301 Commits (999af4f62a234d78f682c2b842f434410a61f56f)

Author	SHA1	Message	Date
Sascha Steinbiss	c31360070b	rust/mqtt: add MQTT parser	5 years ago
Victor Julien	ecd7862c36	app-layer: add debug	5 years ago
Victor Julien	4f73943df9	app-layer: split EOF flag per direction	5 years ago
Victor Julien	ac3cf6ff75	detect/config: set config for special cases ... Allow app-layer to declare the txs are uni-directional and special care is needed for applying config.	5 years ago
Victor Julien	a2f249cc86	app-layer: handle AppLayerTxData being NULL ... Http parser can have 'NULL' user data in case of memcap limit getting reached.	5 years ago
Victor Julien	f88657206c	app-layer: GetTxData callback is mandatory	5 years ago
Victor Julien	8fe9faecb2	app-layer: remove DetectFlags API. Replaced by AppLayerTxData	5 years ago
Victor Julien	9664f73f75	app-layer: remove logged API calls	5 years ago
Victor Julien	5665fc8301	app-layer: add ApplyTxConfig API ... Optional callback a parser can register for applying configuration to the 'transaction'. Most parsers have a bidirectional tx. For those parsers that have different types of transaction handling, this new callback can be used to properly apply the config.	5 years ago
Victor Julien	e15995e2d2	detect: store detect flags in AppLayerTxData	5 years ago
Victor Julien	411f428a38	app-layer: define AppLayerTxData and AppLayerTxConfig ... AppLayerTxData is a structure each tx should include that will contain the common fields the engine needs for tracking logging, detection and possibly other things. AppLayerTxConfig will be used by the detection engine to configure the transaction.	5 years ago
Shivani Bhardwaj	6f7d8e50c8	src: use FatalError whenever possible ... Replaces all patterns of SCLogError() followed by exit() with FatalError(). Cocci script to do this: @@ constant C; constant char[] msg; @@ - SCLogError(C, + FatalError(SC_ERR_FATAL, msg); - exit(EXIT_FAILURE); Closes redmine ticket 3188.	5 years ago
Victor Julien	6608b9a5f3	app-layer: set EOF flag in case of unsupported GAP ... If GAP is not supported set EOF flags in the parser.	5 years ago
Victor Julien	79681bf655	app-layer: remove old MPMId API calls ... Had been deprecated and non-functional since 2017.	5 years ago
Philippe Antoine	293eebd999	fuzz: remove obsolete AFL code	5 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	5 years ago
Victor Julien	9b1f0656d0	app-layer: fix progress tracking ... Esp in combination with GAPs and proto detection.	5 years ago
Victor Julien	674b8dc0fb	app-layer: add 'incomplete' return logic ... Allow app-layer parsers to indicate how much data they need before being called again.	5 years ago
Victor Julien	44d3f264bf	app-layer: update API to return more details ... Add AppLayerResult struct as the Parser return type in preparation of allowing returning 'Incomplete(size)' similar to what nom in Rust allows.	5 years ago
Victor Julien	3bcf948a75	app-layer: change return codes ... This patch simplifies the return codes app-layer parsers use, in preparation of a patch set for overhauling the return type. Introduce two macros: APP_LAYER_OK (value 0) APP_LAYER_ERROR (value -1) Update all parsers to use this.	5 years ago
Victor Julien	54b2ec0e4d	app-layer: minor optimization	5 years ago
Jason Ish	688874582a	dhcp: remove C app-layer-dhcp wrapper ... This just wrapped the Rust function to register the parse, so instead just call the Rust function directly to remove the C wrapper, and the 2 C files.	5 years ago
Jason Ish	a0e3e2d7b4	dns: register parsers from Rust ... And port the C DNS tests to Rust.	5 years ago
Victor Julien	a4a4d17ad0	app-layer/files: optimize GetFiles calls ... Remove FlowGetProtoMapping calls from the GetFiles wrapper and get the alstate from the flow directly.	6 years ago
Victor Julien	d369e54f1d	app-layer: all protocols are tx aware now ... So remove the runtime check for it.	6 years ago
Victor Julien	618ad0d92f	app-layer: optimize inspection id tracking ... Increase the inspect id for a completely inspected tx in any case. This avoids re-evaluating transactions. Reported-by: Ilya Bakhtin	6 years ago
Eric Leblond	3ded7f1170	qa/coccinelle: fix false positive in setter getter ... Coccinelle test was doing a false positive on the function AppLayerParserStateSetFlag and AppLayerParserStateIssetFlag. To address that, this patch adds a new coccinelle markup: /* coccinelle: AppLayerParserStateSetFlag():2,2:APP_LAYER_PARSER_ */ It indicates that AppLayerParserStateSetFlag is a setter and getter and that the checks should be disabled inside the function. Currently this markup is only used for that but following patch will add some checks on option value.	6 years ago
Jason Ish	ba3a2c31bf	app-layer: validate TX detect flag callbacks ... Check that both are set or unset.	6 years ago
Jason Ish	739df21e2d	app-layer: method to see if parser supports tx detect flags ... Add method to check if a parser for an app-layer protocol supports tx detect flags. This is a bit of a hack for now as where we need to run this check from we do not have the IP protocol.	6 years ago
Victor Julien	ab471c3054	app-layer: don't consider tx flags if not registered ... If a protocol does not support TxDetectFlags, don't try to use them. The consequence of trying to use them was that a TX would never be considered done, and it would never be freed. This would lead to excessive memory use and performance problems due to walking an ever increasing list.	6 years ago
Konstantin Klinger	808ea0dba9	app-layer: remove obsolete msn protocol detection	6 years ago
Giuseppe Longo	2e975a0481	rust/sip: add parser for SIP protocol	6 years ago
Giuseppe Longo	ed5a439b8e	app-layer-parser: flag a tx to use stream depth ... This adds a new API that permit to set the stream-depth file for file-storing when a rule with filestore keyword is matched.	6 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp ... Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	6 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	6 years ago
Jeff Lucovsky	bc68ef4657	app-layer: Invoke FTP parser cleanup function	6 years ago
jason taylor	da2c4d7382	applayer: fix typo in debug output ... Signed-off-by: jason taylor <jtfas90@gmail.com>	6 years ago
Jeff Lucovsky	a5d9d37c34	rust/parser: Extend Rust parser for event-by-id ... Extend the Rust parsing infrastructure with the "get event info by id" calls. This changeset extends the parser structure, the C-based registration handlers and the template parser.	6 years ago
Jeff Lucovsky	d568e7fadd	eve/logging: 2991 Optimize logging by TX ... This changeset makes changes to the TX logging path. Since the txn is passed to the TX logger, the TX can be used directly instead of through the TX id.	6 years ago
Jeff Lucovsky	4a39d7a1ee	app-layer: Extend event container with progress	6 years ago
Jeff Lucovsky	36644907f5	app-layer/logging Add TX packet logging support ... Add transactional logging support for packet based loggers, like the anomaly logger.	6 years ago
Jeff Lucovsky	50e23ba93a	app-layer: Initial app layer logging	6 years ago
Pierre Chifflier	2df840a8b8	Add SNMP (v1/v2c/v3) application layer	6 years ago
Victor Julien	924982e792	app-layer: minor cleanups	6 years ago
Victor Julien	952cbb563c	app-layer: mandatory tx registration checks ... All protocols now implement the TX API, so the runtime checks for whether or not a protocol supports the TX API can be removed.	6 years ago
Victor Julien	8bc1e120ea	app-layer: make tests tx aware ... Make tests minimally TX-aware so we can asume all parsers use the tx API.	6 years ago
Victor Julien	c2cb155ebb	rust/smb: rename files and code from RustSMB to SMB	6 years ago
Victor Julien	f30c05e684	smb: remove C implementation ... Now that Rust is mandatory it is obsolete. Ticket: #2849	6 years ago
Victor Julien	0e40231189	app-layer: improve transaction cleanup handling ... The app layers with a custom iterator would skip a tx if during the ..Cleanup() pass a transaction was removed. Address this by storing the current index instead of the next index. Also pass in the next "min_tx_id" to be incremented from the last TX. Update loops to do this increment. Also make sure that the min_id is properly updated if the last TX is removed when out of order. Finally add a SMB unittest to test this. Reported by: Ilya Bakhtin	7 years ago
Victor Julien	d34e41068f	app-layer: fix tx tracking updates in tx cleanup ... Fix min_id not getting updated in all cases. Reported by: Ilya Bakhtin	7 years ago