aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
12,898 Commits
7 Branches
161 Tags
173 MiB
main-7.0.x
master
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-8.0.0
suricata-7.0.11
suricata-8.0.0-rc1
suricata-8.0.0-beta1
suricata-7.0.10
suricata-7.0.9
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'b336882008'
${ noResults }
Commit Graph

47 Commits (b336882008d3640973fa71be6f36f3de33d3cd25)

Author SHA1 Message Date
Victor Julien b336882008 smb1: apply close to direction 
Instead of closing files in both direction when receiving a close request,
close only toserver files for the request and close toclient on receiving
a response.
 3 years ago
Victor Julien 0c9fdf8f4f smb: implement frames 
SMB1 record parsing code simplification.

Frames:

    nbss.pdu
    nbss.hdr
    nbss.data

    smb1.pdu
    smb1.hdr
    smb1.data

    smb2.pdu
    smb2.hdr
    smb2.data

    smb3.pdu
    smb3.hdr
    smb3.data

The smb* frames are created for valid SMB records.
 4 years ago
Pierre Chifflier d67f8f9196 rust/smb: convert parser to nom7 functions (SMB1) 4 years ago
Shivani Bhardwaj 89cb337930 smb: use Direction enum 4 years ago
Sam Muhammed da0a976e23 rust(lint): use let for binding single value 
`match` is better used with binding to multiple variables,
for binding to a single value, `let` statement is recommended.

Bug: #4616
 4 years ago
Jason Ish 69cf5c9eea rust(lint): remove needless borrows 
These are needless borrows (references) as the item is already
a reference.
 4 years ago
Philippe Antoine ef5755338f rust: SCLogDebug is real nop when built as release 
Before, even if there were no outputs, all the arguments
were evaluated, which could turn expensive

All variables which are used only in certain build configurations
are now prefixed by underscore to avoid warnings
 4 years ago
Philippe Antoine 2d14606224 smb: andx support 
Add AndX support for SMB1. Finishes #3475.

[Updated by Victor Julien to split functions]
 5 years ago
Philippe Antoine caa7946888 smb: adds file overlap event against evasions 
Evasion scenario is
- a first dummy write of one byte at offset 0 is done
- the second full write of EICAR at offset 0 is then done
and does not trigger detection

The last write had the final value, and as we cannot "cancel"
the previous write, we set an event which is then transformed into
an app-layer decoder alert
 5 years ago
Jason Ish ac93ab281d rust/logging: allow log macros to be used by plugins 
Fix plugin macros so they can be used by external Rust crates
such as plugins.
 5 years ago
Victor Julien 40fe29de96 smb1: fix 'event' txs not getting closed 
If the only reason we created a request side TX was to set an event,
we would not close it.

This patch always looks up the TX from the response side.
 6 years ago
Jason Ish 42e5065ab8 rust: update to Rust 2018 with cargo fix 
Migrate to Rust 2018 edition.

Credit to Danny Browning for first demontrating this:
https://github.com/OISF/suricata/pull/3604/commits
 6 years ago
Victor Julien 3f6624bf16 rust: remove libc crate dependency 
Use std::os::raw instead.
 6 years ago
Victor Julien f7a41412d6 smb1: fix NT create andx records filename parsing 
Use file name parsing routines that take unicode into account
and consider padding bytes as well.
 7 years ago
Pierre Chifflier 13b7399790 rust: upgrade all parsers to nom4 7 years ago
Victor Julien 4d5024255f smb/dcerpc: remove now unused ssn2maxsize_map 7 years ago
Victor Julien ac4e888597 smb2/dcerpc: probe if response data is dcerpc 
If we missed the tree connect we can't know for sure if we're
reading from a (DCERPC) PIPE or not. In this case probe the data
to see if it looks like DCERPC.

If the detection succeeds, use a special 'suricata::dcerpc' service
in the TX.

Simplify handling of DCERPC records that cross records

Update logging for the response only TXs.
 7 years ago
Victor Julien edd0c2246c smb1: add SMB1_COMMAND_QUERY_INFO_DISK command mapping 7 years ago
Victor Julien 2b581cd6db smb: log trans2 that enable delete on close 7 years ago
Victor Julien eefac0ef95 smb1: add support for trans2 set_path_info rename 7 years ago
Victor Julien 1b86d4e1a2 smb: improve dcerpc logic 
Detect whether a pipe is a dcerpc channel based on the name of the
pipe.
 7 years ago
Victor Julien 4d58aaae90 smb: clean up partial read/write record handling 8 years ago
Victor Julien aa8d64c2b8 smb: improve skip handling 
When skipping records the skip tracker could underflow if the record
parsing had more data than expected.

Enforce the calculation by moving it into a method and make the actual
fields private.
 8 years ago
Victor Julien ea1e13cb00 smb: suppress notice messages 8 years ago
Victor Julien 0dfb3f0e7f smb1: extract rename info from TRANS2 
Exclude TRANS2 from generic TX lookup bypass.
 8 years ago
Victor Julien 8eeda113c8 smb1: add parsing for RENAME command 8 years ago
Victor Julien 15978d4e85 smb: if filename is missing, use '<unknown>' 8 years ago
Victor Julien bc193242ad smb1: add OPEN_ANDX command name for logging 8 years ago
Victor Julien 32b19fac99 smb2: don't log/track each READ/WRITE/etc 8 years ago
Victor Julien fb986abe81 smb: log file FID/GUID as fuid 8 years ago
Victor Julien eed492547c smb1: extract server guid from negotiate 8 years ago
Victor Julien fcbeab70a4 smb1: log create 'service' fields 8 years ago
Victor Julien 90e2abaac4 smb1: use generic string parsing for trans 8 years ago
Victor Julien 668c747aee smb1: more exact tree connect record parsing 8 years ago
Victor Julien 0ed00cf104 smb: move common parsing funcs into own file 8 years ago
Victor Julien 1d4aac1d4d smb1: set event on empty/malformed dialect 8 years ago
Victor Julien caf29e92b3 smb1: parse and log timestamps in CREATE 8 years ago
Victor Julien 28f16e38ac smb1: disable 'generic tx's for common commands 
Don't create a generic TX for each READ, WRITE, TRANS, TRANS2,
except if they cause events to trigger.
 8 years ago
Victor Julien 78cd92a933 smb: generic event per trans/read/write for tx events 8 years ago
Victor Julien 05992f1772 smb: fix event handling when no tx is available 8 years ago
Victor Julien be615c9fbc smb: small cleanups, fixes and optimizations 8 years ago
Victor Julien ad1bc7f473 smb1: minor debug improvment 8 years ago
Victor Julien 170edf7c44 smb1: improve error handling 8 years ago
Victor Julien 98b926bf72 smb1: implement WRITE_AND_CLOSE 8 years ago
Victor Julien 595557eb8d smb1: locking andx may have no response 8 years ago
Victor Julien 8bef120898 smb: session setup improvements 
Improve ntlmssp version extraction and logging, make its data structures
optional. Extract native os/lm from smb1 ssn setup.

Move session setup handling into their own files.

Only log auth data for the session setup tx.
 8 years ago
Victor Julien 75d7c9d64a rust/smb: initial support 
Implement SMB app-layer parser for SMB1/2/3. Features:
- file extraction
- eve logging
- existing dce keyword support
- smb_share/smb_named_pipe keyword support (stickybuffers)
- auth meta data extraction (ntlmssp, kerberos5)
 8 years ago