59 Commits (c4034dafa19c9c63fb0f0ef1e0b65c26dec43a44)

Author	SHA1	Message	Date
Jason Ish	c4034dafa1	rust: fix clippy lints for clippy::derive_partial_eq_without_eq	3 years ago
Victor Julien	79499e4769	app-layer: move files into transactions ... Update APIs to store files in transactions instead of the per flow state. Goal is to avoid the overhead of matching up files and transactions in cases where there are many of both. Update all protocol implementations to support this. Update file logging logic to account for having files in transactions. Instead of it acting separately on file containers, it is now tied into the transaction logging. Update the filestore keyword to consider a match if filestore output not enabled.	3 years ago
Victor Julien	c27df6304d	app-layer: introduce common AppLayerStateData API ... Add per state structure for storing flags and other variables.	3 years ago
Pierre Chifflier	b31c72c06a	rust/rdp: convert parsers to nom7	3 years ago
Pierre Chifflier	49520b2143	rust/rdp: upgrade dependency on tls-parser	3 years ago
Pierre Chifflier	3aace49649	rust/x509: update dependency on x509-parser	3 years ago
Philippe Antoine	2294e9cdbc	rdp: bump up tls-parser crate version ... so that we can use new functions in quic parser	3 years ago
Jason Ish	8790968281	mqtt, rdp: fix copyright dates	3 years ago
Jason Ish	9b0b2beac1	pgsql: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5297	3 years ago
Jason Ish	4e0ad5e0bd	rdp: convert transaction list to vecdeque ... Allows for more efficient removal from front of the list. Ticket: #5295	3 years ago
Jason Ish	7b11b4d3a1	app-layer: more generic state trait ... Instead of a method that is required to return a slice of transactions, use 2 methods, one to return the number of transactions in the collection, and another to get a transaction by its index in the collection. This allows for the transaction collection to not be a contiguous array and instead can be a VecDeque, or possibly another collection type that supports retrieval by index. Ticket #5278	3 years ago
Victor Julien	e6f49e5a05	app/frames: implement name to id API for frames	4 years ago
Victor Julien	c073d5cfbf	app-layer: use StreamSlice as input to parsers ... Remove input, input_len and flags in favor of stream slice.	4 years ago
Victor Julien	6466296b32	app-layer: add StreamSlice to pass data to parsers ... Since object to contain relevant pointer, length, offset, flags to make it easy to pass these to the parsers.	4 years ago
Jason Ish	7732efbec2	app-layer: include decoder events in app-layer tx data ... As most parsers use an events structure we can include it in the tx_data structure to reduce some boilerplate/housekeeping code in app-layer parsers.	4 years ago
Jason Ish	b57280ff48	rdp: fix transaction id ... By our convention the transaction ID is incremented then applied to the new transaction. And the generic transaction iterator requires this behaviour.	4 years ago
Jason Ish	9c67c634c1	app-layer: include DetectEngineState in AppLayerTxData ... Every transaction has an existing mandatory field, tx_data. As DetectEngineState is also mandatory, include it in tx_data. This allows us to remove the boilerplate every app-layer has for managing detect engine state.	4 years ago
Jason Ish	f4b4d531b0	rdp: add tx iterator	4 years ago
Sam Muhammed	922a453da5	rust(lint): use is_null() instead of ptr::null_mut() ... Bug: #4594	4 years ago
Jason Ish	91402f9fba	rust(lint): remove manual implement of map method ... Using `if let` expressions in these cases is better expressed by the map method, and considered idiomatic Rust for this usage.	4 years ago
Jason Ish	dcf57ecd96	rust(lint): replace push_str of single char to push(<char>)	4 years ago
Jason Ish	d5c0962299	rust(lint): fix some usages of references ... - ref is discouraged for top level variables - the other borrow is not required	4 years ago
Jason Ish	69cf5c9eea	rust(lint): remove needless borrows ... These are needless borrows (references) as the item is already a reference.	4 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe ... Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	4 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute ... All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	4 years ago
Philippe Antoine	6da9a37285	rdp: correctly returns incomplete in parse_tc ... Adding the already consumed bytes In case an incomplete tls handshake is handled with/after a refular rdp t123_tpkt	4 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	5 years ago
Philippe Antoine	3e96f96153	rdp: fix incomplete result ... Aggregating the consumed bytes	5 years ago
Jason Ish	1d40d0c5f9	rdp: set unidirection transaction flag	5 years ago
Victor Julien	4da0d9bdea	applayer/rust: expose truncate callback	5 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	5 years ago
Jeff Lucovsky	be57f6d3cc	rust/rdp: Fix use of incorrect buffer ... This commit updates the connection confirmation parsing function to use the correct buffer when determining the packet type.	5 years ago
Zach Kelly	b25de4d99a	rdp: remove parser buffering code	5 years ago
Zach Kelly	22a2bee614	rdp/eve: convert to jsonbuilder	5 years ago
Zach Kelly	ef397daba3	rdp: rustfmt (update)	5 years ago
Jason Ish	53aa967e0b	applayer: add flags to parser registration struct ... This will allow Rust parsers to register for gap handing from Rust (some Rust parsers do handle gaps, but they set the flag from C).	5 years ago
Victor Julien	5dd4d948d9	app-layer: remove unused detect flags API	5 years ago
Victor Julien	c94a5e6392	app-layer/rust: don't use option for GetTxDataFn anymore	5 years ago
Victor Julien	88dd0abb38	rdp: support AppLayerTxData	5 years ago
Victor Julien	9664f73f75	app-layer: remove logged API calls	5 years ago
Victor Julien	5665fc8301	app-layer: add ApplyTxConfig API ... Optional callback a parser can register for applying configuration to the 'transaction'. Most parsers have a bidirectional tx. For those parsers that have different types of transaction handling, this new callback can be used to properly apply the config.	5 years ago
Victor Julien	411f428a38	app-layer: define AppLayerTxData and AppLayerTxConfig ... AppLayerTxData is a structure each tx should include that will contain the common fields the engine needs for tracking logging, detection and possibly other things. AppLayerTxConfig will be used by the detection engine to configure the transaction.	5 years ago
Victor Julien	79681bf655	app-layer: remove old MPMId API calls ... Had been deprecated and non-functional since 2017.	5 years ago
Jason Ish	6ce9b2972b	rdp: enable by default ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/3255	5 years ago
Victor Julien	2f5834cdfa	rust: merge parser.rs into applayer.rs ... Both were serving the same purpose.	5 years ago
Victor Julien	44d3f264bf	app-layer: update API to return more details ... Add AppLayerResult struct as the Parser return type in preparation of allowing returning 'Incomplete(size)' similar to what nom in Rust allows.	5 years ago
Victor Julien	3bcf948a75	app-layer: change return codes ... This patch simplifies the return codes app-layer parsers use, in preparation of a patch set for overhauling the return type. Introduce two macros: APP_LAYER_OK (value 0) APP_LAYER_ERROR (value -1) Update all parsers to use this.	5 years ago
Pierre Chifflier	442500678b	rust: use the streaming version of combinators to fix incomplete reads	5 years ago
Pierre Chifflier	df9a4fd635	rust/rdp: use the streaming version of combinators to fix incomplete reads	5 years ago
Pierre Chifflier	2561da89c0	rust/rdp: fix regression introduced during nom 5 upgrade	5 years ago