_partial	5 years ago
Juliana Fajardini	5226ba1c15	Rust: generic files definition ... Issue: Optimization 3825 - filecontainer: add Files structure, to replace/unify SMBFiles, NFSFiles and HTTP2Files - smb/files: delete SMBFiles implementation - smb/smb: replace SMBFiles with Files - nfs/nfs: delete NFSFiles implementation, replace its former declarations with Files' ones - http2/http2: replace HTTP2Files with Files - http2/mod: Delete reference to file files.rs - http2/files: Delete	5 years ago
Sascha Steinbiss	a4556c9427	dns: use rest() for NULL parsing	5 years ago
Sascha Steinbiss	81b206a5f4	dns: add test for SRV	5 years ago
Sascha Steinbiss	08a6f1441a	dns: parse SRV records	5 years ago
Antti Tönkyrä	f3ad7f14fa	dns: add rdata logging for NS rrtype	5 years ago
Simon Dugas	4336a0e739	dns: log rdata for NULL record type ... Logs the rdata for a NULL record type as a printable string.	5 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	5 years ago
Philippe Antoine	f574663352	http2: files inspection API fixes ... uses right transaction id for file tracker uses FILE_USE_DETECT for good matches with keyword startswith	5 years ago
Philippe Antoine	a63ee5adbd	http2: allow multiple size updates in one headers batch ... cf RFC 7541 section 4.2	5 years ago
Philippe Antoine	6181459086	smb: do not rely on one valid NBSS byte for probing ... Need to have the SMB header so as to validate	5 years ago
Jason Ish	f3c59ef8a6	rust: handle windows naming change from .lib to .a ... Prior to Rust 1.44, Cargo would name static libs with the .lib extension. 1.44 changes this extension to .a when running under a GNU environment on Windows like msys to make it more similar to other unix environments. Now assume static library name to be the same on Windows and unix, but rename the .lib if found to still support older versions of Rust on Windows.	5 years ago
Victor Julien	ba781265a4	dcerpc/udp: fix transaction handling and logging ... Implement missing transaction handling. Fix logging wrongly casting 'state' to DCERPCState instead of DCERPCUDPState leading to crashes and malformed output. Remove unused fields from DCERPCUDPState.	5 years ago
Philippe Antoine	8db78208f9	rust: fix warnings found by nightly compiler ... warning: getting the inner pointer of a temporary `CString` this `CString` is deallocated at the end of the statement, bind it to a variable to extend its lifetime	5 years ago
Jason Ish	2f81f3fbe9	rust/log: clarify comment in non-debug mode SCLogDebug	5 years ago
Jason Ish	a453d28bc6	rust/log: order log macros in descending order ... Readability cleanup. - error, notice, ... debug	5 years ago
Jason Ish	411a5d41c1	rust/log: expand macros after checking log level ... Expand macros in the do_log macro after checking the log level instead of each log macro (ie: SCLogDebug) expanding the macros then passing off to do_log to have the log level check. Will eliminate any expense of expanding macros if this log level does not permit the given message to be logged. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4114	5 years ago
Shivani Bhardwaj	269324e84d	dcerpc/log: Log fields particular to an RPC version ... Log fields that only are meant to be in a PDU for a particular RPC version. Since DCERPC/UDP works on RPC version 4 and DCERPC/TCP works on RPC version 5, there are certain fields that are particular to each version. Remove call_id from the logger for UDP. Add activityuuid and seqnum fields to the logger for UDP. call_id and (activityuuid + seqnum) fields are used to uniquely pair a request with response for RPC versions 5 and 4 respectively.	5 years ago
Ilya Bakhtin	2033f386f9	rust/dcerpc: Remove redundant fields	5 years ago
Ilya Bakhtin	2840a2e064	rust/dcerpc: Make tx_id u64	5 years ago
Ilya Bakhtin	6916b63f09	dcerpc/udp: Fix pairing of request response ... So far, request and response were paired with serial number fields in the header. This is incorrect. According to https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm, "Together, the activity UUID and the sequence number uniquely identify a remote procedure call." Hence, add activity uuid and sequence number to the transaction and pair the request accordingly. Remove incorrect handling of this and fix tests.	5 years ago
Ilya Bakhtin	e9b21553cc	rust/dcerpc: Add UDP flag definitions	5 years ago
Victor Julien	51f4e4d0b7	dcerpc/udp: add missing tx free logic	5 years ago
Victor Julien	9f9c29a14a	dcerpc: fix stream flag handling ... Only hardcoded direction flags were passed to the parser, not the full range. Handle receiving an EOF flag w/o data. Bug: #3856	5 years ago
Victor Julien	f31372ad1d	dcerpc/tcp: fix compile warning ... warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1036:42 | 1036 | let tx = if let Some(mut tx) = self.get_tx_by_call_id(current_call_id, core::STREAM_TOCLIENT) { | ----^^ | | | help: remove this `mut` | = note: `#[warn(unused_mut)]` on by default warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1061:30 | 1061 | Some(mut tx) => { | ----^^ | | | help: remove this `mut`	5 years ago
Victor Julien	67b5295bbc	dcerpc/tcp: add missing detect state cleanup	5 years ago
Philippe Antoine	1fd6f5bc61	http2: asymetric sizes for headers tables ... The headers table from client to server and the one from server to client may have different maximum sizes (even if both endpoints have to keep both tables)	5 years ago
Philippe Antoine	aaa69fe3c5	smb: resistance against padding evasions ... Scenario is use of dummy padding in write AndX request or other similar commands using a data offset. Parsing skips now these dummy bytes, and generates one event	5 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	5 years ago
Philippe Antoine	3e96f96153	rdp: fix incomplete result ... Aggregating the consumed bytes	5 years ago
Jason Ish	0529a00ffd	dhcp: set unidirection transaction flag	5 years ago
Jason Ish	3036ec4db0	ikev2: set unidirection transaction flag	5 years ago
Jason Ish	ff674d0cd0	mqtt: set unidirection transaction flag	5 years ago
Jason Ish	54d5f336d4	sip: set unidirection transaction flag	5 years ago
Jason Ish	1d40d0c5f9	rdp: set unidirection transaction flag	5 years ago
Jason Ish	f7dee602e9	krb5: set unidirection transaction flag	5 years ago
Jason Ish	984d3c7f20	ntp: set unidirection transaction flag	5 years ago
Jason Ish	fc7d59d92f	snmp: set unidirectional transaction flag	5 years ago
Philippe Antoine	64fcba228b	http2: complete parsing of priority frames	5 years ago
Philippe Antoine	c300a859a0	http2: keep track of dynamic headers table size ... And evict entries accordingly to maximum size	5 years ago
Philippe Antoine	1a21eea0e9	http2: variable size integers decoded everywhere	5 years ago
Philippe Antoine	b21acfbf21	http2: StreamIdReuse frame types exceptions ... Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed	5 years ago
Philippe Antoine	89573060d9	http2: use variable integer for headers lengths	5 years ago
Shivani Bhardwaj	97c67cd5ce	dcerpc: fix gap handling ... This patch addresses issues discovered by redmine ticket 3896. With the approach of finding latest record, there was a chance that no record was found at all and consumed + needed became input length. e.g. input_len = 1000 input = 01 05 00 02 00 03 a5 56 00 00 ..... There exists no |05 00| identifier in the rest of the record. After having parsed |05 00|, there was a search for another record with the leftover data. Current data length at this point would be 997. Since the identifier was not found in the data, we calculate the consumed bytes at this point i.e. consumed = current_data.len() - 1 which would be 996. Needed bytes still stay at a constant of 2. So, consumed + needed = 996 + 2 = 998 which is lesser than initial input length of 1000 and hence the assertion fails. There could be two fixes to this problem. 1. Finding the latest record but making use of the last found record in case no new record was found. 2. Always use the earliest record. This patch takes the approach (2). It also makes sure that the gap and current direction are the same.	5 years ago
Philippe Antoine	4f963717f8	fuzz: better configure checks for MSAN building ... More compatible check for rust nightly Checks for CARGO_BUILD_TARGET Builds release or debug mode independently	5 years ago
Victor Julien	5d985c4271	dcerpc: implement tx free function	5 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic ... When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	5 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	5 years ago
Shivani Bhardwaj	301454e9e4	dcerpc: fix datatypes while handling stub data	5 years ago
Shivani Bhardwaj	3fd9a3d420	dcerpc: fix datatype for stub data len	5 years ago
Philippe Antoine	222b386102	rust: rebuilds std when building fuzzers ... so as to have MSAN working	5 years ago
Philippe Antoine	15447cc672	dceprc: signature rust check with is_char_boundary ... before calling split_at which would panic	5 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	5 years ago
Philippe Antoine	7011bddf84	http2: mimic HTTP1 request from upgrade	5 years ago
Philippe Antoine	9d1b030ff0	http2: first connection upgrade from http1	5 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	5 years ago
Sascha Steinbiss	ed9fed4958	mqtt: add some extra tests for varint parsing	5 years ago
Philippe Antoine	1a88df7e88	http2: handles incomplete frames after banner ... To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	5 years ago
Philippe Antoine	7ab9a01db2	mqtt: limit size of variable integer	5 years ago
Philippe Antoine	e3b28bcf2a	http2: returns error in case of index 0 ... As is documented in RFC 7541, section 6.1 The index value of 0 is not used. It MUST be treated as a decoding error if found in an indexed header field representation.	5 years ago
Jason Ish	e9fec043b5	rust/util: expose function to test strings for valid UTF-8 ... rs_check_utf8 will check that the provided string is valid UTF-8 by converting it to a Rust string and returning true or false.	5 years ago
Simon Dugas	7f26246ce1	dns: parse and log fields for SOA record type ... Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA` struct. Added logging for answer and authority SOA records in both version 1 & 2, as well as grouped formats.	5 years ago
Simon Dugas	af498fd840	dns: use nom's rest to take all remaining rdata ... Using nom's `rest` combinator eliminates the need to call the do_parse macro for parsing a single element.	5 years ago
Simon Dugas	8005f50647	dns: refactor to handle more rdata formats ... Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`. This will allow parsing/logging of more complex formats like SOA.	5 years ago
Jason Ish	647e304f4b	rust/log: minor cleanup ... Group functions for setting and getting the log level together.	5 years ago
Jason Ish	ea1338b464	rust: function macro now returns the function name ... Borrow a macro from https://github.com/popzxc/stdext-rs that will give us the Rust function name in SCLog messages in Rust. As this trick only works on Rust 1.38 and newer, keep the old macro around and set a feature based on a Rust version test done during ./configure.	5 years ago
Jason Ish	bac8016d17	rust: plugin bootstrap function ... Functions written in Rust will need to suricata::plugin::init() to bootstrap themselves. This bootstrap process sets the log level within the Rust address space, and hooks up function pointers that are expected to be set during normal runs of Suricata.	5 years ago
Jason Ish	3de98b3595	rust/log: set the log level with a pure Rust function ... Make sure the log level is setup with a pure Rust function, so when it is set, its set within the address space of the caller. This is important for Rust plugins where the Rust modules are not in the address space of the Suricata main process.	5 years ago
Jason Ish	ac93ab281d	rust/logging: allow log macros to be used by plugins ... Fix plugin macros so they can be used by external Rust crates such as plugins.	5 years ago
Jason Ish	3672cea876	rust/Cargo: build as rlib for plugin linkage ... Build Rust code as an rlib, in addition to a staticlib so plugins can link with the Rust code.	5 years ago
Philippe Antoine	b20a8de646	dns: simply skips zero-sized dns requests/responses	5 years ago
Ilya Bakhtin	c903441fe7	mqtt: fixed wrong slice access ... Slice access esults in rust panic when mqtt ping is processed	5 years ago
Victor Julien	4aa80ac7f6	detect/http2: fix header inspection ... Header inspection was overwriting data that was still being referenced by the detect engine, leading to ASAN issues.	5 years ago
Jason Ish	f26d6eaf98	http2: log as http to abstract http and http2 a little ... This commit logs http2 as an http event. The idea is to somewhat normalize http/http2 so common info can be version agnostic. This puts the http2 specific fields in an "http2" object inside the "http" object. HTTP2 headers/values that are in common with HTTP1 are logged under the "http" object to be compatible with HTTP1 logging.	5 years ago
Jason Ish	6a55606adb	http2: log headers in the same format as http (1) ... Log the headers in request_headers, and response_headers like http1 to remain compatible.	5 years ago
Philippe Antoine	1422b18a99	http2: initial support	5 years ago
Jeff Lucovsky	be57f6d3cc	rust/rdp: Fix use of incorrect buffer ... This commit updates the connection confirmation parsing function to use the correct buffer when determining the packet type.	5 years ago
Shivani Bhardwaj	2529eb35e1	smb: use uuid crate	5 years ago
Jason Ish	e6668560e0	rust: only run cbindgen if needed ... Only run cbindgen when necessary. This is a bit tricky. When building a dist we want to unconditionally build the headers. When going through a "make; sudo make install" type process, cbindgen should not be run as the headers already exist, are valid, and the environment under sudo is more often than not suitable to pick up the Rust toolchains when installed with rustup. For the normal "make" case we have the gen/rust-bindings.h file depend on library file, this will cause it to only be rebuilt if the code was modified. For "make dist" we unconditionally create "dist/rust-bindings.h". This means the generated file could be in 2 locations, so update configure.ac, and the library search find to find it. The "gen/rust-bindings.h" should be picked up first if it exists, for those who develop from a dist archive where "dist/rust-bindings.h" also exists. Not completely happy having the same file in 2 locations, but not sure how else to get the dependency tracking correct.	5 years ago
Shivani Bhardwaj	4c7f55e636	dcerpc: handle gap for TCP streams	5 years ago
Jason Ish	6cff558663	dns: add tailing data to split tcp unit test ... Add trailing data to the complete payload to test the case where data is consumed, but still incomplete.	5 years ago
Jason Ish	cc154ce152	dns: fix subtraction overflow in debug message ... The math for the return value wasn't updated in the debug log to match the logic and could lead to a subtraction overflow	5 years ago
Philippe Antoine	80ccbff28a	dns: return status from parsing tcp request	5 years ago
Philippe Antoine	1296740471	dns: fix incomplete results ... and messages parsing whose length is >= 32768	5 years ago
Philippe Antoine	83567e8732	files: rust closes files even on 0 length chunk	5 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Victor Julien	b99ffd9ece	eve: remove unused jansson code	5 years ago
Jeff Lucovsky	961b314b86	dns: Remove parser buffering code	5 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format ... Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	5 years ago
Philippe Antoine	eb5b927787	ssh: fixing incomplete kex parsing ... We use the record length from the ssh record header, and not the size of the parsed data, as is done in other places.	5 years ago
Victor Julien	bcd416e6ba	nfs: fix 'dangling' files in lossy sessions ... In case of lossy connections the NFS state would properly clean up transactions, including file transactions. However for files the state was never set to 'truncated', leading to files to stay 'active'. This would lead these files staying in the NFS's state. In long running sessions with lots of files this would lead to performance and memory use issues. This patch cleans truncates the file that was being transmitted when a file transaction is being closed. Based on 65e9a7c31c	5 years ago
Victor Julien	fc7cecb4ae	nfs: check post-gap timeouts once a second at most ... Based on 25f2efe977	5 years ago
Victor Julien	5d65e5a748	nfs: update ts only if it changed ... Based on 8aa380600d	5 years ago
Zach Kelly	b25de4d99a	rdp: remove parser buffering code	5 years ago
Zach Kelly	22a2bee614	rdp/eve: convert to jsonbuilder	5 years ago
Zach Kelly	ef397daba3	rdp: rustfmt (update)	5 years ago
Shivani Bhardwaj	35362b7bfa	jsonbuilder: run test if not debug-validate	5 years ago
Shivani Bhardwaj	2ce7d98af1	dcerpc: fix tests to have a valid header	5 years ago
Shivani Bhardwaj	9f9670ebdc	logging: Add DCERPC logger	5 years ago
Shivani Bhardwaj	bab497ab2c	dcerpc: Add multi transaction support ... DCERPC parser so far provided support for single transactions only. Extend that to support multiple transactions. In order for multiple transactions to work, there is always a transaction identifier for any protocol in its header that lets a response match the request. In DCERPC, for TCP, that param is call_id in the header which is a 32 bit field. For UDP, however since it uses different version of RPC (4.x), this is defined by serial number field defined in the header. This field however is not contiguous and needs to be assembled by the provided serial_low and serial_hi fields.	5 years ago
Shivani Bhardwaj	67e7be633c	krb: convert to jsonbuilder ... Closes redmine ticket 3754.	5 years ago
Shivani Bhardwaj	72dab0a8b7	snmp: convert to jsonbuilder ... Closes redmine ticket 3756.	5 years ago
Jason Ish	7ca24041b6	rust: add doc target to build rust docs ... Uses "cargo doc --no-deps" to build the documentation just for our Suricata package. Without --no-deps, documentation will be build for all our dependencies as well. The generated documentation will end up in target/doc as HTML.	5 years ago
Jason Ish	abc71dc4a5	applayer template (rust): better gap handling example ... In the request parser, show checking if a gap was received and what one example of trying to continue might look like.	5 years ago
Jason Ish	b91bb92b7d	applayer template (rust): incomplete support ... Show how to use the incomplete AppLayerResult type within the limits of what the template protocol parser can provide. Redmine issue: https://redmine.openinfosecfoundation.org/issues/3541	5 years ago
Jason Ish	3f615f751b	rust app-layer template: add stubs for gap handling	5 years ago
Jason Ish	d60671d855	rust/dns: use new flags field to set parser option flags	5 years ago
Jason Ish	53aa967e0b	applayer: add flags to parser registration struct ... This will allow Rust parsers to register for gap handing from Rust (some Rust parsers do handle gaps, but they set the flag from C).	5 years ago
Jason Ish	9d9a901b68	dns: conditional logging ... Apply config to newly created response TX.	5 years ago
Victor Julien	ac3cf6ff75	detect/config: set config for special cases ... Allow app-layer to declare the txs are uni-directional and special care is needed for applying config.	5 years ago
Victor Julien	5dd4d948d9	app-layer: remove unused detect flags API	5 years ago
Victor Julien	c94a5e6392	app-layer/rust: don't use option for GetTxDataFn anymore	5 years ago
Victor Julien	8fe9faecb2	app-layer: remove DetectFlags API. Replaced by AppLayerTxData	5 years ago
Victor Julien	88dd0abb38	rdp: support AppLayerTxData	5 years ago
Victor Julien	9664f73f75	app-layer: remove logged API calls	5 years ago
Victor Julien	e0debed0b4	tftp: support AppLayerTxData	5 years ago
Victor Julien	4ff51a0e07	sip: support AppLayerTxData	5 years ago
Victor Julien	cc1210c956	ntp: support AppLayerTxData	5 years ago
Victor Julien	e0f75157a0	ikev2: support AppLayerTxData	5 years ago
Victor Julien	64e2a27512	applayer/template: support AppLayerTxData	5 years ago
Victor Julien	a484bbbe1b	dhcp: support AppLayerTxData	5 years ago
Victor Julien	11e2434526	snmp: support AppLayerTxData	5 years ago
Victor Julien	5afe4835ad	rfb: support AppLayerTxData	5 years ago
Victor Julien	9f29366c7c	krb5: support AppLayerTxData	5 years ago
Victor Julien	2aab1938d7	ssh: support AppLayerTxData	5 years ago
Victor Julien	a1e06247a6	dcerpc/udp: support AppLayerTxData	5 years ago
Victor Julien	3202d29325	dcerpc: support AppLayerTxData	5 years ago
Victor Julien	77a95eddd9	smb: support AppLayerTxData	5 years ago
Victor Julien	7a7805cde6	nfs: support AppLayerTxData	5 years ago
Victor Julien	fb3bdd8cf3	dns: remove detect_flags and logged now that we use AppLayerTxData	5 years ago
Victor Julien	5665fc8301	app-layer: add ApplyTxConfig API ... Optional callback a parser can register for applying configuration to the 'transaction'. Most parsers have a bidirectional tx. For those parsers that have different types of transaction handling, this new callback can be used to properly apply the config.	5 years ago
Victor Julien	e15995e2d2	detect: store detect flags in AppLayerTxData	5 years ago
Victor Julien	c797c9f09c	app-layer: add logger flags to AppLayerTxData	5 years ago
Victor Julien	411f428a38	app-layer: define AppLayerTxData and AppLayerTxConfig ... AppLayerTxData is a structure each tx should include that will contain the common fields the engine needs for tracking logging, detection and possibly other things. AppLayerTxConfig will be used by the detection engine to configure the transaction.	5 years ago
Jason Ish	03efbccfe6	jsonbuilder: set_float, append_float methods ... New methods for setting and appending float values.	5 years ago
Philippe Antoine	ece29c4210	ssh: fix incomplete return for ssh kex ... In the case where we already parsed some records	5 years ago
Philippe Antoine	ca6d072297	dcerpc: detect right parsing of empty op version	5 years ago
Emmanuel Thompson	6e5d64f102	detect/asn1: Simplify errors and checks	5 years ago
Emmanuel Thompson	4fc45b5c60	detect/asn1: Update ASN1 struct lifetime ... - 'static is only realistic when allocating and leaking it over the FFI boundary	5 years ago
Emmanuel Thompson	627e90a4bd	detect/asn1: Log out errors ... - Failure to parse asn1-max-frames - Failure on asn1 detection checks	5 years ago
Emmanuel Thompson	88601b1993	detect/asn1: Update relative_offset keyword ... - To be consistent with recent C version changes - Add checks for over/underflows	5 years ago
Emmanuel Thompson	7af6cdb7ec	detect/asn1: Update asn1 C files to use rust code ... Mark rust extern "C" functions as pub in asn1 module to expose via cbindgen Update detect-asn1.c/h to use rust functions	5 years ago
Emmanuel Thompson	63704fdf13	rust/asn1: Introduce ASN1 rust module ... This module uses the `der-parser` crate to parse ASN1 objects in order to replace src/util-decode-asn1.c It also handles the parsing of the asn1 keyword rules and detection checks performed in src/detect-asn1.c	5 years ago
Emmanuel Thompson	6b8517dc12	rust: Update der, kerberos and snmp parser dependencies ... - The update to der-parser allows us to use the latest API changes	5 years ago
Jason Ish	43b9bfaed4	applayer template (rust): convert to JsonBuilder	5 years ago
Vadym Malakhatko	126597144c	eve: add Hassh fields to SSH JSON logger and add ssh log condition	5 years ago
Vadym Malakhatko	536cee3ba9	rust/ssh: add hassh generation ... Add generation of hassh fingerprints based on fields in the kexinit record	5 years ago
Jeff Lucovsky	d5bb41011c	output/ikev2: Convert to JsonBuilder ... Convert the IKEV2 Json logging to use JsonBuilder.	5 years ago
Victor Julien	65e9a7c31c	smb: fix 'dangling' files in lossy sessions ... In case of lossy connections the SMB state would properly clean up transactions, including file transactions. However for files the state was never set to 'truncated', leading to files to stay 'active'. This would lead these files staying in the SMB's state. In long running sessions with lots of files this would lead to performance and memory use issues. This patch cleans truncates the file that was being transmitted when a file transaction is being closed.	5 years ago
Victor Julien	25f2efe977	smb: check post-gap timeouts once a second at most	5 years ago
Victor Julien	8aa380600d	smb: update ts only if it changed	5 years ago
Jeff Lucovsky	8c5c949cfa	output/tftp: Convert to JsonBuilder ... This commit converts the TFTP logging mechanisms to JsonBuilder.	5 years ago
Jason Ish	07e88a7479	jsonbuilder: add debug_validate to state ... If debug validation is enabled, panic on invalid state errors. For example, calling close on an already closed jsonbuilder object.	5 years ago
Jason Ish	ca6b70ea1b	rust: macro debug_validate_fail to fail with message ... Add a new debug_validate macro that unconditionally panics with a message. Useful in Rust pattern matching.	5 years ago
Shivani Bhardwaj	a7535099b4	smb/eve: convert to jsonbuilder ... Closes redmine ticket 3712.	5 years ago
Jason Ish	639f3d265e	rust: lock to nom 5.1.1 ... 5.1.2 pulls in dependencies that don't build on Rust 1.34.	5 years ago
Victor Julien	79681bf655	app-layer: remove old MPMId API calls ... Had been deprecated and non-functional since 2017.	5 years ago
Jason Ish	a545cdef6a	jsonbuilder: setter for formatted data ... Create a method to set preformatted data that contains the key and the value already formatted. This is an optimization for static data.	5 years ago
Jason Ish	e3b7c58218	jsonbuilder: export {set,append}_string_from_bytes to C	5 years ago
Jason Ish	f184bcc10e	jsonbuilder: use Box::from_raw instead of transmute to free ... I think this is a bad use of transmute, while the end result is the same, Box::from_raw is more correct as we created this pointer with Box::into_raw.	5 years ago
Philippe Antoine	baf5f52f22	ssh/eve: convert to jsonbuilder	5 years ago
Victor Julien	b3b5802c85	eve/nfs: switch output to jsonbuilder	5 years ago
Jason Ish	6ce9b2972b	rdp: enable by default ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/3255	5 years ago
Jason Ish	5a7ba62493	sip: enable by default ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/3256	5 years ago
Jason Ish	36d687580a	rfb/eve: convert to jsonbuilder	5 years ago
Jason Ish	60bfbd43fd	jsonbuilder: add reset marks ... Add methods to get the state of a JsonBuilder (called a mark), then allow restoring to the mark.	5 years ago
Jason Ish	ddb22549be	rust: allow some clippy lints without warning ... Suppresses some clippy lints that have more to do with style than anything else, to reduce the amount of noise in the clippy output.	5 years ago
Jason Ish	03cf3dcd6d	dns/eve: convert to jsonbuilder	5 years ago
Jason Ish	6a70d6bb6e	sip/eve: convert to jsonbuilder	5 years ago
Jason Ish	deed0541bb	dhcp/eve: convert to jsonbuilder	5 years ago
Jason Ish	942dd08654	jsonbuilder: new module for generating json ... JsonBuilder is a Rust module for creating JSON output. Unlike Jansson, the final JSON string is built up as items are added, instead of building up an object tree and rendering it when done. The idea is to create a more efficient JSON serializer instead of a flexible one.	5 years ago
Jason Ish	c1f4edc434	rust: bring back libc as a dependency ... Its already pulled in by some of other dependencies so adds zero extra weight, and provides handy definitions for basic functions like free().	5 years ago
Jason Ish	5513b4ed0b	rust/json: expose libjansson json_dumps ... This will be temporarily used by JsonBuilder to add the ability to extend JsonBuilder with Jansson's json_t types.	5 years ago
Victor Julien	9fd326b6c0	ssh: minor cleanups in incomplete handling	5 years ago
Victor Julien	3a2434ed4d	app-layer: support Copy and Clone traits in AppLayerResult	5 years ago
Victor Julien	b0288da686	app-layer: add methods to get status from AppLayerResult	5 years ago
Philippe Antoine	6373071aa3	ssh: handles incomplete record after banner ... To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	5 years ago
Philippe Antoine	69b4fffdae	parse: move SSH parser from C to Rust	5 years ago
Philippe Antoine	cb3c478525	style: compressed function headers for rustfmt	5 years ago
Philippe Antoine	6b2e7dde7d	rust: export enums definition to C	5 years ago
Shivani Bhardwaj	80adf7d1cf	smb: Import constants from DCERPC ... Remove DCERPC constants to avoid duplicate name errors. Import the required constants from DCERPC implementation.	5 years ago
Shivani Bhardwaj	6457754fd6	dcerpc: Replace C function calls with Rust ... All the dead code in C after the Rust implementation is hereby removed. Invalid/migrated tests have also been deleted. All the function calls in C have been replaced with appropriate calls to Rust functions. Same has been done for smb/detect.rs as a part of this migration.	5 years ago
Shivani Bhardwaj	8036202c7b	rust: Add DCERPC parser ... This parser rewrites the DCE/RPC protocol implementation of Suricata in Rust. More tests have been added to improve the coverage and some fixes have been made to the tests already written in C. Most of the valid tests from C have been imported to Rust. File anatomy src/dcerpc.rs This file contains the implementation of single transactions in DCE/RPC over TCP. It takes care of REQUEST, RESPONSE, BIND and BINDACK business logic before and after the data parsing. DCERPCState holds the state corresponding to a particular transaction and handles all important aspects. It also defines any common structures and constants required for DCE/RPC parsing irrespective of the carrier protocol. src/dcerpc_udp.rs This file contains the implementation of single transactions in DCE/RPC over UDP. It takes care of REQUEST and RESPONSE parsing. It borrows the Request and Response structs from src/dcerpc.rs. src/detect.rs This file contains the implementation of dce_iface and opnum detect keywords. Both the parsing and the matching is taken care of by functions in this file. Tests have been rewritten with the test data from C. src/parser.rs This file contains all the nom parsers written for DCERPCRequest, DCERPCResponse, DCERPCBind, DCERPCBindAck, DCERPCHeader, DCERPCHdrUdp. It also implements functions to assemble and convert UUIDs. All the fields have their endianness defined unless its an 8bit field or an unusable one, then it's little endian but it won't make any difference. src/mod.rs This file contains all the modules of dcerpc folder which should be taken into account during compilation. Function calls This is a State-wise implementation of the protocol for single transaction only i.e. a valid state object is required to parse any record. Function calls start with the app layer parser in C which detects the application layer protocol to be DCE/RPC and calls the appropriate functions in C which in turn make a call to these functions in Rust using FFI. All the necessary information is passed from C to the parsers and handlers in Rust. Implementation When a batch of input comes in, there is an analysis of whether the input header and the direction is appropriate. Next check is about the size of fragment. If it is as defined by the header, process goes through else the data is buffered and more data is awaited. After this, type of record as indicated by the header is checked. A call to the appropriate handler is made. After the handling, State is updated with the latest information about whatever record came in. AppLayerResult::ok() is returned in case all went well else AppLayerResult::err() is returned indicating something went wrong.	5 years ago
Shivani Bhardwaj	6db1f19d62	rust: Add debug_validate_bug_on macro ... This macro allows to check if certain parts of the code are reachable during fuzzing.	5 years ago
Shivani Bhardwaj	57ad609a97	rust: Add new crate uuid	5 years ago
Shivani Bhardwaj	ab6b4986ce	rust: Add Debug and PartialEq to AppLayerResult	5 years ago
frank honza	bbe9137f20	rfb: Update incomplete handling in parser. ... This commit adds an updated incomplete handling for the RFB-Parser. If incomplete data is processed, the successfully consumed position and length of remainder + 1 is returned. If the next packet is not empty suricata will call the parser again. This commit is a result of discussion on https://github.com/OISF/suricata/pull/4792.	5 years ago
Philippe Antoine	edcb784f1a	dns: improve probe_tcp handling of incomplete data	6 years ago