suricata

Commit Graph

Author	SHA1	Message	Date
Philippe Antoine	59a109c049	http2: turn Host header into authority during upgrade HTTP1 uses Host, but HTTP2 uses rather :authority cf HPACK (cherry picked from commit `75f75e1eb0`)	5 years ago
Philippe Antoine	cf04608992	dns: improve probing parser Checks opcode is valid Checks additional_rr do not exceed message length Better logic for incomplete cases (cherry picked from commit `9e7ea631b2`)	5 years ago
Philippe Antoine	c42b81b769	nfs: improve probing parser Checks credentials flavor is known (cherry picked from commit `b3c1f2ab48`)	5 years ago
Philippe Antoine	8704057df0	http2: better file tracking If an HTTP2 file was within only ont DATA frame, the filetracker would open it and close it in the same call, preventing the firther call to incr_files_opened Also includes rustfmt again for all HTTP2 files (cherry picked from commit `bb98a18b3d`)	5 years ago
Victor Julien	12e71ed090	smb: add debug validation on file counts (cherry picked from commit `c9cee7af49`)	5 years ago
Victor Julien	c7da7215db	smb: count files in tx (cherry picked from commit `114d3ba730`)	5 years ago
Victor Julien	f8a50a66ca	http2: support per-tx file accounting (cherry picked from commit `c1dfb619c4`)	5 years ago
Victor Julien	bed74c7fbc	nfs: add debug validation on file counts (cherry picked from commit `1b3c3225cd`)	5 years ago
Victor Julien	e9ff5e2c6e	nfs: support per-tx file accounting (cherry picked from commit `1d48601c25`)	5 years ago
Victor Julien	8f2f2b55ee	nfs: don't reuse file transactions After a file has been closed (CLOSE, COMMIT command or EOF/SYNC part of READ/WRITE data block) mark it as such so that new file commands on that file do not reuse the transaction. When a file transfer is completed it will be flagged as such and not be found anymore by the NFSState::get_file_tx_by_handle() method. This forces a new transaction to be created. (cherry picked from commit `67759795c6`)	5 years ago
Victor Julien	717c6b021e	filestore: track files getting stored per tx Avoid evicting a tx before the filedata logger has decided it is done. (cherry picked from commit `56d3e28a3a`)	5 years ago
Victor Julien	4151173e1a	app-layer/transactions: track files opens and logs To make sure a transaction is not evicted before all file logging is complete. (cherry picked from commit `c78f5ac316`)	5 years ago
Philippe Antoine	a900dea72e	http2: support deflate decompression cf #4556 (cherry picked from commit `1378b2f451`)	5 years ago
Victor Julien	b46b2936f2	http2: set Debug on structs (cherry picked from commit `20e8f90981`)	5 years ago
Philippe Antoine	9d9209b65f	rust: bump bitflags dependency version So that lexical-core, needed by nom, and using bitflags is used with version 0.7.5 instead of version 0.7.0 which fixed the fact that BITS is now a reserved keyword in nightly version (cherry picked from commit `0105d4f017`)	5 years ago
Jason Ish	c37f4b7e54	rust/ike: suppress some compile warnings when not debug Due to `ef5755338f`, the variables that are only used for debug output now emit unused variable warnings when Suricata is not built with debug. Prefix these variables with _ to suppress these warnings.	5 years ago
Shivani Bhardwaj	6a53185797	ikev2: remove transforms fields	5 years ago
Philippe Antoine	d70bbb24f4	rust: SCLogDebug is real nop when built as release Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings (cherry picked from commit `ef5755338f`)	5 years ago
Philippe Antoine	234cafdcfe	detect: use u32 for InspectionBufferMultipleForList So that we do not have an endless loop casting index to u16 and having more than 65536 buffers in one transaction Changes for all protocols, even ones where it is impossible to have such a pattern, so as to avoid bad pattern copy/paste in the future (cherry picked from commit `7d0a39412b`)	5 years ago
Philippe Antoine	80c3bc4827	dcerpc: handles bigger inputs than 2^16 By comparing integers with the largest size (cherry picked from commit `6f03ee2e47`)	5 years ago
Jason Ish	0e8a248b99	rust/template: suppress unread variable warning Suppress the warning about an unused variable in the template parser. As this is just a template I think this is OK, however master should make sure this variable is used, if only to be more self documenting.	5 years ago
Sascha Steinbiss	b6fd5e0c2d	rust: fix warnings with nightly	5 years ago
Philippe Antoine	41054a68ef	http2: http.cookie keyword now works for HTTP2 (cherry picked from commit `999327ba1f`)	5 years ago
Philippe Antoine	7d5dd8b5b2	http2: makes all HTTP1 header keywords work (cherry picked from commit `017e39d8fd`)	5 years ago
Philippe Antoine	f81985596b	http2: http.host.raw keyword now works for HTTP2 (cherry picked from commit `df039555bc`)	5 years ago
Philippe Antoine	9c1349ac18	http2: http.method keyword now works for HTTP2 (cherry picked from commit `1e82d0b3c8`)	5 years ago
Philippe Antoine	a79b784edd	http2: http.user_agent keyword now works for HTTP2 (cherry picked from commit `47928babfc`)	5 years ago
Philippe Antoine	00eadac277	http2: http.uri keyword now works for HTTP2 cf #4067 (cherry picked from commit `a98d0fe6ed`)	5 years ago
Philippe Antoine	9aa5c6aff0	rust: fix app-layer parser flags This especially allows for SSH bypass to work (cherry picked from commit `fdab22d924`)	5 years ago
Philippe Antoine	437b7d3348	ftp: completely parses pasv and epsv responses (cherry picked from commit `ca6e434e0b`)	5 years ago
Philippe Antoine	e0764e1e12	http2: make decompression a configure-time option	5 years ago
Philippe Antoine	56bda0f9cb	http2: have filecontainer for both directions (cherry picked from commit `6fe8bce3b0`)	5 years ago
Philippe Antoine	2504b96c48	http2: adds check about dynamic headers table size (cherry picked from commit `3de0123ffb`)	5 years ago
Victor Julien	a3f94435d3	http2: remove dead code (cherry picked from commit `de280c47d9`)	5 years ago
Philippe Antoine	eb250e5512	http2: remove assertion which can be wrong Brotli decoder stops consuming input it it reaches the end of its input (cherry picked from commit `b3c502d572`)	5 years ago
Philippe Antoine	6109855bca	http2: pass data through when decompression fails as is done for HTTP1 (cherry picked from commit `1ca4f041bb`)	5 years ago
Philippe Antoine	899a9b8e17	http2: decompression for files gzip and brotli decompression for files (cherry picked from commit `d861228214`)	5 years ago
Philippe Antoine	0e6ffb966f	rust: BIT_U16 macro utility (cherry picked from commit `2e46b5d100`)	5 years ago
Philippe Antoine	9287f6ae7f	rust: better panic message for missing file config (cherry picked from commit `aee8e60149`)	5 years ago
Jason Ish	a8e1172e7f	rust: pin memchr to ~2.3 2.4+ requires a newer version of Rust.	5 years ago
Philippe Antoine	76a981f7a2	rdp: correctly returns incomplete in parse_tc Adding the already consumed bytes In case an incomplete tls handshake is handled with/after a refular rdp t123_tpkt (cherry picked from commit `6da9a37285`)	5 years ago
Philippe Antoine	effa7ac54f	kerberos: fix probing parser tag condition according to the comment (cherry picked from commit `cb150e97d0`)	5 years ago
Philippe Antoine	90fdb53439	smb: relax probing parser to handle first NBSS message cf dcerpc-udp S-V test : First message is Message Type: Session request (0x81) Second message is SMB (cherry picked from commit `8307010255`)	6 years ago
Philippe Antoine	bfa66c6d6c	smb: probing parser for start and midstream The probing parser is more strict at the start of the stream (cherry picked from commit `1b6e81cd72`)	6 years ago
Philippe Antoine	fe50461346	smb: split probing function for code style Introduces rs_smb_probe_tcp_midstream (cherry picked from commit `9dc5258a21`)	6 years ago
Philippe Antoine	2c9a2cc895	protodetect: rename direction to flags And use whole flags in AppLayerProtoDetectPPGetProto (cherry picked from commit `c6aadf0dfa`)	6 years ago
Shivani Bhardwaj	dd2285724e	dcerpc: trigger raw assembly on record completion (cherry picked from commit `0ac5c5376a`)	6 years ago
Shivani Bhardwaj	772b8f61e7	rust/context: add AppLayerParserTriggerRawStreamReassembly (cherry picked from commit `c77c8e7005`)	6 years ago
Shivani Bhardwaj	a0fce7bb4e	dcerpc/udp: improve detection Lately, Wireguard proto starting w pattern \|04 00\| is misdetected as DCERPC/UDP which also starts with the same pattern, add more checks to make sure that it is the best guess for packet to be dcerpc/udp. (cherry picked from commit `f967a49104`)	6 years ago
Shivani Bhardwaj	d7a633a684	dcerpc: add probe function (cherry picked from commit `3641f1b522`)	6 years ago
Shivani Bhardwaj	f8f0c2534e	rust/applayer: split EOF flag per direction (cherry picked from commit `d7a3523b12`)	6 years ago
Shivani Bhardwaj	6801590aa1	dcerpc/udp: remove transmute The book defines transmute as "This is really, truly, the most horribly unsafe thing you can do in Rust. The guardrails here are dental floss." Transmute can result into mind boggling undefined behaviors. Get rid of it wherever possible. (cherry picked from commit `0ca8591994`)	6 years ago
Victor Julien	5c940c363c	rust: require test-case 1.0.1; don't use 1.1	6 years ago
Philippe Antoine	f574663352	http2: files inspection API fixes uses right transaction id for file tracker uses FILE_USE_DETECT for good matches with keyword startswith	6 years ago
Philippe Antoine	a63ee5adbd	http2: allow multiple size updates in one headers batch cf RFC 7541 section 4.2	6 years ago
Philippe Antoine	6181459086	smb: do not rely on one valid NBSS byte for probing Need to have the SMB header so as to validate	6 years ago
Jason Ish	f3c59ef8a6	rust: handle windows naming change from .lib to .a Prior to Rust 1.44, Cargo would name static libs with the .lib extension. 1.44 changes this extension to .a when running under a GNU environment on Windows like msys to make it more similar to other unix environments. Now assume static library name to be the same on Windows and unix, but rename the .lib if found to still support older versions of Rust on Windows.	6 years ago
Victor Julien	ba781265a4	dcerpc/udp: fix transaction handling and logging Implement missing transaction handling. Fix logging wrongly casting 'state' to DCERPCState instead of DCERPCUDPState leading to crashes and malformed output. Remove unused fields from DCERPCUDPState.	6 years ago
Philippe Antoine	8db78208f9	rust: fix warnings found by nightly compiler warning: getting the inner pointer of a temporary `CString` this `CString` is deallocated at the end of the statement, bind it to a variable to extend its lifetime	6 years ago
Jason Ish	2f81f3fbe9	rust/log: clarify comment in non-debug mode SCLogDebug	6 years ago
Jason Ish	a453d28bc6	rust/log: order log macros in descending order Readability cleanup. - error, notice, ... debug	6 years ago
Jason Ish	411a5d41c1	rust/log: expand macros after checking log level Expand macros in the do_log macro after checking the log level instead of each log macro (ie: SCLogDebug) expanding the macros then passing off to do_log to have the log level check. Will eliminate any expense of expanding macros if this log level does not permit the given message to be logged. Redmine issue: https://redmine.openinfosecfoundation.org/issues/4114	6 years ago
Shivani Bhardwaj	269324e84d	dcerpc/log: Log fields particular to an RPC version Log fields that only are meant to be in a PDU for a particular RPC version. Since DCERPC/UDP works on RPC version 4 and DCERPC/TCP works on RPC version 5, there are certain fields that are particular to each version. Remove call_id from the logger for UDP. Add activityuuid and seqnum fields to the logger for UDP. call_id and (activityuuid + seqnum) fields are used to uniquely pair a request with response for RPC versions 5 and 4 respectively.	6 years ago
Ilya Bakhtin	2033f386f9	rust/dcerpc: Remove redundant fields	6 years ago
Ilya Bakhtin	2840a2e064	rust/dcerpc: Make tx_id u64	6 years ago
Ilya Bakhtin	6916b63f09	dcerpc/udp: Fix pairing of request response So far, request and response were paired with serial number fields in the header. This is incorrect. According to https://pubs.opengroup.org/onlinepubs/9629399/chap12.htm, "Together, the activity UUID and the sequence number uniquely identify a remote procedure call." Hence, add activity uuid and sequence number to the transaction and pair the request accordingly. Remove incorrect handling of this and fix tests.	6 years ago
Ilya Bakhtin	e9b21553cc	rust/dcerpc: Add UDP flag definitions	6 years ago
Victor Julien	51f4e4d0b7	dcerpc/udp: add missing tx free logic	6 years ago
Victor Julien	9f9c29a14a	dcerpc: fix stream flag handling Only hardcoded direction flags were passed to the parser, not the full range. Handle receiving an EOF flag w/o data. Bug: #3856	6 years ago
Victor Julien	f31372ad1d	dcerpc/tcp: fix compile warning warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1036:42 \| 1036 \| let tx = if let Some(mut tx) = self.get_tx_by_call_id(current_call_id, core::STREAM_TOCLIENT) { \| ----^^ \| \| \| help: remove this `mut` \| = note: `#[warn(unused_mut)]` on by default warning: variable does not need to be mutable --> src/dcerpc/dcerpc.rs:1061:30 \| 1061 \| Some(mut tx) => { \| ----^^ \| \| \| help: remove this `mut`	6 years ago
Victor Julien	67b5295bbc	dcerpc/tcp: add missing detect state cleanup	6 years ago
Philippe Antoine	1fd6f5bc61	http2: asymetric sizes for headers tables The headers table from client to server and the one from server to client may have different maximum sizes (even if both endpoints have to keep both tables)	6 years ago
Philippe Antoine	aaa69fe3c5	smb: resistance against padding evasions Scenario is use of dummy padding in write AndX request or other similar commands using a data offset. Parsing skips now these dummy bytes, and generates one event	6 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	6 years ago
Philippe Antoine	3e96f96153	rdp: fix incomplete result Aggregating the consumed bytes	6 years ago
Jason Ish	0529a00ffd	dhcp: set unidirection transaction flag	6 years ago
Jason Ish	3036ec4db0	ikev2: set unidirection transaction flag	6 years ago
Jason Ish	ff674d0cd0	mqtt: set unidirection transaction flag	6 years ago
Jason Ish	54d5f336d4	sip: set unidirection transaction flag	6 years ago
Jason Ish	1d40d0c5f9	rdp: set unidirection transaction flag	6 years ago
Jason Ish	f7dee602e9	krb5: set unidirection transaction flag	6 years ago
Jason Ish	984d3c7f20	ntp: set unidirection transaction flag	6 years ago
Jason Ish	fc7d59d92f	snmp: set unidirectional transaction flag	6 years ago
Philippe Antoine	64fcba228b	http2: complete parsing of priority frames	6 years ago
Philippe Antoine	c300a859a0	http2: keep track of dynamic headers table size And evict entries accordingly to maximum size	6 years ago
Philippe Antoine	1a21eea0e9	http2: variable size integers decoded everywhere	6 years ago
Philippe Antoine	b21acfbf21	http2: StreamIdReuse frame types exceptions Also handles better the state so as not to revert from HTTP2StateHalfClosedClient to HTTP2StateDataServer and not go to final HTTP2StateClosed	6 years ago
Philippe Antoine	89573060d9	http2: use variable integer for headers lengths	6 years ago
Shivani Bhardwaj	97c67cd5ce	dcerpc: fix gap handling This patch addresses issues discovered by redmine ticket 3896. With the approach of finding latest record, there was a chance that no record was found at all and consumed + needed became input length. e.g. input_len = 1000 input = 01 05 00 02 00 03 a5 56 00 00 ..... There exists no \|05 00\| identifier in the rest of the record. After having parsed \|05 00\|, there was a search for another record with the leftover data. Current data length at this point would be 997. Since the identifier was not found in the data, we calculate the consumed bytes at this point i.e. consumed = current_data.len() - 1 which would be 996. Needed bytes still stay at a constant of 2. So, consumed + needed = 996 + 2 = 998 which is lesser than initial input length of 1000 and hence the assertion fails. There could be two fixes to this problem. 1. Finding the latest record but making use of the last found record in case no new record was found. 2. Always use the earliest record. This patch takes the approach (2). It also makes sure that the gap and current direction are the same.	6 years ago
Philippe Antoine	4f963717f8	fuzz: better configure checks for MSAN building More compatible check for rust nightly Checks for CARGO_BUILD_TARGET Builds release or debug mode independently	6 years ago
Victor Julien	5d985c4271	dcerpc: implement tx free function	6 years ago
Victor Julien	8b2886635f	dcerpc/tcp: implement trunc logic When one side of the connection reaches the STREAM_DEPTH condition the parser should be aware of this. Otherwise transactions will forever be waiting for data in that direction.	6 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	6 years ago
Shivani Bhardwaj	301454e9e4	dcerpc: fix datatypes while handling stub data	6 years ago
Shivani Bhardwaj	3fd9a3d420	dcerpc: fix datatype for stub data len	6 years ago
Philippe Antoine	222b386102	rust: rebuilds std when building fuzzers so as to have MSAN working	6 years ago
Philippe Antoine	15447cc672	dceprc: signature rust check with is_char_boundary before calling split_at which would panic	6 years ago
Philippe Antoine	6694737fcf	http2: settings from http1 upgrade	6 years ago
Philippe Antoine	7011bddf84	http2: mimic HTTP1 request from upgrade	6 years ago
Philippe Antoine	9d1b030ff0	http2: first connection upgrade from http1	6 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	6 years ago
Sascha Steinbiss	ed9fed4958	mqtt: add some extra tests for varint parsing	6 years ago
Philippe Antoine	1a88df7e88	http2: handles incomplete frames after banner To signal incomplete data, we must return the number of consumed bytes. When we get a banner and some records, we have to take into account the number of bytes already consumed by the banner parsing before reaching an incomplete record.	6 years ago
Philippe Antoine	7ab9a01db2	mqtt: limit size of variable integer	6 years ago
Philippe Antoine	e3b28bcf2a	http2: returns error in case of index 0 As is documented in RFC 7541, section 6.1 The index value of 0 is not used. It MUST be treated as a decoding error if found in an indexed header field representation.	6 years ago
Jason Ish	e9fec043b5	rust/util: expose function to test strings for valid UTF-8 rs_check_utf8 will check that the provided string is valid UTF-8 by converting it to a Rust string and returning true or false.	6 years ago
Simon Dugas	7f26246ce1	dns: parse and log fields for SOA record type Added `dns_parse_rdata_soa` to parse SOA fields into an `DNSRDataSOA` struct. Added logging for answer and authority SOA records in both version 1 & 2, as well as grouped formats.	6 years ago
Simon Dugas	af498fd840	dns: use nom's rest to take all remaining rdata Using nom's `rest` combinator eliminates the need to call the do_parse macro for parsing a single element.	6 years ago
Simon Dugas	8005f50647	dns: refactor to handle more rdata formats Represent rdata as `DNSRData` enum variants instead of `Vec<u8>`. This will allow parsing/logging of more complex formats like SOA.	6 years ago
Jason Ish	647e304f4b	rust/log: minor cleanup Group functions for setting and getting the log level together.	6 years ago
Jason Ish	ea1338b464	rust: function macro now returns the function name Borrow a macro from https://github.com/popzxc/stdext-rs that will give us the Rust function name in SCLog messages in Rust. As this trick only works on Rust 1.38 and newer, keep the old macro around and set a feature based on a Rust version test done during ./configure.	6 years ago
Jason Ish	bac8016d17	rust: plugin bootstrap function Functions written in Rust will need to suricata::plugin::init() to bootstrap themselves. This bootstrap process sets the log level within the Rust address space, and hooks up function pointers that are expected to be set during normal runs of Suricata.	6 years ago
Jason Ish	3de98b3595	rust/log: set the log level with a pure Rust function Make sure the log level is setup with a pure Rust function, so when it is set, its set within the address space of the caller. This is important for Rust plugins where the Rust modules are not in the address space of the Suricata main process.	6 years ago
Jason Ish	ac93ab281d	rust/logging: allow log macros to be used by plugins Fix plugin macros so they can be used by external Rust crates such as plugins.	6 years ago
Jason Ish	3672cea876	rust/Cargo: build as rlib for plugin linkage Build Rust code as an rlib, in addition to a staticlib so plugins can link with the Rust code.	6 years ago
Philippe Antoine	b20a8de646	dns: simply skips zero-sized dns requests/responses	6 years ago
Ilya Bakhtin	c903441fe7	mqtt: fixed wrong slice access Slice access esults in rust panic when mqtt ping is processed	6 years ago
Victor Julien	4aa80ac7f6	detect/http2: fix header inspection Header inspection was overwriting data that was still being referenced by the detect engine, leading to ASAN issues.	6 years ago
Jason Ish	f26d6eaf98	http2: log as http to abstract http and http2 a little This commit logs http2 as an http event. The idea is to somewhat normalize http/http2 so common info can be version agnostic. This puts the http2 specific fields in an "http2" object inside the "http" object. HTTP2 headers/values that are in common with HTTP1 are logged under the "http" object to be compatible with HTTP1 logging.	6 years ago
Jason Ish	6a55606adb	http2: log headers in the same format as http (1) Log the headers in request_headers, and response_headers like http1 to remain compatible.	6 years ago
Philippe Antoine	1422b18a99	http2: initial support	6 years ago
Jeff Lucovsky	be57f6d3cc	rust/rdp: Fix use of incorrect buffer This commit updates the connection confirmation parsing function to use the correct buffer when determining the packet type.	6 years ago
Shivani Bhardwaj	2529eb35e1	smb: use uuid crate	6 years ago
Jason Ish	e6668560e0	rust: only run cbindgen if needed Only run cbindgen when necessary. This is a bit tricky. When building a dist we want to unconditionally build the headers. When going through a "make; sudo make install" type process, cbindgen should not be run as the headers already exist, are valid, and the environment under sudo is more often than not suitable to pick up the Rust toolchains when installed with rustup. For the normal "make" case we have the gen/rust-bindings.h file depend on library file, this will cause it to only be rebuilt if the code was modified. For "make dist" we unconditionally create "dist/rust-bindings.h". This means the generated file could be in 2 locations, so update configure.ac, and the library search find to find it. The "gen/rust-bindings.h" should be picked up first if it exists, for those who develop from a dist archive where "dist/rust-bindings.h" also exists. Not completely happy having the same file in 2 locations, but not sure how else to get the dependency tracking correct.	6 years ago
Shivani Bhardwaj	4c7f55e636	dcerpc: handle gap for TCP streams	6 years ago
Jason Ish	6cff558663	dns: add tailing data to split tcp unit test Add trailing data to the complete payload to test the case where data is consumed, but still incomplete.	6 years ago
Jason Ish	cc154ce152	dns: fix subtraction overflow in debug message The math for the return value wasn't updated in the debug log to match the logic and could lead to a subtraction overflow	6 years ago
Philippe Antoine	80ccbff28a	dns: return status from parsing tcp request	6 years ago
Philippe Antoine	1296740471	dns: fix incomplete results and messages parsing whose length is >= 32768	6 years ago
Philippe Antoine	83567e8732	files: rust closes files even on 0 length chunk	6 years ago
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	6 years ago
Victor Julien	b99ffd9ece	eve: remove unused jansson code	6 years ago
Jeff Lucovsky	961b314b86	dns: Remove parser buffering code	6 years ago
Victor Julien	00cc3c7374	eve/ssh: change hassh logging format Elastic search didn't accept the 'hassh' and 'hassh.string'. It would see the first 'hassh' as a string and split the second key into a object 'hassh' with a string member 'string'. So two different types for 'hassh', so it rejected it. This patch mimics the ja3(s) logging by creating a 'hassh' object with 2 members: 'hash', which holds the md5 representation, and 'string' which holds the string representation.	6 years ago
Philippe Antoine	eb5b927787	ssh: fixing incomplete kex parsing We use the record length from the ssh record header, and not the size of the parsed data, as is done in other places.	6 years ago
Victor Julien	bcd416e6ba	nfs: fix 'dangling' files in lossy sessions In case of lossy connections the NFS state would properly clean up transactions, including file transactions. However for files the state was never set to 'truncated', leading to files to stay 'active'. This would lead these files staying in the NFS's state. In long running sessions with lots of files this would lead to performance and memory use issues. This patch cleans truncates the file that was being transmitted when a file transaction is being closed. Based on `65e9a7c31c`	6 years ago
Victor Julien	fc7cecb4ae	nfs: check post-gap timeouts once a second at most Based on `25f2efe977`	6 years ago
Victor Julien	5d65e5a748	nfs: update ts only if it changed Based on `8aa380600d`	6 years ago
Zach Kelly	b25de4d99a	rdp: remove parser buffering code	6 years ago
Zach Kelly	22a2bee614	rdp/eve: convert to jsonbuilder	6 years ago
Zach Kelly	ef397daba3	rdp: rustfmt (update)	6 years ago
Shivani Bhardwaj	35362b7bfa	jsonbuilder: run test if not debug-validate	6 years ago
Shivani Bhardwaj	2ce7d98af1	dcerpc: fix tests to have a valid header	6 years ago
Shivani Bhardwaj	9f9670ebdc	logging: Add DCERPC logger	6 years ago
Shivani Bhardwaj	bab497ab2c	dcerpc: Add multi transaction support DCERPC parser so far provided support for single transactions only. Extend that to support multiple transactions. In order for multiple transactions to work, there is always a transaction identifier for any protocol in its header that lets a response match the request. In DCERPC, for TCP, that param is call_id in the header which is a 32 bit field. For UDP, however since it uses different version of RPC (4.x), this is defined by serial number field defined in the header. This field however is not contiguous and needs to be assembled by the provided serial_low and serial_hi fields.	6 years ago
Shivani Bhardwaj	67e7be633c	krb: convert to jsonbuilder Closes redmine ticket 3754.	6 years ago
Shivani Bhardwaj	72dab0a8b7	snmp: convert to jsonbuilder Closes redmine ticket 3756.	6 years ago
Jason Ish	7ca24041b6	rust: add doc target to build rust docs Uses "cargo doc --no-deps" to build the documentation just for our Suricata package. Without --no-deps, documentation will be build for all our dependencies as well. The generated documentation will end up in target/doc as HTML.	6 years ago
Jason Ish	abc71dc4a5	applayer template (rust): better gap handling example In the request parser, show checking if a gap was received and what one example of trying to continue might look like.	6 years ago
Jason Ish	b91bb92b7d	applayer template (rust): incomplete support Show how to use the incomplete AppLayerResult type within the limits of what the template protocol parser can provide. Redmine issue: https://redmine.openinfosecfoundation.org/issues/3541	6 years ago

1 2 3 4 5 ...

741 Commits (809aebfee183c680ae14e4d58316e477fad0dca0)