149 Commits (cf9b2b5fd1ea85290848630a4b1856fdb01d3de2)

Author	SHA1	Message	Date
Philippe Antoine	9b8be5a650	smb: get file name in case of chained commands	5 years ago
Philippe Antoine	3e5f59e2cb	smb: fix parsing of file deletion over SMB1	5 years ago
Philippe Antoine	fde753d9d2	smb: recognizes file deletion over SMB2 ... using set_info_level == SMB2_FILE_DISPOSITION_INFO	5 years ago
Jason Ish	b9f10ba22f	smb: use derived get_event_info/get_event_info_by_id	5 years ago
Jason Ish	5bf5de3350	rust(lint): don't use unwrap_or for function calls ... Calling a function in unwrap_or causes that function to always be called even when not needed. Instead use unwrap_or_else with a closure which will only be called when needed.	5 years ago
Jason Ish	602bb05e75	rust(lint): fix redundant closures ... This lint checks for a closure where a function can be directly supplied. Runtime performance is unchanged, but this makes less work for the compiler.	5 years ago
Jason Ish	69cf5c9eea	rust(lint): remove needless borrows ... These are needless borrows (references) as the item is already a reference.	5 years ago
Jason Ish	363b5f99c3	rust: functions that reference raw pointers are unsafe ... Based on the Rust clippy lint that recommends that any public function that dereferences a raw pointer, mark all FFI functions that reference raw pointers with build_slice and cast_pointer as unsafe. This commits starts by removing the unsafe wrapper inside the build_slice and cast_pointer macros then marks all functions that use these macros as unsafe. Then fix all not_unsafe_ptr_arg_deref warnings from clippy. Fixes clippy lint: https://rust-lang.github.io/rust-clippy/master/index.html#not_unsafe_ptr_arg_deref	5 years ago
Jason Ish	53413f2d7a	rust: remove all usage of transmute ... All cases of our transmute can be replaced with more idiomatic solutions and do no require the power of transmute. When returning an object to C for life-time management, use Box::into_raw to convert the boxed object to pointer and use Box::from_raw to convert back. For cases where we're just returning a pointer to Rust managed data, use a cast.	5 years ago
Victor Julien	aa9d8658ef	smb: minor formatting fixup	5 years ago
Victor Julien	094208823b	smb: minor code cleanup	5 years ago
Shivani Bhardwaj	e5c948df87	smb: Add rust registration function ... Get rid of the C glue code and move registration completely to Rust.	5 years ago
Shivani Bhardwaj	27af4bb002	smb: add missing code from rust impl of fns	5 years ago
Shivani Bhardwaj	6420df84b7	smb: Change fn sign as per rust registration requirement ... Registering parsers in Rust requires signatures to be a certain way and compatible with C. Change signatures of all the functions.	5 years ago
Shivani Bhardwaj	4d6b6b5dfe	smb: add constants	5 years ago
Philippe Antoine	ef5755338f	rust: SCLogDebug is real nop when built as release ... Before, even if there were no outputs, all the arguments were evaluated, which could turn expensive All variables which are used only in certain build configurations are now prefixed by underscore to avoid warnings	5 years ago
Victor Julien	3587033d9e	files: construct with default, free on drop ... Update protocols.	5 years ago
Jeff Lucovsky	02dccb1529	smb: Rework constructs to use Self/Default ... This commit modifies the constructors to use Self and/or Default::default() when feasible	5 years ago
Philippe Antoine	8307010255	smb: relax probing parser to handle first NBSS message ... cf dcerpc-udp S-V test : First message is Message Type: Session request (0x81) Second message is SMB	6 years ago
Philippe Antoine	1b6e81cd72	smb: probing parser for start and midstream ... The probing parser is more strict at the start of the stream	6 years ago
Philippe Antoine	9dc5258a21	smb: split probing function for code style ... Introduces rs_smb_probe_tcp_midstream	6 years ago
Philippe Antoine	2d14606224	smb: andx support ... Add AndX support for SMB1. Finishes #3475. [Updated by Victor Julien to split functions]	6 years ago
Philippe Antoine	aee8e60149	rust: better panic message for missing file config	6 years ago
Philippe Antoine	8ac363c34d	rust: fix warning about unused values in smb tests	6 years ago
Juliana Fajardini	e33bbee9b7	nbss: add parser tests ... Add tests to parse_nbss_record and parse_nbss_record_partial	6 years ago
Juliana Fajardini	5226ba1c15	Rust: generic files definition ... Issue: Optimization 3825 - filecontainer: add Files structure, to replace/unify SMBFiles, NFSFiles and HTTP2Files - smb/files: delete SMBFiles implementation - smb/smb: replace SMBFiles with Files - nfs/nfs: delete NFSFiles implementation, replace its former declarations with Files' ones - http2/http2: replace HTTP2Files with Files - http2/mod: Delete reference to file files.rs - http2/files: Delete	6 years ago
Victor Julien	efc9a7a398	app-layer: remove callback for completion status ... Since the completion status was a constant for all parsers, remove the callback logic and instead register the values themselves. This should avoid a lot of unnecessary callback calls. Update all parsers to take advantage of this.	6 years ago
Philippe Antoine	6181459086	smb: do not rely on one valid NBSS byte for probing ... Need to have the SMB header so as to validate	6 years ago
Philippe Antoine	aaa69fe3c5	smb: resistance against padding evasions ... Scenario is use of dummy padding in write AndX request or other similar commands using a data offset. Parsing skips now these dummy bytes, and generates one event	6 years ago
Philippe Antoine	caa7946888	smb: adds file overlap event against evasions ... Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert	6 years ago
Philippe Antoine	547d6c2d78	applayer: pass parameter to StateAlloc ... This parameter is NULL or the pointer to the previous state for the previous protocol in the case of a protocol change, for instance from HTTP1 to HTTP2 This way, the new protocol can use the old protocol context. For instance, HTTP2 mimicks the HTTP1 request, to have a HTTP2 transaction with both request and response	6 years ago
Jason Ish	ac93ab281d	rust/logging: allow log macros to be used by plugins ... Fix plugin macros so they can be used by external Rust crates such as plugins.	6 years ago
Shivani Bhardwaj	2529eb35e1	smb: use uuid crate	6 years ago
Victor Julien	77a95eddd9	smb: support AppLayerTxData	6 years ago
Victor Julien	65e9a7c31c	smb: fix 'dangling' files in lossy sessions ... In case of lossy connections the SMB state would properly clean up transactions, including file transactions. However for files the state was never set to 'truncated', leading to files to stay 'active'. This would lead these files staying in the SMB's state. In long running sessions with lots of files this would lead to performance and memory use issues. This patch cleans truncates the file that was being transmitted when a file transaction is being closed.	6 years ago
Victor Julien	25f2efe977	smb: check post-gap timeouts once a second at most	6 years ago
Victor Julien	8aa380600d	smb: update ts only if it changed	6 years ago
Shivani Bhardwaj	a7535099b4	smb/eve: convert to jsonbuilder ... Closes redmine ticket 3712.	6 years ago
Shivani Bhardwaj	80adf7d1cf	smb: Import constants from DCERPC ... Remove DCERPC constants to avoid duplicate name errors. Import the required constants from DCERPC implementation.	6 years ago
Shivani Bhardwaj	6457754fd6	dcerpc: Replace C function calls with Rust ... All the dead code in C after the Rust implementation is hereby removed. Invalid/migrated tests have also been deleted. All the function calls in C have been replaced with appropriate calls to Rust functions. Same has been done for smb/detect.rs as a part of this migration.	6 years ago
Victor Julien	2f5834cdfa	rust: merge parser.rs into applayer.rs ... Both were serving the same purpose.	6 years ago
Victor Julien	5cd9cfb5a0	smb: update return type of GAP handling	6 years ago
Victor Julien	4bf87d30e4	smb: convert to return AppLayerResult ... Support returning 'incomplete' and remove the buffering code from the parser.	6 years ago
Victor Julien	3bcf948a75	app-layer: change return codes ... This patch simplifies the return codes app-layer parsers use, in preparation of a patch set for overhauling the return type. Introduce two macros: APP_LAYER_OK (value 0) APP_LAYER_ERROR (value -1) Update all parsers to use this.	6 years ago
Victor Julien	a729d266c3	smb: fix rustc 1.42 warnings	6 years ago
Pierre Chifflier	442500678b	rust: use the streaming version of combinators to fix incomplete reads	7 years ago
Pierre Chifflier	f3ddd7127c	rust: Add types annotation when required ... Unfortunately, the transition to nom 5 (and functions instead of macros) has side-effects, one of them being requiring lots of types annotations when using a parsing, for ex in a match instruction.	7 years ago
Pierre Chifflier	d1bf34a427	rust/smb: add custom error handling	7 years ago
Pierre Chifflier	1ab8c5763c	rust: add SecBlobError custom error type for the Kerberos parser	7 years ago
Pierre Chifflier	5b809f77f1	rust: upgrade all parsers to nom 5	7 years ago