Commit Graph

14 Commits (8b379a3b04d9082e82d64dba9ac84a1dafa67eff)

Author SHA1 Message Date
Philippe Antoine 4b541b39f2 rust: move AppLayerEventType definition to C
and bindgen it to rust.

Will make easier the bindgen of RustParser structure which uses
a callback which uses AppLayerEventType
9 months ago
Philippe Antoine c52121586a rust: move AppLayerEvents funcs out of RustContext
Ticket: 7667

just use it directly, with bindgen, and cfg not test
1 year ago
Philippe Antoine 2b419a5a26 src: clean includes for app-layer-events.h 1 year ago
Jason Ish ab6dcb3fc1 app-layer: use uint8_t consistent for event IDs
Introduce a common function for mapping names to IDs that performs
bounds checking.

Note: For event IDs in the enum that are larger than a uint8_t, -1
will be returned instead of -4. -4 has special meaning during
signature parsin that means requirements were not met. -4 has no
special handling prior to requirements, or the meaning has been lost.
2 years ago
Jason Ish 44388f1b69 src: make include guards more library friendly
Include guards for libraries should use a prefix that is meaningful for
the library to avoid conflicts with other user code. For Suricata, use
SURICATA.

Additionally, remove the pattern of leading and trailing underscores as
these are reserved for the language implementation per the C and C++
standards.
3 years ago
Victor Julien 643f25280b detect/app-layer-events: constify arguments; minor cleanups 3 years ago
Philippe Antoine f2a18e91c4 rust: define AppLayerEventType only in rust
And detect.h does no longer depend on app-layer-events.h
3 years ago
Victor Julien 93050c26b3 app-layer/events: remove unused function 5 years ago
Jeff Lucovsky 4a39d7a1ee app-layer: Extend event container with progress 7 years ago
Jeff Lucovsky 50e23ba93a app-layer: Initial app layer logging 7 years ago
Victor Julien 6f42ae91c7 app-layer: protocol change API
Add API calls to upgrade to TLS or to request a protocol change
without a specific protocol expectation.

If the HTTP CONNECT session includes a port on the url, use that to
look up the probing parser during protocol detection. Solves a
missed detection of a SSLv2 session that upgrades to TLSv1. SSLv2
relies on the probing parser which is limited to certain ports.

In case of STARTTLS in SMTP and FTP, the port is hardcoded to 443.

A new event APPLAYER_UNEXPECTED_PROTOCOL is set if there was a
mismatch.
10 years ago
Mats Klepsland 72c757433a app-layer: add decoder event for missing TLS after STARTTLS 10 years ago
Victor Julien 8eac1156c6 app-layer-events: remove unused API options 10 years ago
Victor Julien 347c0df9c4 app-layer-event: refactor
Move app layer event handling into app-layer-event.[ch].
Convert 'Set' macro's to functions.
Get rid of duplication in Set and SetRaw. Set now calls SetRaw.
Fix potentential int overflow condition in the event storage.
Update callers.
13 years ago