4 Commits (aa20770277da4044ccdfa1ca4019c4d4c6dc78a7)

Author	SHA1	Message	Date
Jeff Lucovsky	1b791f34a5	output: Remove unused variables/define	6 years ago
Jason Ish	36d687580a	rfb/eve: convert to jsonbuilder	6 years ago
Jason Ish	99f460aa5a	eve/fivetuple: use intermediate address struct (jsonbuilder prep) ... Currently alert logging relies on the ability to change existing values in the json_t structure to overwrite addresses with xff data. This feature is also used for the "target" logging. As we can't do this with JsonBuilder, create a new struct to hold the 5 tuple, with the values swapped as needed, and overwritten with XFF data if needed. This struct will now be used to write out the 5 tuple, as well as cache the information for log fields to be written out later on in the log path.	6 years ago
Frank Honza	1c8943dedd	add RFB parser ... This commit adds support for the Remote Framebuffer Protocol (RFB) as used, for example, by various VNC implementations. It targets the official versions 3.3, 3.7 and 3.8 of the protocol and provides logging for the RFB handshake communication for now. Logged events include endpoint versions, details of the security (i.e. authentication) exchange as well as metadata about the image transfer parameters. Detection is enabled using keywords for: - rfb.name: Session name as sticky buffer - rfb.sectype: Security type, e.g. VNC-style challenge-response - rfb.secresult: Result of the security exchange, e.g. OK, FAIL, ... The latter could be used, for example, to detect brute-force attempts on open VNC servers, while the name could be used to map unwanted VNC sessions to the desktop owners or machines. We also ship example EVE-JSON output and keyword docs as part of the Sphinx source for Suricata's RTD documentation.	6 years ago