aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
10,164 Commits
7 Branches
155 Tags
194 MiB
master
main-7.0.x
master-6.0.x
master-5.0.x
master-4.1.x
master-4.0.x
master-3.2.x
suricata-7.0.8
suricata-7.0.7
suricata-7.0.6
suricata-6.0.20
suricata-7.0.5
suricata-6.0.19
suricata-6.0.18
suricata-7.0.4
suricata-6.0.17
suricata-7.0.3
suricata-6.0.16
suricata-7.0.2
suricata-6.0.15
suricata-7.0.1
suricata-6.0.14
suricata-7.0.0
suricata-7.0.0-rc2
suricata-6.0.13
suricata-6.0.12
suricata-6.0.11
suricata-7.0.0-rc1
suricata-6.0.10
suricata-6.0.9
suricata-7.0.0-beta1
suricata-6.0.8
suricata-6.0.7
suricata-6.0.6
suricata-5.0.10
suricata-6.0.5
suricata-5.0.9
suricata-6.0.4
suricata-5.0.8
suricata-6.0.3
suricata-5.0.7
suricata-6.0.2
suricata-5.0.6
suricata-6.0.1
suricata-5.0.5
suricata-4.1.10
suricata-4.1.9
suricata-5.0.4
suricata-6.0.0
suricata-6.0.0-rc1
suricata-6.0.0-beta1
suricata-5.0.3
suricata-4.1.8
suricata-4.1.7
suricata-5.0.2
suricata-4.1.6
suricata-5.0.1
suricata-5.0.0
suricata-5.0.0-rc1
suricata-4.1.5
suricata-5.0.0-beta1
suricata-4.1.4
suricata-4.1.3
suricata-4.0.7
suricata-4.1.2
suricata-4.1.1
suricata-4.1.0
suricata-4.0.6
suricata-4.1.0-rc2
suricata-4.1.0-rc1
suricata-4.0.5
suricata-4.1.0-beta1
suricata-4.0.4
suricata-4.0.3
suricata-4.0.2
suricata-3.2.5
suricata-4.0.1
suricata-3.2.4
suricata-4.0.0
suricata-4.0.0-rc2
suricata-3.2.3
suricata-4.0.0-rc1
suricata-4.0.0-beta1
suricata-3.2.2
suricata-3.1.4
suricata-3.2.1
suricata-3.2
suricata-3.2RC1
suricata-3.1.3
suricata-3.2beta1
suricata-3.1.2
suricata-3.1.1
suricata-3.1
suricata-3.0.2
suricata-3.1RC1
suricata-3.0.1
suricata-3.0.1RC1
suricata-3.0
suricata-2.0.11
suricata-3.0RC3
suricata-3.0RC2
suricata-3.0RC1
suricata-2.0.10
suricata-2.0.9
suricata-2.1beta4
suricata-2.0.8
suricata-2.0.7
suricata-2.1beta3
suricata-2.0.6
suricata-2.0.5
suricata-2.1beta2
suricata-2.0.4
suricata-2.1beta1
suricata-2.0.3
suricata-2.0.2
suricata-2.0.1
suricata-2.0.1rc1
suricata-2.0
suricata-2.0rc3
suricata-2.0rc2
suricata-2.0rc1
suricata-2.0beta2
suricata-1.4.7
suricata-1.4.6
suricata-1.4.5
suricata-2.0beta1
suricata-1.4.4
suricata-1.4.3
suricata-1.4.2
suricata-1.4.1
suricata-1.3.6
suricata-1.4
suricata-1.3.5
suricata-1.4rc1
suricata-1.3.4
suricata-1.4beta3
suricata-1.3.3
suricata-1.4beta2
suricata-1.3.2
suricata-1.4beta1
suricata-1.3.1
suricata-1.3
suricata-1.3rc1
suricata-1.3beta2
suricata-1.3beta1
suricata-1.2.1
suricata-1.2
suricata-1.2rc1
suricata-1.2beta1
suricata-1.1.1
suricata-0.8.2
suricata-1.0.0
suricata-1.0.1
suricata-1.0.2
suricata-1.0.3
suricata-1.0.4
suricata-1.0.5
suricata-1.1
suricata-1.1beta1
suricata-1.1beta2
suricata-1.1beta3
suricata-1.1rc1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd14fe372b4'
${ noResults }
Commit Graph

316 Commits (d14fe372b4cc92443dd4a51e7c55425fd5ef99a8)

Author SHA1 Message Date
Pierre Chifflier 13b7399790 rust: upgrade all parsers to nom4 6 years ago
Pierre Chifflier 2f08b3eabd rust/nom4: error_code is superseded by error_position 6 years ago
Pierre Chifflier d3011e3ee8 rust: update dependencies for nom4 transition 6 years ago
Jason Ish 93c956ebdf issue 2795: python 3 fix in Rust C header gen 
The C header generation script was failing with a unicode error
in Python 3 on FreeBSD.  Fix the reading of files to properly
handle unicode in all Python 3 environments.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2794
 6 years ago
Victor Julien 8b570c0293 smb: improve request/response mapping 
Only use ssn_id and msg_id for mapping a response to a request.

By not using the tree_id it can always be included in the tx.hdr which
means it can be logged properly in case of IOCTL and DCERPC.
 6 years ago
Pierre Chifflier 3eade88bd8 Krb5: make TCP probing function less strict, messages can be fragmented 6 years ago
Jason Ish b7083bc3a8 rust/dns/v2 - log rrtype in response 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2723
 6 years ago
Jason Ish b7a58680db dns/rust - if let Some over options instead of loop. 
Except in one case where the loop makes more sense for easy break
out.

Also remove one line of non-conforming debug logging.
 6 years ago
Jason Ish 4163d5c360 rust/dns/lua - fix call convention to match C. 
Also, when requesting the query, if the request doesn't exist,
return the query from the response. This makes it behave
more like C implementation.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2730
 6 years ago
Jason Ish 87250da0fc rust/dns: add v1 dns logging 
Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2704
 6 years ago
Victor Julien 0e40231189 app-layer: improve transaction cleanup handling 
The app layers with a custom iterator would skip a tx if during
the ..Cleanup() pass a transaction was removed.

Address this by storing the current index instead of the next
index. Also pass in the next "min_tx_id" to be incremented from
the last TX. Update loops to do this increment.

Also make sure that the min_id is properly updated if the last
TX is removed when out of order.

Finally add a SMB unittest to test this.

Reported by: Ilya Bakhtin
 6 years ago
Victor Julien eedf08be29 rust/filetracker: remove reachable panic 
Remove reachable panic condition when an existing file chunk is not
completed. Instead trunc the file and reset.

Related to bug #2717
 6 years ago
Victor Julien 1b1e136c4f nfs: improve file tracking under packet loss 
In case of packet loss during an in-progress chunk the file tracker
could loose track of a file because it couldn't map the XID to a
file handle.

The file tracker would then panic if a new file was opened, as
it noticed the last chunk wasn't yet complete.

This patch tracks the file handle for a in-progress chunk in the
state, just like the tracking of the size that is left.

Bug #2717
 6 years ago
Victor Julien 27f87567ca rust/nfs: improve debug output 6 years ago
Victor Julien c62273f4fd rust/smb: silence noisy debug messages 6 years ago
Victor Julien 083908f3be rust/ike2: free destate on tx free 
Bug #2604
 6 years ago
Jason Ish 6f00ba0659 rust: fix (again) out of tree builds 
As the generated Cargo.toml is shipped as part of a release
tarball, build from the source directory but set the cargo
CARGO_TARGET_DIR to the build directory.
 6 years ago
Victor Julien 4d5024255f smb/dcerpc: remove now unused ssn2maxsize_map 6 years ago
Victor Julien 4d044483cf smb/dcerpc: clean up and unify DCERPC probe logic 6 years ago
Victor Julien ac4e888597 smb2/dcerpc: probe if response data is dcerpc 
If we missed the tree connect we can't know for sure if we're
reading from a (DCERPC) PIPE or not. In this case probe the data
to see if it looks like DCERPC.

If the detection succeeds, use a special 'suricata::dcerpc' service
in the TX.

Simplify handling of DCERPC records that cross records

Update logging for the response only TXs.
 6 years ago
Victor Julien 9dd7c38113 smb2: skip rest of READ response if status is not success 6 years ago
Victor Julien ae10a92bc6 rust/applayer: use correct return type for Parser 
The mismatch between the types would randomly lead to the return code
of the Rust parser to be not correctly handled over the C/Rust
boundary. This would lead to the API considering a parser to be in
error state when it was not.
 7 years ago
Jason Ish 58933bafc1 rust app layer template: functions to get buffers 
Example functions for getting the request and response buffers.
Useful for running detection on the decoded buffers.
 7 years ago
Jason Ish 01f7dcf5fd rust template parser: sample pcap 7 years ago
Jason Ish c3f1a35e28 rust: app-layer template parser and logger 
The protocol is a simple request/reply based protocol that can
be hand driven with netcat.

Request  -> 12:Hello World!
Response -> 3:Byte

Its of the format <length>:<message> where length is the length
of the message, not including the length or the delimiter.
 7 years ago
Jason Ish 7682b1ba74 rustfmt.toml: set to 80 char line width 
The rustfmt default is 100, set to 80 to be more inline with
the Suricata C code.
 7 years ago
Jason Ish 9636b9de32 rust: expose AppLayerParserStateIssetFlag to Rust. 7 years ago
Jason Ish 90dfcf4907 rust/gen-c-headers: don't attempt to split empty lines 7 years ago
Jason Ish 1c6bc5754c dhcp: check length of option before accessing 
Prevent Rust index out of bounds panic.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2571
 7 years ago
Jason Ish 7bc2469eb1 dhcp: remove println!() that got committed 7 years ago
Victor Julien a337908c78 rust/dhcp: free events and destate at tx end 7 years ago
Victor Julien edd0c2246c smb1: add SMB1_COMMAND_QUERY_INFO_DISK command mapping 7 years ago
Maurizio Abba bf4398b15d output-json: ensure string is json-encodable 
Substitute json_string with SCJsonString custom function.
SCJsonString will ensure string passed is json-encodable (utf-8).
If it's not, the string will be converted in such a way that any
non-printable character will be encoded in its hex form.
The resulting json object will be returned.

rust modification will encode any non-printable character during its
conversion in to_cstring.
 7 years ago
Victor Julien 177966970a smb: probing parser improvement 7 years ago
Victor Julien fd38989113 proto/detect: remove probing parser offset argument 
Remove offset argument as it was unused.
 7 years ago
Victor Julien c6e79f4410 nfs4: create tx for CREATE procedure 7 years ago
Victor Julien 90e0e3da27 nfs: fix applying nfs3 logging logic to nfs4 7 years ago
Victor Julien cb3abba1e0 nfs4: log remove procedure + add multi-proc support 
Add TX creation for NFS4 transactions. Start with the 'REMOVE' procedure.

Start on logging all procs. In NFS4 COMPOUND records there are multiple
procedures. One of them can be considered the 'main' procedure, with others
as supporting utility. This patch adds the first step in supporting to
track those in the TX for logging and inspection.
 7 years ago
Victor Julien ff518e5c64 nfs4: for putrootfh set 'mount root' as name 7 years ago
Victor Julien 22e0fc97f8 nfs: rename generic functions from nfs3 to nfs 7 years ago
Victor Julien d22c170c38 nfs: move v2 parsing into own file 7 years ago
Victor Julien 9b42073e54 nfs3: move nfs3 specific handling into own file 7 years ago
Victor Julien 4c09766b33 nfs: request parser cleanup 7 years ago
Victor Julien f570905f8c nfs: get rid of reachable panic statements 7 years ago
Victor Julien 8a1af5c367 nfs4: remove panic calls, set events instead 7 years ago
Victor Julien f2382356b1 nfs4: support 4.1 SEQUENCE procedure 7 years ago
Victor Julien 2b581cd6db smb: log trans2 that enable delete on close 7 years ago
Victor Julien eefac0ef95 smb1: add support for trans2 set_path_info rename 7 years ago
Victor Julien 1b86d4e1a2 smb: improve dcerpc logic 
Detect whether a pipe is a dcerpc channel based on the name of the
pipe.
 7 years ago
Victor Julien 7c8a078a2c smb1: improve NT Create response record parsing 7 years ago
Victor Julien 2e6014b15c rust/smb: search for record on midstream start 
Calls with both START and MIDSTREAM mean the record might be cut and the
start of it could be missing. For this case, enable the same logic as is
used when catching up after a GAP. Search for the start of the record
instead of assuming it sits exactly at the start of the input data.
 7 years ago
Victor Julien 905d9a1dd8 rust: define all STREAM_* types 7 years ago
Victor Julien 7bc3c3ac6e app-layer: pass STREAM_* flags to parser 
Pass the STREAM_* flags to the app-layer parser functions so that
the parser can know more about how it is called.
 7 years ago
Victor Julien b5bc509857 dhcp: suppress notice message at startup 7 years ago
Jason Ish d83707bef9 rust/dns - remove extra parantheses 
Removes rust compiler warning.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2521
 7 years ago
Jason Ish 9210d8743b rust/dhcp: Rust based DHCP decoder and logger. 
This is a DHCP decoder and logger written in Rust. Unlike most
parsers, this one is stateless so responses are not matched
up to requests by Suricata. However, the output does contain
enough fields to match them up in post-processing.

Rules are included to alert of malformed or truncated options.
 7 years ago
Jason Ish 1b0b74dc16 rust: a Rust ConfNode wrapper. 
A Rust wrapper around the C ConfNode object. Currenlty only exposes
ConfGetChildValueBool and ConfGetChildValue.
 7 years ago
Jason Ish 2ec3381600 rust/app-layer: macros to export de_state functions 
These macros generate the extern "C" functions for transactions
structs that need provide functions for setting and getting
the de_state. The idea is to provide macros do avoid code
duplication and make it simpler to create an app-layer.

A trait would be the correct solution, but it doesn't look like
you can use traits to export extern "C" functions.
 7 years ago
Jason Ish da4912dfe7 rust: add get_tx_iterator to parser registration 7 years ago
Pierre Chifflier e9ae62ed05 Kerberos 5: properly handle TCP buffering 7 years ago
Pierre Chifflier 1076c7cd47 Add krb5_err_code detection keyword 7 years ago
Pierre Chifflier d6b9c0294a Add krb5_cname and krb5_sname detection keywords 7 years ago
Pierre Chifflier 0bd81ff838 Add krb5_msg_type detection keyword 7 years ago
Pierre Chifflier 5037051161 Kerberos 5: rename weak crypto to weak encryption, and log it 7 years ago
Pierre Chifflier 6ae53a1869 Add event rules for Kerberos 5 7 years ago
Pierre Chifflier 3a017f61b0 Kerberos 5: pretty-print error code when logging 7 years ago
Pierre Chifflier 52f5c7914f Log Kerberos 5 errors 7 years ago
Pierre Chifflier 1e5f5d405f Kerberos 5: add support for TCP as well 7 years ago
Pierre Chifflier 645ba17509 Kerberos: check version in probing function 7 years ago
Pierre Chifflier fd175f2bfb Add logger for Kerberos 5 metadata 7 years ago
Pierre Chifflier 77f0c11c9e Add Kerberos 5 application layer 7 years ago
Jason Ish d73b5ee276 rust: cargo fixes for out of tree build 7 years ago
Pierre Chifflier 2d1c4420de Update ntp-parser to 0.2.0 7 years ago
Victor Julien 73d94fff73 nfs4: support records wrapped in GSSAPI integrity 7 years ago
Victor Julien 53fa2af07c nfs4: fix attr parsing corner case 7 years ago
Victor Julien 39489bc5fd nfs4: implement COMMIT parsing and handling 7 years ago
Victor Julien c7cb01b636 nfs4: parse GSSAPI init 7 years ago
Victor Julien bfa60753f9 nfs4: create link support 7 years ago
Victor Julien 06f6c15954 nfs4: initial implementation 
Implements record parsing and file extraction for READs and WRITEs.

Defines all types from RFC 7530.
 7 years ago
Victor Julien 75c5722b7e nfs/rpc: add parser for GSSAPI Integrity records 7 years ago
Victor Julien f40fc0293b smb: minor optimizations 7 years ago
Victor Julien f201a3761f rust: remove multi level 'experimental' 
Don't treat 'external' parsers as more experimental. All parsers
depend on crates to some extend, and all have C glue code. So the
distinction doesn't really make sense.
 7 years ago
Pierre Chifflier d222b9ae6c IKEv2: Use JSON arrays instead of comma-separated values 7 years ago
Pierre Chifflier bf66948ad7 IKEv2: suppress some debug output 7 years ago
Pierre Chifflier 3fbfb22204 IKEv2: remove events counter 7 years ago
Pierre Chifflier 4e4cf00c07 Remove the 'experimental' mark for IKEv2 7 years ago
Pierre Chifflier f65fafa34b IKEv2 logger: use Debug trait for IkePayloadType 7 years ago
Pierre Chifflier d94346282c Add logger for IKEv2 7 years ago
Pierre Chifflier c99b9462d7 Add new parser: IKEv2 
Add a new parser for Internet Key Exchange version (IKEv2), defined in
RFC 7296.
The IKEv2 parser itself is external. The embedded code includes the
parser state and associated variables, the state machine, and the
detection code.

The parser looks the first two messages of a connection, and analyzes
the client and server proposals to check the cryptographic parameters.
 7 years ago
Pierre Chifflier b810275b16 Rust: fix prototype of parsing function (make pstate mutable) 7 years ago
Pierre Chifflier 8e8f0db192 Rust: expose function AppLayerParserStateSetFlag 7 years ago
Victor Julien 91307dafd9 nfs/rpc: fix reponse parsing 7 years ago
Victor Julien b1e2783788 auth/krb5: move kerberos5 wrapper to rust root 
Make it available outside of just the SMB parser.
 7 years ago
Victor Julien 4d58aaae90 smb: clean up partial read/write record handling 7 years ago
Victor Julien aa8d64c2b8 smb: improve skip handling 
When skipping records the skip tracker could underflow if the record
parsing had more data than expected.

Enforce the calculation by moving it into a method and make the actual
fields private.
 7 years ago
Victor Julien eac7a92200 smb2: improve read/write record parsing 
parse_smb2_response_read()/parse_smb2_response_write() can be called on
incomplete data, so they didn't use the read/write length field to grab
the data field. Instead it just used rest(). However in some cases
SMB2 records have trailing data, which would be included in the
READ/WRITE data.

This patch addresses this by using the length field if enough data is
available.
 7 years ago
Victor Julien 53f63f7498 nfs/rpc: improve RPCv2 parser, add GssApi 
Improve RPCv2 credentials parsing. Add GssApi and turn creds into
an enum.

Minor cleanups and optimizations.
 7 years ago
Victor Julien 47ebef3af8 nfs: minor cleanup 7 years ago
Victor Julien ea1e13cb00 smb: suppress notice messages 7 years ago
Pierre Chifflier 576b8ef722 SMB: simplify code 7 years ago