121 Commits (c862e84c01d59b71cd44b57998936c48b4d142b2)

Author	SHA1	Message	Date
Philippe Antoine	02f2602dde	src: rework includes as per cppclean	4 years ago
Philippe Antoine	5a31b3508d	ftp: optimized tx iterator ... To be more efficient with larger number of transactions. Ticket: #5314	4 years ago
Philippe Antoine	79d7edb3e0	ftp: fix integer warning ... Ticket: #4516	4 years ago
Philippe Antoine	5a00acece2	ftp: remove temporary fields from state ... As input, input_len and direction only last for the scope of one call of AppLayerParserParse, it is not necessary to keep them in FtpState which lives longer, so we consume less memory.	4 years ago
Philippe Antoine	5bd19135b0	util: remove malloc from streaming buffer config ... as it is unused	4 years ago
Victor Julien	6c3222dee6	ftp: code clarifications ... src/app-layer-ftp.c:945:49: style: Parameter 'ftp_state' can be declared with const [constParameter] static FTPTransaction *FTPGetOldestTx(FtpState *ftp_state, FTPTransaction *starttx) ^	4 years ago
Victor Julien	07bf921451	ftp-data: fix direction for active mode commands ... Set correct direction for PORT mode, where the server connects to the client. The direction is not also strictly enforced. No data in the wrong direction will be accepted to setup the file or to be added to the file after setup. This also fixes files getting closed twice. Adds some general cleanups. Bug: #3542.	4 years ago
Jason Ish	9645285dff	ftp: truncate first segment if over max length ... The first segment was not limited to the configured maximum line length allowing it to be up to 65k. This could result in the next input length being negative, which while handled properly by the code, did trigger a debug validation assertion. The fix is to be consistent and apply the limit to the first segment as well, which does ensure the input_len could never be less than 0. Ticket #5281	4 years ago
Jason Ish	cf8ed576e0	ftp: truncate command data that is too long ... FTP control commands will be buffered forever until a new line is seen, this can lead to memory exhaustion in Suricata. To fix, set an upper bound, 4096 bytes on the size of the command that is saved in the transaction. The input continues to be parsed to find the end of the command so the parser can continue to move onto the next command. The result is that the command data in the transaction is truncated, which also shows up in the ftp transaction logs. This value is configurable with the max-line-length field in the ftp app-layer.protocols section. As FTP doesn't have events at this time, add a new fields to eve-log that specificy if the request, or the response has been truncated. Ticket #5024	4 years ago
Philippe Antoine	2ef4172437	ftp: limits the number of active transactions per flow ... Ticket: 4530 As for HTTP2 and MQTT. In FTP case, transactions are pipelined, not identified by an id. So, there are less chances of DOS by quadratic complexity.	5 years ago
Philippe Antoine	86ea7f2474	file: define own variable instead of PATH_MAX ... to be used for maximum size of file names, and not depend on the OS	5 years ago
Philippe Antoine	defce022b4	ftp: fix int warnings ... Explicitly truncate a file name if it is longer than UINT16_MAX	5 years ago
Victor Julien	c073d5cfbf	app-layer: use StreamSlice as input to parsers ... Remove input, input_len and flags in favor of stream slice.	5 years ago
Victor Julien	6466296b32	app-layer: add StreamSlice to pass data to parsers ... Since object to contain relevant pointer, length, offset, flags to make it easy to pass these to the parsers.	5 years ago
Jason Ish	7732efbec2	app-layer: include decoder events in app-layer tx data ... As most parsers use an events structure we can include it in the tx_data structure to reduce some boilerplate/housekeeping code in app-layer parsers.	5 years ago
Jason Ish	9c67c634c1	app-layer: include DetectEngineState in AppLayerTxData ... Every transaction has an existing mandatory field, tx_data. As DetectEngineState is also mandatory, include it in tx_data. This allows us to remove the boilerplate every app-layer has for managing detect engine state.	5 years ago
Victor Julien	04ba6dc138	ftp: support per-tx file accounting	5 years ago
Jeff Lucovsky	1eeb96696b	general: Cleanup bool usage	5 years ago
Victor Julien	4b3be24506	app-layer/expectation: clean up storage id logic	5 years ago
Shivani Bhardwaj	b195ffbe18	applayer/ftp: convert to FAIL/PASS API	6 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	6 years ago
Philippe Antoine	057c4b34c8	ftp: optimize FTPGetOldestTx by starting from last handled tx ... Avoids DOS by quadratic complexity algorithm. Attack is 1 stack many requests/transactions (like cwd commands on a line) 2 get many answers	6 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	6 years ago
Victor Julien	4f73943df9	app-layer: split EOF flag per direction	6 years ago
Xiaofan Wang	071f55dcd7	ftp: fix direction of expectation for STOR command ... Fix direction in active mode.	6 years ago
Victor Julien	7c364017da	ftp: small code cleanup	6 years ago
Jeff Lucovsky	72e2f36f9b	ftp: Restrict file name lengths ... Restrict file name lengths to PATH_MAX - 1 to avoid over subscribing memory to FTP file name tracking.	6 years ago
Victor Julien	c98f597831	ftp: support AppLayerTxData	6 years ago
Jeff Lucovsky	648bd5afff	output/ftp: Use "Eve" prefix with FTP helpers ... This commit changes the prefix of the FTP helper routines from Json to Eve.	6 years ago
Jeff Lucovsky	03de315bc2	ftp/eve: Convert FTP logging to use JsonBuilder ... This commit converts the FTP logging mechanisms to use JsonBuilder.	6 years ago
Jeff Lucovsky	aa3f784d32	detect/ftp: FTP memory accounting fixes ... This commit continues the work started by @vanlink and corrects the accounting of FTP memory usage against the memcap limit.	6 years ago
Philippe Antoine	fef124b92d	ftp: use switch for ftp commands for style	6 years ago
Philippe Antoine	6f36403219	ftp: FTPGetAlstateProgress for done port commands ... For a done transaction with command PORT, we expect FTP_STATE_FINISHED and we got FTP_STATE_PORT_DONE instead which prevented logging of these transactions We change the order of the evaluations to get the right result	6 years ago
Philippe Antoine	699d6682da	ftp: indent FTPParseResponse again	6 years ago
Philippe Antoine	a6294d6ec2	ftp: FTPParseResponse bufferizes lines ... Protects against evasion by TCP packet splitting The problem arised if the FTP response is split on multiple packets The fix is to bufferize the content, until we get a complete line	6 years ago
Victor Julien	44d3f264bf	app-layer: update API to return more details ... Add AppLayerResult struct as the Parser return type in preparation of allowing returning 'Incomplete(size)' similar to what nom in Rust allows.	6 years ago
Victor Julien	3bcf948a75	app-layer: change return codes ... This patch simplifies the return codes app-layer parsers use, in preparation of a patch set for overhauling the return type. Introduce two macros: APP_LAYER_OK (value 0) APP_LAYER_ERROR (value -1) Update all parsers to use this.	6 years ago
Victor Julien	157d01e87e	ftp: minor code cleanups	6 years ago
Danny Browning	b573c16dd5	build: cbindgen ... Rust headers are now generated using cbindgen. If cbindgen is present, they can be generated during dist, otherwise they will be available for builds.	7 years ago
Jason Ish	b1beb76fd7	ftpdata: add tx detect flags	7 years ago
Jeff Lucovsky	354074bac6	ftp: Handle malformed RETR/STOR ... Ensure that RETR (STOR) have a filename -- otherwise, treat the command string as malformed. Added unittests for each command and verified that SEGV's occur without parser change and no longer occur with the parser change.	7 years ago
Jason Ish	ebcc4db84a	file extraction: always prune files after detect ... If a keyword like filemd5 was being used without a filestore, or a file output enabled, it would be pruned before detection had a chance to match. Consolidate file pruning to the end of the flow worker so files are available for detection even when a file output is not enabled. Redmine issue: https://redmine.openinfosecfoundation.org/issues/2490	7 years ago
Jeff Lucovsky	b4070b6dcd	ftp: Use rust parsers to parse dynamic ports	7 years ago
Victor Julien	579cc9f02b	const: constify decoder, app-layer, detect funcs	7 years ago
Jeff Lucovsky	86deaefe66	ftp: Ensure non-zero command length with MPM init	7 years ago
Jeff Lucovsky	86fabef093	ftp: address review comments	7 years ago
Jeff Lucovsky	f79316d71a	ftp: remove RUST guards	7 years ago
Jeff Lucovsky	09ab032a8d	ftp: Use MPM for command lookup	7 years ago
Jeff Lucovsky	4f2a485c55	ftp: Remove LIBJANSSON guards	7 years ago
Jeff Lucovsky	3df2b3437c	eve/ftp: Move "get next line" into app-layer-ftp.c	7 years ago