938 Commits (a14854bce9b14e5ad3c5827fa692663802461745)

Author	SHA1	Message	Date
Jason Ish	fcbdc30426	dns: create transaction even if z-bit was set ... It appears that DNS servers will still process a DNS request even if the z-bit is set, our parser will fail the transaction. So create the transaction, but still set the event. Ticket #4924	3 years ago
Pierre Chifflier	d67f8f9196	rust/smb: convert parser to nom7 functions (SMB1)	3 years ago
Pierre Chifflier	895a54cea4	rust/smb: convert parser to nom7 functions (DCERPC records)	3 years ago
Pierre Chifflier	8d77ce1ffc	rust/smb: convert parser to nom7 functions (SMB2)	3 years ago
Pierre Chifflier	5cadb878ff	rust/smb: convert parser to nom7 functions (SMB3)	3 years ago
Pierre Chifflier	4c97dfa851	rust/smb: convert parser to nom7 functions (NTLM/SSP records)	3 years ago
Pierre Chifflier	3da816eb23	rust/smb: convert parser to nom7 functions (NBSS records)	3 years ago
Pierre Chifflier	90f9450971	rust: add nom7 combinator take_until_and_consume	3 years ago
Philippe Antoine	87d9c44ec5	rust: export constants via cbindgen ... so that constants are not defined twice in Rust anc C So that we are sure they have the same value	3 years ago
Philippe Antoine	784558df2e	mime: handles multiple sections for a parameter ... Ticket: 4386 as per RFC2231. For instance filename can be split between filename*0, filename*1, etc...	3 years ago
Philippe Antoine	8feb9c35ae	mime: move FindMimeHeaderTokenRestrict to rust ... Also fixes the case where the token name is present in a value	3 years ago
Philippe Antoine	1b10848d84	mqtt: fix transaction completion ... Ticket: 4862 A transaction to client is always considered complete in the direction to server and vice versa. Otherwise, transactions are never complete for AppLayerParserTransactionsCleanup	3 years ago
Jason Ish	7732efbec2	app-layer: include decoder events in app-layer tx data ... As most parsers use an events structure we can include it in the tx_data structure to reduce some boilerplate/housekeeping code in app-layer parsers.	3 years ago
Philippe Antoine	0caaf6bd23	range: prevents memory leak of file from HTTP2 ... Ticket: 4811 Completes commit c023116857 state.free should also close files with ranges as state.free_tx did already And file_range field should be reset so that there is no use after free.	3 years ago
Jeff Lucovsky	23faeaea5c	ftp: Remove diagnostic print ... This commit removes a diagnostic message displayed during extraction of the EPSV port.	3 years ago
Philippe Antoine	c023116857	range: prevents memory leak of file from HTTP2 ... If a HTTP2 transaction gets freed before the end of the range request, we need to have the files container which is in the state, to transfer owernship of this file to the files container. Ticket: 4811	3 years ago
Pierre Chifflier	acb3ec6db1	rust/nfs: convert parser to nom7 functions (NFS v2 records)	3 years ago
Pierre Chifflier	ea1d03f8e3	rust/nfs: add a maximum number of operations per compound ... The `count` combinator preallocates a number of bytes. Since the value is untrusted, this can result in an Out Of Memory allocation. Use a maximum value, large enough to cover all current implementations.	3 years ago
Pierre Chifflier	0ffe123330	rust/nfs: convert parser to nom7 functions (NFS v3 and v4 records)	3 years ago
Jason Ish	eb6cc62937	dhcp: fix url in comment ... rustdoc was complaining about the format of the URL in a comment while trying to generate documentation. Convert the comment to a non-rustdoc comment for now to satisfy rustdoc.	3 years ago
Jason Ish	b57280ff48	rdp: fix transaction id ... By our convention the transaction ID is incremented then applied to the new transaction. And the generic transaction iterator requires this behaviour.	3 years ago
Jason Ish	9c67c634c1	app-layer: include DetectEngineState in AppLayerTxData ... Every transaction has an existing mandatory field, tx_data. As DetectEngineState is also mandatory, include it in tx_data. This allows us to remove the boilerplate every app-layer has for managing detect engine state.	3 years ago
Jason Ish	f4b4d531b0	rdp: add tx iterator	3 years ago
Jason Ish	238ec953b7	krb5: use tx iterator	3 years ago
Jason Ish	ef0c351953	ntp: add tx iterator	3 years ago
Jason Ish	871fb035b4	sip: add tx iterator	3 years ago
Jason Ish	d6b2d7e16a	ike: add tx iterator ... For IKE the manual iterator functions were there, but never registered. So this commit does add a tx iterator to ike.	3 years ago
Jason Ish	3f2d2bc12b	snmp: use generic tx iterator	3 years ago
Jason Ish	ac4c5ada2f	dhcp: use generic tx iterator	3 years ago
Jason Ish	54e62ddf71	http2: use generic tx iterator	3 years ago
Jason Ish	6cffecfe3e	template: use generic tx iterator	3 years ago
Jason Ish	a936755731	nfs: use generic tx iterator	3 years ago
Jason Ish	0188a01daf	rfb: use generic tx iterator	3 years ago
Jason Ish	b335409690	mqtt: use generic tx iterator	3 years ago
Jason Ish	d71bcd82d9	modbus: use generic tx iterator	3 years ago
Jason Ish	fcfc9876ce	smb: use generic tx iterator	3 years ago
Jason Ish	049d43212e	rust/app-layer: provide generic implementation of iterator ... Create traits for app-layer State and Transaction that allow a generic implementation of a transaction iterator that parser can use when the follow the common pattern for iterating transactions. Also convert DNS to use the generic for testing purposes.	3 years ago
Shivani Bhardwaj	26c7d3cc35	http2: remove needless borrows	3 years ago
Shivani Bhardwaj	f3a1e3b92e	core: Remove unneeded consts	3 years ago
Shivani Bhardwaj	b5a123adb1	ssh: use Direction enum	3 years ago
Shivani Bhardwaj	baf30cfc05	snmp: use Direction enum	3 years ago
Shivani Bhardwaj	89cb337930	smb: use Direction enum	3 years ago
Shivani Bhardwaj	8f9f78c2d0	sip: use Direction enum	3 years ago
Shivani Bhardwaj	11c438a07d	nfs: use Direction enum	3 years ago
Shivani Bhardwaj	a7ac79bed7	mqtt: use Direction enum	3 years ago
Shivani Bhardwaj	209e2f17fa	krb: use Direction enum	3 years ago
Shivani Bhardwaj	243960a511	ike: use Direction enum	3 years ago
Shivani Bhardwaj	ee5b300ccf	http2: use Direction enum	3 years ago
Shivani Bhardwaj	0c6e9ac931	files: use Direction enum	3 years ago
Shivani Bhardwaj	a19d2b4e1e	dns: use Direction enum	3 years ago
Shivani Bhardwaj	a866499bca	dcerpc: use Direction enum	3 years ago
Shivani Bhardwaj	9512bfd729	core: add Direction enum ... Ticket: 3832	3 years ago
Philippe Antoine	3212fa7d2b	ntp: fixes leak of de_state ... Bug: #4752.	3 years ago
Philippe Antoine	28a3181a2d	snmp: fixes leak of de_state ... Bug: #4752.	3 years ago
Philippe Antoine	f37240a3e2	smb: midstream probing checks for netbios message type ... If it is available Bug: #4620.	3 years ago
Philippe Antoine	8f8823b6f2	rust: right condition for both uint to be zero ... Theay can overflow leading to their addition to be zero If a NFS read reply indicates a count of 0xFFFFFFFF Bug: #4680.	3 years ago
Pierre Chifflier	ce652511bd	rust/tftp: convert parser to nom7 functions	3 years ago
Pierre Chifflier	c525a1337c	rust/dns: convert parser to nom7 functions	3 years ago
Pierre Chifflier	74be8b94ec	rust/ssh: convert parser to nom7 functions	3 years ago
Pierre Chifflier	8a584c211e	rust/mqtt: convert parser to nom7 functions	3 years ago
Pierre Chifflier	d27125d77a	rust/sip: convert parser to nom7 functions	3 years ago
Pierre Chifflier	1046a7d1a3	rust/ftp: convert parser to nom7 functions	3 years ago
Pierre Chifflier	ebd5883da8	rust/dhcp: convert parser to nom7 functions	3 years ago
Pierre Chifflier	17170c41aa	rust: add nom7 dependency	3 years ago
Modupe Falodun	a87c7e5c08	rust: remove unnecessary nested match ... Bug: #4605	3 years ago
Modupe Falodun	74c39500c3	rust: fix inherent to string ... Bug: OISF#4618	3 years ago
Sam Muhammed	922a453da5	rust(lint): use is_null() instead of ptr::null_mut() ... Bug: #4594	3 years ago
Sam Muhammed	23768c7181	rust(lint): use is_null() instead of ptr::null() ... Bug: #4594	3 years ago
Sam Muhammed	da0a976e23	rust(lint): use let for binding single value ... `match` is better used with binding to multiple variables, for binding to a single value, `let` statement is recommended. Bug: #4616	3 years ago
Philippe Antoine	5bd065cb3c	range: checks that end is after start for HTTP2 ... As was done only for HTTP1 in previous commit The verification part stays separated from the parsing part, as we want to keep on logging invalid ranges values.	3 years ago
Philippe Antoine	accdad7881	ike: do not keep server transforms in state ... Fixes #4534 Now, only the tx with the transforms will match with ike.chosen_sa_attribute	3 years ago
Philippe Antoine	83887510a8	modbus: tx iterator ... When there are a lot of open transactions, as is possible with modbus, the default tx_iterator will loop for the whole transacations vector to find each transaction, that means quadratic complexity. Reusing the tx_iterator from the template, and keeping as a state the last index where to start looking avoids this quadratic complexity.	3 years ago
Philippe Antoine	ea4a509a54	app-layer: disable by default if not in configuration ... DNP3, ENIP, HTTP2 and Modbus are supposed to be disabled by default. That means the default configuration does it, but that also means that, if they are not in suricata.yaml, the protocol should stay disabled.	3 years ago
Philippe Antoine	8e8899c90c	http2: range: check return value when opening ... HttpRangeContainerOpenFile can return NULL so, http2_range_open can set file_range to NULL And we should check this before calling http2_range_close	3 years ago
Philippe Antoine	cb30772372	style: remove latest warnings ... about unused variables	3 years ago
Philippe Antoine	98f84d5a9b	http2: follow range requests ... Move the content-range parsing code to rust	4 years ago
Philippe Antoine	56fae072b2	http2: better rust lifetimes ... so that borrow check gets happy	4 years ago
Philippe Antoine	a1f9e0c97a	rust: rename to StreamingBufferConfig as in C	4 years ago
Shivani Bhardwaj	42da0fb5c5	smb: fix broken stream depth setting ... The stream depth setting was broken since it was moved to Rust because of a missing parser for memory values in configuration. Use get_memval fn from conf.rs to calculate and fetch the correct values.	4 years ago
Shivani Bhardwaj	0cfe512ef0	rust/conf: add getter for memval ... Add a parser for memory values like 50kb, 20mb, etc on the Rust side.	4 years ago
Shivani Bhardwaj	f3fcc39738	ssh: remove futile default port setting	4 years ago
Shivani Bhardwaj	1f48714e75	smb: remove futile default port setting	4 years ago
Shivani Bhardwaj	13741540ce	rfb: remove futile default port setting	4 years ago
Shivani Bhardwaj	7c9d573800	nfs: remove futile default port setting	4 years ago
Shivani Bhardwaj	f4f6387a00	dcerpc: use null for default ports	4 years ago
Philippe Antoine	596a4a9d6e	http2: better rust style	4 years ago
Philippe Antoine	48ed874dda	http2: concatenate one headers multiple values ... For detection, as is done with HTTP1	4 years ago
Philippe Antoine	e3ff0e7731	http2: generic http2_header_blocks ... so as not to forget continuation and push promise when iterating over headers	4 years ago
Philippe Antoine	0b0649d98e	http2: http.header keyword now works for HTTP2 ... As well as http.header.raw	4 years ago
Philippe Antoine	9b9f909d7d	http2: http.header_names keyword now works for HTTP2	4 years ago
Philippe Antoine	547e9f4ab4	http2: http.host normalized keyword now works for HTTP2	4 years ago
Philippe Antoine	75f75e1eb0	http2: turn Host header into authority during upgrade ... HTTP1 uses Host, but HTTP2 uses rather :authority cf HPACK	4 years ago
Philippe Antoine	bb98a18b3d	http2: better file tracking ... If an HTTP2 file was within only ont DATA frame, the filetracker would open it and close it in the same call, preventing the firther call to incr_files_opened Also includes rustfmt again for all HTTP2 files	4 years ago
Philippe Antoine	1378b2f451	http2: support deflate decompression ... cf #4556	4 years ago
Victor Julien	c9cee7af49	smb: add debug validation on file counts	4 years ago
Victor Julien	114d3ba730	smb: count files in tx	4 years ago
Victor Julien	c1dfb619c4	http2: support per-tx file accounting	4 years ago
Victor Julien	1b3c3225cd	nfs: add debug validation on file counts	4 years ago
Victor Julien	1d48601c25	nfs: support per-tx file accounting	4 years ago
Victor Julien	67759795c6	nfs: don't reuse file transactions ... After a file has been closed (CLOSE, COMMIT command or EOF/SYNC part of READ/WRITE data block) mark it as such so that new file commands on that file do not reuse the transaction. When a file transfer is completed it will be flagged as such and not be found anymore by the NFSState::get_file_tx_by_handle() method. This forces a new transaction to be created.	4 years ago
Victor Julien	56d3e28a3a	filestore: track files getting stored per tx ... Avoid evicting a tx before the filedata logger has decided it is done.	4 years ago
Victor Julien	c78f5ac316	app-layer/transactions: track files opens and logs ... To make sure a transaction is not evicted before all file logging is complete.	4 years ago
Philippe Antoine	9b8be5a650	smb: get file name in case of chained commands	4 years ago
Philippe Antoine	3e5f59e2cb	smb: fix parsing of file deletion over SMB1	4 years ago
Philippe Antoine	fde753d9d2	smb: recognizes file deletion over SMB2 ... using set_info_level == SMB2_FILE_DISPOSITION_INFO	4 years ago
Jason Ish	71679c6ad0	ike: use derive macro from app-layer events	4 years ago
Jason Ish	eb55297876	modbus: use derive macro from app-layer events	4 years ago
Jason Ish	d3bd008e33	app-layer template: use derived app-layer event	4 years ago
Jason Ish	cef2832dcf	http2: use derived app-layer event	4 years ago
Jason Ish	e92cb36bb8	krb5: use derived app-layer event	4 years ago
Jason Ish	92561837f8	ntp: use derived app-layer event	4 years ago
Jason Ish	1f71fb2cde	rfb: register None for get_event_info/get_event_info_by_id ... Implementations are not required if they're just going to return -1. We allow None to be registered for that.	4 years ago
Jason Ish	4fd6aa866f	sip: use derived app-layer event	4 years ago
Jason Ish	18448f6ed6	snmp: use derived app-layer event	4 years ago
Jason Ish	bb094b17db	ssh: use derived app-layer event	4 years ago
Jason Ish	9c3f06d9b5	dhcp: use derived app-layer event	4 years ago
Jason Ish	b9f10ba22f	smb: use derived get_event_info/get_event_info_by_id	4 years ago
Jason Ish	8eac5fc221	mqtt: derive AppLayerEvent for MQTTEvent	4 years ago
Jason Ish	6ed827a4ef	dns: use derive macro for DNSEvent	4 years ago
Jason Ish	9221f1d9d5	applayerevent: derive get_event_info and get_event_info_by_id ... Add generation of wrapper functions for get_event_info and get_event_info_by_id to the derive macro. Eliminates the need for the wrapper method to be created by the parser author.	4 years ago
Jason Ish	0fa7b5c2a2	rust/applayer: provide generic event info functions ... Provide generic functions for get_event_info and get_event_info_by_id. These functions can be used by any app-layer event enum that implements AppLayerEvent. Unfortunately the parser registration cannot use these functions directly as generic functions cannot be #[no_mangle]. So they do need small extern "C" wrappers around them.	4 years ago
Jason Ish	27d1ee98ce	rust: derive crate: for custom derives ... Currently has one derive, AppLayerEvent to be used like: #[derive(AppLayerEvent)] pub enum DNSEvent { MalformedData, NotRequest, NotResponse, ZFlagSet, } Code will be generated to: - Convert enum to a c type string - Convert string to enum variant - Convert id to enum variant	4 years ago
Jason Ish	dbea7d636f	rust/applayer: define AppLayerEvent trait ... The derive macro will implement this trait for app-layer event enums.	4 years ago
Jason Ish	cf21694ba6	rust(lint): suppress clippy lints that we should fix ... Suppress all remaining clippy lints that we trip. This can be fixed on a per-lint basis.	4 years ago
Jason Ish	91402f9fba	rust(lint): remove manual implement of map method ... Using `if let` expressions in these cases is better expressed by the map method, and considered idiomatic Rust for this usage.	4 years ago
Jason Ish	b021726a0d	rust(lint): map the error instead of using or_else ... This is the preffered style and easier to understand the meaning of the code.	4 years ago
Jason Ish	dcf57ecd96	rust(lint): replace push_str of single char to push(<char>)	4 years ago
Jason Ish	d5c0962299	rust(lint): fix some usages of references ... - ref is discouraged for top level variables - the other borrow is not required	4 years ago
Jason Ish	d0772e04b1	rust(lint): replace checked_mul with saturating_mul ... When defaulting checked_mul to u64::max, Rust has a method that does the same thing called saturating_mul.	4 years ago
Jason Ish	d0be7541e9	rust(lint): removed unused unit () return ... This is code that is not needed and is a bit confusing to see.	4 years ago
Jason Ish	4abbfd0d97	rust(lint): remove extra parens around bitwise or ... This is a readability fix, as on first look they almost look like a Rust tuple.	4 years ago
Jason Ish	ac3a20b6e0	rust(lint): remove useless conversions and clones ... These add complexity and may not be optimized out by the compiler.	4 years ago
Jason Ish	8bb6dab69d	rust(lint): remove useless format calls ... In these simple cases to_string() is recommended and likely performs better as the formatter is not called.	4 years ago
Jason Ish	5bf5de3350	rust(lint): don't use unwrap_or for function calls ... Calling a function in unwrap_or causes that function to always be called even when not needed. Instead use unwrap_or_else with a closure which will only be called when needed.	4 years ago
Jason Ish	602bb05e75	rust(lint): fix redundant closures ... This lint checks for a closure where a function can be directly supplied. Runtime performance is unchanged, but this makes less work for the compiler.	4 years ago
Jason Ish	69cf5c9eea	rust(lint): remove needless borrows ... These are needless borrows (references) as the item is already a reference.	4 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe ... Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	4 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute ... All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	4 years ago
Victor Julien	9d24a53c53	nfs: minor code cleanup	4 years ago
Victor Julien	aa9d8658ef	smb: minor formatting fixup	4 years ago
Victor Julien	094208823b	smb: minor code cleanup	4 years ago
Shivani Bhardwaj	0a1747c1ba	nfs: fix comment	4 years ago
Shivani Bhardwaj	58ac9b0f38	nfs: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	61fca4e9db	nfs: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	de50ac631e	nfs: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions. Probe fn has also been changed to return AppProto as required by the new fn signature.	4 years ago
Shivani Bhardwaj	e5c948df87	smb: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	4 years ago
Shivani Bhardwaj	27af4bb002	smb: add missing code from rust impl of fns	4 years ago
Shivani Bhardwaj	6420df84b7	smb: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	4 years ago
Shivani Bhardwaj	4d6b6b5dfe	smb: add constants	4 years ago
Shivani Bhardwaj	d1ea00521b	rust/core: Add flow flags	4 years ago