Commit Graph

14 Commits (cdd061ba37682cad1174fa6f4149a837a31e18ef)

Author SHA1 Message Date
Victor Julien 723f1586ca ikev2: remove excess new lines 6 years ago
Victor Julien 0301ceab13 rust/mingw: fix missing IPPROTO_* declarations
The libc crate doesn't provide these on MinGW, so define them in
our 'core' instead. We only use IPPROTO_TCP and IPPROTO_UDP.

Bug #2733
6 years ago
Victor Julien 422e4892cc proto-detect: improve midstream support
When Suricata picks up a flow it assumes the first packet is
toserver. In a perfect world without packet loss and where all
sessions neatly start after Suricata itself started, this would be
true. However, in reality we have to account for packet loss and
Suricata starting to get packets for flows already active be for
Suricata is (re)started.

The protocol records on the wire would often be able to tell us more
though. For example in SMB1 and SMB2 records there is a flag that
indicates whether the record is a request or a response. This patch
is enabling the procotol detection engine to utilize this information
to 'reverse' the flow.

There are three ways in which this is supported in this patch:

1. patterns for detection are registered per direction. If the proto
   was not recognized in the traffic direction, and midstream is
   enabled, the pattern set for the opposing direction is also
   evaluated. If that matches, the flow is considered to be in the
   wrong direction and is reversed.

2. probing parsers now have a way to feed back their understanding
   of the flow direction. They are now passed the direction as
   Suricata sees the traffic when calling the probing parsers. The
   parser can then see if its own observation matches that, and
   pass back it's own view to the caller.

3. a new pattern + probing parser set up: probing parsers can now
   be registered with a pattern, so that when the pattern matches
   the probing parser is called as well. The probing parser can
   then provide the protocol detection engine with the direction
   of the traffic.

The process of reversing takes a multi step approach as well:

a. reverse the current packets direction
b. reverse most of the flows direction sensitive flags
c. tag the flow as 'reversed'. This is because the 5 tuple is
   *not* reversed, since it is immutable after the flows creation.

Most of the currently registered parsers benefit already:

- HTTP/SMTP/FTP/TLS patterns are registered per direction already
  so they will benefit from the pattern midstream logic in (1)
  above.

- the Rust based SMB parser uses a mix of pattern + probing parser
  as described in (3) above.

- the NFS detection is purely done by probing parser and is updated
  to consider the direction in that parser.

Other protocols, such as DNS, are still to do.

Ticket: #2572
6 years ago
Pierre Chifflier f90733fe3f rust/ikev2: fix events not being raised in first message
The `set_event` function requires that the transaction is already
inserted, or the event set is silently lost.
When parsing first IKEv2 message, first insert transaction, prepare
values, and borrow back inserted transaction to update it.
6 years ago
Pierre Chifflier 13b7399790 rust: upgrade all parsers to nom4 7 years ago
Victor Julien 083908f3be rust/ike2: free destate on tx free
Bug #2604
7 years ago
Victor Julien ae10a92bc6 rust/applayer: use correct return type for Parser
The mismatch between the types would randomly lead to the return code
of the Rust parser to be not correctly handled over the C/Rust
boundary. This would lead to the API considering a parser to be in
error state when it was not.
7 years ago
Victor Julien fd38989113 proto/detect: remove probing parser offset argument
Remove offset argument as it was unused.
7 years ago
Victor Julien 7bc3c3ac6e app-layer: pass STREAM_* flags to parser
Pass the STREAM_* flags to the app-layer parser functions so that
the parser can know more about how it is called.
7 years ago
Jason Ish da4912dfe7 rust: add get_tx_iterator to parser registration 7 years ago
Pierre Chifflier bf66948ad7 IKEv2: suppress some debug output 7 years ago
Pierre Chifflier 3fbfb22204 IKEv2: remove events counter 7 years ago
Pierre Chifflier d94346282c Add logger for IKEv2 7 years ago
Pierre Chifflier c99b9462d7 Add new parser: IKEv2
Add a new parser for Internet Key Exchange version (IKEv2), defined in
RFC 7296.
The IKEv2 parser itself is external. The embedded code includes the
parser state and associated variables, the state machine, and the
detection code.

The parser looks the first two messages of a connection, and analyzes
the client and server proposals to check the cryptographic parameters.
7 years ago