suricata

Commit Graph

Author	SHA1	Message	Date
Giuseppe Longo	ba5e850264	sip: make pattern matching more robust SIP and SSDP share method names like NOTIFY and SUBSCRIBE, causing SSDP traffic to be misidentified as SIP. Add a probing parser callback that checks for "SIP/" in the payload before accepting a pattern match. Example of a misidentified flow before the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"sip","flow":{"..."}} After the fix: {"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250 ","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"failed","flow":{"..."}} Ticket #8355	3 months ago
Philippe Antoine	709ad1bdf4	rust: format sip files Ticket: 3836	3 months ago
Li Heng	1106323ae1	rust/sip: delete redundant computing codes Delete call of is_alphanumeric where is_alphanumeric and is_token_char are called together. Four places are modified. Ticket: 8003	10 months ago
Jason Ish	f0f4d88119	rust/sip+sdp: update to nom 8 Done together as there is a dependence of SDP by SIP. Ticket: #8025	11 months ago
Jason Ish	c994cfb615	rust/sip: replace rs_ naming with SC	1 year ago
Giuseppe Longo	fbc3cd1b3f	rust/sip: store response headers To match on response SIP headers, those headers must be stored. Ticket #6374	2 years ago
Giuseppe Longo	cfb793ce28	rust/sip: store multiple header values According to RFC 3261, a single header can be repeated one or more times, and its name can also be specified using the 'compact form.' This patch updates the hashmap used for storing headers to accommodate multiple values instead of just one. Additionally, if a header name is defined in the compact form, it is expanded into its long form (i.e., the standard name). This conversion simplifies the logic for matching a given header and ensures 1:1 parity with keywords. Ticket #6374	2 years ago
Giuseppe Longo	868493529b	rust/sip: parse and log sdp If SDP payload is found within a SIP message, it will be parsed and then logged. Ticket #6627	2 years ago
Giuseppe Longo	69f841c998	sip/parser: enforce valid chars for sip version The `is_version_char` function incorrectly allowed characters that are not part of the valid SIP version "SIP/2.0". For instance, 'HTTP/1.1' was mistakenly accepted as a valid SIP version, although it's not. This commit fixes the issue by updating the condition to strictly check for the correct version string.	3 years ago
Giuseppe Longo	7e993d5081	sip/parser: accept valid chars Accepts valid characters as defined in RFC3261.	3 years ago
Philippe Antoine	a8199bf2ca	rust: fix assertions_on_constants for assert!(false) using panic! instead with a string message	3 years ago
Philippe Antoine	668501c225	rust: remove unused	3 years ago
Jason Ish	c4034dafa1	rust: fix clippy lints for clippy::derive_partial_eq_without_eq	4 years ago
Pierre Chifflier	16db04c1a7	rust: remove nom 5 dependency	4 years ago
Victor Julien	1203750388	sip: add frames support Frames: - sip.pdu - sip.request_line - sip.response_line - sip.request_headers - sip.response_headers - sip.request_body - sip.response_body The `sip.pdu` frame is always created, the rest only if the record parser succeeded. Ticket: #5036.	5 years ago
Pierre Chifflier	d27125d77a	rust/sip: convert parser to nom7 functions	5 years ago
Sascha Steinbiss	11912bd715	sip: address trailing space parsing	7 years ago
Pierre Chifflier	442500678b	rust: use the streaming version of combinators to fix incomplete reads	7 years ago
Pierre Chifflier	f3ddd7127c	rust: Add types annotation when required Unfortunately, the transition to nom 5 (and functions instead of macros) has side-effects, one of them being requiring lots of types annotations when using a parsing, for ex in a match instruction.	7 years ago
Pierre Chifflier	5b809f77f1	rust: upgrade all parsers to nom 5	7 years ago
Jason Ish	517ecd68a9	sip: rustfmt As this is new Rust code, format with rustfmt using default styling.	7 years ago
Jason Ish	fdbc2fe49c	sip rust fixup: remove unused import in tests	7 years ago
Giuseppe Longo	2e975a0481	rust/sip: add parser for SIP protocol	7 years ago

23 Commits (ba5e8502647f6c5c5708f72498895037ccaa24ba)